Can only open 1 PDF at a time from DFS server

[stever]

Hi all,

I recently moved files over to a server which is using DFS and can only open one PDF at a time unless I turn off Sandbox Protection. This is happening to everyone and I've narrowed it down to be an issue with Adobe Reader and DFS. That being said:

Is Sandbox Protection worth having on?

Has anyone else had this issue and were you able to resolve it?

Thanks

[Serene_nature15C3]

Hi Stever,

Apologies for the trouble caused, as described above you are experiencing issues and only able to open 1 PDF at a time on DFS server with enabled security, We need some more information for a better understanding:

• What is the version of the application? To check the version of the application you may please refer to the link - Identify the product and its version for Acrobat and Reader DC​
• What is the OS and the version?
• Are you able to open multiple files locally available on your computer?
• Are you getting any error message when you try to open multiple files on the server?
• Could you please share a screenshot when you try to open the files on the server?

In the meantime, you may try the following steps:

• Please update the application to the latest version. Go to Help > Check For Updates. To know more about the latest version available please refer to the link - DC Release Notes — Release Notes for Acrobat DC Products​
• You may try providing the access path to the folder on DFS server through Adobe Reader:
  -Go to Edit (Windows), Adobe Reader (Mac) > Preferences > Enhanced Security > Add Folder Path >Select the appropriate folder
• Go to Edit (Windows), Adobe Reader (Mac) > Preferences > General > Select open documents as new tabs in the same window and click OK and restart the application and check.

You may also refer to the help articles in the links:

-Protected View feature for PDFs (Windows), Adobe Reader
- Protected Mode troubleshooting | Adobe Reader

Let us know if that works for you

Regards,

Amal

[stever]

Hi Amalj,

It says there are no updates and I am running  this version: Adobe Acrobat Reader DC (19.012.20035)

The issue is happening on all of our Windows 10 machines. My current Windows 10 version is 1903 (OS Build 18362.239). I haven't tested it on a mac yet.

I am able to open multiple files locally on the computer. I can also open multiple files from the DFS server if they are opened through File > Open but this isn't a realistic workaround for our users. The issues happens when the file is opened through Windows Explorer.

There are no errors or messages.

I would send you a screenshot but there really isn't anything to see. When I double click the second file nothing happens.

I've also already tried what you have suggested with no luck.

Thanks for your time and I hope this info is helpful. Let me know if there are any other details I can provide.

[IB-Rahn]

We also experience this. Everything updated and we also listed the individual servers in the Intranet Sites via GPO. But with no luck. Hope there is a fix for this soon, as turning off security features never feels good.

[AnandSri]

Hi All,

We're sorry for the trouble you had, would you mind collecting the process monitor for the affected machines on which you are not able to open the multiple PDF files so that we can investigate further?

Download the Process Monitor tool Process Monitor - Windows Sysinternals | Microsoft Docs

Open and run it, reproduce the issue at your end, save the log files, and share it with us in private message only.

To send a private message, please take help from the article How Do I Send  Private Message | Adobe Community

Upload the log files in Document Cloud Storage and share the link Adobe Document Cloud

Download and install the latest patch available for Acrobat and Reader and see if you still experience the issue 19.012.20036 Planned update, August 13, 2019 — Release Notes for Acrobat DC Products

Thanks for your time and patience thus far.

Regards,

Anand Sri.

[IB-Rahn]

The issue still persist and with the new forum it seems like you're not able to direct message anyone anymore? I've sent you a log and you forwarded it to the engineers, is there any news from them? Also I've received some notification e-mails which said new posts were made and I could read them, yet they don't appear in this conversation, what's up with that?

[dabadge]

Are you still looking for more procmon traces?  I'm having the same issues as the original poster.

[MichaelKazlow]

Is Sandbox Protection worth having on?

It depends on how critical it is for you not to have malware on your machine. If all of your PDFs were created by your company and have been checked for malware before being placed on the server, then sandboxing is probably an unnecessary extra step.

[DimitriIacomi]

Hi stever,

I have exactly the same problem, did you managed to solve that issue?

I'm running Acrobat Reader version 19.012.20040 on Windows 10 1903.

[ls_rbls]

Hi,

I am going to post here the same info that I shared in a similar thread.

After much reading, I thinks the following references might be useful.

It seems like the DFS is preventing access to the  namespace when a client tries to hit a folder target with Acrobat in protected mode .

Verify if when  you add the absolute path for a priviledged location ,   

that the  namespace is not configured to issue referrals with the "insite" option.

See here  for troubleshooting: https://support.microsoft.com/en-us/help/975440/how-to-troubleshoot-distributed-file-system-namespac... 

