Acrobat® Family of Products Modification date: 3/2/12 Enterprise Administration Guide © 2009-2011 Adobe Systems Incorporated. All rights reserved. Enterprise Administration Guide for the Adobe® Acrobat Family of Products. If this guide is distributed with software that includes an end user agreement, this guide, as well as the software described in it, is furnished under license and may be used or copied only in accordance with the terms of such license. Except as permitted by any such license, no part of this guide may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, recording, or otherwise, without the prior written permission of Adobe Systems Incorporated. Please note that the content in this guide is protected under copyright law even if it is not distributed with software that includes an end user license agreement. The content of this guide is furnished for informational use only, is subject to change without notice, and should not be construed as a commitment by Adobe Systems Incorporated. Adobe Systems Incorporated assumes no responsibility or liability for any errors or inaccuracies that may appear in the informational content contained in this guide. Please remember that existing artwork or images that you may want to include in your project may be protected under copyright law. The unauthorized incorporation of such material into your new work could be a violation of the rights of the copyright owner. Please be sure to obtain any permission required from the copyright owner. Any references to company names in sample templates are for demonstration purposes only and are not intended to refer to any actual organization. Adobe, Acrobat®, Reader®, and the Adobe logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States and/or other countries. Windows®, Windows NT®, and Windows XP® are registered trademarks of Microsoft® Corporation registered in the United States and/or other countries. Mac® and Macintosh® are registered trademarks of Apple Computer®, Inc. in the United States and other countries. All other trademarks are the property of their respective owners. Adobe Systems Incorporated, 345 Park Avenue, San Jose, California 95110, USA. Notice to U.S. Government End Users. The Software and Documentation are“Commercial Items,” as that term is defined at 48 C.F.R. §2.101, consisting of “Commercial Computer Software” and“Commercial Computer Software Documentation,” as such terms are used in 48 C.F.R. §12.212 or 48 C.F.R. §227.7202, as applicable. Consistent with 48 C.F.R. §12.212 or 48 C.F.R. §§227.7202-1 through 227.7202-4, as applicable, the Commercial Computer Software and Commercial Computer Software Documentation are being licensed to U.S. Government end users (a) only as Commercial Items and (b) with only those rights as are granted to all other end users pursuant to the terms and conditions herein. Unpublished-rights reserved under the copyright laws of the United States. Adobe Systems Incorporated, 345 Park Avenue, San Jose, CA 95110-2704, USA. For U.S. Government End Users, Adobe agrees to comply with all applicable equal opportunity laws including, if appropriate, the provisions of Executive Order 11246, as amended, Section 402 of the Vietnam Era Veterans Readjustment Assistance Act of 1974 (38 USC 4212), and Section 503 of the Rehabilitation Act of 1973, as amended, and the regulations at 41 CFR Parts 60-1 through 60-60, 60-250, and 60-741. The affirmative action clause and regulations contained in the preceding sentence shall be incorporated by reference. 3 Contents Contents.............................................................................................................................3 Introduction.......................................................................................................................9 1.1 Related Resources............................................................................................................................... 9 1.1.1 Documentation..............................................................................................................................................................9 1.1.2 Tools for IT......................................................................................................................................................................10 1.1.3 Videos for IT...................................................................................................................................................................10 1.2 Getting started.................................................................................................................................. 11 1.2.1 Best practices ................................................................................................................................................................11 1.2.2 File types.........................................................................................................................................................................12 1.2.3 Determining what’s already installed ..................................................................................................................12 1.2.4 End of life schedule.....................................................................................................................................................12 1.3 Supported Workflows ...................................................................................................................... 12 1.3.1 Windows.........................................................................................................................................................................12 1.3.2 Macintosh.......................................................................................................................................................................14 1.4 Choosing an installer........................................................................................................................ 15 1.4.1 Versioning policy.........................................................................................................................................................15 1.4.2 Installer languages......................................................................................................................................................15 1.4.3 Language tiers..............................................................................................................................................................15 1.4.4 Locale and language codes .....................................................................................................................................16 1.4.5 Selecting a language..................................................................................................................................................17 1.4.6 Enterprise installers.....................................................................................................................................................18 1.4.6.1 Naming conventions........................................................................................................................................18 1.4.7 End user and EXE installers (Windows)................................................................................................................19 1.4.7.1 Reader for individuals from the Reader Download Center ................................................................19 1.4.7.2 Expanding the Reader installer package...................................................................................................19 1.5 Update rules and constraints........................................................................................................... 20 1.5.1 10.x Acrobat updates .................................................................................................................................................21 1.5.2 10.x Reader updates...................................................................................................................................................21 1.5.3 8.x-9x Acrobat updates..............................................................................................................................................22 1.5.4 8.x-9x Reader updates................................................................................................................................................22 1.6 Licensing ........................................................................................................................................... 23 1.6.1 Reader deployments ..................................................................................................................................................23 1.6.2 Acrobat deployments ................................................................................................................................................23 1.6.2.1 Macintosh.............................................................................................................................................................23 1.6.2.2 Windows ...............................................................................................................................................................24 1.7 Identifying deployed applications.................................................................................................. 25 1.7.1 Decoding product details via Windows GUID...................................................................................................25 1.7.2 VersionMax and VersionMin (9.x earlier).............................................................................................................29 1.7.3 MSI API.............................................................................................................................................................................29 1.8 Trial Acrobat installations................................................................................................................ 30 1.8.1 Installing a trial version without a serial number.............................................................................................30 1.8.2 Migrating a trial version to a licensed version ..................................................................................................30 Enterprise Administration for the Acrobat Family of Products 4 Client Configuration and Tuning ...................................................................................32 2 Pre-Deployment Planning and Customization................................................................. 33 2.1 Configuration planning ................................................................................................................... 33 2.1.1 Preferences ....................................................................................................................................................................33 2.1.1.1 Configuration......................................................................................................................................................33 2.1.1.2 Migration and updates ....................................................................................................................................33 2.1.2 What products and versions can coexist? ..........................................................................................................34 2.1.2.1 Reader and Acrobat on a single machine.................................................................................................34 2.1.2.2 Setting the default PDF handler...................................................................................................................34 2.1.3 Plug-ins............................................................................................................................................................................34 2.1.4 iFilter configuration....................................................................................................................................................35 2.1.5 Sharepoint integration..............................................................................................................................................35 2.1.6 Acrobat.com integration...........................................................................................................................................35 2.1.7 Configuring Reader Help for offline use..............................................................................................................36 2.1.8 AIR.....................................................................................................................................................................................37 2.2 Customizing installations ................................................................................................................ 37 2.2.1 Manual configuration.................................................................................................................................................37 2.2.2 Tuning with the Customization Wizard...............................................................................................................37 2.2.2.1 Basic Wizard Tuning..........................................................................................................................................38 2.2.2.2 Advanced Wizard tuning for new installations.......................................................................................39 2.2.3 Multilanguage (MUI) configuration (Reader only)...........................................................................................40 2.2.3.1 MUI configuration via the Customization Wizard..................................................................................41 2.2.3.2 MUI configuration via the registry...............................................................................................................41 2.2.3.3 Non mui language selection via the command line.............................................................................41 2.2.3.4 Additional Windows XP configuration.......................................................................................................42 2.2.4 Wizard FAQs ..................................................................................................................................................................43 3 Application Preference Basics............................................................................................ 44 3.1 Supported products ......................................................................................................................... 44 3.2 Platform specifics ............................................................................................................................. 45 3.2.1 Windows.........................................................................................................................................................................45 3.2.2 Macintosh.......................................................................................................................................................................45 3.2.3 Unix...................................................................................................................................................................................45 3.3 Default values ................................................................................................................................... 46 3.4 Directory and key creation .............................................................................................................. 46 3.5 Importing and exporting preferences ............................................................................................ 47 3.6 Data types: Windows........................................................................................................................ 48 3.7 Data types: Macintosh...................................................................................................................... 49 3.8 Preference convention basics.......................................................................................................... 50 3.9 Order of precedence......................................................................................................................... 51 3.10 Pre-deployment configuration ..................................................................................................... 51 4 Locking Preferences............................................................................................................ 53 4.1 Platform specifics ............................................................................................................................. 53 4.1.1 Windows.........................................................................................................................................................................53 4.1.2 Unix...................................................................................................................................................................................53 4.1.3 Macintosh.......................................................................................................................................................................53 4.2 Preventing End-User Modification.................................................................................................. 54 Enterprise Administration for the Acrobat Family of Products 5 Windows Deployments...................................................................................................59 5 The Command Line and msiexec........................................................................................ 60 5.1 MSI best practices............................................................................................................................. 60 5.2 msiexec usage................................................................................................................................... 60 5.2.1 msiexec: syntax.............................................................................................................................................................60 5.2.2 msiexec: switches and options...............................................................................................................................61 5.2.3 Setting installer properties.......................................................................................................................................62 5.2.4 MSI properties...............................................................................................................................................................63 5.2.5 Troubleshooting msiexec.........................................................................................................................................64 5.2.6 Command line examples..........................................................................................................................................64 5.2.6.1 Creating an administrative installation......................................................................................................65 5.2.6.2 Installing from an MST .....................................................................................................................................65 5.2.6.3 Chaining updates...............................................................................................................................................65 5.2.6.4 Installing a quarterly update and then an out of cycle patch (8.x-9.x)...........................................66 5.2.6.5 Updating and patching 10.x..........................................................................................................................66 5.2.6.6 Silent uninstalls...................................................................................................................................................66 5.2.6.7 Removing browser integration for an already installed product.....................................................67 5.3 Adobe installer properties............................................................................................................... 67 6 Administrative Installations (AIPs) .................................................................................... 70 6.1 Best practices .................................................................................................................................... 70 6.2 AIP creation....................................................................................................................................... 70 6.2.1 When the last update was an out of cycle patch (8-9.x only)......................................................................74 6.3 AIP troubleshooting ......................................................................................................................... 74 6.4 AIP Examples..................................................................................................................................... 75 6.4.1 AIP for Acrobat Pro 10.x.x patch.............................................................................................................................75 6.4.2 AIP for Acrobat Std 10.x.x security patch............................................................................................................75 6.4.3 AIP for Reader 10.x.x quarterly patch...................................................................................................................75 7 Bootstrapper Installations.................................................................................................. 77 7.1 What is the Bootstrapper? ............................................................................................................... 77 7.2 Best practices .................................................................................................................................... 77 7.3 Bootstrapper usage.......................................................................................................................... 77 7.3.1 Bootstrapper configuration.....................................................................................................................................79 7.3.2 Bootstrapper command line switches.................................................................................................................82 7.3.3 Setup.ini examples......................................................................................................................................................82 7.3.4 Language based installer behavior.......................................................................................................................84 8 SCCM-SCUP Deployments .................................................................................................. 85 8.1 SCCM-SCUP basics ............................................................................................................................ 86 8.1.1 File location and types...............................................................................................................................................86 8.1.2 Best practices ................................................................................................................................................................87 8.2 Catalog import.................................................................................................................................. 87 9 Group Policy-Active Directory Deployments.................................................................... 89 9.1 Tested environments ....................................................................................................................... 89 9.2 10.x GPO deployments..................................................................................................................... 89 9.3 9.x GPO deployments....................................................................................................................... 93 9.3.1 Assign the application to a computer:.................................................................................................................93 Enterprise Administration for the Acrobat Family of Products 6 9.4 Removing products using Group Policy Objects ........................................................................... 95 9.5 Creating GPO Templates.................................................................................................................. 95 10 Citrix Server Deployments................................................................................................ 100 10.1 Requirements................................................................................................................................ 100 10.1.1 License requirements ...........................................................................................................................................100 10.1.2 Tested environments............................................................................................................................................101 10.2 Session vs. application virtualization......................................................................................... 101 10.2.1 Performance tuning..............................................................................................................................................101 10.2.1.1 Improving scrolling performance ..........................................................................................................101 10.3 Installing X products on a Citrix XenApp Server 5.0.................................................................. 102 10.3.1 Known Citrix limitations for 10.x products ...................................................................................................102 10.3.2 Disabling Protected Mode..................................................................................................................................102 10.3.3 Installing from the management console.....................................................................................................102 10.3.4 Accessing Citrix from a client.............................................................................................................................104 10.3.4.1 Accessing Published Applications through the Citrix Web Interface........................................104 10.3.4.2 Accessing Citrix via Program Neighborhood Client:.......................................................................105 10.4 Installing 8.x and 9.x on a Citrix Presentation Server................................................................ 106 10.4.1 Installing with Add/Remove Programs..........................................................................................................106 10.4.2 Publishing the application on the server ......................................................................................................107 10.4.3 Accessing Citrix from a client.............................................................................................................................107 10.4.4 Removing the product.........................................................................................................................................109 10.4.5 Known Citrix limitations: with Acrobat 9.x....................................................................................................109 11 Windows Terminal Services Deployments...................................................................... 