Carbon Black Cloud: "There is a Problem with Adobe Acrobat/Reader."

[#1]

Environment

• Carbon Black (CB) Cloud Console: All Versions
• Carbon Black (CB) Cloud Sensor: 3.5.0.1523 and Higher
• Microsoft Windows: All Supported Versions
• Adobe Acrobat/Adobe Reader

Symptoms

With sensor installed Adobe Acrobat is getting the error

There is a problem with Adobe Acrobat/Reader.
If it is running, please exit and try again. (523:523)

Cause

Coding defect by Adobe

Resolution

Update Acrobat to the November 2020 release or later

Additional Notes

If unable to upgrade, the following temporary workarounds have worked for some of our customers:

1. Disabling "Enable Protected Mode at startup" within Adobe Acrobat has been seen to prevent this issue. See Adobe's KB

Or

1. Add a bypass rule for C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

   Applications at path: *:\**\AcroRd32.exe
   Operation Attempt: Performs any API operation
   Action: Bypass
   

PLEASE NOTE: Bypassing AcroRd32.exe creates a high security risk and should only be implemented as a temporary/last-resort workaround
 

Should the issue continue after upgrading Adobe Reader and implementing the workarounds above, please contact Adobe prior contacting Carbon Black support

Related Content

Acrobat-Reader DC Enterprise Toolkit
Protected Mode troubleshooting | Adobe Reader
Carbon Black Cloud: How to Collect Process Monitor Logs When Issue Occurs (Windows)
Carbon Black Cloud: How to Collect ProcMons and ProcDumps on 3.4 and Higher Sensor
Endpoint Standard: How to Create Policy Blocking & Isolation and Permissions Exclusions