Unable to delete temporary files

[Guest]

I am running Acrobat Reader 11.0.0 in a XenApp 6.5 Environment on Windows Server 2008 R2 SP1.  We have recently started using Mandatory profiles and the option set to delete cached profiles on logoff.  We have started noticing that some of the profiles are not being deleted because of files that are locked by the system.  The files are named Z@*.tmp.  I have done some research into the issue and have found an article on your website that mentions this issue specifically:

http://blogs.adobe.com/dmcmahon/2011/11/08/acrobatreader-tmp-files-left-behind-in-temp-folder-after-...

Please note this article is dated 11/2011 and seems to refer only to XP, NT, and 2003 server.  Also at the bottom of the article it states the following:
Following our testing we have discovered that the issue does not occur in Windows 7, or Windows 2008 Server.  It seems that the updated versions of Windows provide a solution to this issue.  We would therefore recommend updating your OS if possible.

I have found that this is not that case and this issue seems to remain, at least in my configuration.

[StefanSch]

Hello,

please make sure you have none of these updates installed:

KB2970228

KB2993651

KB2982791

KB2975719

KB2975331

And if so, uninstall, reboot and check again if this helped.

[Guest]

Hello everybody,

We have had multiple customers with this problem. At almost all sites the solution was: remove KB2993651 (and KB2970228).

Now we have 1 site where KB2970228 was not installed and KB2993651 was. Sites is MSFT 2008 R2 XenApp 6.5 Rollup 4 and Adobe Reader 11.0.0.9. I removed KB2993651 but the issue remains.

I checked all KB's (KB2970228 KB2993651 KB2982791 KB2975719 KB2975331) but none are installed. This customers prints PDF a lot. Like more then 200 per day. Please provide a fix for it Adobe! The customer is already asking us if it's ok to use Foxit (which does not have this problem!)

[Schoorties]

Hello,

We have the same problem, 2 weeks Ago we solved it by removing KB2970228 and KB2993651 and it worked.

Then Microsoft published new updates and since the problem appears again.

We upgraded from Reader X to Reader XI but the problem still happens.

We are praying that Adobe will fix it very soon ! Unfortunately we can't use Foxit cause our company needs to fill some PDF from our state which can only be filled by Adobe Reader.

[Test Screen Name]

It looks as if this is working exactly as Microsoft intended. Adobe Reader makes temporary fonts for good quality and fast printing, using methods Microsoft have recommended for over 15 years. Adobe Reader then cleans up the fonts, but Microsoft in their wisdom stop the fonts from being deleted until the session has finished (by which time Adobe Reader cannot, by definition, be running to delete them). It's hard to imagine what planet Microsoft were on when they decided this was a good solution to whatever the problem was. You can stop Adobe Reader from making fonts for printing by using "print as image" but you can see what this does to print time and quality.

[jc2it]

We had this fixed until 10/16 when updates occurred on our systems. This is the list that was installed, and one or more caused the problem to reoccur. Any idea which of the 34 possibilities? I have started with OS updates, but have not had much luck with deducing the culprit. Also, on 10/15 Adobe Reader was updated to 10.1.4, but I don't think this was the cause, because our files started accumulating on the 16th.

OS updates

KB3000869 - MS14-060: Vulnerability in Windows OLE could allow for remote code execution

KB3000061 - MS14-058: Vulnerabilities in kernel-mode driver could allow remote code execution

     This one modifies the Win32k.sys file. This file was also modified in the original culprit KB

KB2987107 - MS14-056: Cumulative security update for Internet Explorer

    Perhaps this fix is causing the problem???   https://support.microsoft.com/kb/3004256

KB2979570 - MS14-057: Description of the security update for the .NET Framework 3.5.1 for Windows 7 Service Pack 1 and Windows Server 2008 R2 Service Pack 1

KB2977292 - Microsoft security advisory: Update for Microsoft EAP implementation that enables the use of TLS

