•
0
: Disables the feature.
•
1
: Enables the feature.
3.3.6 Verifying the current mode
There are two ways to verify if the application is running in Protected Mode:
• Open the process explorer or task manager. When protected mode is on, two reader processes run.
• When a file is open, choose
File > Properties > Advanced tab
and view the Protected Mode
status. When Protected Mode is enabled, the status will be
Protected mode: On
.
3.3.7 Policy configuration
Protected mode prevents a number of actions which IT can bypass by creating a white list of allowed
actions. The component that reads these policies is called a "broker." The broker performs actions based
on those policies, and when an admin provides a properly configured policy file, the broker can bypass the
application's default restrictions.
The broker first reads and applies all custom policies prior to applying the default policies. Since custom
policies take precedence, they are useful for fixing broken workflows, supporting third party plug-ins, and
cases where unsupported machine configurations cause the Protected Mode to impair required
functionality.
Configurable policies have two requirements:
• They must reside in the Reader install directory adjacent to AcroRd32.exe in the install folder. for
example:
D:\Program Files (x86)\Adobe\Reader 10.0\Reader\
• The name of the policy file must be
ProtectedModeWhitelistConfig.txt
.
3.3.7.1 Enabling custom policies
To allow the application to read and use a policy file, registry configuration is required. To enable policy
files:
1. Go to HKEY_LOCAL_MACHINESOFTWAREPoliciesAdobeAcrobat Reader10.0FeatureLockDown.
2. Right click and choose
New > DWORD Value
.
3. Create
bUseWhitelistConfigFile
.
4. Right click on
bUseWhitelistConfigFile
and choose
Modify
.
5. Set the value to 1 to enable the white list.
3.3.7.2 Creating policies
Once you've enabled policies as described in
`inserttitleEnabling custom policies`_
, you can write and
deploy a policy file. A policy file is a set of policy-rules. There can be one per line, empty lines, or full-line
comments that begin with a semi-colon. Each policy rule (one on each line) has the format:
POLICY_RULE_TYPE
=
pattern string
Pattern strings denote file names, registry locations, exe paths, etc. These strings support the following:
•
*
: Matches zero or more characters. Only one in series allowed. For example:
• FILES_ALLOW_ANY = c:temp
• REG_ALLOW_ANY = HKEY_CURRENT_USERSoftware(SomeProgram)
• SECTION_ALLOW_ANY = imejp
Section 3 Protected Mode
Application Security Guide
Page 12
Section 3 Protected Mode