Enable the cross domain troubleshooting log  in Reader / Acrobat and confirm if the messages that you get are not suggesting to "allow any" type of access which is the least restricted access policy, which would also defeat the purpose of using Enhanced Security and  Protected Mode .

See here too: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html#policy-file-configuration  

See here : https://helpx.adobe.com/acrobat/using/enhanced-security-setting-pdfs.html#bypass_enhanced_security_r... 

Since this seems to be not entirely related to Adobe Reader/Acrobat, there are a few more things that need to  be observed:

• Review on namespacing: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file 
• Review on how DFS works: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc782417(v=ws.... 

• targetting you r applications for windows:  https://docs.microsoft.com/en-us/windows/win32/sysinfo/targeting-your-application-at-windows-8-1 
• How to configure fully qualified domains in referrals: https://support.microsoft.com/en-us/help/244380/how-to-configure-dfs-to-use-fully-qualified-domain-n... 
• Configuring indicators in MS Windows Defender  Advanced Threat Protection https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/manage-in... 
• Configuring Defender AntiVirus exclusions:https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/confi... 
• Controlled Folder Access: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-co... 
• Turning off scaning of DFS files: https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-comput... 
• Enhanced Security: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/enhanced.html#trust-overrides 
• Trusting documents with valid certification:https://helpx.adobe.com/reader/using/protected-mode-windows.html  
• Bypassing protected view restrictions: https://helpx.adobe.com/acrobat/using/protected-view-feature-pdfs-windows.html 
• See Application Security Guide in Troubleshooting Protected View: https://helpx.adobe.com/acrobat/kb/protected-mode-troubleshooting-reader.html  and see Application security libraries customization section in the Application Security Guide.
• Sandboxing : https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/index.html 
• Desired Access and Shared Access to enable opening of shared files using  nNtCreateFile: https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntcreatefile  
• Operating system version API helper function: https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version 
• Adding users to an encrypted file: https://docs.microsoft.com/en-us/windows/win32/fileio/adding-users-to-an-encrypted-file 
• See Workflow section -Actions for Shared Folders : https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/index.html 
• Creating file functions: https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea  
• Access based enumeration: https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-access-based-enumerati...  and using inherited permissions on access bases enumeration: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd... 

I hope these references help.

[admin135]

This is pretty sad. I can find 6 year old threads about issues with DFS shares and there's still no fix from Adobe. It's clearly an issue with DFS. If I map the same path with the servername, I can open PDFs by double-clicking just fine. So I'm left with either turning protected mode off, telling users to drag & drop additional PDFs or just uninstalling Reader and having them use Chrome as a PDF viewer.

[tarutuhoxi]

This problem still exists in 2019.021.20056

[ls_rbls]

Hi,

I am going to post here the same info that I shared in a similar thread.

After much reading, I thinks the following references might be useful.

It seems like the DFS is preventing access to the  namespace when a client tries to hit a folder target with Acrobat in protected mode .

Verify if when  you add the absolute path for a priviledged location ,   

that the  namespace is not configured to issue referrals with the "insite" option.

See here  for troubleshooting: https://support.microsoft.com/en-us/help/975440/how-to-troubleshoot-distributed-file-system-namespac... 

Enable the cross domain troubleshooting log  in Reader / Acrobat and confirm if the messages that you get are not suggesting to "allow any" type of access which is the least restricted access policy, which would also defeat the purpose of using Enhanced Security and  Protected Mode .

See here too: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html#policy-file-configuration  

See here : https://helpx.adobe.com/acrobat/using/enhanced-security-setting-pdfs.html#bypass_enhanced_security_r... 

Since this seems to be not entirely related to Adobe Reader/Acrobat, there are a few more things that need to  be observed:

• Review on namespacing: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file 
• Review on how DFS works: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc782417(v=ws.... 