111 11.1 Tested environments ................................................................................................................... 111 11.2 Installing Acrobat products......................................................................................................... 111 12 Systems Management Server Deployments................................................................... 113 12.1 Tested environments ................................................................................................................... 113 12.2 Installing Acrobat products with SMS ........................................................................................ 114 12.2.1 Removing previous versions..............................................................................................................................114 12.2.2 Creating the SMS package..................................................................................................................................114 12.3 Removing Acrobat 9..................................................................................................................... 117 12.4 Known limitations ........................................................................................................................ 117 13 SharePoint Integration ..................................................................................................... 118 13.1 SharePoint System Requirements .............................................................................................. 118 13.1.1 Tested environments............................................................................................................................................118 13.1.2 Changes across releases......................................................................................................................................118 13.1.2.1 Digital signature changes for 10.1 .........................................................................................................119 13.2 SharePoint Configuration............................................................................................................ 119 13.2.1 Configuration for 10.1.2 and later....................................................................................................................119 13.2.2 Manual configuration...........................................................................................................................................119 13.2.3 Allow HTTP methods in IIS 7 or later...............................................................................................................120 13.2.4 Disabling SharePoint integration.....................................................................................................................120 14 Multi-User Reader Desktop Configuration...................................................................... 122 14.1 What is MURD?.............................................................................................................................. 122 14.1.1 Why LABs?.................................................................................................................................................................123 14.1.2 What’s supported?.................................................................................................................................................123 Enterprise Administration for the Acrobat Family of Products 7 14.2 Deploying a multi-Reader desktop............................................................................................. 123 14.2.1 Download the requisite files..............................................................................................................................124 14.2.2 Client installation ...................................................................................................................................................124 14.2.3 MURD configuration .............................................................................................................................................125 14.2.4 MURD server configuration................................................................................................................................126 14.3 Updates and patches.................................................................................................................... 126 14.4 FAQ ................................................................................................................................................ 127 Macintosh Deployments.............................................................................................. 128 15 Deployment Methods (Mac)............................................................................................. 129 15.1 Installation scenarios ................................................................................................................... 129 15.1.1 Standalone products vs Creative Suite bundles.........................................................................................129 15.2 Installer details ............................................................................................................................. 129 15.2.1 Installer behavior for existing installations...................................................................................................129 15.2.2 Install locations.......................................................................................................................................................130 15.2.3 Components ............................................................................................................................................................130 15.2.4 Language ..................................................................................................................................................................131 15.3 Pre-deployment customization................................................................................................... 131 15.3.1 Install location.........................................................................................................................................................131 15.3.2 Choosing what components are installed....................................................................................................132 15.3.2.1 Using the installer command...................................................................................................................133 15.3.2.2 Modifying the distribution file.................................................................................................................133 15.3.3 Installing special fonts..........................................................................................................................................134 15.4 Apple Remote Desktop ................................................................................................................ 134 15.4.1 Install Acrobat products using ARD ................................................................................................................135 15.4.2 Deploy the Adobe Provisioning Tool (APT)..................................................................................................135 15.4.3 Customizing Acrobat installs with APT ..........................................................................................................136 15.4.4 One step ARD deployments...............................................................................................................................137 15.5 Uninstalling via the command line ............................................................................................. 138 15.6 Preventing updates...................................................................................................................... 139 15.6.1 Disabling and locking the Updater..................................................................................................................139 15.6.2 Setting the Updater to manual.........................................................................................................................140 15.6.3 Preventing any updates.......................................................................................................................................140 15.7 Troubleshooting........................................................................................................................... 140 15.7.1 Logging......................................................................................................................................................................140 15.7.1.1 Install log.........................................................................................................................................................140 15.7.1.2 Updater log.....................................................................................................................................................141 15.7.2 Installation failures ................................................................................................................................................141 Appendices ................................................................................................................... 142 16 Basic Acceptance Tests ..................................................................................................... 143 17 Troubleshooting and Support.......................................................................................... 145 17.1 Troubleshooting Windows installations .................................................................................... 145 17.2 Generating a crash dump file ...................................................................................................... 147 17.3 Contacting support ...................................................................................................................... 148 17.4 Installation FAQs .......................................................................................................................... 149 Enterprise Administration for the Acrobat Family of Products 8 Index.............................................................................................................................. 150 1 9 Introduction This document is specifically designed for administrators and other enterprise IT professionals. It is not intended for end users. Most of the details here pertain to registry and plist level preferences and enterprise technologies, and many also require administrator privileges to use. 1.1 Related Resources This guide is part of an enterprise resource ecosystem designed to help administrators manage Acrobat products across their organizations. 1.1.1 Documentation  Enterprise Portal: Contains the Enterprise Administration Guide and links to related libraries, documents, and tools.  Administrator's Information Manager (AIM): An AIR application containing the Preference Reference (A database of registry-plist level preferences) for Windows and Macintosh, Feature inSight, and other resources.  Release Note Library: A library of all available release notes for all versions of Acrobat products  Application Security Library: Contains an Application Security Guide and documents pertaining to security topics such as document trust and JavaScript controls. Tools for IT 3/2/12: Enterprise Administration for the Acrobat Family of Products 10  Content Security Library: Guides for digital signatures and rights management. Includes a complete guide with some chapters provided as quick keys and separate documents. 1.1.2 Tools for IT The tools listed in Table 1 include items such as the following:  Customization Wizard: A free utility that enables pre-deployment installer customization and feature configuration, thereby facilitating IT control enterprise-wide deployments.  LABs: A newly founded home for utilities, tools, scripts, and other resources of use to IT. 1.1.3 Videos for IT See Table 2. Table 1 Tool library Tool Location AIM & Preference Reference http://learn.adobe.com/wiki/download/attachments/46432650/AIM.air 10.x Customization Wizard http://www.adobe.com/support/downloads/detail.jsp?ftpID=4950 9.x Customization Wizard ftp://ftp.adobe.com/pub/adobe/acrobat/win/9.x/9.0/misc/ Multi-Reader Desktop http://labs.adobe.com/technologies/acrobat_ittools/ iFilter http://www.adobe.com/support/downloads/product.jsp?product=1&platform= Windows. Mac Provisioning Tool ftp://ftp.adobe.com/pub/adobe/acrobat/mac/10.x/10.0.0/misc/ Win Provisioning Tool http://www.adobe.com/products/creativesuite/technical-resources.html?cq_ck= 1308180545248#tools-training Firefox plugin for Mac http://labs.adobe.com/technologies/acrobat_ittools/ 10.x SCUP catalogs http://kb2.adobe.com/cps/837/cpsid_83709.html 9.x SCUP catalogs http://labs.adobe.com/technologies/acrobat_ittools/ JavaScript Blacklist Framework http://labs.adobe.com/technologies/acrobat_ittools/ Table 2 Video library Topic URL Deployment Overview http://tv.adobe.com/embed/71/1002/ Migrating/Sharing Security Settings http://tv.adobe.com/embed/71/1001/ 9.x AIP Deployments http://tv.adobe.com/embed/71/11603/ 10.x AIP Deployments http://tv.adobe.com/embed/714/11602/ Building a Bootstrapper http://tv.adobe.com/embed/714/11606/ Customization Wizard Basics http://tv.adobe.com/embed/714/9387/ Customization Wizard: Advanced http://tv.adobe.com/embed/714/9433/ Getting started 3/2/12: Enterprise Administration for the Acrobat Family of Products 11 1.2 Getting started 1.2.1 Best practices  Start with a fresh set of files.  Accept the Reader Distribution Agreement.  Don't patch without a license.  Don't modify the originally downloaded file. Create a backup file to archive.  On Windows:  Create an MST file or make changes on the command line.  Set the file's read-only attribute on a vendor MSI for which you're creating a transform.  Save your MST in case you need to upgrade with a full installer (MSI or EXE) which would uninstall the existing Reader installation and remove your customizations.  If there is a problem, patch on the original files as a test.  When installing a product of one type over another type (e.g. Acrobat Pro Extended on machines where Acrobat Standard is already installed), always uninstall the other product first. Do not rely on MSI parameters such as REINSTALLMODE=amus to do the work for you.  Develop a pre-deployment configuration plan. Know what settings, files, and functionality you need to support or block. Backing up the original files Adobe recommends that you back up all files and use MST files or the command line to modify the installer rather than editing the original download directly. Doing so lets you always have access to a supported and tested configuration (the default). Create a folder to store the original installation files and the MSP update files to apply. If you are doing a chained installation, the folder should contain the major release installer and the requisite update files. For example:  10.x products are cumulative (quarterly installers are cumulative to the last MSI and patches are cumulative to the last quarterly. Thus, for an upgrade to 10.1, the folder would contain:  The base install from the CD installer, the unpacked download from the Reader Download center, or download from the enterprise FTP site.  The 10.1 update. (note you do not need 10.0.1, 10.0.2, or 10.0.3). Tip: For 10.x installers, see http://kb2.adobe.com/cps/888/cpsid_88814.html.  If installing 9.0 and the 9.1 and 9.1.2 updates and patches, the folder would contain: Customization Wizard: Registry Feature http://tv.adobe.com/embed/714/11605 Customization Wizard: Files and Folders Feature http://tv.adobe.com/embed/714/11604/ Table 2 Video library Topic URL File types 3/2/12: Enterprise Administration for the Acrobat Family of Products 12  The base install from the CD installer, the unpacked download from the Reader Download center, or download from the enterprise FTP site.  AcroProStdUpd910_T1T2_incr.msp (for example, 910 MSP update files for tier 1 & 2 languages).  AcrobatUpd912_all_incr.msp (912 MSP update file). Tip: For 9.x installers, see http://kb2.adobe.com/cps/888/cpsid_49880.html. 1.2.2 File types New and existing installations may work with one or more of the following file types.  Windows  MSI: A full installer cumulative to the base release. For Reader, a single dot release (e.g. 10.1, 9.3, 8.2). Acrobat updates which are always patches MSP files.  MSP: An incremental patch installer usually targeted for a previous update.  MST: MST files are used for a Microsoft Windows Installer transform. The file can perform transforms, adds, deletes, or change properties in a Microsoft Windows Installer (.MSI) package to enable customization of the installation for different groups of users. If you’re using the Customization Wizard, you’ll likely create an MST file that is applied to the original MSI file.  EXE: An executable update. Bootstrapped installers are Setup.exe files.  Macintosh  PKG: Includes both full and update installers. The download is a DMG file. 1.2.3 Determining what’s already installed Before updating, verify what’s installed as described in Decoding product details via Windows GUID. 1.2.4 End of life schedule A product version’s end of life schedule is typically set several years in advance as described at http:// www.adobe.com/support/products/enterprise/eol/eol_matrix.html#86. 1.3 Supported Workflows Enterprise admins almost always modify the installer and the installed product. While there are numerous ways to get the job done, at a high level, the process involves the steps described below. 1.3.1 Windows 1. Download the requisite installer(s). 2. Optional: Modify the installer and the installed product. If you create an MST, save it for future use. You’ll need to apply it again for Reader MSI installs which uninstall the previous version (and therefore destroy your custom settings). Windows 3/2/12: Enterprise Administration for the Acrobat Family of Products 13 3. Determine your installation workflow:  Administrative (full-file) updates: Full file updates are patch administrative installation points (AIP) or clients directly from expanded installer files residing on a network share.  Client (binary) updates. These patch existing files using the bootstrapper setup.exe. Client updates are designed only for individual machines and cannot be used to update an AIP. 4. Set MSI and Adobe properties as needed to perform the actual install as follows:  If you’re using the MSI installer, configure abcpy.ini.  If you’re using the Setup.exe bootstrapper installer, configure setup.ini.  On your command line, you can use msiexec and Adobe properties and switches. 5. Deploy. Macintosh 3/2/12: Enterprise Administration for the Acrobat Family of Products 14 Figure 1 Deployment overview 1.3.2 Macintosh In conjunction with the Acrobat X and Reader X release, Adobe now introduces an installer for the Macintosh platform and support for the Apple Remote Desktop (ARD). Unlike previous product versions which required manual installs, product installation and some configuration can be managed automatically for enterprise deployments. At a high level, deployment involves: 1. Download the requisite installer(s). Links to information about installers and sequencing reside at http://www.adobe.com/go/acrobatitinfo. The following file types are usually available:  PKG: Includes both full and update installers. Choosing an installer 3/2/12: Enterprise Administration for the Acrobat Family of Products 15  DMG: A compressed package containing the PKG. 2. Download the Adobe Provisioning Tool from ftp://ftp.adobe.com/pub/adobe/acrobat/mac/10.x/ 10.0.0/misc/, and use it for batch preserialization, EULA suppression, and so on. 3. Use ARD to deploy the application. 1.4 Choosing an installer Enterprise admins typically get the product download for all platforms from these locations:  Adobe’s FTP site at ftp://ftp.adobe.com/pub/adobe/reader/.  http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows 1.4.1 Versioning policy Adobe uses version numbers to clearly communicate to IT professionals the deployment model for a given release. Acrobat and Reader version numbers contain 3 integers and two dots:  The first integer identifies the major release; for example, 9.0.0 or 10.0.0 (sometimes 10.0 for short).  The second integer is incremented when a quarterly update is delivered as a full installer; for example, 9.1.0, 9.2.0, and 10.1.0. These always include previously released out of cycle patches.  The third integer is incremented for all other updates and out of cycle patches; for example, 9.4.3, 9.4.4, 10.0.1, 10.0.2, etc. Updating Acrobat is straightforward because all update types are incremental and every one must be installed in order. For Reader, however, use the version number and file type to determine your update strategy. For details see “Update rules and constraints” on page 20. Tip: Refer to the release notes library to determine the installer types available for each release: http:// kb2.adobe.com/cps/837/cpsid_83708.html. 1.4.2 Installer languages Installers may or may not be language-specific. Many patches and updates are language agnostic and can be applied to whatever language-specific install is already present. In these cases, language selection is not pertinent and update is simply applied in the language that has been selected during original installation. For installers that target a specific language or language group. Use the filename to identify the supported language. 1.4.3 Language tiers Beginning with the first 10.0 update, installers may be named by the language group (or tier) which they can install. To identify the available language, refer to the release notes or Table 2 below. For example, the 10.0.1 update is named as follows: Locale and language codes 3/2/12: Enterprise Administration for the Acrobat Family of Products 16  Windows: AcrobatUpd1001_Tier_1.msp. Tier 1 indicates the installer is for English, French, German, and Japanese.  Macintosh: AdbeRdrUpd10 01.dmg. The absence of the a tier identifier indicates the installer is generic and should be used for updating any language version. 1.4.4 Locale and language codes Installer filenames include a locale identifier consisting of consists of a language code and a country code. For example, the Reader installer filename is of the form: AdbeRdr90_.exe. Thus, AdbeRdr90_en_US.exe is an English installer. Installer components and workflows adhere to the ID system used by Microsoft. For details, see:  Locale ID: http://msdn.microsoft.com/en-us/goglobal/bb964664.aspx  Language ID: http://msdn.microsoft.com/en-us/library/ms533052(VS.85).aspx These IDs are also used on the command line, in installer tables, and elsewhere. Table 3 Language tiers Tier Windows Macintosh Tier 1 English, French, German, Japanese, (Reader only: MUI Reader) English, French, German, Japanese Tier 2 Italian, Spanish, Dutch, Brazilian Portuguese, Swedish, Danish, Finnish, Norwegian Italian, Spanish, Dutch, Brazilian Portuguese, Swedish, Danish, Finnish, Norwegian Tier 3 Chinese Traditional, Chinese Simplified, Korean Chinese Traditional, Chinese Simplified, Korean Tier 4 Russian, Ukrainian, Romanian,Turkish, Czech, Hungarian, Polish, Slovak, Croatian, Slovenian, (Reader only: Catalan, Basque) Russian, Ukrainian, Romanian, Turkish, Czech, Hungarian, Polish Table 4 Locale and language codes Language Code Language ID code Basque eu 1069 Brazilian Portuguese pt-br 1046 Bulgarian bg 1026 Catalan ca 1027 Chinese (China) zh_CN 2052 Chinese (Taiwan) zh_TW 1028 Croatian hr 1050 Czech cs 1029 Danish da_DK 1030 Dutch nl_NL 1043 English en_US 1033 Estonian et 1061 Selecting a language 3/2/12: Enterprise Administration for the Acrobat Family of Products 17 1.4.5 Selecting a language The application language is selected at the time of installing the initial major version using Setup.exe. The language selected at that time is stored on the system. For example, on Windows, it’s in: [HKEY_CURRENT_USER\Software\Adobe\\\Language]"UI"="ENU" The product UI language is actually determined by the sidecar dll stored in [HKCU\Software\Adobe\ Acrobat Reader\10.0\Language\current]. Therefore, if a user switches the dll under current or changes the UI key the two keys may not match. Ultimately, the dll under current determines the product language. Note that Adobe uses standard MSI technology for installation on Windows, so patches and updates are language agnostic and they are applied to whatever language-specific install is already present. Therefore, application language selection is not pertinent to updates: Patches are simply applied in the language that has been selected during original installation. As noted in http://kb2.adobe.com/cps/507/cpsid_50720.html, it is possible to apply patches during an initial installation. For multi-lingual installers, use the selected language transform (for example, 1036.mst for the French language) in the command line. Transforms in the installer media directory do not require fully qualified paths in the command. Patches do require fully qualified paths. Finnish fi_FI 1035 French fr_FR 1036 German de_DE 1031 Hungarian hu 1038 Italian it_IT 1040 Japanese ja_JP 1041 Korean ko_KR 1042 Latvian lv 1062 Lithuanian lt 1063 Norwegian nb_NO 1044 Portuguese – Brazilian pt_BR 1046 Romanian ro 1048 Russian ru 1049 Slovak sk 1051 Slovenian sl 1060 Spanish es_ES 1034 Swedish sv_SE 1053 Turkish tr 1055 Ukrainian uk 1058 Table 4 Locale and language codes Language Code Language ID code Enterprise installers 3/2/12: Enterprise Administration for the Acrobat Family of Products 18 1.4.6 Enterprise installers Adobe provides enterprise IT with a download site that contains all available installers. Most admins download the product, updates, and patches from ftp://ftp.adobe.com/pub/adobe/reader/. This FTP site provides the following:  While some versions of Reader have been released that include Acrobat.com integration (online services) and the Adobe Air runtime, FTP downloads always provide the vanilla application versions which do not include these components.  An archive of all currently supported binaries for all products, versions, updates, and patches.  Deprecated application versions which are no longer supported. 1.4.6.1 Naming conventions Windows installer naming conventions As shown in Table 5, installer names have several components that help identify what it contains. Figure 2 Installer identification by name Table 5 Installer naming conventions OS Name Description All Tier_# 10.x and later. The language group. For example, Tier_1 is English, French, German, and Japanese. All _cum A full installer for a MUI version. All _all All languages are supported: used for some MSP patches. All T1T2 An older language ID used by 9.1 and 8.1 and earlier. All _en_US A language ID; in this example, English. Mac _i386 Identifies installers for Apple products that use Intel’s 32 bit i386 CPU. Mac _ppc Identifies installers for Apple products use PowerPC CPUs. Mac .pkg The uncompressed installer file. Mac .dmg The compressed installer that contains the PKG file. Win .msp A non-full installer: can be a quarterly update or out of cycle patch. Win .msi A full installer that includes all previous releases. Win .exe A full installer; not typically used in enterprise settings. End user and EXE installers (Windows) 3/2/12: Enterprise Administration for the Acrobat Family of Products 19 1.4.7 End user and EXE installers (Windows) 1.4.7.1 Reader for individuals from the Reader Download Center As of July 13, 2010, Reader downloads include a chained installer that includes all requisite patches and updates. Prior to July, 2010, product downloads from the download center (http://get.adobe.com/ reader/) included the original major release version of the product such as 8.0 and 9.0. These older, full installers did not include the latest patches and thereby created two problems:  Users would have to apply the latest updates and patches to get to the latest version.  