Skip to main content
EianAtDawn
Participant
February 17, 2026
Question

File security permissions inheritance (NTFS ACL) is broken when Acrobat overwrites files with Protected Mode enabled.

  • February 17, 2026
  • 2 replies
  • 47 views

File security permissions inheritance (NTFS ACL) is broken when Acrobat overwrites files with Protected Mode enabled.
When Acrobat overwrites a file in Protected Mode, the resulting PDF inherits the ACL of the sandbox temp file (%LocalAppData%\Temp\acrobat_sbx\).
Hence the overwritten file becomes accessible only to the account that performed the overwrite operation.
Other users on the network who access the shared folder using different credentials (e.g., a shared user account) can no longer see or open the file.

Process:
1. Acrobat opens the PDF inside its sandbox (Protected Mode).
2. When overwriting an existing file, it writes a temporary copy to:
   %LocalAppData%\Temp\acrobat_sbx\
3. That folder inherits the restrictive ACLs of the root TEMP directory (typically SYSTEM/Admins only).
4. Acrobat then replaces the original file using its internal sandbox I/O.
   This replace operation preserves the sandbox ACL instead of reapplying the shared folder’s inherited permissions.
5. Result: users on the share lose access to the overwritten file.

Notes:
- The issue occurs only when overwriting an existing file.
- “Save As” to a new filename inherits permissions correctly.
- Changing permissions on TEMP or acrobat_sbx is technically possible but not recommended
  due to security risks and because TEMP is routinely cleared.

Workaround:
As of now, the safer workaround seems to be disabling Protected Mode so that Acrobat writes directly to the shared folder:
Preferences → Security → uncheck “Enable Protected Mode at Startup”.

    2 replies

    Community Manager
    February 20, 2026

    Hi ​@EianAtDawn

    The product engineering team has suggested enabling the following registry on the affected machines. 

    For Acrobat (both 32 and 64 bit) set: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\Trunk\FeatureState\  4317163 =1

     

    Let us know how it works. 

    ~Tariq
     

    EianAtDawn
    Participant
    February 20, 2026

    There were no Trunk keys at all on the machine so I created them but didn’t fix the issue..
     

    ; Enable FeatureState flag 4317163 for Adobe Acrobat (64‑bit path)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\Trunk\FeatureState]
    "4317163"=dword:00000001

    ; Enable FeatureState flag 4317163 for Adobe Acrobat (32‑bit path on 64‑bit OS)
    [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe Acrobat\Trunk\FeatureState]
    "4317163"=dword:00000001


    Also note that AppContainer setting makes no difference on or off..
    I even tried adding the shared folder to privileged locations and didn’t help either..

    There is another unresolved post with similar issue but was not that extensively tested.. (Acrobat DC Pro removing Users from NTFS File Permissions | Community)

     

    Community Manager
    February 23, 2026

    @EianAtDawn 

    The suggested registry is for Acrobat DC. You wont see a registry key by this name; you have to create one:

    • For Acrobat (both 32 and 64 bit) set
    • Navigate to this path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe Acrobat\DC
    • Create a new Key by name: “FeatureState”
    • And inside that Key “FeatureState create a Dword:  4317163 =1

    Let me know if you have further questions

     

    Community Manager
    February 19, 2026

     

    Hi ​@EianAtDawn

     

    Thanks for reaching out, and sorry for the troubled experience. Appreciate sharing detailed findings for the issue. 
    We would require your assistance to collect logs from one of the affected machines, while ensuring the protected mode is enabled: 

    Important: For troubleshooting, if disabling sandboxing resolves the issue, please check if the problem also resolves by disabling only AppContainer. Additionally, when collecting logs, remember that ProcMon and process dump logs are part of advanced logs and must be explicitly enabled in Acromon. We recommend selecting all boxes and collecting logs in both ON and OFF modes.
     

    Diagnostic logs Screenshot

     

    To collect the logs:

    1. Download and run the Diagnostics Utility from:  https://helpx.adobe.com/acrobat/kb/acrobat-diagnostics.html
    2. Click on Start Diagnostics. Ensure all checkboxes are checked as shown in the screenshot.
    3. Launch Acrobat, reproduce the issue with your file.
    4. Once done, click Stop Monitoring.
    5. Copy the Log ID and share it with us.

    Once we have the logs, we will discuss this issue with the product team to see if there is a possible fix. 

    Will be waiting to hear from you. 

    ~Tariq