Acrobat Fill & Sign “can’t delete signatures” — Field Notes

*See ticket 3964

Symptom

• Fill & Sign shows old signature/initials.
• The “X/–” delete button does nothing.

Root cause (practical)

• Two separate stores:
  1. Digital ID/certificates (Windows/Mac keystores)
  2. Fill & Sign cache files in user profile
• The UI delete often fails; manual file cleanup works reliably.

Fast fix (Windows)

1. Close Acrobat/Reader.
2. Delete Fill & Sign cache files:
   • %AppData%\Adobe\Acrobat\DC\Security\acrobat_fss_signature*
   • (Keep everything else; you’re only targeting files that start with acrobat_fss_signature)
3. Reopen Acrobat; re-open the doc from “Recent”.

If the “Digital ID” keeps reappearing

• Remove the certificate from Windows:
  • certmgr.msc → Personal → Certificates → delete the matching self-issued ID.
• Then repeat the cache cleanup above.

Known pitfalls

• Running as SYSTEM (RMM) makes $env:USERPROFILE/Desktop paths empty for the signed-in user; write to the real user Desktop (often OneDrive).
• OneDrive Desktop redirection: path like C:\Users\XXX\OneDrive - XXX\Desktop.
• Reader vs Pro paths differ. Use if exist guards in scripts.
• Some orgs have multiple Acrobat profiles (e.g., DC vs 2020); the “DC” folder name is the common case.

---

Batch cleanup script (drops into .bat)

This kills Acrobat/Reader, deletes the Fill & Sign cache, and restarts Acrobat/Reader if present.

@echo off
echo Closing Adobe Acrobat...
taskkill /IM "Acrobat.exe" /F >nul 2>&1
taskkill /IM "AcroRd32.exe" /F >nul 2>&1

echo Deleting cached signature and initials files...
set "sigpath=%APPDATA%\Adobe\Acrobat\DC\Security"
if exist "%sigpath%\acrobat_fss_signature*" del /Q "%sigpath%\acrobat_fss_signature*"

echo Restarting Adobe Acrobat (if installed)...
if exist "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" start "" "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
if exist "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" start "" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"

echo "Done. Old Fill & Sign signatures/initials have been cleared."
pause

One-liner to create the .bat on a known Desktop (PowerShell)

Adjust the path for the user:

$bat = @'
@echo off
taskkill /IM "Acrobat.exe" /F >nul 2>&1
taskkill /IM "AcroRd32.exe" /F >nul 2>&1
set "sigpath=%APPDATA%\Adobe\Acrobat\DC\Security"
if exist "%sigpath%\acrobat_fss_signature*" del /Q "%sigpath%\acrobat_fss_signature*"
if exist "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" start "" "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
if exist "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" start "" "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
echo "Done. Old Fill & Sign signatures/initials have been cleared."
pause
'@
$path = 'C:\Users\XXX\OneDrive - XXX\Desktop\Clear_Adobe_Signatures.bat'
$bat | Set-Content -Path $path -Encoding ASCII

Pure PowerShell cleanup (silent, no .bat left behind)

Handy for RMM push:

# Kill Acrobat/Reader
Get-Process Acrobat, AcroRd32 -ErrorAction SilentlyContinue | Stop-Process -Force

# Delete Fill & Sign cache files
$sec = Join-Path $env:APPDATA 'Adobe\Acrobat\DC\Security'
if (Test-Path $sec) {
  Get-ChildItem $sec -Filter 'acrobat_fss_signature*' -ErrorAction SilentlyContinue | Remove-Item -Force -ErrorAction SilentlyContinue
}

# Relaunch if present (optional)
$pro   = 'C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe'
$read  = 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe'
if (Test-Path $pro)  { Start-Process $pro }
elseif (Test-Path $read) { Start-Process $read }

Verification

• Acrobat → Tools → Fill & Sign: should show empty “Add signature / Add initials”.
• Preferences → Signatures → Identities & Trusted Certificates → More…: no unwanted Digital ID listed.
• If still present: confirm you cleaned the right user profile and that Acrobat was closed during deletion.

If escalation is needed

• Schedule a long block with the device present and call Adobe Support.
• Final resort: wipe/reload Windows (no guarantee; only consider after backup and user approval).