why does a pdf file with write permission become read only when it is opened, and can no longer be s

[bartd44160438]

the problem is that i can't open a pdf file, limited editing, and just save to the same file.
I keep getting the message "The document cannot be saved. The file is a read-only file or another user has opened it. Please save the document with a different name or in a different folder."

The original file is stored on a network drive, in a company network with a windows server. The user has full rights on the disk, and local administrator rights on the client PC.

the file itself is originally 'not' set to read-only, and the user who opens the file has all rights 'full control'

If the file is opened in acrobat Pro (64-bit) (version 2022.003.10314. last update. ), and a limited adjustment is made, for example a comment, and the file is simply saved on top of the same file, not 'save as' but 'save', we can get the message that the file is either read only or is being used by someone else.

The file is also not being opened by anyone else at the time.

The type of PDF file can be of various origins. this can be a pdf scan, a pdf export made with e.g. an indesign, or an externally received pdf. It is also strange that some files do not have this problem.

Even if you subsequently wish to save the PDF under a different name 'save as', and then open and modify it again, and try to save it again under the same file, you will receive the same message 'read only'.

in the same location there is no rights problem for all other applications, such as saving all other types of files excel, word, photoshop, indesign with the same file name is no problem at all.

Just saving a simple PDF seems to be blocked by acrobat Pro itself, putting it in a read-only state that prevents it from saving itself

can you help me? who else has this problem?

[ls_rbls]

Hi,

I've seen this behavior brand new Microsoft Windows 11 machines.

What operating system are you on?

Is this happening with every PDF or just one particular document?

[bartd44160438]

thanks in advance for looking into this

The operating system of all clients is Win 10 pro
the server is a Windows 2016 server license

As mentioned in the introduction, we do not have this with every PDF, but we do have this with +-90%, so most of them. despite there being no logic in it, it seems to me that we have this least with a PDF that we have scanned ourselves. we also process many pdfs that we receive externally, most of which also have this problem, but not all of them.
So it would seem that the client (in this case I am administrator) would not have sufficient rights, but this is certainly not the case.

As reported, even custom PDF files (exports from indesign, or word, or print to pdf, as well as a pdf saved under a new name in acrobat) have the same problem

it looks like acrobat is blocking itself ?

[ls_rbls]

Just for troubleshooting purposes, are you able to confirm if the problem goes away if you turn off Protected View and Enhanced Security ?

Also, as far as working around the possibility of the clients not having sufficient rights,  I've experienced this issue in my Windows 11 machines a lot actually.

What worked for me has to be performed manually.

Using  the built-in Windows Administrator account (not the current user account as administrator or with admin rights),  go to the folder where these  PDFs are being saved.

Right-click on that folder => select Properties from the context menu => click on the "Security" tab of the "Document Properties" dialogue window => select from the section "Group or user names" the current user account => in the section below "Permissions for..." (the current user name for that account) see what type of permissions are allowed.

If the current user account doesn't allow full control, or write and modify permissions, click on the "Edit.." button and give the user  full control permissons (or at least, read & execute, modify and write permissions).

If this doesn't work (or reverts back to the same lockdown after a reboot), repeat steps listed earlier but this time click on the "Advanced" button.

And here's the tricky part:

In the dialogue window that will open up, "Advanced Security Settings for Documents" => go to the "Permissions" tab =>  see the section  "Permission entries".

Left-click once with your pointing device on the current user account  to select it => then click on the "Disable inheritance" button.

NOTE:

If you don't do this step, the inherited permission from the parent object may not let you modify the advanced permissions nor remove the misbehaving current user account.

After the inheritance is disabled you will be able to remove and add that user account again.

Just ensure that when the account is added again that you give the appropriate read/write/modify (or full control) permissions; preferably full control.

A reboot may be necessary.