The product was less secure and subject to known vulnerabilities if it was not patched. To resolve these issues, the download centers now only provides chained installers that include all the updates in one bundle. This delivers a seamless experience to users and a single install to get the latest product version. 1.4.7.2 Expanding the Reader installer package These steps do not apply to any installer other than those EXE installers downloaded from the Reader Download Center or the FTP site. Tip: If you are using SMS and do not need to customize the installer, you can use the Nossocompressed file directly with the SMS installer. 1. Open a command prompt. 2. Expand the MSI package with a set of command line switches. The general form of the command to convert a Nosso-compressed file to an MSI package is: \AdbeRdr_.exe [...] For example, the following command specifies that no files are to be executed after the expansion or installation, and the resulting files are to be placed in a folder named“Reader9”: \AdbeRdr90_en_US.exe -nos_o"MyFolder" -nos_ne Tip: Do not use an existing directory, and do not leave any spaces after“-nos_o” or -sfx_o command. Note that the compression technology changed from Nosso to 7-zip with 10.0. Examples The command in Example 1.1 specifies that no files are to be executed after extracting Reader 9.0 files. The installer will not run after expanding the files to a directory named“Reader9”. Example 1.1: Expanding EXEs: Nosso compressed \AdbeRdr90_en_US.exe -nos_o"MyFolder" -nos_ne Win _mui An installer that supports a multilanguage selection user interface. MUI updates always roll back to the base release and patch over it. Table 5 Installer naming conventions OS Name Description Update rules and constraints 3/2/12: Enterprise Administration for the Acrobat Family of Products 20 The command in Example 1.2 specifies that no files are to be executed after extracting Reader 10.0.1 files. The installer will not run after expanding the files to a directory named“Extract”. Example 1.2: Expanding EXEs: 7-zip compressed AdbeRdr1001_en_US.exe -sfx_ne -sfx_o"\Extract 1.5 Update rules and constraints The version number indicates the number of releases that have been issued since your last install and what type of file and chaining workflow to use when updating Reader. For example, some quarterly installers where the second number increments are full installers which can be applied over the base release. Refer to the rules below to define you update strategy. Details about each update can be found at the following:  Release note library: http://kb2.adobe.com/cps/837/cpsid_83708.html identifies whether a release is a security or quarterly update and provides details about the release’s contents, changes, file sizes, and so on.  8.x-9.x Windows update page: http://kb2.adobe.com/cps/498/cpsid_49880.html lists installers by update type, file name, and language support.  10.x updates for Windows and Macintosh: http://kb2.adobe.com/cps/888/cpsid_88814.html lists installers by update type, file name, and language support. Caution: Attempting to update in an unsupported order results in a failure that serves to prevent the use of updates that Adobe does not recommend. See also “Choosing an installer” on page 15. Table 6 Switches for expanding the Nosso installer Nosso switch (9.x) 7-zip switch (10.x) Description -nos_ne -sfx_ne Do not execute any file after installation (overrides the -e switch) This switch should be used if user only wants to extract the installer contents and not run the installer. -nos_nd -sfx_nd Do not delete files after installation (overrides the -r switch) The -r switch uses the existing folder and overwrites the extraction files to the same folder without creating an additional extraction folder. -nos_o -sfx_o Specifies the name of folder where the contents of the expanded package are to be placed. The folder name should be enclosed in quotation marks. It is best if you do not use an existing folder, and there should be no space following the“-nos_o”. For example: \AdbeRdr90_en_US.exe nos_o”TestFolder” -nos_ne The default output folder is %TEMPDIR%/Adobe -sfx_va Validates the decompression of the deliverables. You can run MSI and Adobe switches from the same command line as described in Chapter 5, “The Command Line and msiexec” 10.x Acrobat updates 3/2/12: Enterprise Administration for the Acrobat Family of Products 21 1.5.1 10.x Acrobat updates To get to the latest version, non-AIP installations should use this order: Base release > latest quarterly > latest security update. Note: Installing the latest version always gets you the most functional and secure version. However, you should develop an update plan appropriate for your deployment methodology and business requirements. Tips, tricks, and gotchas  Installers are always MSPs.  Quarterly updates are cumulative to the base release and security patches are cumulative to the last quarterly. Thus, quarterlies always include all previously released out of cycle security patches.  You cannot rollback updates.  In AIP workflows, you cannot apply quarterly updates over a non-10.0 install: e.g. 10.1 over 10.0.1|2|3. AIP workflows are subject to constraints that don’t apply to bootstrapper workflows. Always archive your AIPs so you can restore to a previous version in case such a psuedo-rollback is required (uninstalling and starting over). While you can use the vomus switches to apply updates to end user machines directly, future installs via an AIP will require uninstalling and starting over with a new AIP.  In Bootstrapper workflows, install everything in order.  Save your MST for future use. 1.5.2 10.x Reader updates To get to the lasted version, install the product in this order: Latest MSI > latest quarterly > latest security update. Note: Installing the latest version always gets you the most functional and secure version. However, you should develop an update plan appropriate for your deployment methodology and business requirements. Tips, tricks, and gotchas  Installers can be MSIs or MSPs. MSI’s uninstall the product, so save your MST to reuse your customizations for future installs.  Quarterly updates are cumulative to the latest MSI (e.g. 10.1 replaces the base release of 10.0) and security patches are cumulative to the last quarterly. Thus, start with the latest MSI and add the latest MSPs.  Quarterlies always include all previously released out of cycle security patches.  You cannot rollback updates, so archive your AIPs in case you need to uninstall with /x and reinstall an earlier version. This may be required in those cases where workflows break due to changes in the product or bugs.  In AIP workflows, you cannot apply quarterly updates over a previous quarterly or security patch: e.g. 10.1 over 10.0.1|2|3. AIP workflows are subject to constraints that don’t apply to bootstrapper workflows. Always archive your AIPs so you can restore to a previous version in case such a psuedorollback is required (uninstalling and starting over). While you can use the vomus switches to apply 8.x-9x Acrobat updates 3/2/12: Enterprise Administration for the Acrobat Family of Products 22 updates to end user machines directly, future installs via an AIP will require uninstalling and starting over with a new AIP.  In Bootstrapper workflows, install everything in order.  Save your MST for future use. 1.5.3 8.x-9x Acrobat updates To get to the lasted version, install the product in this order: Base release > all the quarterlies > latest security update. Tips, tricks, and gotchas  Installers are always MSPs.  Start with the latest MSI (e.g. 9.3 replaces the base release of 9.0)  Install all the MSP quarterlies in order. These include interim security updates. In other words, quarterly updates include the most recent out of cycle patches.You do not need to apply any out of cycle patches if you are applying a more recent quarterly update.  Install the latest MSP out of cycle patches. Do not apply a quarterly updates to an AIP in which an out of cycle patch was the most recently applied update. To deploy a new, full quarterly update from an AIP, create a new AIP.  You cannot rollback updates, so archive your AIPs in case you need to uninstall with /x and reinstall an earlier version. This may be required in those cases where workflows break due to changes in the product or bugs.  In AIP workflows, you cannot apply quarterly updates over a previous security patch. AIP workflows are subject to constraints that don’t apply to bootstrapper workflows. Always archive your AIPs so you can restore to a previous version in case such a psuedo-rollback is required (uninstalling and starting over). While you can use the vomus switches to apply updates to end user machines directly, future installs via an AIP will require uninstalling and starting over with a new AIP.  In Bootstrapper workflows, install everything in order.  Save your MST for future use. 1.5.4 8.x-9x Reader updates To get to the lasted version, install the product in this order: Latest MSI > all the latest quarterlies > latest security update. Tips, tricks, and gotchas  Installers can be MSIs or MSPs. MSI’s uninstall the product, so save your MST to reuse your customizations for future installs.  Start with the latest MSI (e.g. 9.3 replaces the base release of 9.0)  Install all the MSP quarterlies in order. These include interim security updates. In other words, quarterly updates include the most recent out of cycle patches.You do not need to apply any out of cycle patches if you are applying a more recent quarterly update.  Install the latest MSP out of cycle patches. Do not apply a quarterly updates to an AIP in which an out of cycle patch was the most recently applied update. To deploy a new, full quarterly update from an AIP, create a new AIP. Licensing 3/2/12: Enterprise Administration for the Acrobat Family of Products 23  You cannot rollback updates, so archive your AIPs in case you need to uninstall with /x and reinstall an earlier version. This may be required in those cases where workflows break due to changes in the product or bugs.  In AIP workflows, you cannot apply quarterly updates over a previous security patch. AIP workflows are subject to constraints that don’t apply to bootstrapper workflows. Always archive your AIPs so you can restore to a previous version in case such a psuedo-rollback is required (uninstalling and starting over). While you can use the vomus switches to apply updates to end user machines directly, future installs via an AIP will require uninstalling and starting over with a new AIP.  In Bootstrapper workflows, install everything in order.  Save your MST for future use. 1.6 Licensing Distributing Reader requires signing a distribution agreement. Acrobat deployments require a license. 1.6.1 Reader deployments To distribute Adobe Reader on a CD, with a computer product, or within your enterprise, you must 1. Go to http://www.adobe.com/products/reader/rdr_distribution1.html. 2. Choose Apply to distribute Reader. 3. Read the information on the page and fill out the required information. 4. Fill out the form and choose Accept and Submit. After responding, you will be notified within two days whether your application has been accepted or denied. 5. Your confirmation e-mail will contain a link for the Reader download.The license agreement is good for one download. The license agreement is good for one year, and you will receive a reminder by email in advance of the expiration date. 1.6.2 Acrobat deployments One off Acrobat installations simply require entering the license key as you install the application. For batch and remote deployments, the licensing methodology varies by deployment method as described below. 1.6.2.1 Macintosh Beginning with Acrobat 10.0, Macintosh deployments can be streamlined via support for Apple Remote Desktop and the Adobe Provisioning Tool (APT). As described in Chapter 15, “Deployment Methods (Mac)”, APT enables bulk preserialization of Acrobat during deployment time. Acrobat deployments 3/2/12: Enterprise Administration for the Acrobat Family of Products 24 1.6.2.2 Windows Licensing: and the Customization Wizard If you are using the Wizard to configure the application prior to deployment, enter the license information in the user interface as described in the user documentation. Doing so writes the serial number information to the abcpy.ini file. This file needs to be placed in the same directory as the MSI used at installation time. Licensing: MSI deployments Installations that use MSI files require that the Abcpy.ini file contain the serial number information for the application. For example, during an administrative installation point deployment, the MSI file reads Abcpy.ini to get the needed information. If you have not used the Wizard, set this up manually as follows: 1. Open Abcpy.ini in a text editor. 2. Find ISX_SERIALNUMBER. 3. Add the serial number. 4. Save and close the file. 5. Verify Abcpy.ini is located in the same directory as the MSI prior to installation. Example 1.3: Abcpy.ini file ;*************************************************************** ;OEM Installation Options ;*************************************************************** [OEM Install] ISX_SERIALNUMBER= USERNAME= COMPANYNAME= INSTALLDIR= Licensing: EXE deployments Deployments that use EXE files require that the Setup.ini file contain the serial number information for the application. For example, during a bootstrapper Setup.exe deployment, the EXE file reads Setup.ini to get the needed information. You can set this up manually as follows: 1. Open Setup.ini in a text editor. 2. Find ISX_SERIALNUMBER. 3. Add the serial number. 4. Save and close the file. 5. Verify Setup.exe located in the same directory as the EXE prior to installation. Licensing: Command line The license key can be entered on the command line during deployment by using the ISX_SERIALNUMBER property. Identifying deployed applications 3/2/12: Enterprise Administration for the Acrobat Family of Products 25  To run the installer by using setup.exe, enter: Setup.exe ISX_SERIALNUMBER="" /sAll  To run the installer by using the msiexec program, enter: msiexec.exe /qn /i ".msi" ISX_SERIALNUMBER="" 1.7 Identifying deployed applications In enterprise settings, administrators often need to know application installation details and versions prior to deploying or updating their applications. Certainly information such as product version and license type will be part of many update and patch workflows. Adobe provides this data as part of the application’s preferences; for example, in the registry on Windows and in similar locations on other platforms. The methodology for gathering this information via scripted registry queries, server-based client management software, and other 3rd party methods is outside the scope of this document. The following methodologies are possible:  Acrobat X products: There are two ways to determine the version:  Decoding product details via Windows GUID  MSI API  Acrobat 9.x and earlier: Use both Decoding product details via Windows GUID and VersionMax and VersionMin (9.x earlier).  Adobe Reader 9.x and earlier: See Decoding product details via Windows GUID. 1.7.1 Decoding product details via Windows GUID Administrators can determine the variations of Acrobat and Adobe Reader deployed across their organization by using asset management tools to query for the product’s GUID. The Windows Installer Service creates this key automatically when the product is properly installed initially, but it is also updated when product is patched. For the Acrobat family of products, the GUID indicates the following:  Product family: Acrobat.  Version: For example, version 9.  Language: For example, English versus English/French/German.  Additional languages: Other languages included in the package.  Product type: Adobe Reader, Standard, Professional, 3D, etc.  License type: Whether the retail or license product is installed.  Major version: For example, 8 or 9. For releases every one to two years.  Minor version: For example .1 or .2. Typically for quarterly releases.  Minor-minor version: For example .1. Typically for patches. Decoding product details via Windows GUID 3/2/12: Enterprise Administration for the Acrobat Family of Products 26 During installation, the product GUID is created as a Value/Data pair in the registry. Each GUID section represents information using a combination of hexadecimal and telephone keypad indicators. Each release and language group receives a unique product code. In the InstallShield project, this code is specified in the Product Configuration panel for the release type. Installers update the GUID though patches do not. Patches (.msp files) target the originating GUID for patch transformation, and thus do not change the GUID. Note that the value’s actual name is always ENU_GUID even when other languages are also present (for example, FRA, DEU, ESP). As shown in Table 7, the GUID for Reader indicates the major, minor, and minor-minor version. However, for 9.x versions of Acrobat and earlier, the GUID does not identify the minor-minor version. Note: The only time the GUID is updated is when the product is installed with a new MSI installer. The GUID is not updated for patches that don’t use an MSI installer. Thus, VersionMin should also be checked when trying to verify the product version. GUID construction The basic formula for constructing and decoding the GUID is as follows:  Acrobat: Example: AC76BA86-1033-F400-7760-100000000002 ----  Reader: Example: AC76BA86-7AD7-1033-7B44-A70500000002 ----  Acrobat Elements (no longer supported): Example: E5E6E687-1033-0000-0000-000000000002 Tip: Refer to Table 7 for a key as to how the values are computed. GUID deconstruction Using the formula above with the elements in Table 7then, Example 1.4 translates to: Acrobat 9.0 Professional, English/French/German, volume license. Example 1.4: GUID [HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\\\Installer] "ENU_GUID"="{AC76BA86-1033-F400-7760-1000003D0004}" Table 7 GUID guidelines for Acrobat Standard, Professional and 3D ID Description product family The first section of the product code attempts to spell the product family using a combination of hexadecimal and telephone keypad indicators. For example: AC - The first two letters of Acrobat using hexadecimal indicators 76 - The letters RO using telephone keypad indicators BA - Two more letters of Acrobat using hexadecimal indicators 8 - The letter T using a telephone keypad indicator 6 - The number 6, indicating product version The last digit is no longer used to determine version. A better indicator of version is noted below. Decoding product details via Windows GUID 3/2/12: Enterprise Administration for the Acrobat Family of Products 27 GUID registry location The GUID is written to a variety of locations. However, Adobe recommends you use the following:  32 bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\{application}\{version}\Installer\  64 bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\{application}\ {version}\Installer\ Reader ID Reader only: 7AD7 language code This second section of the product code contains the four-letter default language code (as defined by Microsoft and used by legacy InstallShield and MSI installers). For language code IDs, see Locale and language codes. For Microsoft details, see http:// msdn.microsoft.com/en-us/goglobal/bb964664.aspx. additional languages A hexadecimal representation of extra languages (ex. "DF60" == DFN == Danish Finnish Norwegian). Use the first letter of the language's country code if it is between A-F. (D = Danish); Otherwise, use a telephone keypad indicator to represent the language. (ex. 6 = Norwegian). For example: F - French, using a hexadecimal indicator 4 - German, using a telephone keypad indicator 00 - No other languages product type The product using hexadecimal and telephone keypad indicators as follows: 7760 - Acrobat Pro (PRO using telephone Keypad indicators, followed by a zero) BA7E - Acrobat Standard 7B44 - ReaderBig 7761 - 3D license type Acrobat only: In the last number series: The first digit in the last indicates volume or retail use. For example, in 100000000002, the leading1 indicates volume licensing. 0 indicates retail licensing. This series is always preceded by an“A” for Reader. Acrobat major version In the last number series, the last digit indicates the major version as follows: 1: version 6 2: version 7 3: version 8 4: version 9 5: version 10 Reader major version The last number series is always preceded by an A and the actual Major.MajorMinor version number.The last digit indicates the minor version. Thus, the formula is: {A}+{Major #}+{MajorMinor # if any}+{zeros}+{MinorMinor version if any} For example:  Reader 9.2 = A920000000001 (1 = 0)  Acrobat 10.1 = {AC76BA86-1033-F400-7760-000000000005} Table 7 GUID guidelines for Acrobat Standard, Professional and 3D ID Description Decoding product details via Windows GUID 3/2/12: Enterprise Administration for the Acrobat Family of Products 28 GUID installer package location Administrators interested in dissecting installer packages prior to deployment can find the GUID in the installer msi package (Figure 3). To find the GUID in an installer, go to Property > ProductCode, and look in the Value column (Figure 3). Note: The only time the GUID is updated is when the product is installed with a new MSI installer. The GUID is not updated for patches that don’t use an MSI installer. Thus, VersionMin should also be checked when trying to verify the product version. Figure 3 Installer MSI: GUID GUID examples Table 8 Example GUIDs Product GUID Acrobat 10.1 {AC76BA86-1033-F400-7760-000000000005} Adobe Reader 9.2 AC76BA86-7AD7-1033-7B44-A70500000002 Acrobat Professional 8.0 {AC76BA86-1033-0000-7760-000000000003} Acrobat Standard 8.0 {AC76BA86-1033-0000-BA7E-000000000003} Reader 8.0 {AC76BA86-7AD7-1033-7B44-A80000000002} Acrobat Professional 7.0 retail edition {AC76BA86-1033-0000-7760-000000000002} Acrobat Professional 7.0 volume license edition {AC76BA86-1033-0000-7760-100000000002} Acrobat Standard 7.0 retail {AC76BA86-1033-0000-BA7E-000000000002} Acrobat Standard 7.0 volume license edition {AC76BA86-1033-0000-BA7E-100000000002} Acrobat 3D retail {AC76BA86-1033-F400-7760--000003D0002} Acrobat 3D volume license edition {AC76BA86-1033-F400-7760-1000003D0002} Reader 7.0 {AC76BA86-7AD7-1033-7B44-A70000000000} VersionMax and VersionMin (9.x earlier) 3/2/12: Enterprise Administration for the Acrobat Family of Products 29 1.7.2 VersionMax and VersionMin (9.x earlier) This method is deprecated and is not used for X products. The installer creates keys during installation which identifies the product version. Administrators can use those keys to automatically query which version of the application is installed and therefore ensure patch status.  VersionMax: Identifies the major version and any major dot release. For example, 9.3 would be 90003. Thus, VersionMax is a 4 digit representation of major version (first number before the dot) with an appended integer value indicating the major dot release, if any.  VersionMin: Identifies the minor dot release which is appended to VersionMax, if any. For example, 9.3.0 would be 0 and 9.3.1 would be 1).Thus, VersionMin is the integer value of the number after the second dot. Note: VersionMin must be used in conjunction with the GUID to identify the minor-minor version of Acrobat. VersionMax-Min location These preferences reside in the following locations:  32 bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\{application}\{version}\Installer\  64 bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\{application}\ {version}\Installer\ 1.7.3 MSI API For 10.x product versions, you can use the MSI API to determine the product version. To use the MSI API, use the MsiEnumRelatedProducts() and MsiGetProductInfo() as shown in Example 1.5. For more information about these APIs, see http://msdn.microsoft.com/en-us/library/ aa370130(VS.85).aspx. Example 1.5: Product version via MSI API //UpgradeCode is a family of ProductCodes //ProductCode property is what you need to get installed Product Info void GetProductInfo() { Reader 7.0.5 {AC76BA86-7AD7-1033-7B44-A70500000002} Acrobat 7.0.1 and Reader 7.0.1 Update {AC76BA86-0000-7EC8-7489-000000000702} Acrobat 7.0.2 and Reader 7.0.2 Update {AC76BA86-0000-7EC8-7489-000000000703} Acrobat 7.0.3 and Reader 7.0.3 Update {AC76BA86-0000-7EC8-7489-000000000704} Acrobat 7.0.5 and Reader 7.0.5 Update Use the product ID 7.0 listed above Adobe Acrobat 7.0.7 and Reader 7.0.7 update {AC76BA86-1033-F400-7760-100000000002} Adobe Acrobat 7.0.8 and Reader 7.0.8 update {AC76BA86-1033-0000-7760-100000000002} Table 8 Example GUIDs Product GUID Trial Acrobat installations 3/2/12: Enterprise Administration for the Acrobat Family of Products 30 CString sUpgrdCode = _T("{A6EADE66-0000-0000-484E-7E8A45000000}");//All Reader installers (any version) have the same UpgradeCode //UpgradeCodes for Acrobat - these values do not change //APEX {AC76BA86-0000-0000-7761-7E8A45000000}; //Pro {AC76BA86-0000-0000-7760-7E8A45000000}; //Std {AC76BA86-0000-0000-BA7E-7E8A45000000}; CString sProdCode; DWORD dw = ERROR_SUCCESS; for(int index = 0; dw == ERROR_SUCCESS; index++) { dw = MsiEnumRelatedProducts(sUpgrdCode, 0, index, sProdCode.GetBuffer(MAX_PATH)); sProdCode.ReleaseBuffer(); if(dw == ERROR_SUCCESS) { UINT ret; TCHAR sVersionString[MAX_PATH] = {0}, sVerMajor[MAX_PATH] = {0}; DWORD dwSize = 10; ret = MsiGetProductInfo(sProdCode, INSTALLPROPERTY_VERSIONMAJOR, sVerMajor, &dwSize); //ret = MsiGetProductInfo(sProdCode, INSTALLPROPERTY_VERSIONSTRING, sVersionString, &dwSize); } } } 1.8 Trial Acrobat installations Note: There is no trial version for Macintosh. 1.8.1 Installing a trial version without a serial number Sometimes it may be expedient to install the product without a serial number. For example, when creating a disk image for trial use or when you don’t know how many seats you may eventually need. To do so, install the product without a serial number prior to creating your image. If you do not pass a serial number via ISX_SERIALNUMBER, a trial version of the product is automatically installed. The ISX_SERIALNUMBER property is usually used in setup.ini, abcpy.ini, or on the command line. Simply make sure you are not using that property. 1.8.2 Migrating a trial version to a licensed version If you’re trial version is expiring you can upgrade your installs without a reinstall as follows: 1. Obtain an enterprise volume license. Migrating a trial version to a licensed version 3/2/12: Enterprise Administration for the Acrobat Family of Products 31 2. Download the Adobe Application Manager, Enterprise Edition 2.1 (Windows) from http:// www.adobe.com/products/creativesuite/technical-resources.html?cq_ck=1308180545248#toolstraining. AAMEE includes the Adobe Provisioning Tool. 3. Extract and run the AAMEE installer. 4. Open a command line. 5. Navigate to the APT downloaded tool. A typical path looks like: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\Enterprise\utilities\APTEE 6. Run: adobe_prtk --tool=ReplaceSN --serialize=LEID --serial= Note: The product ID (LEID) for Acrobat X is“AcrobatPro-AS1-Win-GM” Client Configuration and Tuning Planning and Tuning Preference Basics Feature Lockdown 2 33 Pre-Deployment Planning and Customization 2.1 Configuration planning A key step in planning for deployment is to decide the installation parameters and user preferences you would like to set. You can specify both the installation type (silent, reboot, etc.) and product preferences (application settings such as whether to update, enable security, etc.). Depending on your requirements, you may make use of one or more of the following:  command line: For running msiexec commands and setting both MSI and Adobe properties  Customization Wizard: For copying registry settings and folders/files from existing installations as well as creating new configurations.  