Printing

Validate device-level printer restrictions and UI verb availability across applications.

Objectives

• No printers enumerate when device restrictions apply.
• Print jobs are denied under deny posture.
• Files tab Print verb appears only when configured.

Preconditions

• Device-level printer restrictions enabled via policy/runtime settings.
• For UI verb tests, file association rules present or absent per test case.

Controls Under Test

• Device controls for printers; Files tab association verbs.

Test Scenarios

ID	Canonical IDs	Scenario	Procedure	Expected Outcome
SCEN-SYSTEM-PRINT-01	DM-DEVICE-PRINT-01	Enumeration blocked	Open a print dialog in a simple app (for example, Notepad).	No printers are available inside the Sandbox. Audit device event reflects deny/suppression.
SCEN-SYSTEM-PRINT-02	DM-DEVICE-PRINT-02	Print job denied	Attempt to print any document to a local/virtual device.	Print is denied; no spooled output; audit shows action: "deny", bytesWritten: 0.
SCEN-SYSTEM-PRINT-03	HARD-FILES-PRINT-UI-01	Verb availability	On a fileType without any verbs.print, verify Print is absent; add a print handler and re-test.	Print absent when not configured; appears when present; app‑referenced handlers require an allow policy matching the executable.
SCEN-SYSTEM-PRINT-04	HARD-FILES-01	Print to PDF virtualization	In an app that supports "Save as PDF" in the Print dialog, choose Desktop as the target.	Output is written into the sandbox overlay/Storage Context (secure desktop), not the host Desktop. Audit fileOp shows deny/virtualize semantics with attempted host path.

Evidence Requirements

• device events for printer actions; fileOp for Files tab verbs; include rule.id and integrity.hash.