KB2972100 - MS14-057:

KB2968294 - MS14-057:

.NET updates:

KB2979578v2

KB2972107

Office updates:

KB2589352

KB2825635

KB2760598

KB2687455

KB2589298

KB2878252

KB2837606

KB2597087

KB2889836

KB2883013

KB2850016

KB982726

KB2880971

KB2794737

KB2837595

KB2817369

KB2687423

KB2494150

KB2760631

KB2837581

KB2878281

KB2837579

KB2687567

KB2589375

KB2810073

KB2881071

[jc2it]

KB3000061 - MS14-058: Vulnerabilities in kernel-mode driver could allow remote code execution

     This one modifies the Win32k.sys file. This file was also modified in the original culprit KB

Based on the version of the Win32k.sys file I should have if I had installed KB2993651 I believe KB3000061 is what is causing the problem in October. I am going to test this, but it will be Monday 10-27-14 before I know for sure. If you can test sooner please let us know.

Thanks,

Job

schoorties, StefanSch, mbiesheuvel

[george_kazantzis]

Hi everyone. I currently have a Citrix Xenapp farm (provisioning services), on 6.5 2K8 R2 servers. I was also having these issues and only a reboot of the Xenapp server would clear these temps files. I was able to rename these files but could not delete them. This was causing Profile Manager to have entries all over my servers.

But the solution for me was doing the following 3 things and which cleared this issue :

1) Remove KB2970228

2) Remove KB2993651

3) Finally I removed adobe reader and reinstalled it from the adobe site (11.0.9).

This setup has been live for 10 days without issues. I reapplied those patches on a test server and issues came back. Thus I will be avoiding both patches for a while until another comes up that resolves the issue. Hopefully this works for all of you.

[giloup_]

Hi Guys!

The solution provided by Adobe in 2011 is working.

[WinFntSvr]

TTToSysPrintDisabled=1

T1ToTTDisabled=1

Save this as acroct.ini copy it in the windows diorectory and bye bye the problem.

We have a Xenapp 6.5 environnement on Windows 2008R2

[Schoorties]

Hello again,

I just tested and I confirm it works for us too on XenApp6.5 Win2008R2

Do you have news about the print quality ? Adobe says that applying this may reduce the print quality.

Regards

[giloup_]

I didn't see any difference!

I suppose it  must depend of the type of pdf file your printing

[jc2it]

It is great that the Adobe problem can be fixed by changing settings. Removing the update also fixes some other problems we have seen.

Removing KB3000061 fixes:

• Problems with Z@*.tmp files being left in \\<RDPServer>\Users\<UserName> directory.
• Print jobs getting stuck in the Amyuni print driver queue.
• Also, it allows ProComm Plus to Copy to printer and send print jobs to a slave print via serial.
• And perhaps a slew of other issues related to changing how the kernel handles Fonts.

[12nico34]

None of the above helped for me.

I was forced to install an other pdf viewer on the Remote Desktop server.

I hope this issue will be fixed by Adobe or Microsoft.

The other pdf viewers don't have the customization wizard.

[Guest]

The same issue experienced here on Windows 2008 R2 Standard running XenApp 6.5 With HRP04.

No post HRP04 Citrix hotfixes installed.

Adobe Reader XI version 11.0.1.

I can reproduce the issue every time by printing from a pdf and logging off.

We had all currently recommended microsoft windows hotfixes installed as of 17/10/2014.

I got it fixed by uninstalling the following updates (similar to what jc2it suggested):

KB2993651

KB2982791

KB3000061

(Hotfix 2970228 we don't have installed)

Until I uninstalled all 3 of those hotfixes the issue was not fixed and even reinstalling 2993651 later on causes this issue to come back.

The key to resolving this seems to be removing whichever hotfix(s) bring down updated versions of: win32k.sys and gdi32.dll.