[bartd44160438]

I have followed everything, even though we have already done this with our network it expert. according to him it can not be due to the active directory rights of the windows 2016 server

despite
I have adjusted all the client's permissions on that location as you describe perfectly.
since the permissions are determined on the server, I have rewritten the client's permissions on the server NAS as well. I also disabled the inheritance on the specific MAP.
The user was removed on this specific folder and added back with Full controll (so all permissions from before were rewritten on this folder once again, applied on the server console.. not on the client computer of course.

Extended security is currently also disabled in adobe (throughout this test, but I probably should turn it back on when the test is over?

our it expert(network and server) was convinced that it must be an adobe acrobat specific problem and it is certainly not a rights specific problem. this has already been thoroughly checked. but just to be sure I followed your steps (+ server and client were restarted)

turning off the 'extensive security acorbat' was a new fact. Are there any elements we can turn off?

any new help is welcome, thanks in advance for this try. it may work for a Win11, but for now we stick to the Win10pro clients

[bartd44160438]

the issue is not resolved yet, and I have performed some additional testing

the problem does not arise if the pdf file is in a folder directly on the pc (eg desktop), and also not on an external Onedrive folder.

The problem therefore always occurs on all folders on the server
I did additional testing to be sure, created a totally new shared folder directly on the C drive of the server.
Opened everything on this folder under share permissions/ and Security advanced permissions, for both 'everyone' and 'my user'. So Full control in share and security.
at advanced security setting, user has 'none' inheritenace', access full control
So opened everything completely without restrictions on the map

The rights of the Users are distributed by default by the server, active directory Users, Window 2016 server, and the locale user has the administrator rights

yet the problem remains. it seems that adobe 'locks' the pdf's if it is on a server folder (despite all permissions) and not if it is 'lcoal' or in the cloud.

Does anyone have this problem, and tips on how to fix it?

[ls_rbls]

Hmmm.  Maybe elevating the user rights is not the only detail that needs attention, but also how to spot the way that your users are sharing/accessing PDFs through a fully qualified domain. In which case, the distributed file server that may be handling the referrals (if any) is enforcing the namespace sahres correctly,  OR, the universal naming convention paths back to a local folder in their systems... just guessing in the blind.

• https://stackoverflow.com/questions/14242695/getting-the-fully-qualified-url-for-a-local-static-file...

As I already suggested to another user, you may need to downgrade to Adobe Acrobat(32-bit) in one of those Windows 10 (64-bit) computers and test and compare; although I may be off-track with this suggestion, I truly believe that is where the issue is..

[ls_rbls]

The Admin Guide has some additional features that you may be able to modify or lock.

See this topic about security:

• https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/trust.html

[bartd44160438]

Thank you in advance.
I'll have these tested. it looks like you lowered the security here. We also process many externally received files (such as invoices) in these folders, so we cannot simply bypass security. are these methods safe?

possibly also relevant is that our anti virus "Symantec endpoint security enterprise". Could this have something to do with the problem, are there known conflicts between adobe and Symantec?

[ls_rbls]

Thank you in advance.
I'll have these tested. it looks like you lowered the security here. We also process many externally received files (such as invoices) in these folders, so we cannot simply bypass security. are these methods safe?

possibly also relevant is that our anti virus "Symantec endpoint security enterprise". Could this have something to do with the problem, are there known conflicts between adobe and Symantec?

By @bartd44160438

Yes, very relevant and it is possible.

I've seen before topics in this community  in which Adobe Acrobat users and Adobe community experts have mentioned of issues that the Anti-virus software may trigger issues with the Acrobat or Reader  sanboxing features.

In such case, you may want to test (I say again... only for testing purposes) by disabling the User Account Control (UAC) on the client(s) without disabling the anti virus, OR, lowering the vulnerability detection of the Anti virus without disabling the UAC (just food for thought).

On a side note, about lowering the security:

I only made the recommendation with your IT staff as a whole in mind.

The idea I am suggesting is to keep the big boss happy.

