Knowledgebase

Symptoms

You may find that PDF attachments no longer open from Microsoft Outlook when PDF-XChange Editor is set as the default PDF viewer.

Common symptoms include:

• Double-clicking a PDF attachment in Outlook has no effect.
• Outlook displays a message indicating that Windows security has blocked the action.
• Microsoft Defender prevents PDF-XChange Editor from launching.
• The issue occurs even though PDF-XChange Editor opens PDF files normally outside Outlook.

This issue has been reported in both New Outlook and Classic Outlook environments.

Cause

In some managed Windows environments, Microsoft Defender Attack Surface Reduction (ASR) rules may prevent Outlook from launching PDF-XChange Editor to open attachments.

Specifically, the Defender ASR rule ”Block Office communication application from creating child processes" may block Outlook from starting PXCEditor.exe when a user attempts to open a PDF attachment.

This behavior originates from Microsoft Defender rather than PDF-XChange Editor.

Resolution

If your computer is managed by your organisation, you may need assistance from your IT administrator to implement the workaround below.

For IT Administrators

Configure an exclusion for PDF-XChange Editor within Microsoft Defender's Attack Surface Reduction settings.

The exclusion should specify the full path to the PDF-XChange Editor executable:

C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe

Microsoft Intune / Endpoint Manager

1. Open Microsoft Intune Admin Center.

2. Navigate to:

   Endpoint security
   → Attack surface reduction
   → ASR rules
   → Exclusions

3. Add the full path to the PDF-XChange Editor executable:

   C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe

4. Save and deploy the updated policy.

Group Policy

1. Open the Group Policy Editor.

2. Navigate to:

   Computer Configuration
   → Administrative Templates
   → Windows Components
   → Microsoft Defender Antivirus
   → Attack Surface Reduction

3. Open the policy “Apply a list of exclusions to specific attack surface reduction (ASR) rules”.

4. Configure an exclusion for:

   Rule ID:
   26190899-1602-49e8-8b27-eb1d0a1ce869
   File:
   C:\Program Files\PDF-XChange\PDF Editor\PXCEditor.exe

Related ASR Rule

The exclusion is associated with the Defender ASR rule “Block Office communication application from creating child processes”.

Rule ID:

26190899-1602-49e8-8b27-eb1d0a1ce869

Please note that PDF-XChange cannot modify Microsoft Defender policies on users' behalf. If the workaround above does not resolve the issue, we recommend contacting your IT department or Microsoft support for further assistance.