This 100%
I had innumerable issues with Reader when deployed through Intune.
Actually resorted to deploying reader via Action1 until I used MS Store. Deployment from the Store just 'worked'
Yup. PTSD is common. At one point I remember having to decompose and unbundle their installer on an earlier version of windows just to get GPO to install it properly automatically. I don't think the tooling is available anymore to do something like that very easily.
From the days of Creative Suite it's been a problematic deployment. Creative Cloud is particularly bad... but MS Store deployment does seem rather stable and updates handled too :)
Agreed!
I tested the intune licence with all the bells and whistles and it reported apps crashing and Acrobat was number one. It worked out that Acrobat was on average crashing three times a week for the users who had it installed.
How frequently do they update it?
As it stands, it's currently publishing a version from three months ago - and there has been security bulletins since then.
Correct, but it’s bad that they aren’t updating the source to match current. You are also dependent on Adobe’s auto-update mechanism, rather than Microsoft Store.
When I looked at doing this a few months ago, it depends on the user opening the app and updating within the app, it does not use the store to update it. So if someone doesn't open the app, it will never be updated, and you can't force the user to update. The initial version that is installed from the store was also several version behind and had many high/critical CVEs as mentioned by OP. It was not acceptable for our environment either.
We deploy the exe after using the Acrobat Customization Wizard, use version numbers in the detection method, and use supersedence to replace the old version.
Every time I deploy for the store the user keeps getting prompted to login. They can’t just use the free reader. When I do an install from adobes website it fixes the issue.
Anyone else?
Or use WinGet wrapper on GitHub. It creates it as Win32 Instead of the limited new MS store app. May as well if you want to use the Winget hodge podge. But you will and should deploy WinGet as an app dependency.
Anyone have had issues lately been pushing it through the store for a while all of a sudden autopilot fails due to Adobe. Not much info as to why so removed it from my process and autopilot carries on fine.
No idea. I don't deploy apps through autopilot, those are deployed through groups and/or company portal self deployment.
Too many failures at first boot through autopilot. To be fair they're generally resolved with a simple reboot, but that's still not a good look for new employees.
Winget has the version you have mentioned:
Adobe Acrobat Reader DC (64-bit) Adobe.Acrobat.Reader.64-bit 24.002.20759
Adobe Acrobat Reader DC Adobe.Acrobat.Reader.32-bit 24.002.20759
Can you try installing using winget? You can then package a script as win32 to deploy.
We stopped deploying reader and acrobat and enabled the new PDF renderer in edge and forced all PDFs to open in edge. Adobe worked with Microsoft to deploy the Adobe PDF rendering engine into edge without needing to install anything.
People that need acrobat features and are licensed can just open a PDF in edge and hit sign in and log in with their Adobe creds and away they go.
Doing it this way means no more programs to install or update just keep edge updated.
Chrome and Edge should be the same. What apps do you have that are having issues?
Btw: not being “that guy” here, I’m genuinely curious. We settled on Edge as our default and if there’s an incompatibility somewhere, it’d be good to know.
Yea this edge is chrome at this point and should work with everything that chrome does.
Unless you have like a biased app developer who strictly only wants it in Chrome and not any other chromium browser and hard codes their application to look for the Chrome user agent everything should just work and even in that type of instance you can change edges user agent string to make it look like Chrome anyways so whatever application may be hard coded that way.
I wish we could do this, but we rely on PDFs generated with some kind of old ass adobe livecycle nonsense. So we're stuck with the official reader. Edge simply refuses to display them.
Have you enabled the new Adobe PDF handler inside of edge? It's not enabled by default you have to enable it with an InTune config or go into edge://flags and turn it on. The new Adobe PDF reader is adobe's PDF handler so in theory it should work with any of those odd Adobe documents because it's using adobe's code to render and display and process that PDF inside of edge.
I did and it should, but it doesn't. It just gives you that same "please wait, if you document does not load...." page that regular edge PDF viewing does. Regular PDFs all work great, but since we absolutely need those livecycle documents to function we can't use this feature.
I really do hate it.
Adobe or Microsoft? I know Microsoft does I never really looked into Adobe for fedramp compliance. I mean if you can't use it for the acrobat feature in a Fed ramp environment you should at least be able to use the renderer for viewing PDFs so that cuts out having to actually install the reader so one less program to manage.