• targetting you r applications for windows:  https://docs.microsoft.com/en-us/windows/win32/sysinfo/targeting-your-application-at-windows-8-1 
• How to configure fully qualified domains in referrals: https://support.microsoft.com/en-us/help/244380/how-to-configure-dfs-to-use-fully-qualified-domain-n... 
• Configuring indicators in MS Windows Defender  Advanced Threat Protection https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/manage-in... 
• Configuring Defender AntiVirus exclusions:https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/confi... 
• Controlled Folder Access: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-co... 
• Turning off scaning of DFS files: https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-comput... 
• Enhanced Security: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/enhanced.html#trust-overrides 
• Trusting documents with valid certification:https://helpx.adobe.com/reader/using/protected-mode-windows.html  
• Bypassing protected view restrictions: https://helpx.adobe.com/acrobat/using/protected-view-feature-pdfs-windows.html 
• See Application Security Guide in Troubleshooting Protected View: https://helpx.adobe.com/acrobat/kb/protected-mode-troubleshooting-reader.html  and see Application security libraries customization section in the Application Security Guide.
• Sandboxing : https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/index.html 
• Desired Access and Shared Access to enable opening of shared files using  nNtCreateFile: https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntcreatefile  
• Operating system version API helper function: https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version 
• Adding users to an encrypted file: https://docs.microsoft.com/en-us/windows/win32/fileio/adding-users-to-an-encrypted-file 
• See Workflow section -Actions for Shared Folders : https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/index.html 
• Creating file functions: https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea  
• Access based enumeration: https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-access-based-enumerati...  and using inherited permissions on access bases enumeration: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd... 

I hope these references help.

[GGbce]

Hi, I would like to inform people that we have the same problem in our enteprise since many months. For Adobe Support, we can easly reproduce the problem on your side following this procedure:

1. Just have a shared folder on your local network in Microsoft DFS mode. To validate if you network share is in DFS mode, when you right-click on folder properties you can see "DFS" tab.

2. Put 2 PDF files on this share.

3. Try to open one PDF.

4. Let Adobe Reader DC opened with your actual PDF file

5. Double-click on the second PDF file to open it... 

6. Normally, this second file should be opened in a new tab inside Adode Reader DC... But those files are located on a DFS share nothing happen !!!

Other tests that you can do to confirm this issue happen only in this context:

A. Reproduce the same steps, but copy 2 PDF files on local hard drive. Result: The second PDf file open in a new tab correctly.

B. Reproduce the same steps, but copy 2 PDF files on a "regular" SMB/CIFS/Windows share. Result: The second PDF file open in a new tab correctly.

C. Go to Edit -> Preferences... menu. Go to Protection (Enforced) category, uncheck "Enable protected mode at startup". Close Adobe Reader, then reproduce the same steps on a DFS share. Result: The second PDf file open in a new tab correctly.

Then, it's easy to confirm this issue happen with Adobe Reader DC when"default security" is activated for sandbox mode. I tested to open multiples PDF file using a non-Adobe application and it work fine.

I tested to add UNC share in the privileged locations, but no changes. This option not seem to have a link with sandbox... And also not support UNC with star like \\*.mydomain.com\ only URL like *.mydomain.com... (in other context it could be an improvement.)

Tested on many computers:

Microsoft Windows 10 (1809 or 1903)

Adobe Reader DC (2019.010.20098, 2019.010.20064, 2019.012.20040, 2019.021.20061, ...)

The issue happen on all these versions combined... 

[ls_rbls]

Hey this is awesome. Thanks for sharing this info.

I am actually trying to help a Windows 10 Enterprise user with a different issue.

He is trying to enforce disablement of Adobe Acrobat automatic updates using Group Policy in an Active Directory domain.

Long story short, I found a very interesting detail that  is not well documented in the Adobe Acrobat Preferences Reference guide, unless you combine this reference with the Adobe Acrobat Customization Wizard Reference Guide, and the Enterprise Toolkit.

My angle is, that a few things have changed in Windows Servers since the 2008R2 version.

For starters, Microsoft support for 2008 Server reached its EOL a few days ago this month.

So now we are left with 2012, 2012R2, 2016 and latest to experiment with. 

A note on that however, some Windows Server 2012 users have expressed that they don't seem to have this issue with the 2012 Server versions and earlier.

And I read somewhere that in 2016 version and later,  that the opening of a second file that resides in the same file share location triggers the enforcement of Windows Protected View a little tighter than prior versions. 

So it seems like this issue could be related to how the files that are shared in Priviledged locations is handled with Protected View enforcement in windows explorer and Internet Explorer respectively; then it conflicts when Protected Mode and Security Ehnaced (sandboxing) settings are enforced in  the Acrobat/Reader applications.

For network administrators:  the ability to edit or modify Protected View settings is, or could be, hidden by default from other administrative user accounts.

So, in order  for those system admins that are concerned with disabling Protected Mode and don't want to disable it in Acrobat/Reader, it may be necessary to manually edit an administrative template using GPO with the primary Administrator Account in the Windows Server that is enforcing group policies.

Furthermore, it seems like the way to go from here is to modify a registry preference that restrict users from browsing and discovering priviledged locations in a domain (unless authorized with GPO),  manually  editing, copy and pasting, or typing in a fully qualified domain path in the Acrobat/Reader Preferences when they're trying  edit Acrobat Preferences, Trsusted Manager settings, Internet Zones, to access a Priviledged file share location, for example.