The versions of these files that the issue doesn't occur with for me is:

win32k.sys

Version: 6.1.7601.18512

Date: 18/06/2014 1:10pm

gdi32.dll

Version: 6.1.7601.18275

Date: 3/10/2013 3:23pm

Also I noticed much faster printing of PDF files from acrobat reader after removing these hotfixes, before removal the printing dialog box would stay on the screen for a while, now it's pretty much instant.

[jc2it]

It looks like KB3002885 will modify the win32k.sys on Win 2008 R2 server. I will try to test it later this week.

http://support.microsoft.com/kb/3002885

[WesleyL3]

We have the same problem where user.domain.001 will be created on our Terminal Servers because of a Adobe Reader tmp file that is in use.

Infra:

     - Windows 2008R2 + SP1

     - Remote Desktop Service Role

     - Adobe Reader 11.0.0

     - Roaming Profiles

Removed these updates:

     - KB2993651

     - KB2982791

     - KB3000061

Still have the same problems unfortunately, do I miss anything?

note: Will install 11.0.9 tonight on all Terminal Servers tonight.

[jc2it]

In your environment I would make sure all of these updates are not installed.

KB2970228

KB2993651

KB2982791

KB2975719

KB2975331

KB2976897

Also, the new update that came out yesterday KB3002885, may cause the same thing. I have not had the opportunity to test it.

After you have ensured the updates are uninstalled check the versions of the following files.

Remember to reboot after uninstalling updates.

win32k.sys

Version: 6.1.7601.18512

Date: 18/06/2014 1:10pm

gdi32.dll

Version: 6.1.7601.18275

Date: 3/10/2013 3:23pm

If they match or are earlier versions then Adobe should work on 2008 R2.

Document everything and create a support call with Microsoft, so we can get this solved permanently.

[Test Screen Name]

Has anyone seen anything from Microsoft on WHY they make this change in hotfixes, and whether this is intended to be a permanent change?

[Guest]

In addition to my last post I found the latest round of MS patches break printing again.

I haven't gone through to figure out exactly which patch breaks it but it's one or more of these lot of patches that were released this month:

2993958, 3003743, 2978120, 3010788, 2978128, 2992611, 2991963, 3006226, 2899526, 2899527, 3003057, 3005607, 3002885.

We've reached a point where we can not continue to not install critical security patches during every round of patching as it's starting to add up to quite a lot of work to figure out each patching cycle which patches break pdf printing and which don't. Our security team are not impressed with this either.

Today I have implemented the workaround solution #2 suggested by adobe years ago in this thread:

Acrobat/Reader: Z@xxx.tmp files left behind in Temp folder after printing

The workaround #1 made no difference, only the 2nd workaround ini file solved this.

Basically on each terminal server I had to create a file named "C:\Windows\acroct.ini" with the following contents:

[WinFntSvr]

TTToSysPrintDisabled=1

T1ToTTDisabled=1

I can confirm this workaround works fine. I tested the impact it has on pdf print quality and found absolutely no difference. Maybe it affected only certain types of PDF files but none I tested. We will be leaving this workaround in place.

Regarding logging a call with either MS or Adobe, I don't think MS would accept it as their fault and neither would adobe, the usual blame each-other circle.

To me it seems that adobe might need to adjust acrobat behaviour when it comes to making system calls to windows printing/font system to match the latest updated behaviour in Windows but what do I know, I'm not a developer.

[jc2it]

My untested Theory is that KB3002885 will cause this behavior to return. You might try uninstalling this one first. Let us know if it fixes it.

Thanks!

[Test Screen Name]

Aha! I found this in http://support.microsoft.com/kb/KbView/2982791

"MS14-045: Description of the security update for kernel-mode drivers: August 12, 2014...

Known issues with this security update

Known issue 1

After you install this security update, fonts that are installed in a location other than the default fonts directory (%windir%\fonts\) cannot be changed when they are loaded into any active session. Attempts to change, replace, or delete these fonts will be blocked, and a "File in use" message will be presented. "

Now, there is no more, but by including this as a "known issue" it at least suggests that Microsoft consider that it is a problem and a resolution would be desirable. They don't commit to anything or suggest a workaround, however.