Manual manipulation of the registry pre and post deployment. Post deployment product configuration is common, and IT personnel often manage preferences via standard (non-Adobe technologies) such as GPO or SCCM. Tip: A database of registry and plist preferences resides in the Administrator's Information Manager (AIM). AIM is an AIR application containing the Preference Reference for Windows and Macintosh, Feature inSight, and other resources. 2.1.1 Preferences 2.1.1.1 Configuration Configure preferences via the Wizard, installer tables, or the command line. For example, common tasks include turning off the EULA, disabling the updater, and disabling acrobat.com integration. There are hundreds of other preferences that you can use to control workflows, certificate processing, data handling, communications with others servers, and so on. Refer to the Preference Reference in Administrator’s Information Manager (AIM). AIM is an AIR application containing a database of preferences and other resources. 2.1.1.2 Migration and updates Most application settings are not automatically migrated. If you inspect the TransferRegistry table via the Wizard, Orca, etc, you can see what gets migrated. When deploying, keep in mind the following:  MSIs uninstall the existing product before continuing with the new installation. Therefore, you should save your existing MST for future MSI deployments. Alternatively, you can keep a reference copy of the application from which you can leverage the registry settings each time.  MSPs don't uninstall the product, so existing settings remain intact. Note that Adobe has implemented cumulative updates with 10.0 and beyond, thereby greatly simplifying keeping the product up to date. The intention is to provide MSI installers rarely and only when required due to the extensive nature of changed features or fixes. For 10.x products, quarterly MSPs are cumulative to the last MSI, and out of cycle patches are cumulative to the last quarterly. You can always remain up to date with no more than two chained installers. Also, MSIs are rarely released, thereby reducing the number of installs that require setting migration. Pre-Deployment Planning and Customization What products and versions can coexist? 3/2/12: Enterprise Administration for the Acrobat Family of Products 34 Tip: SCCM users should note that SCUP catalogs can't deliver anything but a generic installer. Because enterprises use different configurations, there is no way for Adobe to provide installers tailored to individual organizations. However, MSPs do not change existing settings, and MSI deployments always involve using an MST to migrate settings. 2.1.2 What products and versions can coexist? 2.1.2.1 Reader and Acrobat on a single machine With 10.x products it is possible to for different products and versions to coexist on a single machine as follows:  Any version of Reader 10.x and Acrobat 10.x.  Reader 10.x and Acrobat 9.x. This configuration allows IT to install the more secure Reader with its sandboxing features while retaining the more functional Acrobat. This configuration should be tested before enterprise-wide deployments. Tip: For information about maintaining the integrity of regulated and certified workflows by controlling which product versions and products open specific PDFs, see Chapter 14, “Multi-User Reader Desktop Configuration”. 2.1.2.2 Setting the default PDF handler Prior to 10.x, Adobe did not recommend or support having both applications installed on the same system. Ideally, Acrobat should be upgraded to the latest version and used as the default viewer since it provides the best performance and security. If you do deploy both applications, the installer sets Acrobat as the more functional of the two applications as the default PDF viewer. If the Acrobat application is an early version such as 5 or 6, opening PDFs can be significantly slower than with Reader. The default handler can be set in the following ways:  For 10.0 and later, the product allows the user to specify the default PDF handler on first launch.  Admins can preset that choice via a registry/plist preference stored at HKLM\SOFTWARE\Adobe\ Installer\{product GUID}\DEFAULT_VERB.  For pre-deployment configuration of the installer, on the command line or in an MST file. See Adobe installer properties for more information.  Via the user interface by choosing Preferences > General > Select Default PDF Handler.  Admins can prevent end users from changing the setting by using the HKLM feature lockdown preference DisablePDFHandlerSwitching. 2.1.3 Plug-ins Many organizations use plug-ins for Reader to customize their workflows to meet their particular needs. The Customization Wizard allows you to specify custom plug-ins for automatic installation. You can use plug-ins from third-party suppliers or develop your own using the Acrobat Software Developers Kit (SDK). For more information, see the Acrobat Developer Center: http://www.adobe.com/devnet/ acrobat/. Pre-Deployment Planning and Customization iFilter configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 35 2.1.4 iFilter configuration The Adobe® PDF iFilter is designed for end users or administrators who wish to index Adobe PDF documents using Microsoft indexing clients. This allows the user to easily search for text within Adobe PDF documents. The key benefits include:  Integrates with existing operating systems and enterprise tools.  Provides an easy solution to search within local or networked Adobe PDF documents.  Greatly increases your ability to accurately locate information. 32-bit Acrobat 9.x and later products bundle a 32-bit PDF iFilter. It uses the Microsoft iFilter interface and allows third-party indexing tools to extract text from Adobe PDF files. 64-bit versions are available as an add-on from http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows. Searching attachments and portfolios By default, attachments are not searchable inside Windows desktop search because iFilters for Windows Desktop Search (WDS) run in a filter isolation process (SearchFilterHost.exe). The process runs under the Local System security context with restricted rights which doesn’t permit creating temporary files. Since searching attachments requires creating a temp file, attachment searches fail. The workaround is to make WDS allow the PDF iFilter write a temp file so that it can extract contents out of PDF file attachments. To do so: 1. Open the registry. 2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gathering Manager\ UseSystemTemp. 3. Set the value to 1. 2.1.5 Sharepoint integration See Chapter 13, “SharePoint Integration”. 2.1.6 Acrobat.com integration All versions of Acrobat and Reader after 9.0 provide some level of acrobat.com integration by default. Disable Acrobat.com integration by setting preferences via one of the following methods:  Use Customization Wizard to disable Acrobat.com menus. Table 1 iFilter availability for both Acrobat and Reader Version 32-bit 64-bit iFilter version an notes Reader 8.x bundled None Version 6. Acrobat 8.x bundled bundled Version 6. All 9.x bundled Add on Version 9. First added in 10.1. 32 bit not in 10.0-10.0.3 All 10.x bundled Add on Version 9. Security improved with 10.1 Pre-Deployment Planning and Customization Configuring Reader Help for offline use 3/2/12: Enterprise Administration for the Acrobat Family of Products 36  Edit the registry-plist to disable the acrobat.com features. For example, you can set the following: [HKEY_CURRENT_USER\Software\Adobe\(product name)\(product version)\Workflows] "bEnableAcrobatHS"=dword:00000000 Note: The are a number of acrobat.com settings which allow you to fine tune acrobat.com access. For details, refer to the Preference Reference in Administrator’s Information Manager (AIM). If you disable access to Acrobat.com, take care to avoid inadvertently prevent access to shared reviews. 2.1.7 Configuring Reader Help for offline use With 10.x products, the Reader Help system is only available online. If the product does not have online access, configure the installations to point to a local version on your Intranet. Note: For alternative solutions as well as solutions for 9.x, see http://kb2.adobe.com/cps/865/ cpsid_86505.html. To configure local access to Help for 10.x products: 1. Download the Help from http://help.adobe.com/en_US/reader/using/reader_X_help.pdf. 2. Install it in some accessible location. 3. Place the JavaScript in Example 2.1in the JavaScripts directory of each installed client. For example, (C:\Program Files\Adobe\Reader \Reader\Javascripts). This script replaces the existing Help link with your custom link. Tip: The easiest way to place this file prior to deployment is by using the Customization Wizard’s Files and Folders feature. The Wizard allows you to create an MST file that will modify the installer with any of your customizations. Example 2.1: Help menu JavaScript /********************************************************************* Copyright (C) 1998-2011 Adobe Systems Incorporated. All rights reserved. NOTICE: Adobe permits you to use, modify, and distribute this file in accordance with the terms of the Adobe license agreement accompanying it. If you have received this file from a source other than Adobe, then your use, modification, or distribution of it requires the prior written permission of Adobe. *********************************************************************/ /****************************** Hide Menu ********************************/ //Hide the default Help menu app.hideMenuItem("HelpReader"); /****************************** Menu Execution items **********************/ app.addMenuItem({ cName: "Adobe Reader Help PDF", cParent: "Help", cExec: "fTDocs1()", nPos: 0}); /***************************** Functions ************************************/ // Note: The "/C/Program Files/Adobe/" convention was used to conform to the // Adobe SDK format but the installer does not do this so you may need to Pre-Deployment Planning and Customization AIR 3/2/12: Enterprise Administration for the Acrobat Family of Products 37 // edit the path for your system. function fTDocs1() {app.openDoc("/C/Program Files/Adobe/Reader 10.0/Help/reader_X_help.pdf");}; 2.1.8 AIR Reader X does not include the AIR runtime, but 9.x English language versions provided from the Reader Download Center do install the AIR™ runtime. There are several ways to avoid AIR installation:  Download the enterprise installer without AIR from ftp://ftp.adobe.com/pub/adobe/reader/, or  Use installer properties on the command line or in the bootstrapper’s Setup.ini file during installation to prevent AIR installation. For details, see The Command Line and msiexec. 2.2 Customizing installations Installer customizations are the norm in enterprise settings. Administrators usually want to enable, disable, and preconfigure numerous features. There are three alternatives:  Manual configuration  Tuning with the Customization Wizard  Some combination of the two above. If this is a new installation, this is the most common choice. You will likely install the application, configure it manually, further configure it via the Wizard, and then copy the MST to the administrative installation point. 2.2.1 Manual configuration MSI and Adobe-specific properties can be set on the command line during install time. For details, see The Command Line and msiexec. 2.2.2 Tuning with the Customization Wizard Tip: Wizard documentation is included with the application, but the latest PDF or CHM (compiled help) documentation can be downloaded from www.adobe.com/go/ acrobatitinfo. The Adobe Customization Wizard enables tuning the Windows installer for Adobe products prior to mass deployments. The Wizard is a free, downloadable utility designed to help IT professionals take greater control of enterprise-wide deployments of any of the Acrobat family of products. Note: Prior to version 8, customization was handled by the Adobe InstallShield Tuner® utility. The Wizard enables IT to:  Modify the installer via a transform file (MST file) without altering the original package (MSI file).  Leverage existing installations by drag and dropping registry settings and file from already configured applications.  Take advantage of an intuitive user interface to customize the Installer. Pre-Deployment Planning and Customization Tuning with the Customization Wizard 3/2/12: Enterprise Administration for the Acrobat Family of Products 38  Optimize installer behavior by including silent installation, pre-serialization, reboot, multilingual, and custom setup choices.  Optimize first time startup behavior including suppressing the EULA, registration prompts, and the Getting Started window.  Customize key application preferences such as collaboration and security settings, access point to Acrobat.com, and any other feature.  Prevent users from modifying certain preferences by locking them. Note: Although many tools (such as Orca and Admin Studio) and can be used to customize Microsoft transform (MST) files, Adobe Technical Support only supports the Adobe Customization Wizard and the supported command line options. To download the Wizard, go to:  10.x: ftp.adobe.com/pub/adobe/acrobat/win/10.x/10.0.0/misc/  9.x: ftp.adobe.com/pub/adobe/acrobat/win/9.x/9.0/misc/ 2.2.2.1 Basic Wizard Tuning The Wizard provides a user interface for modifying the installation without preinstalling the application. You can modify the registry, files, and user interface options using only the Wizard. However, to take full advantage of the application’s configuration options, advanced users should skip this section and proceed to “Advanced Wizard tuning for new installations” on page 39. The limitations to only using the Wizard UI include:  Files and Folders: Many template files won’t exist unless you have installed and configured the application. For example, the easiest way to create a directory server file is via the application’s GUI.  Registry-plist: Many application preferences and directories do not exist until the code is exercised from an installed application. While you could build the paths and add the values manually, simply configuring an installed application and using it as a template does most of the work for you.  Other options: The Wizard does not provide an UI for every configurable option, but much of the application’s behavior is modifiable. Installing, configuring, and using the application is the quickest way to understand how and why the installer should be modified to suit your environment. Pre-Deployment Planning and Customization Tuning with the Customization Wizard 3/2/12: Enterprise Administration for the Acrobat Family of Products 39 Figure 1 Wizard: Main user interface 2.2.2.2 Advanced Wizard tuning for new installations The Wizard’s user interface (GUI) only provides basic options for security configuration. Moreover, using the Wizard’s GUI to set preferences will result in overwriting existing registry settings that you might drag and drop from your template application. For these reasons, power users--those with extensive experience modifying the registry and who are familiar with the products advanced features--may want to utilize a more manual process. A feature rich deployment workflow involves the following: 1. Install the new application (or use an already configured existing installation). 2. Configure the application via its user interface. In particular, go through the menus under Edit > Preferences. Tip: UI configuration modifies, files, installer properties, and the registry. There are dozens of registry preferences that you can use to control, feature access, workflows, certificate processing, data handling, communications with others servers, and so on. Refer to the Preference Reference in Administrator’s Information Manager (AIM). AIM is an AIR application containing a database of preferences and other resources. 3. Lock down features so that settings can not be changed by end users. See the Preference Reference for available options. 4. Use the Wizard to drag and drop the configured template registry to the installer. 5. Use the Wizard to configure application preferences not already configured manually. Pre-Deployment Planning and Customization Multilanguage (MUI) configuration (Reader only) 3/2/12: Enterprise Administration for the Acrobat Family of Products 40 6. Set up file deployment: 1. Click on Files and Folders to open a directory of files on the source computer that enables copying existing files to the destination system. You can add or remove files from the installation list and modify file records. Copy preconfigured files from an existing installation from the top window to the appropriate folder in the bottom window under Destination Computer. 2. Copy needed files. Paths vary by application, version, and user. For example, on Windows XP, drag and drop all acrodata files from C:\Documents and Settings\\ Application Data\Adobe\Acrobat\\Security to CommonAppDataFolder\Adobe\\\Replicate\ Security. Acrodata files could include:  addressbook.acrodata: Populates the Trusted Identity Manager with certificate data. This file can be used to distribute a trust anchor for signature validation.  directories.acrodata: Populates the directory server list in the Security Settings Console. This file can be used to configure connections to an LDAP server used as a certificate repository.  Appearances.acrodata: Stores signature appearances. Unless there is a shared company appearance, do not use this file.  security-policy.acrodata: Populates the security policy list in the Security Policy Manager. This file can be used to distribute common document security policies. 3. Copy other needed files to a custom or existing directory. For example, expand the Destination Computer directory ProgramFileFolder\Adobe\Acrobat \Acrobat\ and create a new folder called Security. Some common files that may be distributed this way include:  SignatureLogo.pdf: To create a watermark or logo on each employee signature, create the logo and manually copy the file to the Documents and Settings Directory under their username.  PKCS#11 drivers: If you use smart cards, you can distribute drivers that end users can import via the Security Settings Console.  Custom security handlers: If you have developed a custom handler for signing or document security, install it in the application’s plugin directory. Note: The tuned installer will copy these files to the matching location. You are now ready to deploy the application as described in the Wizard’s documentation. 2.2.3 Multilanguage (MUI) configuration (Reader only) Multilanguage (MUI) installers provide a way to install Reader with support for more than one language. Features include:  Support for more than one language so that users can switch languages.  Automatic selection of the language based on the language of the current OS. MUI usage requires a MUI installer. The base installer is an MSI file, and MSP patches are also periodically released which can only be applied over the base mui MSI install. Both installers are identified by“_mui” in the filename. Pre-Deployment Planning and Customization Multilanguage (MUI) configuration (Reader only) 3/2/12: Enterprise Administration for the Acrobat Family of Products 41 Tip: MUI installers are only created in tandem with full MSI installers. They are not created for MSP updates and patches. For example, 10.0 and 10.1 include MUI installers while 10.0.1, 10.0.2, and 10.0.3 do not. Download the MUI installer from ftp.adobe.com/pub/ adobe/reader/. The MUI Reader always contain the base English resources. To support another language, an additional resource bundle is added to the installation. Therefore, English is always present, and the single language Reader is about the same size as the MUI Reader. The installation size varies with the type of install:  Bootstrapper (setup.exe) or UI-based installer: The size is approximately 275 MB larger than the single language version because the full installer is kept on the disk.  AIP install: Except for minor differences in some of the text files, the size of the MUI Reader will be about the same as the single language Reader. 2.2.3.1 MUI configuration via the Customization Wizard When a mui installer is opened in the Wizard, mui configuration options appear in the Installation Options panel. Select one of the following options:  Allow the user to choose the installation language: Provides the user the user will have the option of selecting an available language to use during installation. Deselecting this box enables the Install Language drop down list.  Install Language: Provides a drop down list of available languages you can preselect for the user. The setup.ini command line will be set to /sl . 2.2.3.2 MUI configuration via the registry You can configure the application to use the OS language for MUI installers as follows: 1. Navigate to HKEY_CURRENT_USER\Software\Adobe\\\Language. 2. Create a key called UseMUI. 3. Right click and choose New > DWORD value. 4. Set the value to 1. Tip: You can also create a machine-level setting at HKEY_LOCAL_MACHINE\SOFTWARE\ Adobe\Adobe Acrobat\(version: 10.1 or later)\Language\UseMUI. End users cannot change this setting without administrator privileges. For more detail about Language and other preferences, see the Preference Reference. 2.2.3.3 Non mui language selection via the command line Before starting, verify you have the correct installer. There are several installer types:  Single language installers identified by the lang_ID in the installer name (e.g. en_US).  Tier installers identified by tier_# in the installer name that typically support 4 or more languages. For example, Tier 1 supports English, French, German, and Japanese.  MUI installers identified by _mui in the installer name. Pre-Deployment Planning and Customization Multilanguage (MUI) configuration (Reader only) 3/2/12: Enterprise Administration for the Acrobat Family of Products 42 Tip: In addition to the filename, you can also check the setup file directory which includes the language specific .mst files as well as the Acrobat msi file. These are identified by language ID codes (see Locale and language codes). The installer installs the default language unless a language specific mst is specified. To specify a non-default language for an AIP install, do the following: 1. Create the AIP. 2. Copy the language mst files as well as any custom mst you may have to the AIP directory. Note: The language mst files provided with your installer do not automatically get copied to the Administrative Install Point (AIP) created by the msiexec utility. Transforms in the installer media directory do not require fully qualified paths in the command. Patches do require fully qualified paths. 3. Change directories to the AIP. 4. Patch the AIP to the desired level. 5. Deploy from the AIP. For example, to deploy a Dutch version of the product, use: msiexec /i AcroStan.msi TRANSFORMS="1043.mst;Custom.mst" /qf 2.2.3.4 Additional Windows XP configuration On Windows XP machines, the OS’s regional settings may need to be changed to enable non-Latin language selection during a MUI install. Regional switching is not an Acrobat feature but how Windows XP works with codepages. For more information about codepages, see Codepages. To change the OS settings: 1. Control Panel > Regional and Language Options. 2. Selected Advanced tab. 3. In Language for non-Unicode programs, select the Language. 4. For Japanese, Chinese, and Korean: 1. Choose the Languages tab. 2. Choose Install files for East Asian Languages. 3. Reboot if you don’t immediately see these languages available under Language for non-Unicode programs. Codepages XP uses codepages to enable certain character support. Codepages are the way Windows enabled non-Latin language character encodings before Unicode was supported. For an overview, see http:// en.wikipedia.org/wiki/Windows_code_page. Selecting a codepage activates all the languages associated with that code page. For example, changing the regional settings and selecting a codepage for Czech also makes Polish, Hungarian, etc. available, but not Turkish. Pre-Deployment Planning and Customization Wizard FAQs 3/2/12: Enterprise Administration for the Acrobat Family of Products 43 * Acrobat 9 languages not in Acrobat 10 ** Reader only 2.2.4 Wizard FAQs Why do I get the error "The Wizard cannot modify this MSI package. . ."?  You are trying to open a product MSI that is not supported. The Wizard checks a signature based on a GUID in the property table: the target product should have the requisite signature property as well as the expected major version value in the GUID.  You are using Acrobat Elements which is not supported by the Wizard.  The versions of the Acrobat product and Wizard are not identical. For example, the Wizard 9 can only be used with 9.x products and Wizard X can only be used with 10.x products. Why doesn’t my install respect the“silent install” settings I specified with the Wizard? If you command line is something like: MSIEXEC /I C:\somePath\AcroPro.msi TRANSFORMS="C:\somePath\AcroPro.mst Then you are not using Setup.ini your workflow. The Wizard rewrites Setup.ini when you specify a silent install to include this option. The silent install switch is not saved in the MST. Either run Setup.ini or change your command line to: MSIEXEC /I C:\somePath\AcroPro.msi TRANSFORMS="C:\somePath\AcroPro.mst" /qn Table 4 Language mapping to codepages Codepage Language 932 Japanese 949 Korean 936 Chinese Simplified 950 Chinese Traditional 1250 Czech, Polish, Hungarian, Croatian, Slovenian, Romanian, Slovak 1252 English, French, German, Italian, Spanish, Swedish, Dutch, Danish, Finnish, Norwegian, Brazilian Portuguese, Catalan**, Basque** 1254 Turkish 1251 Russian, *Bulgarian, Ukrainian 1257 Estonian*, Latvian*, Lithuanian* 3 44 Application Preference Basics Administrators often need to configure end user machines before deployment and manage, patch, and update those clients after deployment. Since manipulation of client side settings through the user interface is rarely scalable, configuration typically occurs at the registry or plist level. This configuration can be handled via the Adobe Customization Wizard prior to deployment, manually, or via standard scripting mechanisms with which you are already familiar. All of the Acrobat family of products are built on a uniform platform, share a common set of preferences, and are similar in their configuration details. Before continuing, you should know that:  The tables and examples use the Windows registry. Most are applicable to Macintosh, Unix, and Linux systems.  Feature lockdown is not available on Macintosh.  The root directory for registry settings stored on a per-user basis are at: HKEY_CURRENT_USER\ Software\Adobe\\\\.  The examples use Acrobat; other applications may provide different menu options.  Some keys do not appear in the registry until after a feature is used. Subdirectories also appear as the code is exercised.  Many preferences cannot be set thought the UI and must be manually created and configured at the registry level. Caution: Adobe strongly recommends that you do not make changes to the registry unless you are knowledgeable about editing and troubleshooting application settings. Improper use of this feature can result in the corruption of critical system files Before modifying the registry, make sure you understand what product versions are supported, what the default settings are, and how to create new keys. 3.1 Supported products In general, the preferences in this and related document apply to all products in the Acrobat family, including Acrobat Professional, Acrobat Standard, and Adobe Reader. While differences may be noted on a per-setting basis, if a product or product version does not support a feature, then its related registry setting is also unsupported. For example, setting all the signature preferences for Adobe Reader might not result in any behavioral change since Reader only supports signing under limited conditions. Note: This document originally included information applicable to versions as early as 7.0. Over time, these earlier versions become unsupported and certain preferences may become deprecated. Legacy content is not removed from this document, and differences between settings and versions are noted when known. Application Preference Basics Platform specifics 3/2/12: Enterprise Administration for the Acrobat Family of Products 45 3.2 Platform specifics The path to a particular key varies by platform. For example: 3.2.1 Windows On Windows, the a preference path is a registry path. The path varies with both the nature of the key and the OS as follows:  User modifiable keys. HKEY_CURRENT_USER (HKCU) stores settings that are specific to the currently logged-in user:  Current user keys: HKEY_CURRENT_USER\Software\Adobe\(product name)\(version)\ Note: Some HKCU keys have a matching key in FeatureLockdown.  