Application crash / Event-ID 1000 in Version 23.8.20470.0 with AcroCEF.exe on Windows Server 2022

[Alexander-Suess]

Hello, we see since the Windows Updates 2024-01 at every file open process the event-ID 1000 in WIndows Application Log and the user gets the information: Adobe Acrobat has some fails in modules - the users are able to open the file mostly but AcroCEF.exe (in 64bit-versions) and RdrCEF.exe (in 32bit) crashes.

It was already in build 23.8.20458.0 the same! Started with Microsoft Windows updates 2024-01!

[Peter34851727dd9p]

We are encountering the same issue.

[Joachim34852256p0ii]

We also have the same problem!

[Peter34851727dd9p]

Tried the following.

Repair Reader Installation.  No Change

Uninstall Reader.  Reboot.  Reinstall.  No change.

Uninstalled all of the January Windows Updates.  No change.

After uninstalling the January Windows Updates, tried repairing Adobe installation again.  No change.

After uninstalling the January Windows Updated, tried uninstalling Adobe.  Rebooting.  Reinstalling.  No change.

Using the latest versions of Reader - 2023.008.20470.  We use the 64-bit Reader, but we can replicate the problem with 32-bit as the original poster noted.  Since uninstalling the January Windows Updates did not resolve the issue, I feel the issue may have started with the 23.008.20458 release.

[Joachim34852256p0ii]

Maybe this helps:

for us deleteing the following registry keys fixed the issue:

"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe",
"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe"

[Harsh Vats]

Hi,

Sorry for the inconvenience here. Can you please provide the following information?

• Did this start happening after you updated the Reader version or after you updated Windows version?
• Also Please share the ProcMon logs of Acrobat and rdrCEF/AcroCEF for debugging purposes.

Thanks,

Harsh

[Peter34851727dd9p]

After further testing, I believe the issue is indeed with the January 2024 Windows Server 2022 update.  Both the server and Acrobat Reader were updated at the same time last week.  It took a few days before we received reports of issues with Acrobat Reader.  The specific issue seems to be with Windows Patch KB5034129.  Uninstalling KB5034129 will sometimes fix the issue.  I've found that sometimes I have to uninstall Acrobat Reader, reinstall, then do a repair AFTER uninstalling KB5034129 to get full functionality back.  Sometimes uninstalling KB5034129, uninstalling/reinstalling/repairing Acrobat Reader does not work at all.   Seems like KB5034129 is blocking cloud related features, so "Save As," "Email File" simply do not work as either the resulting dialogue box is blank or Adobe produces an error. Here is a screenshot of the error:

Sometimes simply opening Acrobat Reader results in the above error.

Event log shows the following:

Log Name: Application
Source: Application Error
Date: 1/16/2024 6:39:36 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Computer-Name.domain.com
Description:
Faulting application name: AcroCEF.exe, version: 23.8.20470.0, time stamp: 0x65a2c37a
Faulting module name: libcef.dll, version: 112.5.0.0, time stamp: 0x631bae2d
Exception code: 0x80000003
Fault offset: 0x00000000034b4fd3
Faulting process id: 0x67f4
Faulting application start time: 0x01da48dda37fc11f
Faulting application path: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Faulting module path: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll
Report Id: 92b0cc69-94cf-4b9b-89b0-9e70eb0c8dcb
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>100</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2024-01-17T00:39:36.4712879Z" />
<EventRecordID>10759</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>Computer-Name.domain.com</Computer>
<Security />
</System>
<EventData>
<Data>AcroCEF.exe</Data>
<Data>23.8.20470.0</Data>
<Data>65a2c37a</Data>
<Data>libcef.dll</Data>
<Data>112.5.0.0</Data>
<Data>631bae2d</Data>
<Data>80000003</Data>
<Data>00000000034b4fd3</Data>
<Data>67f4</Data>
<Data>01da48dda37fc11f</Data>
<Data>C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe</Data>
<Data>C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll</Data>
<Data>92b0cc69-94cf-4b9b-89b0-9e70eb0c8dcb</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>

Other users on other forums are also reporting the same issue, not just with Adobe Reader.

https://www.reddit.com/r/sysadmin/comments/193b1zq/chrome_broken_after_windows_2022_jan_2024_updates...

The issue does not seem to impact Windows 10 (the OS we are using on our desktops).  The issue only impacts our Windows 2022 Servers, which we use in a VDI environment.

If you want me to collect ProcMon logs, please let me know exactly how you would like me to collect the logs.

Thanks.

[Harsh Vats]

Thanks @Peter34851727dd9p @Alexander-Suess @Joachim34852256p0ii  for sharing valuable feedback. To share Procmon logs please refer: Basic Steps for Making a Process Monitor (ProcMon) Capture - Microsoft Community Hub

Note: In case of RdrCEF.exe not getting captured, please follow below steps:-

Download latest acromon check process monitor logs in advanced mode

1. Once Procmon launches click on Filter>Reset Filter in Procmon. (refer image)
2. Perform the problematic steps and Validate Procmon is capturing all logs now including RdrCEF
3. Save logs (File>Save) and share with us.
4. Alternatively, within acromon you can upload the logs and share the guid/confirmation id and it should immediately reach it us
   

Thanks,

Harsh

[Peter34851727dd9p]

Do you really need the logs since this issue is so easy to replicate?

[Harsh Vats]

Yes, @Peter34851727dd9p we are unable to reproduce it inhouse. Therefore logs are required to debug the exact issue. 
Regards

Harsh

[Peter34851727dd9p]

It is a bit perplexing how you cannot replicate the issue.  Are you using Server 2022 with the latest updates?  Also, if you need logs, do you want to setup a time for a remote session?  Otherwise, could you please provide more detailed information on how I am supposed to collect the logs for you and how I am to send the logs to you?

[Alexander-Suess]

Hello,

I am QUITE sure that the issue came up with installing MS-Updates on 9th of January, because the issues started there.

The Acrobat update to AcroRdrDCx64Upd2300820458 was performed on 4th of january and the systems were without issue until 10th of january. The AcroRdrDCx64Upd2300820470_incr was applied on 16th of january.

The issue can be reproduced on ALL Windows Server 2022 (german) with actual clean install of Acrobat Reader so that the issue should become reproducable fast!

[Joachim34852256p0ii]

Try deleting the registry key in regedit. It worked for me

"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe"

[Alexander-Suess]

Ok, I killed the key (after backup ;-)) on ALL Servers - Reboots are scheduled for tonight!

But this soulds like a workaround first 😉

[Alexander-Suess]

Here is the update information for the developers:

KILLING this reg-Key "solves" the issue obviously because the eventlog is clean from reboot on. But: May someone please answer WHAT this service/program does and HOW this would be fixed permantly!

[support@ak-bs.ch · Accepted solution]

Hi

For us deleteing the following registry keys fixed the issue too:

"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe",
"HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe"

Added a GPO entry to delete them.
Problem started with MS Hotfix KB5034129. I hoped, adobe will fix it with the latest update 2023.008.20470.

We use server 2022 with terminal services and Citrix Xenapp and Desktops 2203 LTSR.

[Tariq Ahmad Dar · Accepted solution]

Hi all, 

As support@ak-bs.ch has found, the issue is related to Server 2022's latest patch.

This is a known issue introduced via the Windows 2022 update(KB5034129), and Microsoft will fix this in an upcoming release for Win 2022 Server. Please follow the steps mentioned in the release notes for Windows Server 2022(KB5034129) to resolve this issue till the OS update with the fix is available. The keys would be AcroCEF and RdrCEF. 

~Tariq