MS14-045: Hinweise zum Sicherheitsupdate für Kernelmodustreiber: 27. August 2014
MS14-045: Description of the security update for kernel-mode drivers: August 27, 2014
Problem temporary Fonts file where the API has no permission to change because outside (c:\windows\fonts)
Files with the names Z@*.tmp block the Roaming profile from closing correct after you use Adobe Reader to print a PDF or any other related PDF product. The user is logged on with temporary profile. Extensions used are: .001 / .002 / .003 and so on (As shown in screenshot below).
This is related to all PDF-related products which have a print function and use special fonts in the PDF. With most PDF Software there is a temporary file generated which contains Fonts data when printing. Because of the Patch KB2993651 the software is unable to delete the file afterwards. We have seen this in FREEPDF with GS but also products like Adobe Reader.
Microsoft describes this in their patch bulletin:
Here is how to uninstall the patch silent:
wusa /uninstall /kb:2975331 /quiet /norestart
Solution on a Citrix Server:
- Cleaned up profiles
- Uninstalled KB2993651
- Rebooted server
- Logged in and opened C:\Users\<Username>\Appdata\Local\Temp\<number>\
- Opened a PDF and printed it – watched the Z@*.tmp files be created in temp folder
- Closed Adobe Reader – watched Z@*.tmp files be deleted.
- Logged off – confirmed that the profile was indeed deleted.
On a different server, someone tried installing Adobe Reader 11.0.09 without removing KB2993651 and the issue was still present so .09 did not resolve the issue.