Open two PDFs from DFS Server 2019

[julians87814861]

We face the issue that we're not able to open two pdf files from a Server 2019 DFS at the same time.

We use Windows 10 1809, the recent version of Adobe Reader DC (Version: 2019.010.20069) and a Server 2019 distributed file system.

The first pdf opens normally, but if we want to open a second one at the same time, nothing happens.

No Error message appears. No Event Log entry.

[Test Screen Name]

What kind of open do you do?

- Open from the File menu in Reader?

- Double click in Windows?

- Some other app opens it?

- A web service opens it?

- Something else?

[julians87814861]

It only appears if we want to open it via double click in the windows explorer.

Open it from the file menu within the Reader works fine.

[AnandSri]

Hey Julians,

We're sorry for the trouble you had, please navigate to Adobe Reader's Preferences from Edit>Preferences>Security(Enhanced)>Disable 'Protected Mode at startup' and 'enhanced security'>Click OK>Restart the application and check.

Note: Disabling Protected Mode and Enhanced Security is only for testing purpose, please enable it back.

Whitelist the storage location of the files in Adobe Reader's Preferences from Edit>Preferences>Security(Enhanced)

Let us know how it goes and share your observation.

Thanks,

Anand Sri.

[julians87814861]

With disabling the protected mode we're now able to open two PDFs at the same time.

Whitelisting the storage location doesn't effect anything.

But as you said, disabling the protected mode is only for testing purpose. What can we do now?

[daniele48813572]

Issue still persist in 19.010.20098. Works with protected mode disabled, but as I said we don't want to disable it.

[daniele48813572]

We're facing the same issue and have the same setup (Windows 10 1809 on the clients and server 2019). Updated to 2019.010.20091 this morning in the hopes of resolving it but we still can't open multiple PDFs from dfs.

Works with protected mode disabled, but we don't want to disable it.

If i enable the protected mode log file we get this;

NtCreateFile: STATUS_ACCESS_DENIED

Does not help to enter the path to privileged locations.

[Pudong]

Problem still exists in Version 2019.021.20049

DFS on Windows Server 2019

Clients Windows 10 1809

Works with protected mode disabled, but we don't want to disable it.

[tarutuhoxi]

This problem still exists in 2019.021.20056.

[Ikati]

This problem still exists in 2019.021.20061

[Christophe B.]

Hi , this problem exist from at least 1 year and no real solution from adobe support ?? Up 🙂 

[ls_rbls]

Hi,

Actually this problem can be traced back to 2015.

Personally, I don't have a work environment where I can test different scenarios; I go by what I read.

That said, I am not sure if this is entirely related just to Adobe Acrobat or Reader because it seems to also occur with other programs that are not related to any of the Adobe family of products.

If you look more carefully in the forums, some users report that it happens when both Acrobat and Reader are opening a file in a shared environment.

In other cases, some users report that the problem only happens if Adobe  Reader is used instead of Acrobat. And others reported that it only happens with Acrobat but not with Reader.

So the main question is : why when you disable protected mode in Reader or  Acrobat it seems to work?

Now keep in mind that this seems to happen while a DFS server is in use.

I've not seen other threads in which the users specify if they're using BFS instead of a DFS server.

I don't know what impact would it have if instead of using  a DFS server to test for the same problem would be when using clients of Acrobat and Reader accessing PDF files from a BFS server. 

See key differences here:

https://techdifferences.com/difference-between-bfs-and-dfs.html#KeyDifferences 

Additionally, I think it is also worth checking out, what option are available at installation time that can be passed on to the installation setup program to comply with all and any services that handle replication of data on the DFS side.

Another scenario to test for this problem would be a unix client (like macOS) with Reader or Acrobat, and also a linux PC with Adobe Reader (emulated) . Would these clients get the same error under these circumstances as they try to access file shares?

It's starting to look like it is almost exclusively related to the Windows platforms used both on the server side and client side.

There is a good link that I found in Microsoft support that addresses that possibility.

Research more in Windows Server documentation recommendes guide from Microsoft:

https://docs.microsoft.com/en-us/windows-server/index 

See more about setting up fully qualified domains:

https://support.microsoft.com/en-us/help/244380/how-to-configure-dfs-to-use-fully-qualified-domain-n... 

DFS Replication:

https://docs.microsoft.com/en-us/windows-server/storage/dfs-replication/dfsr-faq 

ntifs.h (NtCreateFile function):https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntcreatefile 

https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntcreatefile 

Setting access control lists: https://lists.samba.org/archive/samba-technical/2008-July/060247.html 

Enabling/Disabling client failback (referrals):

https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-or-disable-referrals-a... 

DFS namespace overview:

https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/dfs-overview 

Granting user permisson to  access namespace :

https://support.microsoft.com/en-sg/help/258992/how-to-configure-delegate-administration-permissions... 