In your particular case, you need a quick plan of action in order to  assess the issue with simple troubleshooting, AND, without delaying production any further nor sacrificing what is already working.

More specifically, what I was trying to imply wasn't considering to lower the security in a 64-bit environment.

Your server and the OS in your clients are already handling that part.

So, I wouldn't be too worried about testing a 32-bit version of Acrobat because of the WOW64 subsystem in your Windows 10 (64-bit) client machines.

Besides that, the 64-bit operating systems also has plenty of vulnerabilities running in the wild as we speak. And if you run the Task Manager on any given Windows client, you'll see a bunch of 32-bit apps still running in the background silently.

Are you saying that your entire organization moved completely to a 64-bit world ??

(that was a joke, just trying to throw some humor here...)

But seriously now,  You know what I mean ?  🙂

Just download and run any rootkit detection tool and you may be surprised.

Adobe also has been very busy patching their products commendably against vulnerabilities (see the Adobe Security Bulletin).

What would worry me more is how your power-users are interacting with those external files that they receive over the Internet and into your LAN(s).

But for now, if I was in your shoes, my approach would be to isolate only one PC out of that production environment, and if the 32 bit version of Acrobat works OK on a Windows 10 (64-bit) client, then it will be a lot easier to produce logs and examine them to narrow down the problem for the Adobe Acrobat(64-bit) clients.

[ls_rbls]

Here's another observation that we've missed.

Unless your shared folder(s) are not hosted in a cache folder (at the file server level), a shared file is usually physically hosted locally on the file server.

But when a client pulls that shared file from a network folder drive, the file that renders on the clients' screen writes itself to a cache (or a temporary folder).

When this happens the document that is being rendered on screen (as the user scrolls up and down in that document) a background process manages the download of the file in the background, but it loads one page at a time in the host program (in this case a shared PDF that is viewed with Adobe Acrobat on a Windows 10 computer).

This part of that process is handled by the Acrobat program (usually referred to as file synchronization service(in cloud-space slang)).

The difference between how a cached network folder handles a shared file and how a file is updated (or FileSynced) on real-time when it is accessed locally (at the desktop level) or through a cloud service is that an entire offline copy of the shared is saved locally on the client device. Changes made to that file will give the impression that are happen immediately, when in reality only blocks of the modified cached file are added to the offline copy to reflect the latest changes only.

This may explain why the issue is not experienced when the file is moved from cloud to desktop or vice versa.

But in this context, the same is not true at the File Server level. I've been hearing about this issue that you have at work since Window Server R8 . This is not new and it is not exclusive of PDF files handled by the Acrobat software.

This tells me, that the read-only issue happens because the shared files are written to a temporary cache. And, if this is true, then you must give Full Control to the users to that temporary cache folder in the same way that you did it locally on each client computer and with the shared folder drive on the file server.

To work around this, you need to check in which TEMP folder the file server is writing to or caching these shared PDFs.

And then the issue should be resolved if you give the users Full Control permissions (specifically Write and Modify and other Advanced Permission (if needed)) to the temp folder.

For example:

On a Microsoft Windows 10 client the temp folder may be C:\Windows\Temp, but at the file server it may be something like E:\Temp.

In which case, you can right-click on that temp folder , pull up the properties and give full control to your users to that cache localtion (that is where the real changes occur on real-time for the shared files as they are rendered on the clients desktops).

Last, I've also seen other forums outside of Adobe's to check if you have the BranchCache feature enabled in your Windows Server 2016.

If it is not, download and install it, and ensure that this feature is enabled and configured accordingly.

See also these older threads:

• https://social.technet.microsoft.com/wiki/contents/articles/14309.branchcache-frequently-asked-quest...

• https://serverfault.com/questions/727614/windows-server-share-read-only-from-network-and-write-local...

• https://community.spiceworks.com/topic/2091424-trouble-with-file-server-files-opening-as-read-only