Admin-only keys (require administrator privileges to modify). HKEY_LOCAL_MACHINE (HKLM) stores settings that are specific to the local computer.  Lockable keys (32 bit): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\(product name)\ (version)\FeatureLockDown\  Lockable keys (64 bit): HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe  Non lockable machine keys: HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\(product name)\ (version)\ 3.2.2 Macintosh Macintosh uses plist files to manage preferences. Look for the plist under Acrobat or Reader package > MacOS/Preferences. The plist path and keyname is in most cases similar to Windows. For example, to set the log level for the Acrobat Updater logging, on Windows you would set iLogLevel to 0 or 1. On Mac, you would do the following: 1. Go to Mac: com.adobe.ARM.plist. 2. Set LogLevel:  Brief: defaults write com.adobe.ARM.plist LogLevel -int 0  Verbose: defaults write com.adobe.ARM.plist LogLevel -int 1 3.2.3 Unix UNIX uses an equivalent of the registry key system used on Windows. Preferences are stored in a preferences file in the users' home directory. For example, .adobe/Acrobat/8.0/Preferences/reader_ prefs. Example 3.2: Preferences: UNIX /AVPrivate [/c << /ChooseLangAtStartup [/b false] /EULAAcceptanceTime [/i 1169559777] /ForceXFADirectRender [/b true] /SplashDisplayedAtStartup [/b true] /UnixLanguageStartup [/i 4542037] Application Preference Basics Default values 3/2/12: Enterprise Administration for the Acrobat Family of Products 46 /showEULA [/b false] >>] 3.3 Default values Some keys have default values which are used internally and do not appear in the registry. These keys may be overridden by the administrator’s registry configuration or as a result of a user’s action. Other keys are directly created as a result of some user action such as checking a checkbox or selecting a drop down list item or are indirectly generated by the application; for example, the application maintains a list of opened certified documents and their signature status the last time they were opened. The default values listed in the following tables only apply to fresh installations that have not been modified by the Adobe Customization Wizard. The values include:  N/A: The key does not exist at installation time or contains subkeys with no set value.  : Preferences that exist by default (are set at install time) are usually prepopulated with some value. many default preferences do not appear in the UI unless they are configured manually; that is, the application uses a value which is stored internally until it is overridden by the administrator. 3.4 Directory and key creation Many preferences are exposed in the API. The plugins use the cross platform ASCab preference mechanism supported by all Acrobat products. This mechanism uses calls such as AVAppGetPrefCab and AVAppSetPrefCab, that were introduced in Acrobat 5.0. Refer to the Acrobat and PDF Library API Reference for details on these calls. Most settings only appear if a certain part of the code is exercised. For example, cMain registry keys only appear if someone uses security envelopes (eEnvelopes prior to 8.0) to deliver a document securely. Some are set by the UI automatically; others must be manually added. On aWindows OS, many registry entries only exist (physically in the registry) if the value is manually set. Many default values are simply provided internally by the application. If you would like the application to automatically build the directories prior to registry customization, exercise the UI. For example, to configure digital signature-related settings: 1. Launch the application. This example uses Acrobat on Windows. Other applications on other platforms provide different menu options. 2. Navigate to the top level security-related menu items under the Advanced menu. Note: If you are not using the customization wizard or an existing installation, it is helpful to access the security-related menu to exercise the code and let the application build the directories. For example, directories are written to the registry when menu items are used as follows: Application Preference Basics Importing and exporting preferences 3/2/12: Enterprise Administration for the Acrobat Family of Products 47  Advanced > Manage Trusted Identities creates Security\PPKLite.  Advanced > Security Console creates Security\cASPKI.  Advanced > Manage Security Policies creates Security\PPKHandler and Security\ cSecurityConsole.  Advanced > Sign & Certify creates Security\cHandlers and Security\cPubSec. 3. Close the application. 3.5 Importing and exporting preferences For Windows machines, use the Customization Wizard to tune the application installer when upgrading or deploying in large, multi-user environments.There are other, scripted ways to manage configurations as well. The following describes a simple import/export method that should be familiar to administrators. For example, say you want to share trusted site settings: On Windows, begin by prepopulating the trust list in Acrobat’s user interface and then exporting the URL list from the registry. To create a trust list that can be shared across product installations, add the URL to the URL list manually by typing it into the edit field above the list box and then choosing Allow or Block as appropriate. Once you have built this list you and can export the HKEY_CURRENT_USER\ Software\Adobe\\\TrustManager key from the Windows registry. On the Macintosh, you would have to navigate to the Users::Library:Preferences folder and open either the com.adobe.Acrobat..plist (Acrobat Standard) or the com.adobe.Acrobat.Pro.plist (Acrobat Professional) and then extract everything between the following: TrustManager ~ Importing the Data All of the settings extracted from the TrustManager key can either be imported as is for each installation, or you can modify the REG file and change HKEY_CURRENT_USER to HKEY_LOCAL_ MACHINE for enterprise installations where the computer will support multiple users. Acrobat does not support the concept of shared preferences on the Macintosh. You would need to devise a method of programmatically writing the data into the plist file for each user. Application Preference Basics Data types: Windows 3/2/12: Enterprise Administration for the Acrobat Family of Products 48 3.6 Data types: Windows When adding new keys to the registry it is critical that you get the Value data and Name fields correct as shown in Table 5. Every Windows registry preference has a data type as indicated by its prefix. These need to be added in the format that the application can recognize. For example, to force a digest comparison with bEnforceSecureChannel: 1. Open the registry. 2. Navigate to HKEY_CURRENT_USER\Software\Adobe\\\Security\PubSec. 3. Highlight PubSec. EnforceSecureChannel is a boolean so its prefix is“b.” Looking at Table 5 we learn that this is mapped to REG_DWORD. 4. In the right pane, right click and choose New > DWORD Value. 5. Create a value called bEnforceSecureChannel. 6. Right click on bEnforceSecureChannel. 7. Choose Modify. 8. Set Value Data to 1. Table 5 Registry preference data types: Versions 8.x and later Acrobat Prefix Data Type Registry type Description a atom REG_SZ The string may be UTF-8 and can therefore include Unicode. The Value Data field is typically entered as text. For example, a value for cHandlers:aPrivKey could be Adobe.PPKLite. b bool REG_DWORD 0 (false) or 1 (true). c cab N/A Containers that hold keys are preceded by a“c” on Windows. i int REG_DWORD An integer. s string REG_BINARY ASCII only. t text REG_SZ The string may be UTF-8 and can include Unicode. The Value Data field is entered as text. For example, a value for cEDC:tLastServerURL could be https://aps.serv. com:123. Note: 7.x and earlier use REG_BINARY and tValue. a, s, or t ASPath See a, s, and t above. ASPath objects require three components: aFS: The filesystem for the path, such as DOS. sDI: A string of device independent path. tDIText: The device independent path again in Unicode. Application Preference Basics Data types: Macintosh 3/2/12: Enterprise Administration for the Acrobat Family of Products 49 3.7 Data types: Macintosh When adding new keys to the registry it is critical that you get the key name and data type correct. Every preference has a data type as indicated by the integer field under the key.These need to be added in the format that the application can recognize. For example, to force a digest comparison with EnforceSecureChannel: 1. Open ~root/com.adobe.(product name)_(product version).plist 2. Navigate to [Security\PubSec] . 3. Under PubSec add a new key EnforceSecureChannel. 4. Create an array element with an integer element specifying the data type and the boolean value (Example 3.3). Example 3.3: Setting a Mac preference EnforceSecureChannel 0 Table 6 Registry preference data types: Versions 8.x and later Integer Data Type Description 0 bool true or false 1 int An integer. 2 atom The string may be UTF-8 and can therefore include Unicode. The field typically contains text. For example, a value for Handlers:PrivKey could be Adobe.PPKLite. 3 number Double. 4 text The string may be UTF-8 and can include Unicode. The Value Data field is entered as text. For example, a value for cEDC:tLastServerURL could be https://aps.serv.com:123. Note: 7.x and earlier use REG_BINARY and tValue. 5 string ASCII only. 6 data A binary blob. 7 Unused. 8 dict Containers that hold additional keys. Application Preference Basics Preference convention basics 3/2/12: Enterprise Administration for the Acrobat Family of Products 50 3.8 Preference convention basics Modifying existing or creating custom preferences requires some knowledge of the supported naming conventions and data types. In general:  Folders or directories that contain the actual preferences (keys), appear in the left-hand window are the names are always prepended by a“c.” For example, cAdobe_ChainBuilder and cAcceptablePolicyOIDs are containers.  The lowest level key container is an array. Item names are always“c” + . Thus, in Figure 2, an array under cAcceptablePolicyOIDs could be c0, c1, c2, c3, and so on.  Keys are usually stored in the lowest level container. The subkey structure has a dependency on the data type of the parent container. Cabs at the c0, c1, c2, etc. level use a subdirectory named cValue that contain the actual key data. For all other data types, store the value directly at the c0, c1, c2, etc. level (Figure 2). For example, to create keys for a cab container such as cAcceptablePolicyOIDs: 1. Look up the container data type in this specification. cAcceptablePolicyOIDs is a cab of cabs. 2. Right click on the container and choose New > Key. Name it c0. Repeat for each new key and increment by 1. 3. Right click on each c item, and choose New > Key. Add a new subentry called cValue. 4. Right click on cValue and choose New > Value. In this example, choose Binary Value because strings are mapped to REG_Binary (Table 5). 5. Provide a value name and a value that match one of those listed in Table 5. Figure 2 Preference relevance keys Application Preference Basics Order of precedence 3/2/12: Enterprise Administration for the Acrobat Family of Products 51 3.9 Order of precedence Most features do not provide more than one setting or component that interact in a way that cancels the affect of another setting. Many preferences are simply off or on and are either toggled via the UI or direct registry configuration. However, for some complex features, understanding the order of precedence is critical. For example, in Acrobat 9.x, the trust manager, certified documents, and the enhanced security feature are tightly integrated. Each of these can allow a PDF to access a networked file, and the most permissive setting generally applies. Additionally, Acrobat’s signing and security feature behavior is determined by registry configuration, certificate extensions, and seed values. One or more of these variables may be changed by an administrator or an end user. In order to understand what is happening to a document then, it is important to understand how these variables interact and which one is controlling. In general, the smaller the scope of the variable, the more controlling it is. Thus, seed values override application preferences, and application preferences override certificate extensions (which has a larger scope because it can be used in a number of contexts). Such a hierarchy allows document authors to have more control over their documents once they are published. For example, an application has a default timestamp server configured, a certificate contains an OID that specifies a different timestamp server, and a seed value specifies a third timestamp server for a particular signature field; in this case, the seed value timestamp server is used. Figure 3 Precedence order 3.10 Pre-deployment configuration Preconfiguration of clients involves customizing the product installer with the Adobe Customization Wizard so that clients behave consistently and adhere to the same policies across the organization. Application level preferences (registry settings and plist preferences) are available for controlling many aspects of the product. For details, see http://www.adobe.com/go/enterprise_deployment. Seed value Application preferences Certificate extensions Most controlling Least controlling Application Preference Basics Pre-deployment configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 52 You can use the wizard to customize product installers in the following ways:  Modify application registry and installer tables for any security feature, including enhanced security, digital signatures, and document security.  Lock settings so they cannot be altered by users.  Install files such as templates, trusted identity lists, and so on. Figure 4 Customization wizard 4 53 Locking Preferences Certain security-sensitive or otherwise enterprise-centric preferences can be locked so that they are uneditable by end users through the user interface. Lockable settings include preferences in HKCU that are mapped to entries in the registry’s HKLM FeatureLockdown section as well as keys that only exist in HKLM. Preferences that reside in HKLM rather than HKCU can’t be modified by end users unless they have administrator privileges. Tip: For details about all lockable keys besides those listed here, refer to the Preference Reference. Feature lockdown is not supported on the Macintosh platform. 4.1 Platform specifics The path to a particular key varies by platform as described below. 4.1.1 Windows On Windows, the a preference path is a registry path. The path varies with both the nature of the key and the OS as follows:  User modifiable keys. HKEY_CURRENT_USER (HKCU) stores settings that are specific to the currently logged-in user:  Current user keys: HKEY_CURRENT_USER\Software\Adobe\(product name)\(version)\ Note: Some HKCU keys have a matching key in FeatureLockdown.  Admin-only keys (require administrator privileges to modify). HKEY_LOCAL_MACHINE (HKLM) stores settings that are specific to the local computer.  Lockable keys (32 bit): HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\(product name)\ (version)\FeatureLockDown\  Lockable keys (64 bit): HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe  Non lockable machine keys: HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\(product name)\ (version)\ 4.1.2 Unix UNIX uses an equivalent of the registry key system used on Windows. Lockable preferences reside in the FeatureLockdown section is stored files at a location based on the product type and version. For example, for Adobe Reader 9.x : [ReaderInstallationLocation]/Adobe/Reader9/Reader/GlobalPrefs/reader_prefs 4.1.3 Macintosh Not supported. Locking Preferences Preventing End-User Modification 3/2/12: Enterprise Administration for the Acrobat Family of Products 54 4.2 Preventing End-User Modification While many lockable preferences have a matching corollary stored in HKCU, their editability via the user interface is controlled by their boolean lockdown counterpart in HKLM.When marked as uneditable, the application user interface item associated with that preference is disabled. The hierarchy within FeatureLockdown is typically the same as the one under the HKCU Security directory. The Adobe Customization Wizard provides a UI for modifying some of these keys when tuning the client installer for Windows prior to deployment. However, because some lockable keys are not exposed in the wizard, it is often simpler to modify the keys manually and then use the Wizard to drag and drop the configured registry directories to the installer. To lock down features: 1. Navigate to:  7.x: HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\\\FeatureLockDown  8.x and later: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\\\ FeatureLockDown  64 bit Windows: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\ FeatureLockdown. 2. Create a directory path that mirrors the path in HKCU. For example, when configuring a digital signature key, create a cSecurity directory. Tip: The HKLM path usually mirrors the HKCU path, but is sometimes different. For details about keys besides those listed here, refer to the Preference Reference. 3. Add the requisite subdirectories. Use the same path used for the settings described in the rest of this chapter. For example, create a directory cPPKLite to set bAllowPasswordSaving"=dword:00000000. See Example 4.4. 4. Predeployment installer tuning via the Wizard: When you finish your other registry modifications, use the wizard UI to drag and drop the FeatureLockDown directory from My Computer to the Destination Computer. Tip: Most of the lock down keys are booleans indicating whether the preference is editable by end users. For more detail about a particular setting, refer to the Preference Reference. When looking for a key, search for the key name without the data type prefix. For example, search for PrivKey and NOT bPrivKey since that setting is not a boolean in HKCU. Table 6 Lockable keys: For security features (e.g. digital signatures) Preference Feature Description bAllowPasswordSaving Various Caches passwords so they don’t have to be re-entered when accessing digital IDs, policies, and other features that use passwords. HKLM and HKCU bPrivKey Certificate handling Prevents a user from changing the security handler used for signing and certificate security. HKLM and HKCU Locking Preferences Preventing End-User Modification 3/2/12: Enterprise Administration for the Acrobat Family of Products 55 bVerify Signature validation Prevents a user from changing the security handler used for the default signature verification method. HKLM and HKCU bVerifyUseAlways Signature validation Qualifies the use of aVerify. HKLM and HKCU bValidateOnOpen Signature validation Forces signature validation when a document opens. HKLM and HKCU bReqRevCheck Signature validation Requires revocation checking to behave as specified. HKLM and HKCU bReasons Signing Prevents users from modifying the reasons setting. v8.1: If locked and cReasons if empty, bAllowSigningReasons is 0 and read only. If locked and cReasons has values, then bAllowSigningReasons is true and read only. HKLM and HKCU bSuppressStatusDialog Signing Deprecated since 8.0. Prevents the Document Status dialog from appearing when a certified document opens. HKLM and HKCU bSuppressMessageBar Signing (v 8.0) Default: 0 Path: cPPKHandler Prevents the appearance of the document message bar. Adversely affects signing when preview mode is used. HKLM only bWinCacheSession Handles Signing (v 8.1 Windows only) Default: 1 Path: cPPKHandler Specifies whether to retain CSP handles when a user authenticates to a digital ID. If true, a user does not have to reauthenticate to use the ID unless they log out or the session ends.The impact of this preference will vary based on the CSP in use; however, the setting does not affect the Windows CSPs. HKLM only bWinCacheSession Handles Signing (v 8.1 Windows only) Default: 1 Path: cPPKHandler\bWinCacheSessionHandles Specifies whether to retain CSP handles when a user authenticates to a digital ID. If true, a user does not have to reauthenticate to use the ID unless they log out or the session ends.The impact of this preference will vary based on the CSP in use; however, the setting does not affect the Windows CSPs. Note: This key cannot be used in HKCU. bAllowInvisibleSig Signing and document security Prevents user from signing with an invisible certification signature. Disables the menu option in the signing menus. HKLM and HKCU Table 6 Lockable keys: For security features (e.g. digital signatures) Preference Feature Description Locking Preferences Preventing End-User Modification 3/2/12: Enterprise Administration for the Acrobat Family of Products 56 bMSStoreTrusted Signing and document security Prevents the user from changing the settings for using certificates in the Windows Certificate store for validating approval and certification signatures. Disables the two checkboxes in the digital signature advanced preferences Windows Integration tab. HKLM and HKCU bAllowAPSConfig Document security v 8.1 (Windows only) Default: 1 Prevents a LiveCycle Rights Management Server from being configured via Acrobat. Disables the menu option in the Security Settings Console. HKLM only tWhiteList Attachments (v 7.0) Default: see list Path: FeatureLockDown\cDefaultExecMenuItems Prevents users from opening or launching file types other than PDF or FDF. Disables the menu option in Trust Manager. HKLM only tBuiltInPermList Attachments (v 7.0) Default: see list Path: FeatureLockDown\cDefaultLaunchAttachmentPerms Prevents users from modifying the behavior for the listed attachments file types. For more details, see the document Vulnerability and Runtime Security in the Acrobat Family of Products. HKLM only tSchemePerms Links to external content (v 7.0) Default: see list Path: FeatureLockDown\cDefaultLaunchURLPerms Prevents users from modifying the behavior for links to the listed file types. HKLM only bEnhancedSecurity Standalone Enhanced Security (v 9.0) Default: 0 Path: FeatureLockDown\ Locks enhanced security either off or on for the standalone application. Setting configured in HKCU; lockdown is configured in HKLM by setting 1 to lock. bEnhancedSecurity InBrowser Enhanced Security (v 9.0) Default: 0 Path: FeatureLockDown\ Locks enhanced security either off or on for the application running in the browser. Setting configured in HKCU; lockdown is configured in HKLM by setting 1 to lock. t_file path and name Enhanced Security (v 9.0) Default: null Path: FeatureLockDown\TrustManager\cTrustedFile\one or more of these: cCrossdomain, cDataInjection, cExternalStream, cScriptInjection, cSilentPrint, cWebLink Locks enhanced security either off or on for the application running in the browser. Setting configured in HKCU; lockdown is configured in HKLM by setting 1 to lock. Table 6 Lockable keys: For security features (e.g. digital signatures) Preference Feature Description Locking Preferences Preventing End-User Modification 3/2/12: Enterprise Administration for the Acrobat Family of Products 57 Example 4.4: Lockdown example [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\ cDefaultLaunchAttachmentPerms]"tBuiltInPermList"="version:1|.ade:3|.adp:3|.app:3|.asp:3|.bas:3|.bat: 3|.bz:3|.bz2:3|.chm:3|.class:3|.cmd:3|.com:3|.command:3|.cpl:3|.crt:3|.csh:3|.desktop:3|.exe:3|.fxp:3|.gz:3|. hex:3|.hlp:3|.hqx:3|.hta:3|.inf:3|.ini:3|.ins:3|.isp:3|.its:3|.job:3|.js:3|.jse:3|.ksh:3|.lnk:3|.lzh:3|.mad:3|.maf:3|. mag:3|.mam:3|.maq:3|.mar:3|.mas:3|.mat:3|.mau:3|.mav:3|.maw:3|.mda:3|.mde:3|.mdt:3|.mdw:3|.mdz:3|. msc:3|.msi:3|.msp:3|.mst:3|.ocx:3|.ops:3|.pcd:3|.pi:3|.pif:3|.prf:3|.prg:3|.pst:3|.rar:3|.reg:3|.scf:3|.scr:3|.sct:3|. sea:3|.shb:3|.shs:3|.sit:3|.tar:3|.tgz:3|.tmp:3|.url:3|.vb:3|.vbe:3|.vbs:3|.vsmacros:3|.vss:3|.vst:3|.vsw:3|. webloc:3|.ws:3|.wsc:3|.wsf:3|.wsh:3|.zip:3|.zlo:3|.zoo:3|.pdf:2|.fdf:2" [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\ cDefaultLaunchURLPerms]"tSchemePerms"="version:1|shell:3|hcp:3|ms-help:3|ms-its:3|ms-itss:3|its: 3|mk:3|mhtml:3|help:3|disk:3|afp:3|disks:3|telnet:3|ssh:3|javascript:1|vbscript:1|acrobat:2|mailto:2|file:2" [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\ cDocumentStatus]"bSuppressMessageBar"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\cSecurity\ cDigSig]"bValidateOnOpen"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\cSecurity\ cEDC]"bAllowAPSConfig"=dword:00000000 t_folder path and name Enhanced Security (v 9.0) Default: null Path: FeatureLockDown\TrustManager\cTrustedFolders\one or more of these: cCrossdomain, cDataInjection, cExternalStream, cScriptInjection, cSilentPrint, cWebLink Locks enhanced security either off or on for the application running in the browser. Setting configured in HKCU; lockdown is configured in HKLM by setting 1 to lock. t_host name Enhanced Security (v 9.0) Default: null Path: FeatureLockDown\TrustManager\cTrustedSites\one or more of these: cCrossdomain, cDataInjection, cExternalStream, cScriptInjection, cSilentPrint Locks enhanced security either off or on for the application running in the browser. Setting configured in HKCU; lockdown is configured in HKLM by setting 1 to lock. bDisableTrustedFolders Enhanced Security (v 9.0) Default: 0 Path: FeatureLockDown\ Prevents the user from setting a folder as a privileged location. HKLM bDisableTrustedSites Enhanced Security (v 9.0) Default: 0 Path: FeatureLockDown\ Prevents the user from setting a site/host as a privileged location. HKLM Table 6 Lockable keys: For security features (e.g. digital signatures) Preference Feature Description Locking Preferences Preventing End-User Modification 3/2/12: Enterprise Administration for the Acrobat Family of Products 58 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\cSecurity\ cHandlers] "bVerify"=dword:00000000 "bPrivKey"=dword:00000000 "bVerifyUseAlways"=dword:00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\8.0\FeatureLockDown\cSecurity\ cPubSec]"bReasons"=dword:00000000 Windows Deployments 5 60 The Command Line and msiexec In addition to the Adobe properties described below, this document provides Windows installation syntax and examples that you can use to install Acrobat products. Adobe Acrobat and Adobe Reader installers and updates are developed using standard Windows Installer technology. Installation and patch-apply workflows such as chaining are typical to this technology and are fully supported. Note: Microsoft Installer (MSI) commands were not invented by Adobe. Adobe provides this information as a courtesy, but Adobe technical support can not help you craft a command line syntax to fit specific situations and environments. Required MSI version For 9.x and earlier: 3.0. 10.0 and later: 3.1 5.1 MSI best practices  When installing over an existing product, remove the old product first in a separate action.  When scripting MSI actions, do not use RemoveExistingProducts after InstallFinalize. Doing so results in the installer updating files before removing the old application, and in the event of application removal failure, the installation may be incomplete.  