The key here is to disable Protected View in  that priviledged location for them while restricting their ability to browse and discover other absolute paths in a domain.

This is documented  in the Enterprise Toolkit and the Adobe Acrobat Customization Wizard reference guide but vsry vaguely.

There are a few other things involved.

I will post back with the actual references that I've found.

In the meanwhile, I want to believe we're almost getting there.

[GGbce]

Because we are a large enterprise with over 12000 clients computers, I tested this issue in many scenarios.

Then, I'm surprized to find something that could Adobe support team (probably they talk with someone at Microsoft also). I go more in deep in my tests and I tested many OS platform with Adobe Reader DC 2019 (2019.021.20061) *** Using default configuration wehere Protected mode is enable at startup and protected view is disable.

Using Windows 7 Enterprise *** Where support end in January 2020 *** with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: It works !!!

Using Windows 10 LTSB 2015 Enterprise *** Where support end in October 2025 *** with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: It works !!!

Using Windows 10 LTSB 2016 Enterprise *** Where support end in October 2026 *** with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: It works !!!

Using Windows 10 (1709) Enterprise *** where MS support end in April 2020*** with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: It works !!!

Using Windows 10 (1803) Enterprise *** where MS support end in November 2020*** with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: Doesn't works 😞

Using Windows 10 (1809) Enterprise with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: Doesn't works 😞

Using Windows 10 LTSC 2019 Enterprise *** based on 1809 code *** with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: Doesn't works 😞

Using Windows 10 (1903) Enterprise with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: Doesn't works 😞

Using Windows 10 (1909) Enterprise with Adobe Reader DC 2019 (2019.021.20061) to open multiple files on DFS share. Result: Doesn't works 😞

*** NOTE: If I try to use Microsoft Edge (non-Chromium) on Windows 10 SAC versions to open PDF file on a DFS share, instead Adobe Reader , it work fine for all versions from 1709 through 1909 !

The problem with Adobe Reader DC seem to start since Windows 10 (1803) or newer version, including Windows Server 2019 platform. Well... The problem may be caused by a conflict between Adobe Acrobat/Reader and Microsoft Windows 10. But other PDF applications not seem to be affected... Then this issue need to be solved by Adobe.

[ls_rbls]

Excellent!!!  and Bingo!!!

Did we just get to the root of the problem?

I would suggest that you use your findings and the collaboration of everyone in this thread to report a bug, or more likely to address a security issue here:

https://helpx.adobe.com/security/alertus.html 

And use the wishfomr in this link to report a bug: 

https://www.adobe.com/products/wishform.html 

Thank you so much for your efforts!

[GGbce]

Thank you of sharing these links to forward this issue to Adobe support ! I created a new ticket. 

In hope that someone will take care of this problem and a fast patch will be available !!!

[cojohnst]

We are seeing the exact issues you described here, using Windows 1909 Education and DFS on Server 2019 Standard. Can you post back when you hear anything in regards to this issue? Our current work around is to actually have people open PDFs in Edge rather than messing with turning protected mode off.

[ls_rbls]

Yes the possible work around is to leave Protected Mode enabled in Adobe Acrobat/Reader but assign a priviledge location to the users with Protected View or better said Enhanced Protected Mode disabled  just for the shared folder of the priviledged location.

However, as illustrated above  y GGbce   it seems to be an issue depending on which versions are used. 

See if you can test this workaround and provide your feedback.

[GGbce]

No, I confirm adding "Privileged locations" to the "white list" is not working for DFS issue !

If this list was working fine, I never tried to open a case to Adobe Support and I just use this option to add my locations (my entire local domain shares)... like we can do inside Microsoft Office in comparison.

The only possible method to tweak this problem is to disable the sandbox at startup. Yes, this method work... but also reduce your security. Not very interesting workaround.

[ls_rbls]

Disregard then.  Back to square one 😞

[ls_rbls]

I thought this entire time  we were talking about leaving the Protected Mode at startup for the Acrobat application, but disabling Enhanced protected mode in the priviledged location for the Internet Explorer Trusted Zones.

[cojohnst]

We want to leave Protected Mode at Startup, and we want to open multiple DFS based network locations. However it looks like based on GGbce's sluething and our own information that newer versions of Windows 10 (1803 and on) don't allow that REGARDLESS of whether the DFS location or the hardcoded location are put into the 'Privileged Locations'

[cojohnst]

As a temporary workaround, we've discovered if you have your first open PDF, and then you drag and drop the second PDF you are trying to open into the Adobe Reader, it will open without issue. You can then have multiple PDFs open from a network share. Just a heads up until this is fixed.