Knowledgebase

Symptoms

You may find that PDF attachments no longer open from Microsoft Outlook when PDF-XChange Editor is set as the default PDF viewer.

Common symptoms include:

• Double-clicking a PDF attachment in Outlook has no effect.
• Outlook displays a message indicating that Windows security has blocked the action.
• Microsoft Defender prevents PDF-XChange Editor from launching.
• The issue occurs even though PDF-XChange Editor opens PDF files normally outside Outlook.

This issue has been reported in both New Outlook and Classic Outlook environments, and applies only to PDF-XChange Editor V11.

Cause

In some managed Windows environments, Microsoft Defender Attack Surface Reduction (ASR) rules may prevent Outlook from launching PDF-XChange Editor to open attachments.

Specifically, the Defender ASR rule ”Block Office communication application from creating child processes" may block Outlook from starting PXCEditor.exe when a user attempts to open a PDF attachment.

This behavior originates from Microsoft Defender rather than PDF-XChange Editor.

Resolution

If your computer is managed by your organisation, you may need assistance from your IT administrator to implement the workaround below.

For IT Administrators

Configure an exclusion for PDF-XChange Editor within Microsoft Defender's Attack Surface Reduction settings.

The exclusion should specify the full path to the PDF-XChange Editor executable:

C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe

Note that this fix will only work in V11 and later, as the path to the .exe was changed in that version.

Microsoft Intune / Endpoint Manager

1. Open Microsoft Intune Admin Center.

2. Navigate to:

   Endpoint security
   → Attack surface reduction
   → ASR rules
   → Exclusions

3. Add the full path to the PDF-XChange Editor executable:

   C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe

4. Save and deploy the updated policy.

Note that this fix will only work in V11 and later, as the path to the .exe was changed in that version.

Group Policy

1. Open the Group Policy Editor.

2. Navigate to:

   Computer Configuration
   → Administrative Templates
   → Windows Components
   → Microsoft Defender Antivirus
   → Attack Surface Reduction

3. Open the policy “Apply a list of exclusions to specific attack surface reduction (ASR) rules”.

4. Configure an exclusion for:

   Rule ID:
   26190899-1602-49e8-8b27-eb1d0a1ce869
   File:
   C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe

Note that this fix will only work in V11 and later, as the path to the .exe was changed in that version.

Related ASR Rule

The exclusion is associated with the Defender ASR rule “Block Office communication application from creating child processes”.

Rule ID:

26190899-1602-49e8-8b27-eb1d0a1ce869

Please note that PDF-XChange cannot modify Microsoft Defender policies on users' behalf. If the workaround above does not resolve the issue, we recommend contacting your IT department or Microsoft support for further assistance.

Additionally, please note that some users have reported that, after updating to V11.0.1, existing desktop and Start Menu shortcuts stopped working and had to be recreated manually. This appears to be related to changes in the installation path used by the updated applications.

Users who have enabled Windows Security's “Controlled Folder Access” feature may find that PDF-XChange applications can no longer save files to protected folders (such as Documents) after the update. Because Controlled Folder Access whitelists applications by their executable path, any path changes introduced by the update may invalidate existing exceptions. If this occurs, re-authorize the current PDF-XChange executable in Windows Security > Virus & threat protection > Ransomware protection > Controlled folder access > Allow an app through Controlled folder access. 

If you experience issues saving files following the update, we recommend checking your Controlled Folder Access settings and updating any existing PDF-XChange exceptions as necessary.

System Administrator Option

Admins can add an exception to the local device by running this powershell command:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions “C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe”

This is is a special flag for MS Office products, separate from the normal Windows Defender control options, and works for many applications that experience these issues.