Do not use REINSTALLMODE=amus which forces all files to be reinstalled regardless of checksum or version. Such usage could result in a mixture of files from the old and new products. The recommended properties are vomus.  Use TARGETDIR on the command line or the AIP user interface to specify an install location other than C:\ when creating an AIP. 5.2 msiexec usage Adobe has tested and supports the installation of Acrobat products using the command line. You can use command line methods to install software in many ways, such as typing commands at a command prompt, in a batch script (.bat file) or using Microsoft Systems Management Server (deprecated for 10.x). Note: When using the bootstrapper, command line parameters can be sent to msiexec from the Setup.ini using /msi. See Table 2. 5.2.1 msiexec: syntax The syntax for msiexec is as follows:  Windows Installer command-line options are not case-sensitive. The Command Line and msiexec msiexec: switches and options 3/2/12: Enterprise Administration for the Acrobat Family of Products 61  Brackets ([]): Optional items  Braces ({}); Set of choices separated by a | from which the user must choose only one. For example: {black|white}: 5.2.2 msiexec: switches and options For Microsoft documentation, see http://msdn.microsoft.com/en-us/library/Aa367988. Table 1 msiexec command line parameters Command Description { /?| /h} Displays the Windows Installer version and copyright information. /a Applies the administrative installation option. /f For product repair. Enables one or more of the command-line options below:  p: Reinstalls only if file is missing.  o: Reinstalls if file is missing or if an older version is installed.  e: Reinstalls if file is missing or an equal or older version is installed.  d: Reinstalls if file is missing or a different version is installed.  c: Reinstalls if file is missing or the stored checksum does not match the calculated value.  a: Forces all files to be reinstalled.  u: Rewrite all required user-specific registry entries.  m: Rewrites all required computer-specific registry entries.  s: Overwrites all existing shortcuts.  v: Runs from source and re-caches the local package /g Identifies the language. Syntax: /g LanguageID /i Installs or configures a product. /j Advertises a product. If you want to install the application with elevated privileges, use /jm. Syntax msiexec /j [{u | m}] Package msiexec {u | m} Package /t TransformList msiexec {u | m} Package /g LanguageID  m: Advertises to all users of the computer.  u: Advertises to the current user. The Command Line and msiexec Setting installer properties 3/2/12: Enterprise Administration for the Acrobat Family of Products 62 5.2.3 Setting installer properties The installer contains a number of customer facing properties with default values that can be overridden by passing command line arguments to the installer. The property rules are as follows:  Some properties may be preset in the installer tables; other have to be manually set.  Public property arguments must be all uppercase characters, but can include underscores. /L Specifies the path to the log file. To include the v option in a log file using the wildcard flag, type /L*v at the command prompt. The Windows Installer log file options can also be used with the uninstall and repair processes. For example, use /L*v to set verbose logging. Syntax: msiexec /L [i][w][e][a][r][u][c][m][p][v][+][!]LogFile.txt  i: Logs status messages.  w: Logs nonfatal warnings.  e: Logs all error messages.  a: Logs startup of actions.  r: Logs action-specific records.  u: Logs user requests.  c: Logs initial user interface parameters.  m: Logs out-of-memory.  p: Logs terminal properties.  v: Logs verbose output. To use v, specify /L*v.  +: Appends to existing file.  !: Flushes each line to the log.  *: Logs all information except for the v option. This is a wildcard. /p Applies an update. /q Sets the user interface level. /qb+- is not a supported user interface level. The modal box is not displayed if the user cancels the installation. Syntax: msiexec /q{n | b | r | f | n+ | b+ | b-}  /qn: Displays no user interface.  /qb: Displays a basic user interface.  /qr: Displays a reduced user interface with a modal dialog box displayed at installation end.  /qf: Displays the full user interface with a modal dialog box displayed at the end.  /qn+: Displays no user interface, except for a modal dialog box displayed at the end.  /qb+: Displays a basic user interface with a modal dialog box displayed at the end.  /qb-: Displays a basic user interface with no modal dialog boxes. /qb Indicates the user interaction level for this installation. /t Applies transform to advertised package. Syntax: /t TransformList /x Uninstalls a product. /y Calls the system API DllRegisterServer to self-register modules passed on the command line. /z Calls the system API DllUnRegisterServer to unregister modules passed on the command line. Package Code Specifies the globally unique identifier of the Windows Installer package. For Acrobat products, this is the GUID. For details, see Identifying deployed applications. Package Not supported. Specifies the name of the Windows Installer package file Table 1 msiexec command line parameters Command Description The Command Line and msiexec MSI properties 3/2/12: Enterprise Administration for the Acrobat Family of Products 63  Order of precedence from least to most controlling is as follows: Property table > Transform > command line. That is, command line run properties override any installer setting.  Installer tables may vary by product type (Reader vs. Acrobat vs. Acrobat Standard, etc.) Table 5 uses Reader. Inspect the tables of the product you are installing to determine if a default is provided. Note: While it is possible to use the Customization Wizard’s Direct Editor or 3rd party tool such as ORCA to modify the installer tables, Adobe strongly recommends that you do not do so unless you are knowledgeable about editing and troubleshooting installer tables. Improper use can result in the corruption of critical system files. Figure 1 Direct editor in the Customization Wizard 5.2.4 MSI properties You can also use Windows Installer functions to set properties on the command line. For example, you can set a company name or suppress rebooting. Table 2 shows a few of the MSI properties defined by the Microsoft Windows Installer, but you should refer to Microsoft documentation at http:// msdn.microsoft.com/en-us/library/aa370905(v=VS.85).aspx for a complete and current list. MSI properties: unsupported The following properties are unsupported:  SHORTFILENAMES is no longer supported. Microsoft has removed this property from the Windows 7 Logo Requirements.  ALLUSERS is not working properly in version 9.x. Tip: See also “Adobe installer properties” on page 67. The Command Line and msiexec Troubleshooting msiexec 3/2/12: Enterprise Administration for the Acrobat Family of Products 64 5.2.5 Troubleshooting msiexec When using msiexec, if you receive an "Incorrect command line parameters" error message, verify that:  Your syntax is correct.  There is a space before the log file name if you use the syntax for writing a log file.  You have not placed a /qn switch between the /i switch and the name of the MSI file. Tip: For more information about msiexec options, refer to http://technet.microsoft.com/ en-us/library/cc759262(WS.10).aspx#BKMK_Install. 5.2.6 Command line examples These examples demonstrate different ways to install Acrobat products using the command line. Keep in mind the following:  The examples use specific products and versions. Modify the command line to suit your environment, changing paths and file names as appropriate. Table 2 MSI installer properties Property Description ADDLOCAL A list of comma delimited features to install locally. The features must be present in the Feature column of the Feature Table. To install all features locally, use ADDLOCAL=ALL on the command line rather than the Property Table to avoid creating an installed package that cannot be correctly removed. ALLUSERS Determines where configuration information is stored. It is a per machine setting and is set to 1 by default for both Acrobat and Reader. COMPANYNAME The name of the company installing the product. INSTALLDIR Specifies a non-default installation directory. INSTALLLEVEL The property specifies an installation level threshold. A feature is installed only if the value in the Level field of the Feature table is less than or equal to the current INSTALLLEVEL value. 100 is the default install level. REBOOT Force or suppress rebooting. REINSTALL List of features to reinstall. Setting this property results in a required reboot for 9.x. For 10.x products, let the MSI engine decide what to reinstall; doing so should result in fewer reboots. REINSTALLMODE A string containing letters that specify the type of reinstallation to perform. Use of the vomus switches is the recommended configuration. REMOVE List of features to be removed. TARGETDIR Specifies the root destination directory for the installation. TARGETDIR must be the name of one root in the Directory table. There may be only a single root destination directory. During an administrative installation this property specifies the location to copy the installation package. Do not create an AIP at the root directory. Use the AIP UI or this property on the command line to install from a directory other than C:\, D:\, etc. TRANSFORMS Property that is used to specify what transform (.mst) files should be applied to the package. In some cases, this will be the MST you created via the Customization Wizard. Use with /i, not /p. USERNAME The username of the person performing the installation. The Command Line and msiexec Command line examples 3/2/12: Enterprise Administration for the Acrobat Family of Products 65  It is possible to apply patches during an initial installation.  For multilingual installers, use the selected language transform in the command line (for example, 1036.mst for the French language).  Transforms in the installer media directory do not require fully qualified paths in the command.  Patches do require fully qualified paths. Note: As of July 2010, Reader update installers on the Reader Download Center for Tier 1 are chained by default. If you are downloading the product from the RDC rather than the FTP site, just download the latest file and you’ll get all patches in one file. 5.2.6.1 Creating an administrative installation To create an administrative installation for a customized installer, use /a andTRANSFORMS. For example, the following installs Acrobat Pro with an MST file created with the Customization Wizard: msiexec /a AcroPro.msi TRANSFORMS="AcroPro.mst" To create an administrative installation for a major release installer and a patch, use /a and /p. For example, the following installs Acrobat Pro 7 and the 7.0.5 patch: msiexec /a AdbeRdr1000_lang_ID.msi /p AdbeRdrUpd1010_en_US.msp Tip: It’s always a good idea to keep the files in the same directory and cd to that directory so that you can run the commands from there. 5.2.6.2 Installing from an MST Updates and patch installers can be modified with MST files created via the Customization Wizard. Example 5.1 shows how to install an Acrobat product from an MST file. This example installs a customized version of Acrobat Professional, displays a basic user interface, and enables verbose logging. Example 5.1: msiexec: Customized MST install msiexec /i AcroPro.msi TRANSFORMS=”AcroPro.mst” /qb /L*v c:\acrobat.log 5.2.6.3 Chaining updates To install a quarterly update, provide the path to the base MSI and use PATCH to point the updates. Example 5.3 shows how to install Reader 10.0 with the 10.1 update. Note that because 10.x products have cumulative installers, you do not need to install 10.0.1, 10.0.2, or 10.0.3. Example 5.2: msiexec: Updating 10.x products msiexec.exe /i "[UNC PATH]\AdbeRdr1000_lang_ID.msi" PATCH= "[UNCPATH]\AdbeRdrUpd1010_en_US.msp" TRANSFORMS="1036.mst" Example 5.3 shows how to install Adobe Acrobat 9 Pro EFG (French) with updates 9.1 and 9.1.2 as a single transaction in interactive mode. To run in silent mode, append /qn. Example 5.3: msiexec: Quarterly update installs for 9.x msiexec.exe /i "[UNC PATH]\AcroPro.msi" PATCH="[UNCPATH]\AcroProStdUpd910_T1T2_ incr.msp;[UNCPATH]\AcrobatUpd912_all_incr.msp" TRANSFORMS="1036.mst" The Command Line and msiexec Command line examples 3/2/12: Enterprise Administration for the Acrobat Family of Products 66 When applying multiple patches in a chain patch transaction, set the REINSTALL and REINSTALLMODE public properties as shown. For example, to run msiexec to apply updates 9.1, 9.1.2, and 9.1.3 as a chained patch transaction silently over a previously installed Acrobat 9 Pro. Example 5.4: msiexec: Chained updates for 9.x with REINSTALLMODE msiexec /p "[UNC PATH]\AcroProStdUpd910_T1T2_incr.msp;[UNCPATH]\AcrobatUpd912_ all_incr.msp;[UNC PATH]\AcrobatUpd913_all_incr.msp"REINSTALLMODE=vomus REINSTALL=ALL /qn Example 5.5: msiexec: Chained updates msiexec.exe /i "[UNC PATH]\AcroPro.msi" PATCH="[UNCPATH]\AcroProStdUpd910_T1T2_ incr.msp;[UNCPATH]\AcrobatUpd912_all_incr.msp; [UNCPATH]\AcrobatUpd913_all_ incr.msp TRANSFORMS="1036.mst" 5.2.6.4 Installing a quarterly update and then an out of cycle patch (8.x-9.x) To install the 9.1.1 update at the same time as 9.1, use the following command: Example 5.6: Quarterly + patch installation set MSINAME=AdobeReader set MSIVER=9.1.0 start /w msiexec /i %WINDIR%\installer\%MSINAME%\%MSIVER%\AcroRead.msi TRANSFORMS=%WINDIR%\installer\%MSINAME%\%MSIVER%\AcroRead.mst /update WINDIR%\installer\%MSINAME%\%MSIVER%\AdbeRdrUpd911_all_incr.msp ALLUSERS=2 DISABLE_CACHE=1 DISABLE_BROWSER_INTEGRATION=YES SUPPRESS_APP_LAUNCH=YES REBOOT= ReallySuppress /qn /Liv c:\temp\%MSINAME%.log 5.2.6.5 Updating and patching 10.x 10. x installers are cumulative to the last released MSI for Adobe Reader. Since 10.0 and 10.1are both MSIs, the following patch patterns are supported:  Any version over 10.0:  10.0 > 10.0.1  10.0 > 10.0.2  10.0 > 10.0.3  Any version over 10.1:  10.1.0 > 10.1.1 Since you don’t need to install any intermediate updates other than one MSI and the latest installer, you need never run more than two installers. Thus, the following is possible: msiexec.exe /i "[UNC PATH]\AdbeRdr1010_en_US.msi" PATCH="[UNCPATH]\AdbeRdr1011_en_ US.msp 5.2.6.6 Silent uninstalls A silent removal runs without any dialog boxes to show the user that the removal is running. All products use the same command line and the same installer file for silent updates: msiexec /x {[Package Name | Product Code]} /qn The Command Line and msiexec Adobe installer properties 3/2/12: Enterprise Administration for the Acrobat Family of Products 67 Note: You must include the braces in the command line. An MSI package name (e.g. AcroRead.msi) can be substituted for the Product Code. For Acrobat products, the Product Code is the GUID. See Decoding product details via Windows GUID for details on how to set the GUID. 5.2.6.7 Removing browser integration for an already installed product When Reader is already deployed and a subsequent deployment requires disabling Browser Integration, it is possible to uninstall the feature from the command line: msiexec /i {AC76BA86-7AD7-1033-7B44-A91000000001} REMOVE= ReaderBrowserIntegration /q To re enable Browser Integration, use ADDLOCAL: msiexec /i {AC76BA86-7AD7-1033-7B44-A91000000001} ADDLOCAL= ReaderBrowserIntegration /q 5.3 Adobe installer properties The properties in Table 5 can also be sent to msiexec to modify the installer. These are supported in Setup.ini and on the command line. As shown by the right-hand column, some of the properties appear in the installer tables by default. Table 3 Adobe-specific installer properties: for 10.x and later Property Description In 9.x DISABLE_ASIAN_FONTS YES prevents the installation of Asian language components. NO DISABLE_BROWSER_ INTEGRATION YES prevents the viewer from opening in a browser. Beneficial in Terminal Server environments. When a PDF file opens in a browser and the user browses to a different page, viewer components stay in memory until the browser is closed. YES DISABLE_CACHE 1 disables setup file caching. The opposite of ENABLE_CACHE_FILES. NO ENABLE_CACHE_FILES 1 enables setup file caching. Caching is the default. The opposite of DISABLE_ CACHE. YES ENABLE_OPTIMIZATION 1 runs a disk defragmentation utility that will automatically cluster files on a portion of the destination drive during installation, thereby improving launch time and performance. Defragmentation requires available disk space on the destination drive and adds time to the installation. YES DISABLE_DISTILLER YES prevents the installation of Distiller components. NO DISABLE_PDFMAKER YES prevents the installation of PDFMaker. NO DISABLEDESKTOPSHORTCUT 10.1 and later. Reader only: When set to 1, the desktop shortcut will not be created at the initial install or after any updates. Note that this only takes effect when using an MSI installer. Thus, 10.1 works and 10.1 chained with updates to 10.1.2 works. Applying an MSP update would not work. Support for Acrobat is expected for 11.0. NO EULA_ACCEPT YES prevents the EULA from appearing the first time the viewer is invoked. YES The Command Line and msiexec Adobe installer properties 3/2/12: Enterprise Administration for the Acrobat Family of Products 68 IGNORE_INTEROP_REQS YES disables interoperability dialogs in the full UI mode and allows installation to continue in the reduced UI mode or completely silent mode. “Interoperability” refers to supported installations where one product is installed over another. For example, Acrobat Standard cannot be installed on top 3D. There are 3 use cases: The installation must abort, the installation cannot continue without user action (usually uninstalling the previous product), and the installation can continue. This property turns off warning dialogs for installation failure for the first two cases, thereby causing the abort to happen silently. NO ISX_SERIALNUMBER A retail or volume serial number that can be passed to facilitates silent installs. If a number is not passed, then a trial version of the product is automatically installed. This property can be used in setup.ini, abcpy.ini, and on the command line. NO IW_DEFAULT_VERB  Make Reader the default PDF viewer: For Reader only. Set IW_DEFAULT_ VERB to Read.  Make Acrobat the default PDF viewer: For Acrobat only. Set IW_DEFAULT_ VERB to Open. NO LEAVE_PDFOWNERSHIP New for 10.0 YES prevents the new installation from taking over PDF ownership. NO allows the new install to own opening PDFs. May interact with IW_DEFAULT_VERB NO REMOVE_PREVIOUS Specifies whether to removes an already installed product. The property can only uninstall a previous version of the product when that same product is being installed. For example, REMOVE_PREVIOUS=YES during an Acrobat install will only uninstall previous Acrobat versions. It will not affect any version of Reader that is present. This property can be used during both Acrobat and Reader installs. The default is YES. NO REMOVE_PREVIOUS_ READER Acrobat only: Specifies whether to remove any existing versions of Reader on the system during an Acrobat install. The property can be used in tandem with REMOVE_PREVIOUS when earlier versions of both Acrobat and Reader need to be removed as part of a new Acrobat install. NO SYNCHRONIZER READER ONLY. NO prevents installation of synchronizer.exe components which are used for collaborative commenting, reviews, forms sharing, and the download of trust anchors from Adobe for signature workflows YES DISABLE_ARM_SERVICE_ INSTALL New for 10.1. 10.1 installs ARMsvc.exe as part of the Updater which enables silent and automatic updates on Windows 7 and Windows Vista machines. A value of 1 disables the ARM service on Windows. NO Table 3 Adobe-specific installer properties: for 10.x and later Property Description In 9.x The Command Line and msiexec Adobe installer properties 3/2/12: Enterprise Administration for the Acrobat Family of Products 69 Table 4 Adobe-specific installer properties: deprecated with 10.0 Property Description In 9.x DEFAULT_VERB Replaced by IW_DEFAULT_VERB with 10.0 Sets the default PDF viewer. Serves as a condition for the installation of the several components related to the file extensions like PDF as well as browser integration. For 9.x and earlier, the behavior is as follows:  Reader set to READ (Default): Reader takes over pdf ownership.  Reader set to OPEN: Reader will not touch pdf ownership.  Acrobat set to READ: Acrobat will not touch pdf ownership.  Acrobat set to OPEN (default): Acrobat takes over pdf ownership. Interacts with LEAVE_PDFOWNERSHIP. YES DISABLE_3D YES prevents the installation of 3D components. NO DISABLE_ACCESSIBILITY YES prevents the installation of Accessibility components. NO DISABLE_AIR_SHARE AIR is not included with the Reader download. YES prevents the installation of the AIR runtime. NO DISABLE_LINGUISTICS YES prevents the installation of spelling components. NO DISABLE_MULTIMEDIA YES prevents the installation of multimedia plugin components. NO DISABLE_SEARCH YES prevents the installation of searching and indexing components. NO Table 5 Adobe-specific installer properties: deprecated with 9.0 Property Description In 9.x DISABLE_CE_FONTS YES prevents the installation of Central European fonts NO DISABLE_IMAGEVIEWER YES disables the image viewer plugin NO SUPPRESS_APP_LAUNCH YES disables and hides the“Launch” checkbox on final dialog. YES 6 70 Administrative Installations (AIPs) Administrative installations via administrative install points (AIPs) create an uncompressed source so the application can be installed from a network location. AIPs allow you to create a canonical set of preconfigured files in one location that can be distributed across your organization from one location. An administrative installation does not create shortcuts, register COM servers, create an Add or Remove Programs entry, and so on. Updates and patches also often leverage administrative installations because they require uncompressed images of the installed product versions in order to compute file differences. These points also act as an archive of what you installed. Note that when an MSI is released for Reader, it is usually not accompanied by an MSP, so you should start over with a new AIP. 6.1 Best practices The following recommendations will help you successfully deploy updates and patches:  Verify that no one else is using the network share.  Also adhere to the rules described in MSI best practices.  Copy and archive your AIPs both for future use and troubleshooting.  If you have a problem patching Administrative Install Points (AIP), apply patches one-at-a-time.  Adhere to the required patching order described in Update rules and constraints. 10x updates are cumulative to the base release or last MSI. Thus, 10.0 > 10.1 is valid. 10.0 > 10.0.3 > 10.1 isn’t.  Do not create the AIP directly on the root drive (e.g. C:\). Use TARGETDIR on the command line or the AIP user interface to specify a different install location.  If you have previously deployed using an AIP, then you must apply the successive patches using an AIP.  Know when you can reuse AIPs and when you have to create a new one. For example, Acrobat 10.x quarterlies are cumulative and cannot be installed on top of each other. For Reader, reuse is ok until an MSI appears or when you need to apply a quarterly over a security update. This means that for Acrobat you can always reuse the AIP of the base release, and for Reader you can always reuse that AIP of the base release or the last MSI (whichever is the most recent). 6.2 AIP creation Administrative installation Points (AIP) lay out the installer according to the directory table in the MSI database. One advantage of AIPs is that they can be patched directly, easing deployment and updating of packages already assigned to collections or groups. Because the Customization Wizard allows users to customize which files are installed, you should verify that any files that were included with the transform are laid out properly in the AIP directory structure. Administrative Installations (AIPs) AIP creation 3/2/12: Enterprise Administration for the Acrobat Family of Products 71 To create and update an AIP: 1. Download the requisite installer. You’ll need to know the following:  Language and locale IDs.  Whether the installer is providing a quarterly update or a patch.  What is already installed on the target machines.  A license number if installing Acrobat. 2. Understand the Update rules and constraints and create the AIP accordingly:  For 8.x and 9.x, do not apply a quarterly updates to an AIP in which an out of cycle patch was the most recently applied update. To deploy a quarterly update from an AIP, create a new AIP. Attempting to update in an unsupported order results in a failure that serves to prevent the use of updates that Adobe does not recommend.  For Adobe Reader 8.x and 9.x, create a new AIP when the release provides only an MSI. The install uninstalls the existing product in this case.  For Acrobat 10.x, quarterly updates are cumulative to the base release and security patches are cumulative to the last quarterly.  For Adobe Reader 10.x, quarterly updates are cumulative to the latest MSI (e.g. 10.1 replaces the base release of 10.0) and security patches are cumulative to the last quarterly. Tip: To adhere to the update order constraints, you may need to uninstall the existing product first. For example, you could use msiexec.exe /x 3. Backup the installer files (both the MSI and any needed MSP files) to a location where you will store the original downloads. For example, C:\Temp\Reader\sources\. 4. Create a distribution point folder where machines can install the uncompressed program files (e.g. \ \\Reader\AIP\). The network share must provide authenticated users and Domain Computers with read access. This example calls the path . 5. Copy the installer files you downloaded to . 6. Verify no one is using the share. If a file is in use, the new file version will not copied to the AIP. 7. Change directories to the AIP directory and run the commands from there. 8. At a command prompt, run: msiexec /a \.msi 9. Choose Next at the welcome dialog. Administrative Installations (AIPs) AIP creation 3/2/12: Enterprise Administration for the Acrobat Family of Products 72 Figure 1 msiexec: Welcome screen 10. When prompted, specify a network location for the AIP. Tip: Do not install the AIP at the root directory such as C:\ or D:\ as that often results in errors. You can use the AIP UI to specify a different location. Alternatively, when using the command line with the /qb or /qn switches, use the TARGETDIR property. Administrative Installations (AIPs) AIP creation 3/2/12: Enterprise Administration for the Acrobat Family of Products 73 Figure 2 msiexec: Choose network location screen 11. Choose Install. 12. Choose Finish. A server image of the expanded product is now available for distribution. Figure 3 AIP expanded server image 13. If there are patches, apply the patches to the install point. For example: Example 6.1: 9.x patching on Windows msiexec /a \.msi /p \AdbeRdr910_en_US.msp msiexec /a \.msi /p \AdbeRdr912_en_US.msp Example 6.2: 10.x patching on Windows msiexec /a \.msi /p \AdbeRdr1010_en_US.msi Administrative Installations (AIPs) When the last update was an out of cycle patch (8-9.x only) 3/2/12: Enterprise Administration for the Acrobat Family of Products 74 msiexec /a \.msi /p \AdbeRdrUpd1011.msp 14. Optional: If you wish to customize the MSI (disable and enable client features), create a transform (MST) file with the Customization Wizard. See Tuning with the Customization Wizard. 15. Apply the mst transform file to the expanded MSI in the AIP (note the use of the /i switch rather than /a or /p). /i \.msi TRANSFORMS=\.mst 16. Configure licensing if you have not already provided the license information in the Wizard when you created the MST. For details, see Acrobat deployments. 