Print block of a PDF fails if the file name does not match the name on the tab

Products

• Data Loss Prevention Core Package
• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Suite

Issue/Introduction

You are attempting to block printing of a PDF fillable form that contains Social Security numbers and could contain DOB if completed. 
When the PDF form is opened, it is editable. 
When you print the form as another PDF file, no block pop-up occurs and the file is successfully printed to a new PDF file. 
The agent logs show that there is no content. 
Using filter.exe to parse the new file shows that the output file is completely blank.

If you open the form using a Web browser, and print, a block pop-up occurs.
The file appears to print, but an attempt to open the saved file results in an error.

The file name is "Example_1".
When you open that file in Adobe, the name on the tab matches the file name.
When you try to print that file, Menu > Print, the print job is blocked in about five seconds.

Another file is named "Example_2"
But when the file is opened, the name on the tab is "Not_Example_2", instead, it is the first few words in the file.
When you try to print that file, Menu > Print, it will hang for about 20 seconds and then print.
The block response rule fails.

Cause

DLP does File-based scanning for the PDF files, irrespective of the printer type. 
Because 'Print buffer-based scanning' is not feasible for PDF files.
DLP uses the File Utility Service to fetch the file path of the opened files by that process. 
And the file's name is referred to as the print job name/window title name.
In this case, there was a mismatch between the file name and the title.
If you open the file, you can see that the Window Title is different from the file name.

To fetch the file path of the file we compare the name of the file against the print job name.
Due to the mismatch in the file name and print job name/window title name, we fail to retrieve the file path, resulting in the missed detection.

Please note that this is a limitation and will remain as "by design" in the case where the print job name differs from the actual file name.

Resolution

Feature request ISFR-3617 has been created to address this limitation.
If you want to be added to that feature request, open a case and reference this article.