The D-Spot (The Deployment Spot)

The populair PDF reader and writer from Adobe are often plagued by critical vulnerabilities. Therefore updating and patching Adobe Reader and Adobe Acrobat applications is highly necessary.

Here is how to slipstream the Reader 9.3.3 patch into the 9.3 source, suppress the automatic updates, and acrobat.com online services.

First step: get the sources.

Download sources

Adobe Reader 9.3: AdbeRdr930_en_US.msi

Adobe Reader 9.3.2 Patch: AdbeRdrUpd932_all_incr.msp

Adobe Reader 9.3.3 Patch: AdbeRdrUpd933_all_incr.msp

Adobe Customization Wizard 9: CustWiz90_en_US.exe

Because the upgrade path is 9.3 > 9.3.2 > 9.3.3, we also need the 9.3.2 patch file.

In the second step we need to create a network installation point (administrative installation point). I use C:\temp\reader933\adminpoint, you can choose your own.

Perform an administrative installation

1. Copy the sources to a directory of your choose, for example:
   

   C:\temp\reader933\sources

2. Create a distribution point folder (a folder where the installer can install the uncompressed program files)
   

   C:\temp\reader933\adminpoint

3. Open a command prompt and execute this command:
   

   Msiexec /a <path of AdbeRdr930_en_US.msi>

   With the /a parameter, you’re extracting the MSI to the administrative installation point (folder).

   

   When asked, point to the administrative installation point created in step 2 and hit Install.

   

   

   Admin point has been created:

   

   The 9.3 source files are extracted, now we will slipstream the 9.3.2 and 9.3.3 patches.

4. Apply the 9.3.2 patch:
   

   msiexec /a <path of msi at distribution point> /p <path of Reader 9.3.2.msp>

   for example in my situation:

   msiexec /a "C:\Temp\reader933\adminpoint933\AdbeRdr930_en_US.msi" /p "C:\Temp\adobereader\sources\AdbeRdrUpd932_all_incr.msp"

   

   

   

   

5. Then apply the 9.3.3 path:
   

   msiexec /a "C:\Temp\reader933\adminpoint933\AdbeRdr930_en_US.msi" /p "C:\Temp\adobereader\sources\AdbeRdrUpd933_all_incr.msp"

   

   

   

   

   Last step is to create a transform file. Here you can disable automatic updates and apply custom settings.

Create a transform file (.mst) using the Adobe Customization Wizard:

Run Adobe’s Customization Wizard and open the extracted MSI (leave other files in place). Then change the settings to suit your needs, use the screenshots as an example (this are our adaptations).

Create new key: AVGeneral (in HKCU\Software\Adobe\Acrobat Reader\9.0)

DWORD: bCheckForUpdatesAtStartup

Value: 0

Create new DWORD: OptIn (in HKCU\Software\Adobe\CommonFiles\Usage\Reader 9)

Value: 0

Before saving the package, create an empty setup.ini file in the root of your admin point. If you don’t create this file the Customization Wizard will throw the error: “Setup.ini not found”. (thanks Terry for letting me know)

Save the package, and you’re done.

Add sites to the Trust Manager

We needed to add some sites to the Trust Manager, this step isn’t necessary in the deployment process. We added this IP ranges to the Trust Manager:

172.33.*

172.75.*

Use this .reg file to deploy via scripting:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\9.0\TrustManager]

[HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\9.0\TrustManager\cDefaultLaunchURLPerms]

"tHostPerms"="version:2|172.33.*:2|172.75.*:2"

Import via Customization Wizard should also work, although I didn’t tested the import feature. If somesome has experience with importing these settings, please share and make a comment!

Deployment:

I use this command line to deploy my slipstreamed Adobe Reader via ConfigManager 2007:

msiexec /i "path\AdbeRdr930_en_US.msi" TRANSFORMS="path\tranformfile.mst" /qb REBOOT=ReallySuppress /log "path\reader933.txt"

Update Sept 2010:

Patch to reader 9.3.4

Here is how to patch the Reader 9.3.3 administrative distribution point with the updated Reader 9.3.4 version.

First get the Adobe Reader 9.3.4 sources file from Adobe’s website. Then apply the 9.3.4 (.msp) patch to the previous created distribution point:

msiexec /a <path of msi at the distribution point> /p <path of downloaded patch>

for example in my situation:

msiexec /a “C:\Temp\reader933\adminpoint933\AdbeRdr930_en_US.msi” /p “C:\Temp\adobereader\sources\AdbeRdrUpd934_all_incr.msp”

It can be confusing, because I named the distribution point “reader933”.

Copy the files from distribution point to your desired location and you’re done!