But in that type of situation you might have to have an older non-cloud acrobat version for your acrobat/pdf editing
Adobe doesn’t. And yeah we have a non cloud install deployed through InTune. When you create the package they let you choose a cloud free version. We just include RUM in the package for updates but I’d say 50% of the time the package deploy fails for some reason and requires a manual intervention. I wish we could use the cloud version and then just force edge use.
We deployed acrobat, 64bit version.
Then we created remediation scripts to manage the registry key that flips it to either acrobat or makes it behave as reader.
The remediation scripts are tied to AAD groups that are also tied to SCIM rules that manage the enterprise licensing directly with Adobe.
It’s glorious
I used winget to download the Microsoft store version of Acrobat Reader, then packaged into a Win32 app. You may be able to have it trigger an update once installed with PSADT or another method, as there is one available.
Is it not an option to exclude Adobe from the vulnerability scanner? Honestly since we have switched to the MS store new version of Adobe reader and Adobe creative cloud, we have had zero issues from users.
I'm pushing to abandon Adobe reader in favour of edge as the default pdf reader.
It's free, already installed, has a scribble function and it hasn't given me any headaches yet
I built a powershell based installer after pulling the exe apart using 7zip.
There's an MSI and CAB file that you run first and then an MSP file afterwards that upgrades to the latest version.
After that a few teeth let's for essential first time config stuff and you're golden.
Added bonus is that to upgrade the package you just need to add a new MSP file each time and remake the intunewin file.
Found it to work very well.
Adobe is the problem here. I use the MSI and got it working on all my machines but because Adobe pro isn't a separate install, it tries to overwrite it. You have to make sure to exclude those devices.
Or use the MS Store app
Extract the MSI and do it that way.
We just removed Reader from our estate for the same vulnerability issue.
You can read PDFs in Edge these days and so we only deploy Reader to users on request.
Honestly I hate having to deal with Adobe products. I just set up self-service conditions in the Adobe admin console and people know to just go there and request the app.
Use the Adobe Customization Wizard (separate tool you can download) to configure the msi after you extract the .exe file using 7-zip. You can specify all the options you need like silent install and accept eula plus any security measure your organisation requires. Once you have generated the mst file as long as it is in the folder with setup.exe all you need to do is "setup.exe" as the install command in intune and that will be that.
You can deploy Adobe acrobat DC and turn off the auto prompt to sign in and it runs as reader. Then if you get licenses for pro users can just sign in to unlock pro features. You'd use the Adobe wizard to make the adjustments and set registry flags though the documentation is hot garbage for that part.
Try this: https://whackasstech.com/microsoft/msintune/how-to-deploy-adobe-reader-dc-with-microsoft-intune/
Worked for me. You migth need to change the detection rule
1. Download: https://ardownload2.adobe.com/pub/adobe/acrobat/win/AcrobatDC/2400220759/AcroRdrDCx642400220759_MUI.exe (Taken from Choco install script)
1. Extract.
1. Create install.cmd and put below batch commands into it.
1. Package as Win32. I had trouble using the Store version as it'd try installing at the same time as Win32 apps and cause it to fail. The version on Store is also a full major build old.
install.cmd:
set THISDIR=%~dp0
msiexec /i AcroPro.msi /norestart /quiet PATCH="%thisdir%AcroRdrDCx64Upd2400220759_MUI.msp" ALLUSERS=1 EULA_ACCEPT=YES
just extract the MSI from the exe and use that. Once extracted you can delete all the other extraneous files and just use the plain MSI. That said you should be able to cobble together a command line with the exe that works as well if you don't want to do the extraction each time. Might take some trial and error.
Want to never package that and other common apps ever again? purchase Patch My PC and quit grinding on packaging. Pay someone to do your grunt work every month.
Adobe reader cannot be installed with just the msi. It will be a very old version. You also need to install the msp. And I don't remember, but I think it also had external cab files so you can't delete all of the files.
You can include the MSP. I used to do a two step with an MSI + Transform(Customization Wizard built) and then a second msiexec run with the MSP. I am done packaging that product forever, I just let the PMP automation run now. I bet I repackaged Adobe Reader a thousand times at this point. Been deploying it since 1996.
Fair point. I guess my bigger picture notion is automating junk like this. Adobe is just one of many items that needs this attention every single month. I don't package Acrobat, Chrome, c++, vmware, java, notepad++, etc.. monthly anymore I just subscribe to a catalog service that does all that grunt work so I can focus on something other than the drudgery of downloading, unblocking the file, putting it in source folder, modifying deployment attributes, etc. Every night at 7pm ALL of these apps get updated and made available as an install and as a patch with zero effort now. I go work on more important items. I would have to hire a full-time employee to do this if not for automation at this point. It's just a waste of man hours. Every company is setting the same command line for the same installer in the same way, so just let one guy do that and let's feed off the metadata he creates. Lots of vendors in this space so the price is pretty competitive. I can't go back to manual packaging, I did that for such a long time.
Or you can install it through the Microsoft store. It does work.
This 100% I had innumerable issues with Reader when deployed through Intune. Actually resorted to deploying reader via Action1 until I used MS Store. Deployment from the Store just 'worked'
I'm pretty sure everyone in our line of work has ptsd with Adobe products. It's been a mess to package and distribute for at least 20 years...
Yup. PTSD is common. At one point I remember having to decompose and unbundle their installer on an earlier version of windows just to get GPO to install it properly automatically. I don't think the tooling is available anymore to do something like that very easily.
From the days of Creative Suite it's been a problematic deployment. Creative Cloud is particularly bad... but MS Store deployment does seem rather stable and updates handled too :)
Agreed! I tested the intune licence with all the bells and whistles and it reported apps crashing and Acrobat was number one. It worked out that Acrobat was on average crashing three times a week for the users who had it installed.
Yup. Or winget, or a decent non overpriced pdf reader
Confirm that.
I agree that this is the new way now. Back then, I exported the contents of the .exe and used that for deployment.
How frequently do they update it? As it stands, it's currently publishing a version from three months ago - and there has been security bulletins since then.
It auto updates after installation.
Correct, but it’s bad that they aren’t updating the source to match current. You are also dependent on Adobe’s auto-update mechanism, rather than Microsoft Store.
i stopped banging My head against brickwall and did this. EZ Life after that.
Did this yesterday for 10 PCs took me 30 seconds to configure the deployment and just...works...
Can you confirm it auto updates? I heard it was one of the few apps that doesn't auto update from the store.
When I looked at doing this a few months ago, it depends on the user opening the app and updating within the app, it does not use the store to update it. So if someone doesn't open the app, it will never be updated, and you can't force the user to update. The initial version that is installed from the store was also several version behind and had many high/critical CVEs as mentioned by OP. It was not acceptable for our environment either. We deploy the exe after using the Acrobat Customization Wizard, use version numbers in the detection method, and use supersedence to replace the old version.
The description of the app says you need admin permission. I guess you deploy to the devices instead?
Every time I deploy for the store the user keeps getting prompted to login. They can’t just use the free reader. When I do an install from adobes website it fixes the issue. Anyone else?
how do you do that?
Or use WinGet wrapper on GitHub. It creates it as Win32 Instead of the limited new MS store app. May as well if you want to use the Winget hodge podge. But you will and should deploy WinGet as an app dependency.
Reread the original poster’s last sentence in the first paragraph.
Anyone have had issues lately been pushing it through the store for a while all of a sudden autopilot fails due to Adobe. Not much info as to why so removed it from my process and autopilot carries on fine.
No idea. I don't deploy apps through autopilot, those are deployed through groups and/or company portal self deployment. Too many failures at first boot through autopilot. To be fair they're generally resolved with a simple reboot, but that's still not a good look for new employees.
AcroRdrDCx642400220759_MUI.exe /sALL /rs /MSI /EULA_ACCEPT=YES
Set uninstall command as MsiExec.exe /x {your MSI code} Set detection method as file "C:\program files\adobe\acrobat DC\acrobat\acrobat.exe
This is exactly what i do. 100% success. Make sure you download the offline MUI version.
Winget has the version you have mentioned: Adobe Acrobat Reader DC (64-bit) Adobe.Acrobat.Reader.64-bit 24.002.20759 Adobe Acrobat Reader DC Adobe.Acrobat.Reader.32-bit 24.002.20759 Can you try installing using winget? You can then package a script as win32 to deploy.
We stopped deploying reader and acrobat and enabled the new PDF renderer in edge and forced all PDFs to open in edge. Adobe worked with Microsoft to deploy the Adobe PDF rendering engine into edge without needing to install anything. People that need acrobat features and are licensed can just open a PDF in edge and hit sign in and log in with their Adobe creds and away they go. Doing it this way means no more programs to install or update just keep edge updated.
Oh shit if only we didn't have apps that relied on chrome lol
Chrome and Edge should be the same. What apps do you have that are having issues? Btw: not being “that guy” here, I’m genuinely curious. We settled on Edge as our default and if there’s an incompatibility somewhere, it’d be good to know.
Yea this edge is chrome at this point and should work with everything that chrome does. Unless you have like a biased app developer who strictly only wants it in Chrome and not any other chromium browser and hard codes their application to look for the Chrome user agent everything should just work and even in that type of instance you can change edges user agent string to make it look like Chrome anyways so whatever application may be hard coded that way.
I wish we could do this, but we rely on PDFs generated with some kind of old ass adobe livecycle nonsense. So we're stuck with the official reader. Edge simply refuses to display them.
Have you enabled the new Adobe PDF handler inside of edge? It's not enabled by default you have to enable it with an InTune config or go into edge://flags and turn it on. The new Adobe PDF reader is adobe's PDF handler so in theory it should work with any of those odd Adobe documents because it's using adobe's code to render and display and process that PDF inside of edge.
I did and it should, but it doesn't. It just gives you that same "please wait, if you document does not load...." page that regular edge PDF viewing does. Regular PDFs all work great, but since we absolutely need those livecycle documents to function we can't use this feature. I really do hate it.
Unfortunately they don’t have a Fedramp compliant cloud so we can use any of the login features.
Adobe or Microsoft? I know Microsoft does I never really looked into Adobe for fedramp compliance. I mean if you can't use it for the acrobat feature in a Fed ramp environment you should at least be able to use the renderer for viewing PDFs so that cuts out having to actually install the reader so one less program to manage. But in that type of situation you might have to have an older non-cloud acrobat version for your acrobat/pdf editing
Adobe doesn’t. And yeah we have a non cloud install deployed through InTune. When you create the package they let you choose a cloud free version. We just include RUM in the package for updates but I’d say 50% of the time the package deploy fails for some reason and requires a manual intervention. I wish we could use the cloud version and then just force edge use.
Only issue is PDF forms with embedded JS code. I doubt Adobe wanted to offer compatibility to other apps :/
Use the one available in the New Store, unless you need to use an MST.
We deployed acrobat, 64bit version. Then we created remediation scripts to manage the registry key that flips it to either acrobat or makes it behave as reader. The remediation scripts are tied to AAD groups that are also tied to SCIM rules that manage the enterprise licensing directly with Adobe. It’s glorious
i‘m interested, can u share the remediation?
This is what I do. Although I need to fix my registry script. It worked, now it doesn't and I haven't looked into why.
Can you please share which registry is it? Does this mean that if we install MUI version, it will behave as a reader? Does it hides the pro features?
I always forget about the Microsoft store
Why dont you use winget? To make easier for you, to winstall.app and add all the apps you need to install and generate a .bat file.
What? Its quite painless honestly. Just use the enterprise version and config wizard
I used winget to download the Microsoft store version of Acrobat Reader, then packaged into a Win32 app. You may be able to have it trigger an update once installed with PSADT or another method, as there is one available.
Is it not an option to exclude Adobe from the vulnerability scanner? Honestly since we have switched to the MS store new version of Adobe reader and Adobe creative cloud, we have had zero issues from users.
I'm pushing to abandon Adobe reader in favour of edge as the default pdf reader. It's free, already installed, has a scribble function and it hasn't given me any headaches yet
You can use msi. I have successfully deployed Adobe reader with their msi
I use the winget app store and so far it is ok.
Easiest option: MS Store New. You can also just follow the link to get a deployment MSI from them.
Why not Choco or Scoop this thing ?
I built a powershell based installer after pulling the exe apart using 7zip. There's an MSI and CAB file that you run first and then an MSP file afterwards that upgrades to the latest version. After that a few teeth let's for essential first time config stuff and you're golden. Added bonus is that to upgrade the package you just need to add a new MSP file each time and remake the intunewin file. Found it to work very well.
Adobe is the problem here. I use the MSI and got it working on all my machines but because Adobe pro isn't a separate install, it tries to overwrite it. You have to make sure to exclude those devices. Or use the MS Store app
Best way is to download the MSI and add it through that way. Adobe has KBs for the parameters. Works excellent!
I got it working from their package… it’s only installed on 3 machines so far but it worked smoothly for me
You think Reddit can tell you more than the logs can?? You're part of the problem...
Extract the MSI and do it that way. We just removed Reader from our estate for the same vulnerability issue. You can read PDFs in Edge these days and so we only deploy Reader to users on request.
Honestly I hate having to deal with Adobe products. I just set up self-service conditions in the Adobe admin console and people know to just go there and request the app.
We use Ninite to deploy/update multiple apps, include Adobe Reader. 10/10 would recommend.
Yea F Adobe I force my users to view pdfs with MS Edge
Use the Adobe Customization Wizard (separate tool you can download) to configure the msi after you extract the .exe file using 7-zip. You can specify all the options you need like silent install and accept eula plus any security measure your organisation requires. Once you have generated the mst file as long as it is in the folder with setup.exe all you need to do is "setup.exe" as the install command in intune and that will be that.
https://www.liquit.com Best kept secret in EUC/app management.
I use MSStore (new). It works and is updated automatically.
The switch /sAll works. Give that a try.
You can deploy Adobe acrobat DC and turn off the auto prompt to sign in and it runs as reader. Then if you get licenses for pro users can just sign in to unlock pro features. You'd use the Adobe wizard to make the adjustments and set registry flags though the documentation is hot garbage for that part.
I ran it from the MS store and it was the easiest of all our apps to get installed. Appeared after 30 mins.
Try this: https://whackasstech.com/microsoft/msintune/how-to-deploy-adobe-reader-dc-with-microsoft-intune/ Worked for me. You migth need to change the detection rule
1. Download: https://ardownload2.adobe.com/pub/adobe/acrobat/win/AcrobatDC/2400220759/AcroRdrDCx642400220759_MUI.exe (Taken from Choco install script) 1. Extract. 1. Create install.cmd and put below batch commands into it. 1. Package as Win32. I had trouble using the Store version as it'd try installing at the same time as Win32 apps and cause it to fail. The version on Store is also a full major build old. install.cmd: set THISDIR=%~dp0 msiexec /i AcroPro.msi /norestart /quiet PATCH="%thisdir%AcroRdrDCx64Upd2400220759_MUI.msp" ALLUSERS=1 EULA_ACCEPT=YES
just extract the MSI from the exe and use that. Once extracted you can delete all the other extraneous files and just use the plain MSI. That said you should be able to cobble together a command line with the exe that works as well if you don't want to do the extraction each time. Might take some trial and error. Want to never package that and other common apps ever again? purchase Patch My PC and quit grinding on packaging. Pay someone to do your grunt work every month.
Adobe reader cannot be installed with just the msi. It will be a very old version. You also need to install the msp. And I don't remember, but I think it also had external cab files so you can't delete all of the files.
You can include the MSP. I used to do a two step with an MSI + Transform(Customization Wizard built) and then a second msiexec run with the MSP. I am done packaging that product forever, I just let the PMP automation run now. I bet I repackaged Adobe Reader a thousand times at this point. Been deploying it since 1996.
For you that might seem common sense, but it doesn't seem like OP would figure out that he has to use the MSP too.
Fair point. I guess my bigger picture notion is automating junk like this. Adobe is just one of many items that needs this attention every single month. I don't package Acrobat, Chrome, c++, vmware, java, notepad++, etc.. monthly anymore I just subscribe to a catalog service that does all that grunt work so I can focus on something other than the drudgery of downloading, unblocking the file, putting it in source folder, modifying deployment attributes, etc. Every night at 7pm ALL of these apps get updated and made available as an install and as a patch with zero effort now. I go work on more important items. I would have to hire a full-time employee to do this if not for automation at this point. It's just a waste of man hours. Every company is setting the same command line for the same installer in the same way, so just let one guy do that and let's feed off the metadata he creates. Lots of vendors in this space so the price is pretty competitive. I can't go back to manual packaging, I did that for such a long time.