Adobe Reader DC – There was an error opening this document. Access denied

adobereaderx

I came across this issue when Adobe reader 11.0 was updated to Adobe Reader DC 2015.007 on a Remote desktop server.

Users who tried to open a .pdf file from outlook were prompted with the issue “There was an error opening this document. Access denied.”

However, if the users on the RDS server saved the file there was no issues opening the file.
This because the attachment .pdf file in outlook is classed as an unknown source from internet.

 

Why?

PDF files have grown from beeing static documents to beeing dynamic and smart documents.
PDF files have functions like running scripts on startup. This make pdf files a vulnerability from a security perspective.
Therefor Adobe have a builtin protection from pdf files from unknown sources called “Protection mode” or “Sandbox Protection”

 

Turn of “Protected mode” on a client/users RDS profile:

Open Adobe Reader DC

Click “Edit” and choose “Preferences”

Click on “Security (Enhanced)” and unmark “Enable Protected mode at startup”

adobe_security_pref

This might be a quick solution if you have a handful users, but if you have 250 users in a RDS enivoriment? Not so much.

Turn of “Protected mode” through GPO ( The fast way )

You can turn of “protected mode” through changing a registry key:

HKEY_CURRENT_USER\SOFTWARE\Adobe\Acrobat Reader\DC\Privileged\
Change the valvue “bProtectedMode”=dword:00000001 to “bProtectedMode”=dword:00000000

This will workout just fine, but there is a better way, Through ADMX files.

 

Turn of “Protected mode” through ADMX GPO:

When using a ADMX template for the appropriate software, you can make several changes in the software easy. You will have easier to understand the changes and valvues in the GPO instead of having registry keys changed.

How to:

  1. Access one of your domain controller
  2. Download the ADMX files from adobe ( ftp://ftp.adobe.com/pub/adobe/reader/win/AcrobatDC/misc/ReaderADMTemplate.zip )
  3. unzip the files
  4. Take a copy of C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions  (in case of something will go wrong when you import the ADMX files)
  5. Copy the ADMX files into the folder C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions
  6. Start Group Policy Management
  7. Create a new gpo, or use a current gpo
  8. Edit the gpo and go to Computer Configuration->Policies->Administrative Policy->Adobe Acrobat 2015->Startup-> Disable “Enable Protected mode on startup”

gpo

 

3 thoughts on “Adobe Reader DC – There was an error opening this document. Access denied

  1. Johng156

    You are a really persuasive writer. I can see this in your writeup. You’ve a way of writing compelling info that sparks significantly interest. kbekeekaeeke

    Like

    Reply

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s