The D-Spot (The Deployment Spot)

In many cases virtual applications will talk to physical ones. That’s one of the reasons to keep Adobe Reader installed locally.

But we’ve got an issue with the Reader again.

Launching a PDF file from within the bubble gave an Access Denied error (using a physical Adobe Reader 10.1):

There was an error opening the document. Access Denied

This issue exits only when the PDF file is stored on a “personal folder”, like the Desktop-folder for example. (local User NTFS permissions?).

This isn’t an App-V issue but a Reader X feature called Protected Mode that gave this error.

It can be solved with some basic OSD scripting, but the first step is here to stay: “Know your application”. As Reader X gave this error, we can disable this feature with a registry key. Most of the work is to find out what registry key to set. To keep this short, here is my OSD script that disables Adobe Reader Protected Mode when opening Reader from within a App-V application:

<REGISTRY>
<REGKEY HIVE=”HKCU” KEY=”SOFTWARE\Adobe\Acrobat Reader\10.0\Privileged” NOREDIR=”FALSE”>
<REGVALUE REGTYPE=”REG_DWORD” NAME=”bProtectedMode”>00000000</REGVALUE>
</REGKEY>
</REGISTRY>

This goes into the VIRTUALENV-tag.

Happy sequencing!

The populair PDF reader and writer from Adobe are often plagued by critical vulnerabilities. Therefore updating and patching Adobe Reader and Adobe Acrobat applications is highly necessary.

Here is how to slipstream the Reader 9.3.3 patch into the 9.3 source, suppress the automatic updates, and acrobat.com online services.

First step: get the sources.

Download sources

Adobe Reader 9.3: AdbeRdr930_en_US.msi

Adobe Reader 9.3.2 Patch: AdbeRdrUpd932_all_incr.msp

Adobe Reader 9.3.3 Patch: AdbeRdrUpd933_all_incr.msp

Adobe Customization Wizard 9: CustWiz90_en_US.exe

Because the upgrade path is 9.3 > 9.3.2 > 9.3.3, we also need the 9.3.2 patch file.

In the second step we need to create a network installation point (administrative installation point). I use C:\temp\reader933\adminpoint, you can choose your own.

Perform an administrative installation

1. Copy the sources to a directory of your choose, for example:
   

   C:\temp\reader933\sources

2. Create a distribution point folder (a folder where the installer can install the uncompressed program files)
   

   C:\temp\reader933\adminpoint

3. Open a command prompt and execute this command:
   

   Msiexec /a <path of AdbeRdr930_en_US.msi>

   With the /a parameter, you’re extracting the MSI to the administrative installation point (folder).

   

   When asked, point to the administrative installation point created in step 2 and hit Install.

   

   

   Admin point has been created:

   

   The 9.3 source files are extracted, now we will slipstream the 9.3.2 and 9.3.3 patches.

4. Apply the 9.3.2 patch:
   

   msiexec /a <path of msi at distribution point> /p <path of Reader 9.3.2.msp>

   for example in my situation:

   msiexec /a "C:\Temp\reader933\adminpoint933\AdbeRdr930_en_US.msi" /p "C:\Temp\adobereader\sources\AdbeRdrUpd932_all_incr.msp"

   

   

   

   

5. Then apply the 9.3.3 path:
   

   msiexec /a "C:\Temp\reader933\adminpoint933\AdbeRdr930_en_US.msi" /p "C:\Temp\adobereader\sources\AdbeRdrUpd933_all_incr.msp"

   

   

   

   

   Last step is to create a transform file. Here you can disable automatic updates and apply custom settings.

Create a transform file (.mst) using the Adobe Customization Wizard:

Run Adobe’s Customization Wizard and open the extracted MSI (leave other files in place). Then change the settings to suit your needs, use the screenshots as an example (this are our adaptations).

Create new key: AVGeneral (in HKCU\Software\Adobe\Acrobat Reader\9.0)

DWORD: bCheckForUpdatesAtStartup

Value: 0

Create new DWORD: OptIn (in HKCU\Software\Adobe\CommonFiles\Usage\Reader 9)

Value: 0

Before saving the package, create an empty setup.ini file in the root of your admin point. If you don’t create this file the Customization Wizard will throw the error: “Setup.ini not found”. (thanks Terry for letting me know)

Save the package, and you’re done.

Add sites to the Trust Manager

We needed to add some sites to the Trust Manager, this step isn’t necessary in the deployment process. We added this IP ranges to the Trust Manager:

172.33.*

172.75.*

Use this .reg file to deploy via scripting:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\9.0\TrustManager]

[HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\9.0\TrustManager\cDefaultLaunchURLPerms]

"tHostPerms"="version:2|172.33.*:2|172.75.*:2"

Import via Customization Wizard should also work, although I didn’t tested the import feature. If somesome has experience with importing these settings, please share and make a comment!

Deployment:

I use this command line to deploy my slipstreamed Adobe Reader via ConfigManager 2007:

msiexec /i "path\AdbeRdr930_en_US.msi" TRANSFORMS="path\tranformfile.mst" /qb REBOOT=ReallySuppress /log "path\reader933.txt"

Update Sept 2010:

Patch to reader 9.3.4

Here is how to patch the Reader 9.3.3 administrative distribution point with the updated Reader 9.3.4 version.

First get the Adobe Reader 9.3.4 sources file from Adobe’s website. Then apply the 9.3.4 (.msp) patch to the previous created distribution point:

msiexec /a <path of msi at the distribution point> /p <path of downloaded patch>

for example in my situation:

msiexec /a “C:\Temp\reader933\adminpoint933\AdbeRdr930_en_US.msi” /p “C:\Temp\adobereader\sources\AdbeRdrUpd934_all_incr.msp”

It can be confusing, because I named the distribution point “reader933”.

Copy the files from distribution point to your desired location and you’re done!