6.2.1 When the last update was an out of cycle patch (8-9.x only) This information does not apply to 10.x products. Ideally, you will update in the required order and uninstall intermediate updates and patches as required to adhere to that order with msiexec.exe /x . When you can’t create a new AIP and start over and the last update was an out of cycle patch, you can update user machines with the following: msiexec /i REINSTALL=ALL REINSTALLMODE=vomus The above command line updates user machines, not the AIP itself. At this point you’ve abandoned the use of AIPs for deployments. Future AIP usage will require uninstalling the product and starting over with a new AIP. Tip: When you patch an AIP image, the Windows Installer performs a re-cache and reinstallation of the original product version, thereby replacing the previously cached MSI file and overwriting any old files with the newer version. By installing complete files the administrative update can correctly replace any modified files on the server. 6.3 AIP troubleshooting Verify the following:  You have complied with the Best practices.  You have copied all files to the AIP directory and then have changed directories so that you are running the commands from the AIP directory.  Do not install the AIP at the root directory such as C:\ or D:\ as that often results in errors. You can use the AIP UI to specify a different location. Alternatively, when using the command line with the / qb or /qn switches, use the TARGETDIR property.  Your patch sequence is correct: 10.x installers are cumulative. For Reader, patch to the latest MSI. For Acrobat, any quarterly can be applied to the base release. See also Chapter 17, “Troubleshooting and Support”. Administrative Installations (AIPs) AIP Examples 3/2/12: Enterprise Administration for the Acrobat Family of Products 75 6.4 AIP Examples 6.4.1 AIP for Acrobat Pro 10.x.x patch Creating an AIP for any version should not be more than two steps process except when there is also an out of cycle (security) patch. 1. Create AIP for Acrobat Pro 10.0: msiexec /a TARGETDIR=”AIP_dir” 2. Patch with Acrobat 10.x.x patch msiexec /a /p Tip: Quarterlies are cumulative to the base release, and patches are cumulative to the last quarterly. For example, you cannot install 10.1.1 over 10.1. Use msiexec.exe /x to uninstall versions which impair your ability to adhere to the installation Update rules and constraints. For a list of installer types, see http:// kb2.adobe.com/cps/888/cpsid_88814.html. 6.4.2 AIP for Acrobat Std 10.x.x security patch 1. Create AIP for Acrobat Std 10.0 msiexec /a TARGETDIR=”AIP_dir” 2. Create the AIP for the previous quarterly patch msiexec /a /p 3. Create the AIP for the security patch msiexec /a /p Tip: Quarterlies are cumulative to the base release, and patches are cumulative to the last quarterly. For example, you cannot install 10.1.1 over 10.1. Use msiexec.exe /x to uninstall versions which impair your ability to adhere to the installation Update rules and constraints. For a list of installer types, see http:// kb2.adobe.com/cps/888/cpsid_88814.html. 6.4.3 AIP for Reader 10.x.x quarterly patch For Reader create an AIP from the latest available MSI. For example, as of September 13, 2011, you can start with 10.1 (a full MSI installer) rather than the 10.0 MSI. 1. Create AIP for Reader 10.1: msiexec /a TARGETDIR=”AIP_dir” 2. Create the AIP for the current quarterly patch: msiexec /a /p Tip: Quarterlies are cumulative to the last released MSI, and patches are cumulative to the last quarterly. For example, you cannot install 10.1.1 over 10.1. Use msiexec.exe /x Administrative Installations (AIPs) AIP for Reader 10.x.x quarterly patch 3/2/12: Enterprise Administration for the Acrobat Family of Products 76 to uninstall versions which impair your ability to adhere to the installation Update rules and constraints. For a list of installer types, see http:// kb2.adobe.com/cps/888/cpsid_88814.html. 7 77 Bootstrapper Installations 7.1 What is the Bootstrapper? Any setup.exe or any other executable that installs updates and launches the MSI installer is a bootstrapper. The Acrobat-Reader bootstrapper is provided as part of the Reader bundle on the CD and the web download. It is also provided for some releases on the FTP download site. It provides a streamlined way to chain installs without the need for administrative install points. The bootstrapper provides the following benefits:  Detects whether the required Windows Installer (MSI) is available and installs it if it isn’t.  Detects whether the product is already installed and only proceeds if it does not exist on the target machine.  Provides binary installations where the entire installer is supplied and run by each machine.  Provides a simple way to chain updates in the required order by simply adding the msp to the installer folder and modifying Setup.ini to apply that patch.  It is not subject to the patch constraint that limits an AIP from installing a quarterly update over a out of cycle patch. Thus, installs can always have the latest update without starting over. Note: Beginning with 9.3.3, Reader downloads on the Reader Download Center where the second number is incremented (e.g. are delivered with a bootstrapper that automatically detects, chains, and installs patches and updates in the correct sequence. Also, the product known as“Bootstrapper Big” used for Acrobat 3D 9.x is now deprecated. If you need information about this product, contact technical support. 7.2 Best practices  Back up your original download. Do not modify the original download.  Use the Customization Wizard to create an MST for customizations and Setup.ini file. Save the MST.  Check Setup.ini prior to running Setup.exe. Make additional modifications as needed.  Do not use the bootstrapper if you are already using administrative install points. 7.3 Bootstrapper usage Common bootstrapper workflows can include any of the following: Bootstrapper Installations Bootstrapper usage 3/2/12: Enterprise Administration for the Acrobat Family of Products 78  Manually configuring Setup.ini and running and the bootstrapper.  Modifying the installer and/or installed product via Setup.ini or the command line.  Using the Customization Wizard to modify product features set by the UI, registry, and files. Tip: Using Setup.ini and batch files allows you to keep a record of modifications for future troubleshooting. Always archive your original download and modify a copy rather than the original. Modifying the installer with the Customization Wizard 1. Create a folder to store the original installation files and the MSP update files to apply. For pre 9.3.3 versions, download the needed base install and requisite patches from http://www.adobe.com/ support/downloads/product.jsp?product=1&platform=Windows. 2. Open the Customization Wizard. 3. Modify the product install and other options. 4. Generate a new Transform file (.mst). 5. After the Wizard has created a new MST file and modified the Setup.ini file, open Setup.ini and verify it has all the options you need. 6. Make any additional modifications to Setup.ini and/or to the command line in a batch file. Note: Command line parameters can be sent to msiexec from the Setup.ini using /msi. See The Command Line and msiexec. 7. Run setup.exe to start the installation. Chained install example 1. Create a folder to store the original installation files and the MSP update files to apply. 2. Download the needed base install and requisite patches. 3. Add the following line to setup.ini file, under the [Product] section:  Acrobat 9.x: [Product]PATCH=AcroProStdUpd910_T1T2_incr.msp; AcrobatUpd912_all_incr.msp;AcrobatUpd913_all_incr.msp  Acrobat 10.x: [Product]PATCH=AcrobatUpd1011.msp Note: It is not necessary to use path statements or quotes. 4. Make any additional modifications to Setup.ini and/or to the command line in a batch file. Note: Command line parameters can be sent to msiexec from the Setup.ini using /msi. See The Command Line and msiexec. 5. Run setup.exe to start the installation. Bootstrapper Installations Bootstrapper configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 79 7.3.1 Bootstrapper configuration The bootstrapper uses Setup.ini as a configuration file. Administrators typically modify this file via the Customization Wizard, manually, or both as needed. Tip: The setup.ini files are not up to date. Either ignore the“RequireX” properties and change them to something reasonable. 10.x requires MSI 3.1. However, wrong values here will probably not result in installation failure. Example 7.1: Setup.ini: Default for 10.x mui Reader [Startup] RequireOS=Windows 2000 RequireMSI=3.0 RequireIE=6.0.2600.0 [Product] msi=AcroRead.msi PATCH=AdbeRdrUpd1010_MUI.msp Languages=1033;1031;1036;1041;1034;1040;1043;1046;1053;1030;1035;1044;2052;1028; 1042;1069;1027;1050;1029;1038;1045;1048;1049;1051;1060;1055;1058 1033=English (United States) 1031=German (Germany) 1036=French (France) 1041=Japanese 1034=Spanish (Traditional Sort) 1040=Italian (Italy) 1043=Dutch (Netherlands) 1046=Portuguese (Brazil) 1053=Swedish 1030=Danish 1035=Finnish 1044=Norwegian (Bokmal) 2052=Chinese Simplified 1028=Chinese Traditional 1042=Korean 1069=Basque 1027=Catalan 1050=Croatian 1029=Czech 1038=Hungarian 1045=Polish 1048=Romanian 1049=Russian 1051=Slovak 1060=Slovenian 1055=Turkish 1058=Ukrainian [Windows 2000] PlatformID=2 MajorVersion=5 ServicePackMajor=4 [MSI Updater] Path=http://ardownload.adobe.com/pub/adobe/reader/win/8.x/8.0/misc/ WindowsInstaller-KB893803-v2-x86.exe Bootstrapper Installations Bootstrapper configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 80 Example 7.2: Setup.ini: Default for 9.x Reader [Startup] RequireOS=Windows 2000 RequireMSI=3.0 RequireIE=6.0.2600.0 [Product] msi=AcroRead.msi [Windows 2000] PlatformID=2 MajorVersion=5 ServicePackMajor=4 [MSI Updater] Path=http://ardownload.adobe.com/pub/adobe/reader/win/8.x/8.0/misc/ WindowsInstaller-KB893803-v2-x86.exe Table 1 Bootstrapper configuration sections Section Parameter Description Startup RequireMSI The minimum version of MSI service that requires. 9.x requires 3.0. 10.x requires 3.1. RequireIE The minimum version of Internet Explorer that requires. RequireOS A semicolon-separated list of operation systems. You need only specify the minimum required OS(s). Each OS name from the list must have corresponding INI section with OS specification. While there is no restriction on the string name, these names are used in any error messages. Therefore, real names are more user friendly. [OS name] A list of required OS names which matches those in RequireOS. The key values are always numbers. The default is 0 if any key or value is missing except that there is no default value for Architecture. It is possible to add recognition of the other operating systems such as Server/Client/ Workstation and Professional/Home/Web/Enterprise editions. PlatformID Identifies the OS. See Table 2. MajorVersion Identifies the OS. See Table 2. MinorVersion Identifies the OS. See Table 2. The keys below identify the service pack. Use CSDVersion to identify any OS prior of NT4service pack 6, and use ServicePackMajor-ServicePackMinor for OS NT4-service pack 6 and higher. CSDVersion and ServicePackMajor-ServicePackMinor are mutually exclusive. Bootstrapper Installations Bootstrapper configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 81 CSDVersion Use CSDVersion to identify any OS prior of NT4-Servise Pack 6. CSDVersion and pair of ServicePackMajor-ServicePackMinor are mutually exclusive. If you specify CSDVersion, then ServicePackMajor-ServicePackMinor are ignored. Use ServicePackMajor-ServicePackMinor for OS NT4-Service Pack 6 and higher. ServicePackMajor Identifies the major service pack. See also CSDVersion. ServicePackMinor Identifies the minor service pack. See also CSDVersion. Architecture If specified, the value must match:  0: PROCESSOR_ARCHITECTURE_INTEL  1: PROCESSOR_ARCHITECTURE_MIPS  2: PROCESSOR_ARCHITECTURE_ALPHA  3: PROCESSOR_ARCHITECTURE_PPC  4: PROCESSOR_ARCHITECTURE_SHX  5: PROCESSOR_ARCHITECTURE_ARM  6: PROCESSOR_ARCHITECTURE_IA64  7: PROCESSOR_ARCHITECTURE_ALPHA64  8: PROCESSOR_ARCHITECTURE_MSIL  9: PROCESSOR_ARCHITECTURE_AMD64  10: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 [Product] Product Section msi Name of the msi file to sub-launch. CmdLine Any msiexec command. See msiexec: switches and options and Bootstrapper configuration. Note if [Startup]-CmdLine contains /msi, [Product]-CmdLine is ignored. Languages For multilingual installers only, a semicolon-separated list of languages in LANG_ID format. PATCH Full or relative path to the msp file to apply with MSI sub-launch. Do not use quotes. LANG_ID Language Description key, one for each language. See “Locale and language codes” on page 16. [MSI Updater] The bootstrapper can download and install the required MSI version if needed. Adobe provides the default data. See RequireMSI. Path The absolute or relative path to the required MSI updater file starting with starting from http:// or ftp://. When a fully-qualified URL path os specified, the bootstrapper downloads the new Microsoft Installer first. Timeout The time in minutes after which if downloading is not complete it will be aborted. The default is 15 minutes. Table 2 OS identification for bootstrapper PlatformID MajorVersion MinorVersion OS Name 0 - - Win32s on Windows 3.1 1 4 0 Windows 95 10 Windows 98 90 Windows ME Table 1 Bootstrapper configuration sections Section Parameter Description Bootstrapper Installations Bootstrapper command line switches 3/2/12: Enterprise Administration for the Acrobat Family of Products 82 7.3.2 Bootstrapper command line switches Arguments can be passed to the Setup.exe bootstrap installer to control its operation (Table 3). The general form of the command is: \Setup.exe [...] Tip: All parameters are case insensitive. There is no parameter merging; if any parameter passed as app argument all parameters from INI file will be ignored. 7.3.3 Setup.ini examples Example 7.3 uses Acrobat 9 Pro for languages English, French and German. Except for the PATCH= line and the addition of the ADDLOCAL=ALL property, the changes were written to the file by the Adobe Customization Wizard. Example 7.3: Setup.ini: chained install [Startup] RequireOS=Windows XP RequireMSI=3.0 RequireIE=6.0.2600.0 2 0 Windows NT 4.0 0 Windows 2000 1 Windows XP 2 Windows Server 2003 2 6 0 Windows Vista Table 3 Switches for the Setup.exe bootstrap installer Switch Description /sAll Run installer in silent mode. /sPB Silent mode with minimum UI: show the progress bar only. /rs Reboot Suppress. Setup.exe will not initiate reboot even if it is required. /rps Reboot Prompt Suppress. If reboot is required, the system restarts without warning. /ini "PATH" Relative or absolute path to an alternative (different) Bootstrapper INI file. The CmdLine of alternative INI will be ignored. /l Enable Error Logging. Log file Bootstrap.log will be generated in a temp directory. /sl "LANG_ID" Set Language, where LANG_ID is the decimal code of the destination installation language. Use it only for the multilingual installer, and make sure that the corresponding language transform file exist in the setup directory. If /sl "LANG_ID" is not set and you are running the multilingual installer interactively (not silently),‘Choose Setup Language’ dialog will be displayed. /msi[Command line] Identifies the portion of CmdLine for additional MSIEXEC command line parameters. Everything following /msi is passed to MSIEXEC without analyzing and without any changes. Table 2 OS identification for bootstrapper PlatformID MajorVersion MinorVersion OS Name Bootstrapper Installations Setup.ini examples 3/2/12: Enterprise Administration for the Acrobat Family of Products 83 CmdLine=/sl"1033" /sPB [Product] msi=AcroPro.msi Languages=1033;1031;1036 1033=English (United States) 1031=German (Germany) 1036=French (France) CmdLine=TRANSFORMS="AcroPro.mst" ADDLOCAL=ALL PATCH=AcroProStdUpd910_T1T2_incr.msp;AcrobatUpd912_all_incr.msp; AcrobatUpd913_all_incr.msp [Windows XP] PlatformID=2 MajorVersion=5 MinorVersion=1 ServicePackMajor=2 [Windows XP] PlatformID=2 MajorVersion=5 MinorVersion=1 ServicePackMajor=2 [MSI Updater] Path=WindowsInstaller-KB893803-v2-x86.exe Example 7.4: Windows NT with different service packs RequireOS=Windows NT RequireMSI=3.0 RequireIE=6.0 [Windows NT] PlatformID=2 MajorVersion=4 CSDVersion=5 [Windows NT] PlatformID=2 MajorVersion=4 ServicePackMajor=6 Example 7.5: AcroPro7 EFG –Tuned for silent, transformed, German destination [Startup] CmdLine=/sAll /sl “1031” RequireOS=Windows 2000 [Product] CmdLine=TRANSFORMS="AcroPro.mst" msi=AcroPro.msi Languages=1033;1031;1036 1033=English (United States) 1031=German (Germany) 1036=French (France) [Windows 2000] PlatformID=2 MajorVersion=5 Bootstrapper Installations Language based installer behavior 3/2/12: Enterprise Administration for the Acrobat Family of Products 84 ServicePackMajor=2 7.3.4 Language based installer behavior During installation, both the bootstrapper and the Select Language dialog behavior is determined by two items: the specified Lang_ID key in the setup.ini file and the existence of the language package in the file to be installed. There are three possible scenarios:  When the OS user default locale matches one of the package languages:  The language dialog is invoked with strings in the OS locale language.  Language descriptions in the drop-down list are populated with OS locale strings from system registry. If this fails, then the drop-down list populates with the string from the INI Language Description keys.  The OS locale Language is pre-selected in the drop-down list.  When the OS user default locale is one of the 15 supported languages but doesn’t match any of the package languages:  The dialog labels appear in OS locale language.  Language descriptions in the drop-down list are populated with OS locale strings from the system registry. If this fails, then the drop-down list populates with the string from the INI Language Description keys.  The Package Default Language value of‘ProductLanguage’ from the installer Property table is pre-selected in the drop-down list.  When the OS user default locale doesn’t match any of the 15 supported languages:  The dialog labels appear in the Package Default Language locale.  The drop-down list populates with string from INI Language Description Keys.  The Package Default Language is pre-selected in the drop-down list. 8 85 SCCM-SCUP Deployments 10.x products introduce support for SCCM deployments and SCUP. The SCUP catalogs can be found at http://www.adobe.com/go/acrobatitinfo. System Center Updates Publisher (SCUP) is a stand-alone tool that is used in conjunction with Microsoft’s System Center Configuration Manager (CM hereafter) to allow administrators to more accurately and efficiently install and update software. Together, CM and SCUP are Microsoft’s latest change and configuration management solution that replaces older methodologies such as SMS and GPO. Unlike these older technologies, CM provides features such as metering, asset intelligence, and improved remote client administration. For example, CM users can easily determine what products versions are installed including all dot and double dot patches without having to write a complicated query. This documentation is for administrators who are already familiar with managing networked environments via CM; it is not intended to replace the CM documentation. Figure 1 CM: Update ready for distribution System requirements The SCUP catalog for Acrobat products requires SCUP 4.5. All other requirements are defined by the Microsoft System Center Configuration Manager 2007. Note: Table 1 lists the base software used in Adobe’s lab environment. Administrators should refer to Microsoft’s documentation for information on installing and configuring these SCCM-SCUP Deployments SCCM-SCUP basics 3/2/12: Enterprise Administration for the Acrobat Family of Products 86 requisite components. Every enterprise environment will be unique, and many configurations are possible. 8.1 SCCM-SCUP basics Tip: SCCM users should note that SCUP catalogs can't deliver anything but a generic installer. Because enterprises use different configurations, there is no way for Adobe to provide installers tailored to individual organizations. However, MSPs do not change existing settings, and MSI deployments always involve using an MST to migrate settings. 8.1.1 File location and types SCUP files are hosted on a public server for manual or scripted download as needed. For example, files will reside at http://armmf.adobe.com/arm-manifests/win/SCUP/. There are two types of files:  cab: cab files such as Acrobat10_Catalog.cab are the actual catalog.  xml: xml files such as Acrobat10_Catalog.xml are a hash that can be compared to the cab file to verify its authenticity. Table 1 Required software Software Notes Operating System WIndows Server 2008. Admins should follow the Microsoft documentation and use whatever is appropriate for their environment. Internet Information Services (IIS) 7.0 or later versions .NET Framework 3.5 3.5 or later versions WebDAV 7.5 The Background Intelligent Transfer Service (BITS)-enabled distribution point role requires BITS server extensions and WebDAV extensions. Database Microsoft SQL Server 2008 Microsoft Management Console 3.0 (MMC) Framework that unifies and simplifies day-to-day system management tasks. Microsoft Report Viewer Redistributable 2008 Windows Server 2008 CM R2 requires WSUS 3.0 SP2. Do not install WSUS 3.0 SP1 on Windows Server 2008 R2. Active Directory 2008 Defines computers the CM controls. Site servers may need to be a member of an Active Directory domain depending on the network architecture. Windows Server Update Services 3.0 (WSUS) Distributes the updates. Only the administrator console component is required, and it must be installed prior to SCUP, SCUP 4.50.1103 (System Center Updates Publisher) Publishes updates to WSUS. The Acrobat catalog requires version 4.50.1103. System Center Configuration Manager 2007 SP2 (CM) Configuration Manager 2007 R2 is not a full product version and requires that SP1 or SP2 already be installed before running Configuration Manager 2007 R2 Setup. SCCM-SCUP Deployments Best practices 3/2/12: Enterprise Administration for the Acrobat Family of Products 87 8.1.2 Best practices  Update validation before deployment. Verify patch installation on the intended target for a manual install first (outside SCCM context).  Don’t test deployments during SCCM server changes  Be patient: While operations appear to return UI control back to the user immediately (i.e. Run Synchronization), some operations are batch processes that run in the background and take some time to complete.  Always Run Synchronization after integrating a SCUP catalog. Doing so ensures the WSUS and Configuration Manager Console gets synchronized.  Refresh often: Often once a task completes, updates may not appear in the various UI components and you may not see changes take affect. Always refresh using the Refresh link or context sensitive menu item.  Consider whether or not you should mark an expiration time (deadline) for publication. Once an update has expired, it will no longer be offered by the SCCM client. If you accidentally choose the wrong date or use the wrong UTC date setting, updates won’t be issued in the managed client.  Define boundaries for the managed environment.  Ensure all your managed clients are hosted within the desired domain, and that clients that should not be managed similarly are outside of that domain. For example, you could have an Active Directory Server define the managed domain; anything outside that domain will not be managed by my SCCM server.  Do not delete SCUP catalog components. Deleting the catalog component in SCUP simply deletes the SCUP reference to the package component (i.e. Reader English 9.3.3). Always expire a no longer used component to ensure its synchronized with the WSUS server and Configuration Manager Console before deletion. Otherwise, dangling pointers will prevent you from expiring the actual WSUS package component without some serious hacks.  Do not use prerequisite rules in catalog.  Consider not using Supersedence as SCUP 4.5 does not support Supersedence properly. 8.2 Catalog import There is one catalog for Reader and one for Acrobat. The file names are static, so scripted downloads should be relatively straightforward. Note: It may also be useful to understand the differences between quarterly updates, out of cycle patches, and the possible file types. While SCUP catalogs provide a way to automate installs, you should understand what gets installed and why. For example, Acrobat updating always involves installing every MSP update in order. Reader updates may involve quarterly MSI files that don’t require installing previous updates. To import the SCUP catalog: 1. Download the catalog for your product. 2. In the SCUP Console, choose Actions > Import Updates. SCCM-SCUP Deployments Catalog import 3/2/12: Enterprise Administration for the Acrobat Family of Products 88 3. Choose Single Catalog Import. 4. Choose Next. 5. Browse to the downloaded catalog. 6. Click Accept Adobe as a Trusted Publisher and then click OK. After import, the a summary screen displays information about the current updates. You are now ready to deploy updates using the CM-defined workflow. Figure 2 SCUP: Imported update catalog 9 89 Group Policy-Active Directory Deployments The Windows Server Group Policy Objects (GPO) and the Active Directory services infrastructure enables IT administrators to automate one-to-many management of users and computers. Administrators can implement security settings, enforce IT policies, and distribute software across a given site, domain, or range of organizational units (OU). With the software installation extension of GPO, you can provide on-demand software installation and automatic repair of applications. When the Customization Wizard is not used for pre-deployment configuration, GPO templates can be used to propagate the requisite configurations across your organization. The Group Policy settings that you create are contained in a GPO. To create a GPO, use the Group Policy Management Console (GPMC), which is available for download from the Microsoft website at http://www.microsoft.com/downloads/ details.aspx?FamilyID=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en. Tip: For procedures involving transforms that you can deploy using GPO and Active Directory, use the Customization Wizard to create the transforms. 9.1 Tested environments The procedures in this document were tested in the following environments:  Acrobat 9.x:  Client computers running Windows 2000 Professional Service Pack 4 (Adobe Reader only), Windows XP Professional Service Pack 2 and later, and Windows Vista 32-bit and 64-bit.  Server computers running Windows Server 2003 Enterprise Edition.  Acrobat 10.x:  Client computers running on OS versions defined by the publish system requirements.  Server computers running Windows Server 2008 Enterprise Edition. 9.2 10.x GPO deployments 1. Create an AIP. 2. Copy the AIP folder and rename it as the patch version; for example, 10.0.1. 3. Slipstream the patch into the 10.0 MSI. 4. Open a command prompt and CD to the patch version copy of the AIP. 5. Create the AIP via msiexec /a [MSI file name] /p [MSP file name] 6. Add a new package to the original GPO in the standard way without moving existing packages. Group Policy-Active Directory Deployments 10.x GPO deployments 3/2/12: Enterprise Administration for the Acrobat Family of Products 90 7. Point to the new MSI. 8. In the Deploy Software dialog, choose Advanced to bring up the properties menu for the package. Figure 1 GPO Deploy Software dialog 9. On the Properties page, rename the package to to distinguish this package. This name will appear in the ARP entry of the client system when the update is installed. Figure 2 GPO general tab 10. Switch to the Deployment tab. 11. Optional: If you need to Uninstall this application when it falls out of the scope of management setting, select the Deployment tab and select that checkbox. This will uninstall the application and patch automatically when the scope of the GPO changes or the package is removed from the GPO. Group Policy-Active Directory Deployments 10.x GPO deployments 3/2/12: Enterprise Administration for the Acrobat Family of Products 91 Figure 3 GPO deployment tab 12. Select the Upgrades tab. Figure 4 GPO Upgrades tab 13. Choose the current package (in this case 10.0). 