Can only open 1 PDF at a time from DFS server

[stever]

Hi all,

I recently moved files over to a server which is using DFS and can only open one PDF at a time unless I turn off Sandbox Protection. This is happening to everyone and I've narrowed it down to be an issue with Adobe Reader and DFS. That being said:

Is Sandbox Protection worth having on?

Has anyone else had this issue and were you able to resolve it?

Thanks

[GGbce]

Yes, you're true.

I forgot to mention this alternative... We have observed also using drag and drop the PDF file from Windows Explorer through Adobe Reader window can work ! But, unfortunately it's not always easy to explain that to over 20,000 end-users. Also, in some circumstance, the method to open the file is not possible using the mouse (like a script or incorporated in an application).

[Mike255]

Nice to see there are still DFS issues after a decade of reports. Especially since so many organisations are upgrading to Win2019 with DFS serving Win10 clients now that Win2008r2 is out of support. Thank goodness Edge and Chrome have their own renderers. Time to look seriously at other products.

[The Planet WYH]

I cant believe this is STILL not being fixed. Maybe Adobe doesn't want their software used in companies anymore.

Hopefully the browsers will "solve" this issue so we can get rid of this.

[ls_rbls]

Can anyone who has macOS and who participates in a Windows server DFS can check this guidance https://support.apple.com/guide/directory-utility/distributed-file-system-namespace-support-ior598b5... 

And see if opening PDFs in Acrobat from a macOS client shows the same behavior?

What I'm trying to figure out is that macOS supports 64bit version of Acrobat. Acrobat for Ms Windos doesn't. It is still a 32 bit application that has been tested to run in 64bit versions of MS Windows.

Let's say that you have an Apple client in that network, with the exact same Preferences settings in Adobe Acrobat and Reader. This include starting in Protected Mode, sandbox protection enabled in Security Enhanced, and Trust Manager settings, etc.

I suspect, that if a mac user can access PDFs in Active Directory domains without disabling these protections in Acrobat/Reader, then we're definitely looking at a compatibility issue on how Acrobat enforces the 32bit Protected View on 64bit operating systems.

Would this make sense?

Someone please share some feedback.

[Sad_Emoji]

So by chance, has anyone seen this? https://helpx.adobe.com/acrobat/kb/known-issues-acrobat-dc-reader.html

Under Sandbox, it says:

Problem: Access Denied error when trying to open PDF file from symbolic link via UNC path. [3844582]

(bug report link, as far as I can tell: https://community.adobe.com/t5/acrobat-reader/bug-3844582-access-denied-symbolic-links/td-p/9693802?...

That sounds pretty much like what is happening. Why it suddenly is happening on the newer version of Windows Server (we only see it witth Server 2019), idk. My guess is how the DFS sym links are handled. It's a shame Adobe still hasn't come up with a fix for this though, two years on.

[ls_rbls]

Hey Sad_Emoji,

Would you mind sharing a dump file? or See if anything other than Acrobat (at the OS level) shows up as a warning message (or additional errors) when a client with Reader/Acrobat tries to open a symbolic link?

[Sad_Emoji]

What do you want a dump from? I was looking at a Procmon log, and it looks like Explorer is passing the file to Acrobat just fine. I also noticed just now that if Acrobat is opened via start menu, then you can't open any PDFs.

We ended up turning on the Windows Defender Exploit Protections rules for AcRdr32 manually, and turned off the Acrobat Reader DC protection.

[Guest]

This problem occurs under following circumstances:

Document is on Fileshare on a MS Server 2019 and is accessed through a DFS.

Acrobat Reader DC can open one document. More documents can not be opened. By double click a next document, nothing happens.

This problem don’t occur, when Fileshare is not accessed through a DFS.

This problem don’t occur, when Fileshare is on a MS Server 2016.

This problem don’t occur, when you open a previous opened documents (listed on the Start Tab).

It is version independent. I tested it with DC 2015, 2019 and 2020: same behavior.

I think, the problem is, hoe the path of the document is passed to Reader DC.

Regards, Peter

[GGbce]

Hi,

Like JPS-Wien tell, it's not exactly true.

We observed this problem happen from a computer running Windows 10 (1809) or higner, Windows  10 LTSC 2019 (where it's the same build code like Windows 10 (1809)) and Windows server 2019 + Adobe Reader DC (seem to be all versions of DC).. This is where the action is started (where the user have a session).

The other end (DFS server) can be any version of Windows Server. We have many DFS shares in our enterprise running under Windows Server 2008 R2, Windows Server 2012 R2, Windows Server 2016 and Windows Server 2019... where one "DFS cluster/farm"  always use the same Windows Server version (Ex.: If three DFS server in a specific context, those are with the same Windows Server version to ensure compatibility).

Then, in all cases, when a PDF is located on a DFS share and the client side use Win10 (1809) or newer or WS2019, we are not able to open more than 1 PDF... when a double-click method is used in the Windows Explorer.

But the drag & drop from Windows  Explorer to Adobe Reader  Dc window work... But not very userful method and hard to explain in many case to end-users to change a basic method onyl for one application... Where is not normal.

