Massive compatibility problem with Microsoft Windows Device Guard Memory integrity

[Seb-needs-help]

Dear community,

we have just encountered a massive problem with the Adobe Creative Cloud Desktop App and Windows Device Guard, Memory integrity to be more specific.

After enabling Memory integrity we had a few devices running into a blank/black boot screen and beeing stuck. It was possible to launch to safe mode but never to boot in normal mode. After a lot of hours invested we finally figured out what all devices had in common -> Creative Cloud Desktop App.

A few more hours later we were able to confirm, that CC App had a problem with Memory integrity or vice versa, if you like.

CC App comes with a driver "PX Engine Device Driver for 64-bit Windows" by "Rovi Corporation" that get's blocked by Windows' Memory integrity. You do receive a notivication when installing CC after Memory integrity had been enabled, also you can't enable Memory integrity if CC is already installed.

If you enable Memory integrity via GPO, though, you don't get any warning but rather affected computer will not boot up anymore. THANK YOU Microsoft for that...

Nevertheless, we would really like to have both. Does anybody have a fix for this problem?

Kind regards

Seb

[kglad]

@Seb-needs-help 

are you the admin of a teams or enterprise subscription?

[Seb-needs-help]

Yes, I am.

[kglad]

<moved from cc desktop bugs>

[Kalvyn Rasquinha]

Hi @Seb-needs-help , did you install any other Adobe apps in addition to the Creative Cloud desktop app? "PX Engine Device Driver for 64-bit Windows" is not a driver that is needed for the Creative Cloud desktop app however since it also installs other Adobe apps, it's likely that another app has a dependency.

[Seb-needs-help]

Hi Kalvyn, we do not have anything else installed. Mentioned driver is included in the enterprise installer from the admin center.I have neither selected any plugin to be installed. Was not able to try the "public" installer yet, I am just not sure if it's suitable for SCCM (unattended parameters)?

[Seb-needs-help]

@Kalvyn Rasquinha you think you could forward this issue to your tech team, please? This issue should affect other companies as well. Due to the relation between device guard (credential guard) and NAC, other companies will have to introduce this group policy, as well (latest with W11 transition).

[Kalvyn Rasquinha]

@Seb-needs-help apologies for the delayed response. Could you collect a log file from the machine exhibiting this issue and share the file name with me? Instructions on how to use the tool are here: https://helpx.adobe.com/creative-cloud/kb/cc-log-collector.html

[Seb-needs-help]

Could you let me know, what the current status is? This issue can be replicated on as many PCs as you like. Adobe should be able to do so by their own. Just Install Adobe CC on a W11 client and try to turn on Memory Integrety. Thanks.

[Ricardo González]

Tenemos que saber inglés? Como me doy de baja de los servicios de adobe?

[Alok Kumar22992454uobo]

Hi @Seb-needs-help , Can you share the command used for deploying enterprise installer. 

[Bani Verma]

Hi there, 

As per your questions, it looks like you need help with deployment. Our deployment guide for Admins may provide the assistance you need: https://adobe.ly/41nEMCJ.

Please don’t hesitate to reach out if you need help; we’re here.

Thanks,
^BS

[Seb-needs-help]

Execute-MSI -Action 'Install' -Path 'Custom name.msi' -Parameters 'ALLUSERS=1 ADDLOCAL=ALL /quiet /norestart'

[Alok Kumar22992454uobo]

@Seb-needs-help By Default, PX engine is disable in enterprise installers but since you are using "ADDLOCAL=ALL", so it is getting enabled and thus getting deployed on machine. Please remove "ADDLOCAL=ALL" parameter from your command to resolve it.

[Alok Kumar22992454uobo]

@Seb-needs-help Please let me know if this resolves the issue.

[s.boba]

Hello! I haven't found any technical documentation about the MSI feature properties.

What is this PX engine and are there any side effects by excluding the "AAMEE_PH" feature?

And what is behind the other feature named "AAMEE_BL"? Can this be exclueded as well?

[Anshul_Nautiyal]

Hi @s.boba,

It appears you have an active Teams subscription linked to the Adobe ID you used to post your query.

The PX Engine is associated with DVD-burning functionality in certain Adobe applications. For most deployments, especially when these features are not utilized, excluding the "AAMEE_PH" feature (which relates to the PX Engine) should not impact functionality. This exclusion also helps maintain compatibility with security settings like Windows Device Guard’s Memory Integrity.

The "AAMEE_BL" feature includes additional libraries or components for broader compatibility in specific deployments. If these are not required for your workflows or are causing issues, excluding this feature is generally safe. However, it is recommended to test the deployment on a few devices to ensure no critical functionalities are affected.

Please find the following documentation related to deployment for your reference and guidance:

https://adobe.ly/3ZLE9S4

Adobe Properties — Deployment Planning and Configuration

If you require further assistance or have additional questions, please don’t hesitate to reach out.

Regards,

^AN

[s.boba]

Hi Anshul,

thank you for the fast response and the detailed information. That is exactly I was looking for. I have an open enterprise case on this matter and so I follow related topics within the community.

My case is active for 2 months now and nobody from the support team would provide me the information you gave me in less one hour.

I’m really thankful.

May I suggest to remove the PX Engine Feature completely from future releases and offer it instead as addon/optional download? This would avoid problems and slim down the package. The desperately outdated px-drivers need to be reviewed anyway.

Thank you again and kind Regards!

[Anshul_Nautiyal]

Hi @s.boba,

Thank you for your feedback. Could you please provide the case ID of the support case you have raised? This will help me coordinate with the relevant team to assist you further. Kindly send the case ID via personal message.

Please refer to the following document for guidance on how to send a personal message to a fellow community member.

Regards,
^AN