Protected Mode troubleshooting | Adobe Reader

Protected Mode is an Adobe Reader X feature. It extends Adobe's rapidly evolving defense-in-depth security strategy for mitigating and preventing security vulnerabilities. Protected Mode protects you by limiting what malicious files can do and access. By default, Adobe Reader X enables Protected Mode. Acrobat 10.1 introduced Protected View.

This document lists what Protected Mode does not support as well as changes across releases. Protected View in Acrobat shares some of its behavior.

To learn more about sandboxing and protected mode, see the following:

• For FAQs and information about registry configuration and creating custom policies, see the Protected Mode chapter in the Application Security Guide in the Application Security Library.
• Find architectural-level details in the ASSET team's blog at http://blogs.adobe.com/asset/.

When Protected Mode cannot launch due to an unsupported configuration, a dialog alerts you that Protected mode is unavailable.

“Adobe Reader cannot open in Protected Mode due to a problem with your system configuration. Would you like to open Adobe Reader with Protected Mode disabled?”

Protected Mode: Unsupported configuration dialog box

Fixed in 10.1.3

• With Protected Mode ON in Reader, links in a PDF to local folders now work.
• Printing is now possible on Win Server 2003-64 bit in Protected Mode.
• On Win Server 2003-64 bit systems, the incompatibility dialog is NOT thrown on launching Reader for the first time after system restart.
  

Fixed in 10.1.2

• Reader can freeze up during File > Open when Symantec PGP whole disk encryption software is installed.
• Reader and Entrust software installed on the same machine.
  

Fixed in 10.1.1

• It is not possible to insert PDF files into MS WordPad.
  

Fixed in 10.1

• It is not possible to insert PDF files into MS Office XP and Office 2007.
• Hosting on a Citrix or Windows Terminal Server (including Acrobat's Protected View).
• The iFilter shell extension used for searching PDFs via Microsoft Desktop Search does not work and is not installed with Reader X. This issue is resolved; however, XP users must install Windows Desktop Search 4 (WDS4) to use this feature.
• Specific JavaScript API usage doesn't work. The JS SaveAs function fails: doc.saveAs() fails due to security restrictions. Protected Mode prevents scripts running inside Reader from writing to locations except for %temp% and the AppData area for Reader X
• Cannot open PDF files whose source is DFS or NFS: PDF files in shared locations on a distributed or networked file system (DFS/NFS) cannot be opened. Attempting to open such a file results in an "Access denied" error.

Unsupported

• In Reader 11, Protected View is only supported when Protected Mode is enabled. There can by no HKCU or HKLM Protected Mode registry preference set to 0 (off) when Protected View is enabled.
• Installing Reader on a mapped network drive.
• Running Reader on WinXP when the OS is installed in a public folder.
• Launching Reader in XP-compatible mode on Vista and Win7.
• Launching Reader by right clicking AcroRd32.exe and choosing Run As.
• Using PKCS#11 smart cards in signature workflows. Some cards can work in the presence of custom protected mode policies. For a workaround, see P 11 smart card workaround.
• Collaborating in real time using the Collaborate Live feature.
• Certain configurations of anti-virus software that have not yet white-listed AcroRd32.exe. See Anti-virus software conflicts below.
• JS-invoked processes: Launching a process through JavaScript is not allowed with Protected Mode enabled.
• See also the sections below.

By default, Adobe Reader X runs in Protected Mode. In certain situations Reader experiences compatibility issues with anti-virus software when that software intercepts some system calls for the Reader sandbox. In these cases, Reader could fail to open or crash after displaying an incompatible-configuration dialog.

For example, Protected Mode is known to be incompatible with:

• Some Symantec Endpoint Protection configurations. Adobe recommends that users update to Symantec Endpoint Protection 11.0 RU6 MP2 or higher.
• McAfee VirusScan Enterprise for certain actions in Reader. Known actions include the following:
  • Clicking Help or a Weblink from an embedded Flash widget such as a Portfolio navigator (Fixed 10.1).
  • Launching of some IME tools. Note: Disabling Buffer Overflow Protection can provide a workaround for many McAfee users. 
  • Reader sometimes removes a user's cached credentials when signing out of Adobe.com which could be an issue for a multiuser machine. Fixed 10.1.2 with MVE 8.8.

Adobe is working with anti-virus companies to resolve these problems.

For XP only: Accessibility features sometimes doesn't work. The Read Out Loud feature is unsupported. Therefore, screen readers such as JAWS, Windows Eyes, and Windows Narrator aren't always able to read PDF content. Much of the Accessibility menus involving things like quick check, change Reading options are removed. Keyboard navigation is not implemented.

Note: When a screen reader like JAWS, Window-Eyes, or Narrator is running when Reader is started for the first time on XP, Protected Mode is disabled. On Vista and Windows 7, screen readers do work normally.

The installation of some smart cards doesn't work for Reader X users when in Protected Mode. Because Protected Mode sandboxes certain processes that make system calls, smart card installation can fail or result in the "unsupported configuration" dialog appearing. However, a simple workaround is available. Install the smart card software with Protected Mode turned off as follows: