I came across this issue when Adobe reader 11.0 was updated to Adobe Reader DC 2015.007 on a Remote desktop server.
Users who tried to open a .pdf file from outlook were prompted with the issue “There was an error opening this document. Access denied.”
However, if the users on the RDS server saved the file there was no issues opening the file.
This because the attachment .pdf file in outlook is classed as an unknown source from internet.
PDF files have grown from beeing static documents to beeing dynamic and smart documents.
PDF files have functions like running scripts on startup. This make pdf files a vulnerability from a security perspective.
Therefor Adobe have a builtin protection from pdf files from unknown sources called “Protection mode” or “Sandbox Protection”
Turn of “Protected mode” on a client/users RDS profile:
Open Adobe Reader DC
Click “Edit” and choose “Preferences”
Click on “Security (Enhanced)” and unmark “Enable Protected mode at startup”
This might be a quick solution if you have a handful users, but if you have 250 users in a RDS enivoriment? Not so much.
Turn of “Protected mode” through GPO ( The fast way )
You can turn of “protected mode” through changing a registry key:
Change the valvue “bProtectedMode”=dword:00000001 to “bProtectedMode”=dword:00000000
This will workout just fine, but there is a better way, Through ADMX files.
Turn of “Protected mode” through ADMX GPO:
When using a ADMX template for the appropriate software, you can make several changes in the software easy. You will have easier to understand the changes and valvues in the GPO instead of having registry keys changed.
- Access one of your domain controller
- Download the ADMX files from adobe ( ftp://ftp.adobe.com/pub/adobe/reader/win/AcrobatDC/misc/ReaderADMTemplate.zip )
- unzip the files
- Take a copy of C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions (in case of something will go wrong when you import the ADMX files)
- Copy the ADMX files into the folder C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions
- Start Group Policy Management
- Create a new gpo, or use a current gpo
- Edit the gpo and go to Computer Configuration->Policies->Administrative Policy->Adobe Acrobat 2015->Startup-> Disable “Enable Protected mode on startup”