Vat of Knowledge

Here is an example of one way to push out Adobe Reader 9.1.1 across your network.

To begin, you’re going to need a couple of downloads:

Adobe Customization Wizard 9 (click to download direct)

Adobe Reader 9.1.0 minus Adobe Air (click to download direct)

Adobe Reader 9.1.1 Update (click to download direct)

Extract the MSI

Install the Customization Wizard for later steps. Now open a command line, traverse the file system to the folder you saved your AdbeRdr910_en_US.exe to, and type in:

AdbeRdr910_en_US.exe -nos_o./InstallFiles -nos_ne

This will create the folder InstallFiles from the directory you saved the executable in, and extract the contents there. This will generate a file, AcroRead.msi. This MSI file still needs to be administratively extracted to your network install point:

msiexec /a <path to msi from above> /t:<desired network location>

Now we want to apply the update:

msiexec /p <path to msp> /a <desired network location, same as above>

In order to work with the Customization Wizard in the next step, we need a setup.ini file in the network location, so you can create one from scratch, or copy the one that ended up in InstallFiles to the network location.

Modify the MSI

From here, you can customize the .msi file to automatically accept the EULA, silently install, as well as other options. This will create a silent installation that will uninstall any previous version of Adobe Reader as well. Open Adobe Customization Wizard 9 and open the AcroRead.msi file from the InstallFiles folder.

Make changes under “Default viewer…” and “Run Installation”:

Scroll through to the “EULA and Document Status” and auto accept the EULA:

Next, go down to the Direct Editor and make the changes that appear in the list following this image:

- In the Component table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
- In the Feature table, drop any row containing ‘AUM’ or ‘Updater’
- In the FeatureComponents table, drop any row containing ‘AUM’ or ‘Updater’
- In the File table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
- In the ModuleComponents table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
- In the MsiFileHash table, drop any row containing ‘AdobeUpdater’
- In the Registry table, drop any row containing ‘Adobe_Updater’
- In the Registry table, drop the row containing ‘Registry838′
- In the Shortcut table, drop the row containing ‘SC_READER_DT’

Save the new MSI file now. Now you have a silent installer that will remove previous versions of Adobe and install 9.1.0. Copy the resulting files that are in “InstallFiles” up to a network location that all systems have read access to, and copy the AdbeRdrUpd911_all_incr.msp file from the updater you installed to this directory as well.

Script

Let’s write a script that will first check for the existence of 9.1.0 if it’s already installed, then silently install this rebuilt MSI package. This script will also install 9.1.1 if any other previous version is installed.

:: Script to install/upgrade to Adobe Reader 9.1.1
:: Created 05/22/2009
:: By Jason Knight
:: Please contact the IT department if you have
:: any trouble with this script

If exist %systemdrive%\adobe_911.txt (
Goto eof
) else (
goto install
)

:install
msiexec /uninstall {AC76BA86-7AD7-1033-7B44-A91000000001} reboot=suppress /quiet
msiexec /i “<network path\acroread.msi>” TRANSFORMS=”<network path\acroread.mst>” /qn
echo %date% > %systemdrive%\adobe_911.txt
Goto eof

:eof

Group Policy

Easiest to utilize group policy to push this update out. Remote desktop to a server, or if you have the tools installed locally on your workstation, launch gpmc.msc. You will want to create a new policy and link it to at least your Computers OU. I run it against my entire domain so that all machines get it, since I want it installed on all my servers and all machines. You can pick your own level of granularity. Edit the policy and create a new logon script:

When you double click on Logon, you will be prompted as to the location of your adobe.bat file we created earlier. You need to determine where to place this script by clicking Browse…

As you can see, it puts it under a unique GUID. Click start… run… and type in file:///C|/domain.com (where domain is your local domain). Open up SYSVOL/domain.com/Policies and locate the GUID that this GPO is using, then User, Scripts, Logon and place the script there. Then add it to the GPO. As long as the workstation is recieving group policy correctly, the script will run. You can test this out on a virtual machine. Grab a snapshot before you implement to make sure the script is doing what it is supposed to.

PSExec

You can use psexec to push this installation out via script as well. Copy the above mentioned adobe.bat script file somewhere on your local computer and use psexec like:

psexec.exe \\* -u “DOMAIN\username” -p “yourpassword” -i -c -d “C:\Users\username\Desktop\adobe.bat” /passive

This will enumerate your domain and run the psexec command against all active machines.

Acknowledgements

Thanks to these websites and blogs for help in putting this all together:

Vulnerability Note VU#970180

http://www.kb.cert.org/vuls/id/970180

Adobe Forums thread

http://forums.adobe.com/message/1990217#1990217

Other sites

http://blog.stealthpuppy.com/deployment/deploying-adobe-reader-9-for-windows

http://www.appdeploy.com/packages/detail_pf.asp?id=1328

http://www.msfn.org/board/index.php?showtopic=113643

Share/Bookmark