[Serene_nature15C3]

Hi All,

We're sorry for the trouble and the experience you had with this ongoing issue,

Please collect the process monitor logs for the affected machines on which you are not able to open the multiple PDF files by double click so that we can investigate further?

Download the Process Monitor tool Process Monitor - Windows Sysinternals | Microsoft Docs

Open and run it, reproduce the issue at your end, save the log files, and share it with us.

Upload the log files in Document Cloud (https://documentcloud.adobe.com/link/home/), generate the link and share the link with us.

Regards

Amal

[NMS_4040]

Hello Amal,
thanks for the answer.

Test conditions
The PDFs 1st.pdf and 2nd.pdf are opened one after the other on a Windows file server from a client in Windows Explorer with a double click.
the test client with which the PDFs are opened is a Windows 10 Enterprise Version 1809
in the first test case on a Windows 2019 file server with DFS
in the second test case on a Windows 2019 file server without DFS
in the third test case on a Windows 2012 R2 file server with DFS

capture file for first case
2019dfs.PML
Result 2nd PDF does not open

capture file for second case
2019nodfs.PML
Result 2nd PDF opens

capture file for third case
2012dfs.PML
Result 2nd PDF opens

PML Files are packet in pdftests.zip
Link for file:
https://documentcloud.adobe.com/link/track?uri=urn%3Aaaid%3Ascds%3AUS%3A1a5c1391-7460-425a-b3cb-ce47...

Kind regards

[Serene_nature15C3]

Hi All

Thank you for sharing the information. We have shared the logs with the engineering team for further investigation.

We will share the update once we hear anything from them.

Regards

Amal

[Barnett Waddingham]

Clients with Windows 10 1809 or more (or Win2019) trying to access a PDF via a DFS that is stored on a Windows server 2019 server are not able to open more than 1 pdf.

[Bernd Alheit]

Try this:

disable the protection mode in Acrobat Reader.

[Barnett Waddingham]

That does help, but we don't want to disable protection mode as you then lose the security.

https://helpx.adobe.com/reader/using/protected-mode-windows.html

Is there any plans to get this fixed properly?

[Bernd Alheit]

I don't know.

[Barnett Waddingham]

Is there a way to raise a support case with Adobe on Acrobat Reader DC?

I feel this is an important issue Adobe should be looking to resolve in a future release.

[Bernd Alheit]

You can try here:

https://www.adobe.com/products/wishform.html

[Serene_nature15C3]

Hi there

A new version of Adobe Acrobat/Reader DC is now available v20.009.20063. Please update the application to the new version and see if that works. Go to Help > Check for Updates.

Let us know how it goes

Regards

Amal

[Serene_nature15C3]

Hi there

A new version of Adobe Acrobat/Reader DC is now available v20.009.20063. Please update the application to the new version and see if that works. Go to Help > Check for Updates.

Let us know how it goes

Regards

Amal

[dabadge]

Confirmed that this is still broken with v20.009.20063.

[ITatBSG]

still broken on v20.009.20063

[ls_rbls]

One more optional update was released just  today: 

• https://www.adobe.com/devnet-docs/acrobatetk/tools/ReleaseNotesDC/index.html

[ostesw95446307]

still broken on v20.009.20063

[GGbce]

Hi,

I take a look to the latest updates v20.009.20063 and v20.009.20065. Nothing in release notes tell about something to fix this issue. Don't hope to fix this problem with these updates.

In more, if you read the "Known issues" articles where Adobe list problems that still not solved... this problem is not in this list !!! It tell that Adobe not seem to take this problem in charge... 

[ls_rbls]

Well, it is  address here:

Sandbox

• Problem: Access Denied error when trying to open PDF file from symbolic link via UNC path. [3844582]

But like you said, no it has not been propperly addressed.

The 3844582 work around leads to another thread where the solution is to disable protected mode at startup.

Now, I haven't posted anything yet since the last time  because I've been studying the security guides, yet, I don't have  a DFS to practice or test my theories with.

However, I saw in another thread another possible workaround where an IT manager observed the problem manifesting with specific network adapters.

Physically  changing the network cards seemed to resolve the issue in his

organization.

This lead me to think, that if network adapter drivers, and the network adapter configuration is somehow also part of the conflict, would there be any difference if changing some network configuration options at the Ethernet adapter level do any difference in both the DFS and the client computers?

See, like I said, I don't have a way to test on a DFS what would happen if  only TCP/IPv4 is enabled with NetBIOS over TCP/IP is disabled, and everything else disbaled, like IPv6 disabled,  QoS Packet Scheduler is disabled,  LLDP protocol driver, Link-Layer Topology Discovery Responder, etc?

Moreover, would it make any difference if also the Internet Protocol Version 4 properties are set to not obtain IP addresses automatically nor obtaining DNS addresses automatically?

I asked last time if anyone who had a macOS workgroup was experiencing this, but that is already answered in the security guides.

This issue doesn't apply with macOS(which is 64bit only environment in both the OS and the Acrobat application).

According to the security guides it only pertains to MS Windows environment, where Acrobat is still in 32bit but the OS is 64bit.

It would be a real bummer to find out if this problem doesn't manifest with a 32bit MS Windows version.