Anyone have experience locking down security settings for Adobe Acrobat?

Posted by PsyduckAF@reddit | sysadmin | View on Reddit | 14 comments

At the moment, all users are able to change security settings in Acrobat. Is there a way to disable this? So users aren't able to go into Acrobat settings and change security settings? I've had a look at the FeatureLockdown config file, but doesn't seem like there's a way to disable security settings.

Reply to Post

14 Comments

[-]

Sensitive_Scar_1800@reddit

Hell yes you can! We use a GPO to lock down adobe reader settings, so easy barely an inconvenience

[-]

PsyduckAF@reddit (OP)

Also, any chance you could point me in the direction of how you achieved this?

[-]

Sensitive_Scar_1800@reddit

You need to: 1.download admx files for the applicable product (e.g. Adobe reader) 2. Add admx files to your GPO policies 3. Review available GPO settings and enable the items you desire Use this link as a guide to set certain settings https://cyber.trackr.live/stig/Adobe_Acrobat_Reader_DC_Continuous_Track_STIG/2/1

[-]

PsyduckAF@reddit (OP)

Ah amazing. Now just to figure out how to do it for our Mac devices.

[-]

rthonpm@reddit

There's no real way to lock down one of the core features of the app. What exactly is the use case for locking the feature out?

[-]

PsyduckAF@reddit (OP)

We're aligning with the Essential 8 cyber framework. One of the criteria is not allowing users to modify PDF software security settings. Why would end users need to be configuring security settings in Acrobat?

[-]

damnawesome@reddit

Use the Adobe Customization Wizard to create an MST that needs to be deployed with the MSI. That being said I did not know this was Essential 8. Damn I'm gonna have to redo ours. Lol

[-]

PsyduckAF@reddit (OP)

Yeah it is unfortunately. E8 is fine as a cyber framework for Windows devices, where we're struggling is the Mac side, as E8 was clearly developed with only Windows in mind. We've got a massively hybrid environment of Windows, Mac, and some Linux.

[-]

damnawesome@reddit

[Lockable Settings (adobe.com)](https://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/FeatureLockDown.html?zoom_highlight=security) These are the only available settings for Adobe. Looking at E8, it's asking that software security settings can't be change. I would suggest most obv settings are Security> Prevent end users from trusting files and folders, Prevent end users from addting trusted hosts. Protected View "Files from Potentially unsafe locations". Prevent the user from Enabling PDF Preview in explorer. File Attachements: Prevent Document from opening other files and launching other applications.

[-]

xxdcmast@reddit

Pretty sure you can do this by gpo. And there is a stig for it. https://www.stigviewer.com/stig/adobe_acrobat_reader_dc_continuous_track/ All the setting may be overkill for your environment but it give an idea on how gov agencies need to have acrobat set.

[-]

PsyduckAF@reddit (OP)

>https://www.stigviewer.com/stig/adobe\_acrobat\_reader\_dc\_continuous\_track/ hey this is great! i never knew this existed. I can't see a relevant config change to disable security settings, but this is still really helpful. thank you

[-]

xxdcmast@reddit

Stig are used by mainly govt agencies that have to follow security standards. There are a lot of stigs available for different os and applications. If it’s a commonly used app there may be a stig you can look up. Some settings may be overkill for your environment but it’s a good way to get a look at the areas of concern you may want to Control.

[-]

PsyduckAF@reddit (OP)

Yeah it's great. I work at a government agency, although not in the US, but we are aiming to align with NIST so this is really helpful. Thanks for that!

[-]

billiarddaddy@reddit

You can import the gpos to test without applying them on a domain.