Adobe reader not opening

Community Beginner ,
Sep 15, 2021 Sep 15, 2021

Copy link to clipboard

Copied

Hi,

After MS Windows update KB5005565 Adobe Reader isn't starting up. You can see the process in task manager but the window never open. Using version 21.007.20091.

Repair fix the problem until next reboot then the issue is back. Any solution to this?

 

Best regards
Daniel

TOPICS
General troubleshooting , View PDF , Windows

Views

16.9K

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines

correct answers 1 Correct answer

Adobe Employee , Sep 21, 2021 Sep 21, 2021
Update: Microsoft confirmed that this is a known issue for the latest security updates, KB5005565 and KB5005566. They have created files for temporary mitigation workarounds for this issue while a permanent update is created. Please apply the appropriate Known Issue Rollback to your impacted systems and then deploy the policy as mentioned in https://docs.microsoft.com/en-us/troubleshoot/windows-client/group-policy/use-group-policy-to-deploy-known-issue-rollback#using-group-policy-to-apply-a-kir-to-a-single-device...

Likes

Translate

Translate
New Here ,
Sep 17, 2021 Sep 17, 2021

Copy link to clipboard

Copied

This is happening at our company as well, both Reader and Acrobat were affected, the only thing we have figured out is removing the KB5005565 patch, however that is temp fix as it will get pushed and reinstalled and back at the same issue.

 

MH

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 17, 2021 Sep 17, 2021

Copy link to clipboard

Copied

Issue was with security baselines for us. 

 

See defaultb7iaxf6utjhl comments. We have confirmed this worked for us. 

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 22, 2021 Sep 22, 2021

Copy link to clipboard

Copied

Look at the baseline, it actually sets everything to false. That's not a real fix. that disabls all your protections. it's only EnableExportAddressFilterPlus  that is the issue.

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 17, 2021 Sep 17, 2021

Copy link to clipboard

Copied

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
Sep 17, 2021 Sep 17, 2021

Copy link to clipboard

Copied

The registry key being deleted is an extreme way to clear your Exploit protection settings.
The same can be achieved by editing the settings in Windows Defender
Windows Security | App & Browser Control | Program Settings | AcroRd32.exe [Edit]
Export address filtering (EAF)

Override system settings (unticked) - sets On to Off automatically.

If these options are locked down then you need to look at your Defender security baselines or device configuration profiles (Endpoint Protection).

The XML entry should contain something like the following for AcroRd32.exe

<AppConfig Executable="AcroRd32.exe">
<DEP Enable="true" EmulateAtlThunks="false" />
<ASLR ForceRelocateImages="true" RequireInfo="false" BottomUp="true" HighEntropy="false" />
<Payload EnableImportAddressFilter="false" EnableRopStackPivot="true" EnableRopCallerCheck="true" EnableRopSimExec="true" />
</AppConfig>

This should result in the following reg value.. (values are in Binary so not easy to manipulate without export/import).
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe

default52mxmamiq8lg_0-1631902270040.png

 



Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Employee ,
Sep 19, 2021 Sep 19, 2021

Copy link to clipboard

Copied

Hi,

This is because the Windows security update KB5005565 is causing Reader to become incompatible with the process mitigation flag EnableExportAddressFilterPlus. Note that this flag is off by default. They are usually explicitly enabled in the enterprise enviroment. Also note that users having older version of Acrobat will also face this issue with security update KB5005565 installed and EnableExportAddressFilterPlus set.

 

As a workaround, follow any one of the step mentioned below:

  • Using Powershell (in admin mode), execute the command -> Set-ProcessMitigation -Name AcroRd32.exe -Disable EnableExportAddressFilterPlus
  • Delete or reset registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe
  • Repair Adobe Acrobat Reader. This will automatically reset the registry.
  • Uninstall KB5005565 security update. Note, Adobe does not recommend uninstalling security update as a first response. Kindly uninstall only if other solutions do not work.

 

If you are using the enterprise setup (MDM/Intune/GroupPolicy etc.), you will also have to update the Exploit Protection Baseline configuration to reflect this. You can use the following XML as a guide.

 

<AppConfig Executable="AcroRd32.exe">
<DEP OverrideDEP="false" />
<ASLR ForceRelocateImages="true" />
<Payload OverrideEnableExportAddressFilter="false" OverrideEnableExportAddressFilterPlus="false" OverrideEnableImportAddressFilter="false" OverrideEnableRopStackPivot="false" OverrideEnableRopCallerCheck="false" OverrideEnableRopSimExec="false" />
</AppConfig>

 

We are working with Microsoft to get this resolved at the earliest.

