Suppress Alerting to Endpoint DLP Printing on "Print to PDF".

Question

Is there a way to configure an Endpoint DLP policy for Printing to NOT alert on "Print to File" events primarily Print to PDf's. For example print events where the target name are "Microsoft Print to PDF" or "Adobe PDF"? I understand you can create Printer groups, but there is no way to use as a condition when creating DLP rule.&nbsp;

milgo · Answer

Hello! Thanks for reaching out. As of now, DLP does not provide a direct way to exclude specific printer targets like "Print to PDF" within the DLP rule conditions.
Possible workaround for now would be to consider setting the specific policy to audit mode when it comes to print activities. That way you can monitor the events without generating alerts but this means you would still manually review and filter out “Print to PDF” events.

dalesh07 · Answer

Thanks for the response. We do have a workaround, filtering via Advance Hunting.&nbsp;

mart331 · Answer

Can you elaborate on how you set your workaround up?

manu2360 · Answer

Hi milgo​&nbsp;I have created print groups and put print to PDF as allow in EDLP policy still receiving alerts. Can you guide where my EDLP policy is wrong?&nbsp;&nbsp;&nbsp;

manu2360 · Answer

Hi milgo​&nbsp;I have put "Print to PDF" as allow in EDLP policy by creating Printer groups, still receiving alerts for the same. Kindly check Screen shorts for same.&nbsp;

Forum Discussion

Suppress Alerting to Endpoint DLP Printing on "Print to PDF".

5 Replies

Resources