🛡️ Essential 8 Guide

PDF application security settings cannot be changed by users.

Summary

PDF security settings are locked using Intune to prevent users from altering protective configurations. This aligns with User application hardening guidance in the Essential Eight and ASD Blueprint, reducing the risk of insecure PDF usage.¹²

Justification

PDF readers — particularly Adobe Acrobat and Reader — have historically been a high-value exploitation target due to their complex file parsing logic, JavaScript engine, and rich media support. Allowing users to modify PDF security settings (e.g., re-enabling JavaScript execution, disabling Protected Mode, or enabling external content) directly increases the attack surface for document-based initial access.

Adobe Reader’s Protected Mode (sandbox) and Protected View confine the parser process, preventing privilege escalation to the desktop even when a malicious PDF exploits a parser vulnerability. If users can disable these settings, the effectiveness of the sandbox is entirely negated.

The ISM-1670 ASR rule (Block Adobe Reader from creating child processes, GUID 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c) provides a complementary OS-level control — but is only effective when combined with this control locking the application’s own security settings, preventing a user from re-enabling child process creation from within the application’s Trust settings.

[!NOTE] For Microsoft Edge as PDF viewer (via built-in PDF engine), edge://settings/content/pdfDocuments settings are enforced via Edge ADMX policy — the Adobe ADMX templates are not required unless Adobe Reader/Acrobat is deployed.

Design Decision

[!NOTE] The PDF security settings will be locked using Intune to prevent users from changing them.

Prerequisites

• Licensing: Microsoft Intune Plan 1 is required for target devices when Intune is used for implementation (typically in Microsoft 365 E3+)¹

• Dependencies: Device must be managed by Intune and enrolled in Entra ID and/or hybrid Azure AD joined¹

Implementation Steps

Lock Adobe Acrobat and Reader security settings using custom ADMX via Intune

Organisations that deploy Adobe Acrobat or Adobe Reader as their primary PDF application can enforce an equivalent set of security controls to those available in the Microsoft Edge PDF viewer, using Adobe’s ADMX Group Policy templates imported into Intune.

Adobe publishes ADMX templates through its Enterprise Toolkit that expose the same registry keys under HKLM\SOFTWARE\Policies\Adobe\...\FeatureLockDown that are otherwise set manually via Group Policy or registry script. Importing these ADMX files into Intune makes the settings configurable through the standard Imported Administrative Templates profile type — providing a consistent, auditable, and UI-driven management experience comparable to Edge policy.³⁴

Edge PDF policy → Adobe Acrobat equivalent mapping:

[!NOTE] Adobe Reader and Acrobat Pro DC use slightly different registry paths. Reader DC uses HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown, while Acrobat Pro DC uses HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown. Both paths are managed by the same ADMX template categories; ensure you download the ADMX matching the installed product.

Step 1 — Download the Adobe Acrobat ADMX template:

1. Go to the Adobe Acrobat Enterprise Toolkit and download the Group Policy ADMX template package.
2. Extract the archive. Locate the files:
   • AcrobatReaderDC.admx (or AcrobatDC.admx for Acrobat Pro)
   • AcrobatReaderDC.adml (English language file, in the en-US subfolder)

[!NOTE] A community-maintained ADMX template (updated for Acrobat DC / Reader DC, based on the original NSA Cybersecurity Directorate template) is also available and covers a broader set of settings including AI features, cloud services, and update controls. Verify the source and review all policy definitions before deploying any community ADMX in a production environment.

Step 2 — Import the ADMX template into Intune:

1. In the Microsoft Intune admin center, navigate to Devices > Manage devices > Configuration > Import ADMX tab.
2. Select Import and upload the .admx file.
3. Select Next and then upload the corresponding .adml language file.
4. Review the import summary and select Create. Allow a few minutes for Intune to process the template.
5. Verify the import succeeded under Devices > Configuration > Import ADMX — the status should show Available.³

Step 3 — Create a policy using the imported Adobe ADMX template:

1. Navigate to Devices > Manage devices > Configuration > + Create policy.
2. Set Platform to Windows 10 and later and Profile type to Imported Administrative Templates (Preview).
3. Select Create, enter a descriptive name (e.g., Adobe Acrobat DC — Security Lockdown), and select Next.
4. Under Configuration settings, locate the Adobe Acrobat category and configure each security setting as shown below.³

Step 4 — Configure each security setting:

Alternative: Direct registry OMA-URI (custom profile):

If ADMX import is not available or a specific setting is not exposed in the ADMX template, you can set the underlying registry values directly using a Custom profile with the following OMA-URI format:

[!IMPORTANT] Replace Acrobat Reader/DC with Adobe Acrobat/DC in all paths above when targeting Acrobat Pro DC instead of Reader DC. Assign the custom profile to the same device groups as your Acrobat deployment. Verify settings have applied using Registry Editor on a test device – all values should appear under HKLM\SOFTWARE\Policies\Adobe\...\FeatureLockDown as DWORD entries.⁴

Lock PDF security settings using Intune Attack Surface Reduction

1. In Intune, navigate to Endpoint Security > Attack Surface Reduction. ¹
2. Create (or modify) a new Attack Surface Reduction Endpoint Security Policy. ¹
3. Set Block Adobe Reader from creating child processes to Enable. ¹
4. Assign the Attack Surface Reduction Rule policy to a group. ¹

Additional related information

• Manage sensitivity labels in Office apps provides guidance on disabling PDF support and applying sensitivity labels to PDFs Manage sensitivity labels in Office apps⁵

• ASD Blueprint: System hardening user apps describes system hardening guidance for Windows endpoints including hardening user applications ASD Blueprint: System hardening user apps⁶

• Import custom ADMX templates in Microsoft Intune explains how to upload third-party ADMX and ADML files into Intune to create Imported Administrative Templates policies for non-Microsoft applications Import custom ADMX templates

• Adobe Acrobat Enterprise Toolkit (Group Policy and Registry Reference) provides the official ADMX templates and full registry key reference for all Acrobat DC and Reader DC FeatureLockDown settings, including Protected Mode, Enhanced Security, and JavaScript controls Adobe Acrobat Enterprise Toolkit

• Microsoft Edge PDF Reader policy reference lists all PDF-specific Edge policies (PDFSecureMode, AlwaysOpenPdfExternally, NewPDFReaderEnabled, PDFXFAEnabled) and their registry paths for enforcing consistent PDF security across the built-in viewer Microsoft Edge PDF Reader policies