Let us know if that helps.

 

Regards,

Acrobat Team.

 

Update:

Microsoft confirmed that this is a known issue for the latest security updates, KB5005565 and KB5005566. They have created files for temporary mitigation workarounds for this issue while a permanent update is created. Please apply the appropriate Known Issue Rollback to your impacted systems and then deploy the policy as mentioned in https://docs.microsoft.com/en-us/troubleshoot/windows-client/group-policy/use-group-policy-to-deploy.... Let us know if it does not work.

 

Windows 10, version 1903

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%2010%20(1...

Windows 10, version 1909

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%2010%20(1...

Windows 10, version 2004, Windows 10, version 20H2 and Windows 10, version 21H1

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%2010%20(2...

Windows Sever 2020

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%20Server%...

 

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 20, 2021 Sep 20, 2021

Copy link to clipboard

Copied

any news on this we have the same problem and it's going on since one week now the repair is a temporay fix

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 20, 2021 Sep 20, 2021

Copy link to clipboard

Copied

Some additional informaiton, as I ran into this problem as well. This only happened on Machines that were updated with that patch KB5005565.

 

I slippedstread KB5005565 into a clean WIM file, deployed with Adobe 21.007.20091 AND EnableExportAddressFilterPlus = TRUE. and I do not get the error at all. Adobe works just fine.

 

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Employee ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

Update:

Microsoft confirmed that this is a known issue for the latest security updates, KB5005565 and KB5005566. They have created files for temporary mitigation workarounds for this issue while a permanent update is created. Please apply the appropriate Known Issue Rollback to your impacted systems and then deploy the policy as mentioned in https://docs.microsoft.com/en-us/troubleshoot/windows-client/group-policy/use-group-policy-to-deploy.... Let us know if it does not work.

 

Windows 10, version 1903

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%2010%20(1...

Windows 10, version 1909

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%2010%20(1...

Windows 10, version 2004, Windows 10, version 20H2 and Windows 10, version 21H1

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%2010%20(2...

Windows Sever 2020

https://download.microsoft.com/download/7/f/1/7f194890-eea9-4cad-b19f-25ab67e41bbe/Windows%20Server%...

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

Rollback file did not work for me.

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Employee ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

That is unfortunate to hear. We will convey this information to Microsoft engineers.

In the meantime, could you clarify on what you mean by "did not work"? Did you mean that:

  • the rollback msi did not execute properly and failed to rollback the changes? If so, what is the error? or
  • the rollback was successful but you are still seeing the issue when launching Reader? If so, could you share the process dump with us?

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

The correct answer was to fix your security baselines.

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 22, 2021 Sep 22, 2021

Copy link to clipboard

Copied

The EP Baseline it appears you are talking about?

 

In the lastest Windows security Toolkit, the only EP baseline is EP-reset.xml. I can not find the a new one from microsoft.

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

That's because this is the answer that was already posted. We resolved this in the first 3 hours being reported, yet Adobe marks the correct answer as reverting. Which it isn't. 

 

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

If you want to fix it, check page one, there's a guide to fix the security baselines. That will resolve your issue. Reverting will not. If Adobe understood the issue, they would have told you this. 

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

MSI "rollback" is not working. We applied in some computers  (20) and Acrobat Reader still not opening. As workaround we continue applying registry removal, but is not real solution. More than 3k devices affected and increasing...

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 21, 2021 Sep 21, 2021

Copy link to clipboard

Copied

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Sep 26, 2021 Sep 26, 2021

Copy link to clipboard

Copied

Look at the part 9 of this blog : This should solve the Office & Adobe issue : How to configure Intune Exploit Protection and how to troubleshoot it (call4cloud.nl)

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Oct 16, 2021 Oct 16, 2021

Copy link to clipboard

Copied

LATEST

I beleive this issue reared its head on a few of my computers recently- though it seemed to only affect a few users on the workstations. I used the cleaning tool ran windows updates - then reinstalled acrobat. I have a problem with one user on the computer. Anyway, to recify the issue for the one user. Also, dothewindows updates address this issue?

Likes

Translate

Translate

Report

Report
Community guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines