Can only open 1 PDF at a time from DFS server

Hi All,

Thank you for confirming that the issue is resolved with the Acrobat and Reader August 2020 update version.

To check the latest version for the application, please refer to the release notes here: https://helpx.adobe.com/acrobat/release-note/release-notes-acrobat-reader.html

And to know about what new features added with this version, you may check them here: https://helpx.adobe.com/acrobat/using/whats-new.html

Hope the information helps.

Let us know if you have any questions.

Thanks,

Meenakshi

Today I noticed that Adobe updated the icon for Reader DC so I randomly gave it another try and it seems like this problem was fixed. I can open multiple PDFs on a DFS network share via double clicking (version 2020.012.20041).

Environment:

• Windows Server 2019 DFS share
• Windows 10 Pro 2004 client

Enabled security settings:

• Enable Protected Mode at startup
• Protected View: Files from potentially unsafe locations

Hi,

Just to keep this post up-to-date, I newer version of Adobe Acrobat and Adobe Reader DC was released on July 6th (20.009.20074) and June 2nd (20.009.20067) with some fixes related to the "sandbox" when protect mode is enabled. But nothing about this specific issue seem to be fixed.

If I take a look to the "Known issues" list, nothing was added for this issue also... But a similar problem was added: Problem with "sandbox" and access denied  error when opening PDF from a symbolic link UNC path. May be Adobe work more on some things around "sandbox" issues in the last months.

I tested, the newest version but unfortunately the problem still there.

ls_rbls did you found a job in cybersecurity laywer ? (Joke)

Not OP, but i just moved our company shares from a 2012R2 DFS share to 2019 DFS share overnight and this issue popped up. Our clients are running windows 1909 and adobe latest 20.009.20065 and i can confirm the same issue is still occuring. It can be "bypassed" by turning off "Protected Mode at startup" but this is not something we are willing to disable.

Clients with Windows 10 1809 or more (or Win2019) trying to access a PDF via a DFS that is stored on a Windows server 2019 server are not able to open more than 1 pdf.

Hi All,

We're sorry for the trouble and the experience you had with this ongoing issue,

Please collect the process monitor logs for the affected machines on which you are not able to open the multiple PDF files by double click so that we can investigate further?

Download the Process Monitor tool Process Monitor - Windows Sysinternals | Microsoft Docs

Open and run it, reproduce the issue at your end, save the log files, and share it with us.

Upload the log files in Document Cloud (https://documentcloud.adobe.com/link/home/), generate the link and share the link with us.

Regards

Amal

This problem occurs under following circumstances:

Document is on Fileshare on a MS Server 2019 and is accessed through a DFS.

Acrobat Reader DC can open one document. More documents can not be opened. By double click a next document, nothing happens.

This problem don’t occur, when Fileshare is not accessed through a DFS.

This problem don’t occur, when Fileshare is on a MS Server 2016.

This problem don’t occur, when you open a previous opened documents (listed on the Start Tab).

It is version independent. I tested it with DC 2015, 2019 and 2020: same behavior.

I think, the problem is, hoe the path of the document is passed to Reader DC.

Regards, Peter

Nice to see there are still DFS issues after a decade of reports. Especially since so many organisations are upgrading to Win2019 with DFS serving Win10 clients now that Win2008r2 is out of support. Thank goodness Edge and Chrome have their own renderers. Time to look seriously at other products.

Hi,

I am going to post here the same info that I shared in a similar thread.

After much reading, I thinks the following references might be useful.

It seems like the DFS is preventing access to the  namespace when a client tries to hit a folder target with Acrobat in protected mode .

Verify if when  you add the absolute path for a priviledged location ,   

that the  namespace is not configured to issue referrals with the "insite" option.

See here  for troubleshooting: https://support.microsoft.com/en-us/help/975440/how-to-troubleshoot-distributed-file-system-namespace-access-failures 

Enable the cross domain troubleshooting log  in Reader / Acrobat and confirm if the messages that you get are not suggesting to "allow any" type of access which is the least restricted access policy, which would also defeat the purpose of using Enhanced Security and  Protected Mode .

See here too: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html#policy-file-configuration  

See here : https://helpx.adobe.com/acrobat/using/enhanced-security-setting-pdfs.html#bypass_enhanced_security_restrictions 

Since this seems to be not entirely related to Adobe Reader/Acrobat, there are a few more things that need to  be observed:

• Review on namespacing: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file 
• Review on how DFS works: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc782417(v=ws.10)?redirectedfrom=MSDN 

• targetting you r applications for windows:  https://docs.microsoft.com/en-us/windows/win32/sysinfo/targeting-your-application-at-windows-8-1 
• How to configure fully qualified domains in referrals: https://support.microsoft.com/en-us/help/244380/how-to-configure-dfs-to-use-fully-qualified-domain-names-in-referrals 
• Configuring indicators in MS Windows Defender  Advanced Threat Protection https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/manage-indicators 
• Configuring Defender AntiVirus exclusions:https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus#opt-out-of-automatic-exclusions 
• Controlled Folder Access: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders 
• Turning off scaning of DFS files: https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni 
• Enhanced Security: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/enhanced.html#trust-overrides 
• Trusting documents with valid certification:https://helpx.adobe.com/reader/using/protected-mode-windows.html  
• Bypassing protected view restrictions: https://helpx.adobe.com/acrobat/using/protected-view-feature-pdfs-windows.html 
• See Application Security Guide in Troubleshooting Protected View: https://helpx.adobe.com/acrobat/kb/protected-mode-troubleshooting-reader.html  and see Application security libraries customization section in the Application Security Guide.
• Sandboxing : https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/index.html 
• Desired Access and Shared Access to enable opening of shared files using  nNtCreateFile: https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntcreatefile  
• Operating system version API helper function: https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version 
• Adding users to an encrypted file: https://docs.microsoft.com/en-us/windows/win32/fileio/adding-users-to-an-encrypted-file 
• See Workflow section -Actions for Shared Folders : https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/index.html 
• Creating file functions: https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea  
• Access based enumeration: https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-access-based-enumeration-on-a-namespace  and using inherited permissions on access bases enumeration: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd834874(v=ws.11)?redirectedfrom=MSDN 

I hope these references help.