Windows 10 February Cumulative Updates causes BSOD if Adobe Acrobat DC is installed

[erinl25341586]

Hi -

We have a problem that after Windows 10 v1903/1909 Cumulative Updates were installed, the computer will BSOD non stop, typically within 30 seconds after a restart.

We reached out to Microsoft and their response was;

"After analyzing the dump files it was confirmed that the following binary has a revoked certificate:

\Windows\System32\AdobePDF.dll

So the next step would be for you to follow up with Adobe - they need to determine why the signing certificate used for this binary is revoked and update that binary. That should mitigate the crash."

We confirmed this by uninstalling Adobe Acrobat DC and then installing the February Cumulative Update.  The computer was able to install the update and no longer crashed.  When we tried to reinstall the latest version of Adobe Acrobat DC, the installation errored out and then later crashed the computer.

[DellDeric]

We are experiencing similiar issues to what you have described. Have you found a resolution for your issue?

[Test Screen Name]

This sounds serious. Ha s you reported it to Adobe?

[DellDeric]

We have an open case currently with them about this. Just trying to get community feedback while we wait for log files to be reviewed. 

[erinl25341586]

I have an open case with Adobe however they have yet to respond to it.

I reached out to Microsoft to see if they could assist further and they are doing an analysis of a full memory dump.  Once I have the results I'll reach out to Adobe again.

[seanriki]

Any updates on this?

We are having this same issue with all our Adobe machines.

[DellDeric]

For us it was related to Windows Defender Application Control being enable by sccm. Microsoft has told us that a fix would be available the 3rd week of April. I would reach out to Microsoft to report this issue. 

[DellDeric]

Also to add this effected the ci.dll which was tied to Code Intergrity. If we booted into safe mode and disabled the print spooler service we were able to get the machines to boot without BSOD. We were then able to uninstall the February patches to resolve this issue. 

[wilsonmj]

Any news on a "fix" from Microsoft?  Included in this months CU or delayed?  If you have anything to reference, I'll open a case.  Thanks,

[DellDeric]

The last update I got was that a fix would be out from Microsoft the week of April 20th. 

[erinl25341586]

Microsoft also told me end of April or early May.  I requested that they keep me updates on the release of this fix.

[erinl25341586]

It was determined that WDAC was also causing this problem for my organization as well.  We used SCCM to enable it in audit mode.  If the patches need to be installed before a fix has been released you will want to disable WDAC, please see below on how this is done.

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-con...

Since we had WDAC running in audit mode, there were only two files that needed to be removed

• <EFI System Partition>\Microsoft\Boot\SIPolicy.p7b 
• <OS Volume>\Windows\System32\CodeIntegrity\SIPolicy.p7b 

To be able to access the EFI partition you need to boot the machine into Windows Recovery > Choose an option > Troubleshoot > Advanced Options > Command Prompt.

Once in command prompt, run the following:

• Diskpart
• List volume (here you will normally see about 4 volumes and EFI will normally be “Hidden”)
• Select volume 3 (in my case that volume is where the EFI partition is)
• Assign letter=Z
• Exit
• Z: (to move from X: to Z: drive)
• CD EFI\Microsoft\Boot
• Delete the required files

[erinl25341586 · Accepted solution]

Update KB4550945 was released as an optional update at the end of April to resolve this issue.  I have confirmed that once this update is installed, our computers no longer crash.