With a newly installed terminal RDS farm, the users began to complain that when they were trying to open any PDF file from the desktop (the local drive) using Adobe Reader 11, the following error appeared: “There was an error opening this document. Access denied.” At the same time, this document could be opened from the network share without any problems. (This was completely strange, since the network share is secure source, a priori.)
The problem was that starting with Adobe Reader 10, the Protected Mode is enabled by default, to prohibit users from opening unauthorized PDF files, thus protecting a user computer from potentially malicious PDF documents.
If you trust the sources of files, install security updates in time and keep your antivirus databases up-to-date, the Protected Mode can be disabled. It can be disabled individually for the specific user by unchecking Enable Protected Mode at startup option in Adobe Reader interface Edit → Preferences → Security (Enhanced).
You can disable the Protected Mode in the registry as well.
For the specific user: create a new parameter with the name bProtectedMode and value 0 in the following registry branch: HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\Privileged.
You can create a new registry entry using PowerShell. The command is as follows:
New-ItemProperty -Path "HKCU:\SOFTWARE\Adobe\Acrobat Reader\11.0\Privileged" –Name "bProtectedMode" -Value 0 -PropertyType "DWord"
For all users of a computer: create a DWORD parameter with the name bProtectedMode and the value 0 in the branch: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown.
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown" –Name "bProtectedMode" -Value 0 -PropertyType "DWord"
These registry keys can be distributed to the domain computers using group policies (GPP). To do it, create a new GPO, assign it to user computers and in the Computer Configuration -> Preferences ->Windows Settings -> Registry section create the following keys:
for x64:
Keypath: HKLM\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown
Value name: bProtectedMode
Value type: REG_DWORD
Value data: 0
for x86:
Keypath: HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown
Value name: bProtectedMode
Value type: REG_DWORD
Value data: 0
After you have made the changes to the registry, restart Adobe Reader.