AcroCEF.exe / RdrCEF.exe errors with Acrobat Reader 32-bit on Latest Update

[Jacco34829135tk0g]

We are experiencing errors with Adobe Acrobat Reader. Our setup includes the 32-bit version of Acrobat Reader, updated to the latest version as of January 16 running on Windows Server 2022.

It apears that RdrCER.EXE is the cause of these issues. the exe starts when Adobe Reader does, but in taskmanager we can see it crashing over, and over again. resulting in the events detailed below.

Troubleshooting Steps Taken:

Reinstalled Acrobat Reader.
Attempted running the software on a completely new server.

Despite these efforts, the problem persists with the same error manifestations.

Seeking Advice:

Has anyone encountered a similar issue?
Any recommendations for further troubleshooting steps or potential solutions would be greatly appreciated.

events:

Faulting application name: AcroCEF.exe, version: 23.8.20470.0, time stamp: 0x65a2c37a
Faulting module name: libcef.dll, version: 112.5.0.0, time stamp: 0x631bae2d
Exception code: 0x80000003
Fault offset: 0x00000000034b4fd3
Faulting process id: 0x1d24
Faulting application start time: 0x01da488e06f0f430
Faulting application path: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Faulting module path: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll
Report Id: 2d20b8df-f9ef-4433-add1-1721cc160719
Faulting package full name:
Faulting package-relative application ID:


-------------------------------------------------------------------------------------------------------------------------------------------------------------------


Fault bucket 1422761762432371508, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0

Problem signature:
P1: AcroCEF.exe
P2: 23.8.20470.0
P3: 65a2c37a
P4: libcef.dll
P5: 112.5.0.0
P6: 631bae2d
P7: 80000003
P8: 00000000034b4fd3
P9:
P10:

Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.fb3f5213-23fa-4902-aa6a-39496915ac43.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f5e52926-99b4-42dd-8ea7-3e97c41d33a8.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.93e74105-d605-4ba3-8781-7de64bed3df9.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.256bd3f4-02e5-46a1-9010-8c04587a53a7.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WER.44a7cf8e-834b-4eb3-a267-c8add6d6a4bf.tmp.txt

These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_AcroCEF.exe_45bb777d1f67cf99928ffe255f9abc47a823889_704ab788_2f344dd9-942a-430d-9ef6-8695255812de

Analysis symbol:
Rechecking for solution: 0
Report Id: 2d20b8df-f9ef-4433-add1-1721cc160719
Report Status: 268435456
Hashed bucket: ddb5ada0c7a03882a3beaa48e9ca4b34
Cab Guid: 0

[Justin32206859xv0d]

I've run into the same issue. I've run into this on two separate domains and the first instance of this was reported at 10:46 GMT. I'm curious to see how this is resolved or if there are others who have run into the same issue. I've gone ahead and followed the steps outlined in the Helpx advice page on resolving AcroCEF/RdrCEF.exe issues to no success.

[ls_rbls]

Hi,

I would say to contact support. They may be able to troubleshoot remotely to verify if a new bug was introduced with the latest update OR if there is an actual conflict of modules and dependencies that may also need to be updated at the OS level.

[Jacco34829135tk0g · Accepted solution]

Found the issue!

Apparantly other programs have the same issue because of windows update KB5034129 (No Patch Tuesday Megathread for January? : sysadmin (reddit.com))

for us deleteing the following registry keys fixed the issue:

"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe",
"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe"

[Justin32206859xv0d]

I could kiss you! I'll get on this now!

[ISS34866340rnk9]

Thank you, man. This is it. Many thnx again.

[Jesus34906937emd6]

Worked for me, you're the man

[Harsh Vats]

Hi,

Sorry for the inconvenience here. Can you please provide the following information?

• Did this start happening after you updated the Reader version or after you updated Windows version?
• Also Please share the ProcMon logs of Acrobat and rdrCEF/AcroCEF for debugging purposes.

Thanks,

Harsh

[mscirri]

For us it started happening immediately after updating to Windows Server 2022. It was fine on 2016.

[defaultzhao2fccebdn]

We also had this start happing in our Citrix Environment after patching Server 2022. I also updated to latest Acrobat Pro version which did not fix. Thanks to Jacco we have a temperary fix to delete this key HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe. Will there be an offical fix for this from Adobe or will we need to wait on Microsoft?

[mscirri]

This happened for us immediately after updating to Windows Server 2022. It was fine on 2016.

[dafatta]

Man you're genious. We have installed Acrobat Pro 2023.008.20470 | 64-Bit on Server 2022 Running CItrix Desktop. KB5034129 is installed. In our case we deleted the key:

"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe",

Reader is not installed. 

Thank you ❤️

[mscirri]

It started happening again last night.  Looks like the keys got put back somehow. I am assuming from a software update.  But just be aware of that possibility.   We are investigating if that was in fact the case. 

[ls_rbls]

You may need to customize the master image and disable automatic updates.

Also, if the registry key reappears, that may be an indication that modifying such key is not lockable by Users or Administrators.

[dafatta]

Thank you for the hints. We tested this directly into the master and made a rollout into a small testfarm. The issue was solved there, so we decided to roll out this image to productive machines for today. Automatic Updates are disabled, would be a desaster if acrobat decides to patch itself and stops the printer queue - not that that ever happened 😉 

If we update AcroPro we doublecheck if the key reappers, good advice, thank you. Our image resets the machines every night, so that it doesn't seem necessary to define a gpo that delets this key constantly. If it will reappear, we will be prepared. 

Thank you guys.

[Tariq Dar · Accepted solution]

Hi all, 

This is a known issue introduced via the Windows 2022 update(KB5034129), and Microsoft would be fixing this in an upcoming release for Win 2022 Server. Please follow the steps mentioned in the release notes for Windows Server 2022(KB5034129) to resolve this issue till the OS update with the fix is available. The keys would be AcroCEF and RdrCEF. 

If you aren't using Windows Server 2022, please help us with more details.

~Tariq

[mscirri]

Thank you for confirming the issue and providing this response. We appreciate the dilligence and communication regarding this issue.  And thank you to the folks in the community who provided additional detail and work-arounds while it was under investigation by Adobe. 

[9SM9]

Revisiting this today as Adobe updated and re-created "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe"

KB5034770 released today but don't see anything related to adobe.

https://support.microsoft.com/en-us/topic/february-13-2024-kb5034770-os-build-20348-2322-6ac88bee-2b...

Does Adobe have any updates regarding permanent fix?

Thank you.

[Carl039]

Had the crashing Adobe Reader following recent update to v2023.008.20533 however only affects one of the RDS servers and only some users.  Found that if I opened Adobe Reader and clicked the Sign in button a blank window would appear.  On the other working RDS servers you that Sign in box would appear correctly.

The fix that worked for me was to delete the following entry from the registry:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe

Not sure if I should delete the following to but as Adobe Reader is in 32bit mode then maybe not?

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe

[Johan357192131uks]

Hello Tariq,

We're still having this issue on our Windows 2022 RDS.
Its updated to the latest version (21H2 build: 20348.2322). Also we've removed the registery keys with no luck.
Tried reinstalling etc. But no luck.

Please let me know if you need more details.

[mscirri]

We had to setup a group policy to have those registry keys removed because every time Adobe updated those keys got put back.   

[Johan357192131uks]

@Tariq Dar 
Hi Tariq,

We still didnt manage to fix this issue. Even with the solutions provided.
Is this issue fully resolved or are we the only one? 🤪
Its a fully patched W2022 STD terminal server with latest adobe (2024.001.20643).
When clicking the mail icon or siginin icon a grey/blank screen appears and eventually Adobe returns with an error.

Below the event viewer:
----

Naam van toepassing met fout: AcroCEF.exe, versie: 24.1.20643.0, tijdstempel: 0x660880f7
Naam van module met fout: libcef.dll, versie: 112.5.0.0, tijdstempel: 0x631bae2d
Uitzonderingscode: 0x80000003
Foutmarge: 0x00000000034b4fd3
Id van proces met fout: 0x9608
Starttijd van toepassing met fout: 0x01da8b5497dcf336
Pad naar toepassing met fout: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Pad naar module met fout: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll

-----

Foutbucket 1665405475132394618, type 4
Naam van gebeurtenis: APPCRASH
Antwoord: Niet beschikbaar
Id van CAB-bestand: 0

Handtekening van probleem:
P1: AcroCEF.exe
P2: 24.1.20643.0
P3: 660880f7
P4: libcef.dll
P5: 112.5.0.0
P6: 631bae2d
P7: 80000003
P8: 00000000034b4fd3
P9:
P10:

Any chance we can investigate this issue?
Erik