DFS and file locking:

https://community.spiceworks.com/topic/635610-dfs-r-file-locking 

https://social.technet.microsoft.com/Forums/windowsserver/en-US/8554f751-913d-4950-8cbf-e2c2214b24ce... 

Last, the thing that caught my attention the most was that in one of my readings someone suggested another  user not to host a replication server in a domain controller.

[MrKropotkin]

Hi,

I've just been observing the same issue on one of our networks. It looks like there are a few other threads around relating to this, with various details but no solutions.

I can confirm that if I set the client to use a referal to a 2008R2 server, I do not see the same behaviour as using a 2019 server.

Using Process Monitor to investigate, I believe that the way the UNC paths from DFS are handled in the background has changed between 2008 and 2019. I'm assumign that there's somethign in reader that doesn't handle this well.

In 2008, it appears the file loading is all handled with calls to the namespace. e.g. \\domain\namesapce\share

In 2019, you see an initial referal to this, but subsequent operations use the direct UNC path to the share on the server.

e.g.

\\domain\namespace\share\
\\server\share

On attempting to load the 2nd pdf, you ONLY see \\server\share.

I can't infer that the issue is linked to these observations, but it does look likely to me. What I can be sure of, is that reader gets some way towards loading the file before failing as you can see the right and menu refresh in the GUI at the point that it would have loaded it.

[ls_rbls]

Those are very thorough observations.

Hopefully someone can find a solution to this.

Thank you very much for sharing your feedback.

[ls_rbls]

Hi,

I am going to post here the same info that I shared in a similar thread.

After much reading, I thinks the following references might be useful.

It seems like the DFS is preventing access to the  namespace when a client tries to hit a folder target with Acrobat in protected mode .

Verify if when  you add the absolute path for a priviledged location ,   

that the  namespace is not configured to issue referrals with the "insite" option.

See here  for troubleshooting: https://support.microsoft.com/en-us/help/975440/how-to-troubleshoot-distributed-file-system-namespac... 

Enable the cross domain troubleshooting log  in Reader / Acrobat and confirm if the messages that you get are not suggesting to "allow any" type of access which is the least restricted access policy, which would also defeat the purpose of using Enhanced Security and  Protected Mode .

See here too: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html#policy-file-configuration  

See here : https://helpx.adobe.com/acrobat/using/enhanced-security-setting-pdfs.html#bypass_enhanced_security_r... 

Since this seems to be not entirely related to Adobe Reader/Acrobat, there are a few more things that need to  be observed:

• Review on namespacing: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file 
• Review on how DFS works: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc782417(v=ws.... 

• targetting you r applications for windows:  https://docs.microsoft.com/en-us/windows/win32/sysinfo/targeting-your-application-at-windows-8-1 
• How to configure fully qualified domains in referrals: https://support.microsoft.com/en-us/help/244380/how-to-configure-dfs-to-use-fully-qualified-domain-n... 
• Configuring indicators in MS Windows Defender  Advanced Threat Protection https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/manage-in... 
• Configuring Defender AntiVirus exclusions:https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/confi... 
• Controlled Folder Access: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-co... 
• Turning off scaning of DFS files: https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-comput... 
• Enhanced Security: https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/enhanced.html#trust-overrides 
• Trusting documents with valid certification:https://helpx.adobe.com/reader/using/protected-mode-windows.html  
• Bypassing protected view restrictions: https://helpx.adobe.com/acrobat/using/protected-view-feature-pdfs-windows.html 
• See Application Security Guide in Troubleshooting Protected View: https://helpx.adobe.com/acrobat/kb/protected-mode-troubleshooting-reader.html  and see Application security libraries customization section in the Application Security Guide.
• Sandboxing : https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/index.html 
• Desired Access and Shared Access to enable opening of shared files using  nNtCreateFile: https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntcreatefile  
• Operating system version API helper function: https://docs.microsoft.com/en-us/windows/win32/sysinfo/operating-system-version 
• Adding users to an encrypted file: https://docs.microsoft.com/en-us/windows/win32/fileio/adding-users-to-an-encrypted-file 
• See Workflow section -Actions for Shared Folders : https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/index.html 
• Creating file functions: https://docs.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilea  
• Access based enumeration: https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/enable-access-based-enumerati...  and using inherited permissions on access bases enumeration: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd... 

I hope these references help.

[TAKUYA0222]

Hi, all

I've just been facing the same issue.

I verified that follows just like yours.

- No error via UNC paths ,error with DFS paths

- There is no symptom in Win2012R2

- The phenomenon appears in both Wn2016 and Wn2019

Does anyone know? Whether privileged locations can be used to avoid this.

If it can use it, please let me know how to write it.

Thanks

[ls_rbls]

Hi,

NEW UPDATE WITH ASSUMED CORRECTIVE ACTIONS

Please refere to this thread: https://community.adobe.com/t5/acrobat-reader/can-only-open-1-pdf-at-a-time-from-dfs-server/m-p/1088...