[JSL-WSCPA]

I'm using Acrobat 10 myself, but if I log in to Citrix, print a file to PDF and then log out, the profile folder (c:\Users\<username>) doesn't go anywhere. If I kill acrodist.exe - it does.

The acroct.ini ultimately didn't help me at all. Every time there's a new batch of updates, the problem returns. Today, I removed KB3002885 but that didn't help. Previously, removing updates in this thread helped, but that didn't seem to be the one this time.

I'm considering putting something in a logoff batch file to kill acrodist.exe on the way out... (EDIT: That doesn't work, as it never gets far enough into the logout to fire the script.)

[Guest]

It sounds like the issue you experience is slightly different from the one described in this thread.

The issue we're seeing is acrobat post print tmp files getting locked by system WITHOUT any adobe acrobat processes left running.

In your case looks like acrobat reader distiller doesn't exit on user's logoff and process is left running under the user's name (presuming it runs under the user's id?).

I would suggest trying to follow this Citrix article: Graceful Logoff from a Published Application Renders the Session in Active State

Basically add acrodist.exe to the following registry key on each citrix session host:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Citrix\wfshell\TWI\LogoffCheckSysModules = acrodist.exe

This will force close the process on user's logout. I used this fix to auto kill symantec antivirus process that kept locking roaming profiles and it worked great.

Out of interest could you navigate to the user's stuck profile folder c:\Users\<username>\ and see what folders/files are left behind, might give you a clue about which file is actually locked in the profile.

[JSL-WSCPA]

I think you may be right. I definitely started with the issue in the thread, my profile folders became littered with temp files, but it could be that removing the updates in question fixed that, and revealed a separate issue with acrodist.exe that just I hadn't noticed before.

The only way to really know is to put those updates back on, but I think I'll let it be for now. Thanks for the suggestion - I hope everyone is able to rid themselves of their issues!

[jc2it]

I have been working with Microsoft on this issue. I have been escalated up, and they know about the issue and have a mitigation. I have to schedule down time to test, and will attempt it in the morning. Here is the untested information I have received up to this point. 

Please find the steps below:

1.	Restart the computer in safe mode.
2.	Delete the fntcache.dat file. To do this, type the following command at command prompt , and then press Enter: del %windir%\system32\fntcache.dat
3.	After you delete fntcache.dat, restart the computer. The computer should now start successfully.
4.	Click Start , click Run , type regedit in the Open box, and then click OK .
5.	Locate and then click the following subkey in the registry: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Fonts\
6.	Right-click the Fonts registry subkey, and then click Export .
7.	Type a name for the exported reg file, and select a location to store the file. You will use this file later to restore the font registration that you will remove in the following steps.
8.	After you save the reg file, find any registry values under the Fonts registry subkey for which the data field meets the following criteria: • Contains a full file path (not just a file name) • The full file path ends in an ".otf" extension. (This indicates an OpenType font file.)
9.	Delete the fntcache.dat file again. (It will have been re-created.) To do this, type the following command at command prompt, and then press Enter: del %windir%\system32\fntcache.dat
10.	Open the Programs and Features item in Control Panel, and then click View installed updates . Find and then uninstall any of the following update that are currently installed: • KB2982791 • KB2970228 • KB2975719 • KB2975331
11.	Restart the computer.
12.	Find the reg file that you saved earlier, right-click the file, and then click Merge to restore the font registry values that you previously removed.

Schoorties Learn2Code Caorthann George Kazantzis testScreenName

[AEAG]

Hi Jc2it.

Did you find time to test this solution ?

What worried me, is having to uninstall windows update every month, and even in your solution.

One KB per month (For me August: KB2982791 / Oct KB3000061 / Nov KB3002885)

When it does it will stop...