14. Choose Add. 15. In the Add Upgrade Package dialog, do the following: 1. Select Current GPO. 2. Select the package you want to upgrade. 3. Select Package can upgrade over the existing package to ensure that this will be an upgrade instead of uninstall/reinstall. Group Policy-Active Directory Deployments 10.x GPO deployments 3/2/12: Enterprise Administration for the Acrobat Family of Products 92 Figure 5 GPO Add Upgrade Package dialog 16. Choose OK. 17. Review the summary. Figure 6 GPO summary Group Policy-Active Directory Deployments 9.x GPO deployments 3/2/12: Enterprise Administration for the Acrobat Family of Products 93 Users under a GPO policy will now get the latest update after the group policy refreshes and a computer restart. This procedure can be repeated for all patches. 9.3 9.x GPO deployments All GPO-based deployment is managed using the Group Policy Management Console. To start the Group Policy Management Console: 1. Log on as a Domain Administrator. 2. Open the Group Policy Management Console. 9.3.1 Assign the application to a computer: 1. Right-click Group Policy Objects. 2. Choose New. 3. In the New GPO dialog box, enter a descriptive name for the new policy. 4. Choose OK. 5. In the left-hand panel, expand Group Policy Objects. 6. Highlight the new policy name you just created. 7. On the Scope tab, choose Add in the Security Filtering section. 8. Choose Object Types in the Select User, Computer, or Group dialog box. 9. Choose Computers in the Object Types dialog box, 10. Choose OK. 11. Check the Enter the object name to select text check box in the Select User, Computer, or Group dialog box. 12. Enter the name of the computer to which you want to deploy the software. (To browse available computer names, choose Advanced > Find Now.) Note: Repeat this step for all computer names to which you want to deploy software. 13. Choose OK to close the Select User, Computer, or Group dialog box. 14. In the console’s left panel, right-click the policy name that you initially created. 15. Choose Edit. 16. Expand Computer Configuration in the left panel n the Group Policy dialog box. Group Policy-Active Directory Deployments Assign the application to a computer: 3/2/12: Enterprise Administration for the Acrobat Family of Products 94 17. Expand Software Settings. 18. Right-click Software installation. 19. Choose New > Package. 20. In the Open dialog box, browse to the AIP you created. 21. Select the MSI file containing the installer you want to deploy. 22. Choose Open. 23. In the Deploy Software dialog box, do one of the following:  If you do not plan to apply transforms, select Assigned > OK.  If you plan to apply transforms during installation, select Advanced > OK. 24. In the Properties dialog box for the package you created: 1. Choose the Deployment tab. 2. Select Uninstall this application when it falls out of the scope of management. 3. If you plan to deploy in multiple languages, choose Advanced. In the Advanced Deployment Options dialog box, choose Ignore language when deploying this package, and then choose OK. 4. On the Modifications tab, specify any modification transforms you want to apply when the package is installed by choosing Add and then opening each transform from its network location. 5. On the Security tab, verify the name(s) of any computer(s) to which you are assigning software. 25. Choose OK to close the Properties dialog box. 26. In the Group Policy dialog box, expand Computer Configuration > Administrative Templates > Windows Components. 27. In the Windows Components folder, select Windows Installer. 28. Select Always install with elevated privileges. 29. Select Properties. 30. In the Always install with elevated privileges Properties dialog box, choose the Setting tab > Enabled > OK. 31. Configure logging: 1. In the Windows Installer panel of the Group Policy dialog box, right-click Logging, and then select Properties. 2. Choose Enabled on the Setting tab. 3. Enter iweaprcv in the Logging text box. Group Policy-Active Directory Deployments Removing products using Group Policy Objects 3/2/12: Enterprise Administration for the Acrobat Family of Products 95 4. Choose OK. 32. In the Group Policy dialog box, choose File > Exit. 33. In the Group Policy Management Console, expand Forests and Domains. 34. Right-click the Acrobat OU to which you want to link the GPO that you created earlier in this procedure, and then select Link an Existing GPO. 35. In the Select GPO dialog box > Group Policy objects list > the GPO you created > OK. Note: The GPO must be propagated to the Active Directory Global Catalog and then to the individual computers. For this reason, allow 5-10 minutes before restarting the computers to which you are assigning the Acrobat software, or plan to restart the client computers twice before the system policies are synchronized. 36. Perform the tests as described in Appendix 16, “Basic Acceptance Tests”. 9.4 Removing products using Group Policy Objects Removing Acrobat products by using GPOs requires unlinking the Active Directory OU from the GPO currently enabling the software to run. To remove Acrobat products that are assigned to a computer, unlink the GPO from the OU, or remove the computer from the OU and GPO. The software will be removed the next time the computer restarts. 9.5 Creating GPO Templates You can create GPO templates that will enable configuration of almost any feature. The process is as follows: 1. Create templates that conform to the Microsoft format. For more information, see:  http://oreilly.com/catalog/winsyspe/chapter/ch08.html  http://technet.microsoft.com/en-us/library/cc780425%28WS.10%29.aspx 2. Populate the template fields with information from the Preference Reference. Example 9.1: GPO template: for Accessibility CLASS USER CATEGORY “Accessibility” POLICY "bOverridePageLayout" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bOverridePageLayout" Group Policy-Active Directory Deployments Creating GPO Templates 3/2/12: Enterprise Administration for the Acrobat Family of Products 96 EXPLAIN "Toggles the ability of the application to override the page layout embedded in the PDF." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bOverrideZoom" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bOverrideZoom" EXPLAIN "Enables the zoom setting drop down list so that the user can specify a default zoom setting for all documents." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bOverrideLineArtColors" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bOverrideLineArtColors" EXPLAIN "Limits color changes to black text and line art when iAccessColorPolicy is enabled and a replacement color has been specified." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bUseStructTabOrder" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bUseStructTabOrder" EXPLAIN "Specifies whether to use the PDF document structure for determining the tab order. " SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bShowKeyboardSelectionCursor" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bShowKeyboardSelectionCursor" EXPLAIN "Specifies whether the keyboard selection cursor should always be active in the document." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bUseSystemSelectionColor" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bUseSystemSelectionColor" EXPLAIN "Specifies whether the default selection color (blue) is overridden with a color that the system specifies." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bUseDetailsNavigator" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Access" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 Group Policy-Active Directory Deployments Creating GPO Templates 3/2/12: Enterprise Administration for the Acrobat Family of Products 97 VALUENAME "bUseDetailsNavigator" EXPLAIN "Specifies whether to show PDF Portfolio component files and file details in an accessible list. " SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bUsePlatformNavigator" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Attachments" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bUsePlatformNavigator" EXPLAIN "Specifies whether to always show portfolios in an accessible view. " SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bAutoSaveDocsEnabled" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\AutoSaveDocs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bAutoSaveDocsEnabled" EXPLAIN "Specifies whether or not to automatically save documents." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bAutoFill" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bAutoFill" EXPLAIN "Locks the auto-fill functionality on or off and disables the corresponding user interface item." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "xdata" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs\ cRequiredFieldHLColor" VALUENAME "xdata" EXPLAIN "The default color for required fields in forms." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bRuntimeHighlight" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs\ cRuntimeBGIdleColor" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bRuntimeHighlight" EXPLAIN "Specifies whether to show a field border color on hover. " SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bAutoCompleteOnTab" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bAutoCompleteOnTab" Group Policy-Active Directory Deployments Creating GPO Templates 3/2/12: Enterprise Administration for the Acrobat Family of Products 98 EXPLAIN "Specifies whether to auto complete form field entries on a tab key action." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bStoreNumericEntries" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bStoreNumericEntries" EXPLAIN "Specifies whether to store user entered numeric values." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bFocusRect" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bFocusRect" EXPLAIN "Specifies whether to surround a field with a rectangle when it has focus." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bInlineAutoComplete" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bInlineAutoComplete" EXPLAIN "Specifies whether to auto complete a field based on remembered values when a user starts typing." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bRecordNewEntries" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bRecordNewEntries" EXPLAIN "Specifies whether to remember form field entries for use with future auto-complete actions." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bRuntimeHighlight" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bRuntimeHighlight" EXPLAIN "Specifies whether to highlight fields during data entry." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bUserAskedToEnableAutoComplete" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FormsPrefs" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bUserAskedToEnableAutoComplete" Group Policy-Active Directory Deployments Creating GPO Templates 3/2/12: Enterprise Administration for the Acrobat Family of Products 99 EXPLAIN "Specifies whether the user is asked to enable auto complete at runtime." SUPPORTED "Adobe Reader 9.0" END POLICY POLICY "bAccessOverrideDocColors" KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\Originals" VALUEON NUMERIC 0 VALUEOFF NUMERIC 1 VALUENAME "bAccessOverrideDocColors" EXPLAIN "Specifies whether to replace black test or line art colors when iAccessColorPolicy is enabled and a replacement color has been specified." SUPPORTED "Adobe Reader 9.0" END POLICY END CATEGORY 10 100 Citrix Server Deployments This document describes how to deploy Adobe® Acrobat® on a Citrix server and have it emulated on Windows machines. It provides details about both the Citrix Presentation Server and the Citrix XenApp Server. Tip: There is more than one way to configure the server and the client’s connection to it. The instructions here are intended as helpful examples. Administrators should tailor these instructions to meet the requirements of their own environment. 10.1 Requirements The following is required:  A valid Acrobat software license for every computer that has access to Acrobat software on the Citrix Server.  Citrix system requirements  8.x products: Citrix Presentation Server 4.0, Enterprise Edition.  9.x products: Citrix Presentation Server 4.5 and XenApp 5.0 on Windows Server 2003 64-Bit Enterprise Edition with Service Pack 2 (SP2) and 2008 server 64-Bit Enterprise Edition with Service Pack 1.  10.x products:  Citrix XenApp 5.0 on Windows Server 2003 R2, Enterprise Edition, 32 bit, SP2.  Citrix XenApp 5.0 with Win 2008 Server Enterprise edition x64Bit O/S.  Citrix XenApp 6.0 with Win 2008 R2 Server Enterprise edition x64Bit O/S. Note: Each user runs a different instance of Acrobat, so performance should not degrade as users access the server. However, while each profile uses a separate instance of the running application, additional users do use more CPU and RAM resources. The server should be deployed with the resources needed to handle the expected number of simultaneous users. 10.1.1 License requirements When setting up a Citrix environment to enable access to Acrobat, the following licenses are needed 1. Citrix Server license. 2. Remote Desktop Client Access licenses (previously TS CALs). 3. Acrobat volume licenses of the appropriate version (one for each user). Note the 9.x licenses can only be used for 9.x products, 10.x licenses can only be used for 10.x products, and so on. Citrix Server Deployments Tested environments 3/2/12: Enterprise Administration for the Acrobat Family of Products 101 Tip: For more information, see http://www.adobe.com/products/eulas/pdfs/ Citrix_Policy_A10-5-31-2011.pdf. 10.1.2 Tested environments Because there is an unlimited number of possible execution environments, Adobe confines its testing to common scenarios. For Citrix deployments, the environments used for testing were as follows:  A user account was set up using Active Directory domain user group. The Anonymous User profile was not tested.  The user account was set up on the server with a restricted Common User profile, with Read, Read and Execute, and List Folder Contents permissions. These permissions enable the user to operate the computer and save documents; they do not allow the user to install programs or make changes to the system files or settings.  The server machine was running typical enterprise software. For example, for 9.x products the following is installed: Microsoft Office Professional Edition 2007, Microsoft Internet Explorer® 7.0, Microsoft Visio® Professional Version 2003 and 2007, Microsoft Office Publisher 2007, Microsoft Office Project Professional 2007, Lotus Notes® 8.0, and McAfee® VirusScan Enterprise 8.0. 10.2 Session vs. application virtualization Session virtualization is supported but application virtualization (streaming) will not be supported until 11.0. While Citrix XenApp supports both session virtualization and application virtualization, only the former where the application is hosted on a server is well tested. Again, creating a package and streaming it to the clients will not be supported until 11.0.. 10.2.1 Performance tuning How and when you tune your environment depends on a number of factors such as the number of users, requisite features, PDF content, and so on. It is advisable to use this documentation as well as that provided by Citrix at http://support.citrix.com/search/basic/?searchQuery=Adobe+ Acrobat&searchbtn.x=0&searchbtn.y=0. 10.2.1.1 Improving scrolling performance If scrolling performance is in graphic intensive documents, try the following: 1. Go to Edit > Preferences > Rendering. 2. Uncheck Smooth line art and Smooth images. Alternatively, you can set these preferences during pre-deployment configuration: HKCU\Software\Adobe\Adobe Acrobat\10.0\Originals\bAntialiasGraphics: 0x00000000 HKCU\Software\Adobe\Adobe Acrobat\10.0\Originals\bAntialiasImages: 0x00000000 Citrix Server Deployments Installing X products on a Citrix XenApp Server 5.0 3/2/12: Enterprise Administration for the Acrobat Family of Products 102 10.3 Installing X products on a Citrix XenApp Server 5.0 10.3.1 Known Citrix limitations for 10.x products The following are known issues for Acrobat products and Citrix clients:  When version of Adobe Reader prior to 10.1 is used with Protected Mode enabled (the default), Citrix is not supported. Administrators should disable and lock Protected Mode. 10.1 and later support both Citrix and Windows Terminal Server deployments.  Acrobat Standard and Reader users can run repair from the help menu on Vista and above. If a reboot is required, the Citrix server hosting the application will be restarted. To prevent this problem, create a JavaScript file (.js) containing (app.hideMenuItem("DetectAndRepair");) and place it in the \Reader 10.0\ Reader\Javascripts directory.  Acrobat PDFMaker and Adobe PDF Printer do not currently check Citrix licensing restrictions. Even users who don’t have access to the Acrobat application may be able to use Acrobat PDFMaker and Adobe PDF Printer. 10.3.2 Disabling Protected Mode Tip: For 10.1 and later products, skip this section. When version of Adobe Reader prior to 10.1 is used with Protected Mode enabled (the default), Citrix is not supported. Administrators should disable and lock Protected Mode. 10.1 and later support both Citrix and Windows Terminal Server deployments. Protected Mode can be locked as enabled or disabled as follows: 1. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\\\ FeatureLockDown. 2. Right click and choose New > DWORD Value. 3. Create bProtectedMode. 4. Right click on the key and choose Modify. 5. Set the value to 0. 10.3.3 Installing from the management console 1. Start the Citrix Access Management Console for XenApp Server 5.0 by doing one of the following:  Choose from Start > Programs > Citrix > Management Consoles > Access Management Console.  Launch the console directly by double-clicking Publish application. Note: The Citrix Application PublishingWizard will start and guide you through the process of publishing an application. 7. At the Welcome screen, choose Next. 8. Enter a Display Name for the application (for example, Acrobat X or Reader X) and an optional Application Description. 9. Choose Next. 10. Configure the type of application to publish: 1. Select the Application’ radio button (default). 2. In the Application Type list, select“Accessed from a server”. 3. In the Server application type drop down list, verify Installed application is selected. 4. Choose Next. 11. Choose Browse under the Command Line text field. 12. Navigate to Acrobat. exe or AcroRd32.exe file. Tip: The standard install path is C:\Program Files\ Adobe\\ \. 13. Choose OK. 14. Leave the default values for the Working Directory text fields. 15. Choose Next. 16. Add the servers on which the published application will run: 1. Choose Add. 2. Select the servers. 3. Choose OK. 4. Choose Next. Citrix Server Deployments Accessing Citrix from a client 3/2/12: Enterprise Administration for the Acrobat Family of Products 104 17. Specify the Users who can use the published application:  To provide usage privileges to a specific group, drill down through the domain tree and locate that group and choose Add.  To let anyone on your network use the application, select Allow Anonymous Connections. 18. Choose Next. 19. Optional: Application shortcut placement fields are optional. Select the check boxes to add application shortcuts to the client’s start menu, desktop, and Programs folder (when accessing through Program Neighborhood). Choose Next. 20. Optional: Configure advanced options: 1. Check Configure advanced application settings check box. 2. Choose Next. 3. Set the following as needed:  Access Control  Content Redirection  Limits of instances of application on server  Client options  Application appearance Note: If you are unsure what settings to choose, leave the defaults and uncheck the check box for configuring advanced settings. 21. Choose Finish. Tip: If you receive a restart prompt, Adobe strongly recommends that you restart the system. 22. Perform the tests as described in Appendix 16, “Basic Acceptance Tests”. 10.3.4 Accessing Citrix from a client Using the application from a client can be done through a number of methods. This document defines two:  Accessing Published Applications through the Citrix Web Interface  Accessing Citrix via Program Neighborhood Client: 10.3.4.1 Accessing Published Applications through the Citrix Web Interface 1. Install the Citrix web client locally by running XenAppWeb.msi. 2. Open Internet Explorer and enter the server URL. 3. Enter your credentials. Citrix Server Deployments Accessing Citrix from a client 3/2/12: Enterprise Administration for the Acrobat Family of Products 105 Figure 1 Citrix: Authentication 4. Choose Log On. 5. Double click on any Acrobat or Reader shortcut. Tip: Citrix Maps your local drive with the server. Accessing any local file causes Citrix to open an ICA File Security dialog which asks to allow the server to access your local drive. If you select full access, Citrix maps your both your local drive and printer driver to the server hosted application so that you can seamlessly use the applications. 10.3.4.2 Accessing Citrix via Program Neighborhood Client: 1. Install the Citrix hosted client locally by running XenAppHosted.msi. Doing so installs the Web Client, Program Neighborhood Agent, and Program Neighborhood. 2. Use the installation setup details provided by the Citrix administrator. 3. Double click the Citrix Program Neighborhood icon to open Custom ICA Connection dialog. 4. Choose File >Custom Connections Settings. 5. Verify Network Protocol Connection is set to HTTP/HTTPS on the Connection tab. 6. Verify Server Group is set to Primary. 7. Choose ADD. 8. Enter the server details provided by the Citrix administrator 9. Choose OK. 10. Choose Add ICA Connection. 11. Set Custom ICA connection to Local Area Network. 12. Choose Next. 13. Enter a name for the ICA Connection. 14. Set Network Protocol to TCP/IP+HTTP. Citrix Server Deployments Installing 8.x and 9.x on a Citrix Presentation Server 3/2/12: Enterprise Administration for the Acrobat Family of Products 106 15. Select the Server radio button. 16. Enter your server name or select one from drop down list. 17. Choose the Published Application radio button. 18. Select Acrobat or Reader from the drop down list. 19. Select a view for the published application. 20. Choose Next. 21. Leave the Encryption Level as default. 22. Choose Next. In the log-in Window dialog, do not provide any credential information. 22. Leave Windows color as default. 23. Choose Next. 24. Choose Finish. Note: An ICA connection icon is created with the name you provided. Double click this icon to launch the application. 10.4 Installing 8.x and 9.x on a Citrix Presentation Server Install Acrobat products by using either Add or Remove Programs or Citrix Installation Manager on the computer running Citrix Presentation Server. 10.4.1 Installing with Add/Remove Programs To install Acrobat products using Add or Remove Programs: 1. Choose Start > Settings > Control Panel > Add or Remove Programs. 2. Choose Install. 3. Do one of the following:  If you are installing from a CD, insert the disk and choose Next.  If you are installing from an executable file on the network, choose Next, and then choose Browse to locate the file. 4. Choose Finish. Tip: If the installer prompts you to restart the server, it is strongly recommended that you do so. Citrix Server Deployments Publishing the application on the server 3/2/12: Enterprise Administration for the Acrobat Family of Products 107 10.4.2 Publishing the application on the server Before clients can access an application, you must publish it on the server by using the Citrix Management Console. To publish an application: 1. Choose Start > All Programs > Citrix > Citrix Management Console. 2. In the Log On to Citrix Farm dialog box, select the server. 3. Enter your Citrix administrator credentials. 4. In the Citrix Management Console dialog box, expand the Applications tree. 5. Right-click Application and choose Publish Application. 6. On the first page of the Application Publishing Wizard, enter a display name (for example, Acrobat) and a description of the application (for example, PDF Creation). These details appear on the Web interface and other client interfaces. 7. Choose Next. 8. Choose Application > Browse to find the Acrobat product you want to publish. For example, Acrobat.exe. 9. Choose Next. 10. On the Program Neighborhood Settings page, choose Next. 11. On the Specify Application Appearance page, make any changes to the application resolution, and then choose Next. 12. On the next page, if you want to enable audio, choose Enable Audio. Then, choose Next. 13. On the Specify Application Limits page, choose Next. 14. On the Specify Servers page, choose Citrix Server. 15. Choose Add to move it to the Configured Servers list. 16. Choose Next. 17. On the Specify Users page, if you want to specify users who can run the application, clear the Allow Anonymous Connections option, and specify the users you want to allow. 18. Choose Next. 19. On the Specify File Type Associations page, choose Finish. The wizard finishes and the application is published. 10.4.3 Accessing Citrix from a client After Acrobat is published on the server, Citrix client computers can establish connections to it. Citrix Server Deployments Accessing Citrix from a client 3/2/12: Enterprise Administration for the Acrobat Family of Products 108 Add a new Citrix client connection 1. Choose Start > All Programs > Citrix ICA Client > Citrix Program Neighborhood. 2. Select Add New ICA Connection to open the connection Wizard. 3. Choose Next. 4. Log on to the computer running Citrix Presentation Server. Run Acrobat via the Citrix Web Interface from a client 1. On the computer you want to use to access Acrobat, point the Web browser to the Citrix Server Web portal (for example, http://editcitrix.corp.adobe.com). 2. If you have not yet downloaded the Citrix Web Interface client on this computer, you will be prompted to download it. Follow the on-screen instructions to download and install this application. 3. Log on to the Citrix Web Interface client. 4. On the Web portal site, choose the application icon for the requisite Acrobat application. Access published files via the Citrix Program Neighborhood client 1. Run the installer file ica32.msi on the computer you want to use as the Citrix Program Neighborhood client. 2. Double-click the Citrix Program Neighborhood icon on the computer desktop. 3. Choose File > Custom Connections Settings. 4. On the Connection tab, verify the following settings:  Network Protocol Connection: HTTP/HTTPS  Server Group: Primary  Optional: To add an address list, choose Add, and then follow the on-screen instructions. 5. Choose OK. 6. On the computer desktop, double-click Add ICA Connection. 7. Set the connection type to Local Area Network. 8. Choose Next. 9. On the Connection page, do the following: 1. Enter a description of the ICA connection. 2. Verify that the Network Protocol is set to TCPIP/HTTP. 3. Choose the Server option and type the server name in the text box. 4. Choose Published Application. Citrix Server Deployments Removing the product 3/2/12: Enterprise Administration for the Acrobat Family of Products 109 5. In the list, select the name of the Acrobat application you want to run. 6. Choose Next. 10. Select a view for the published application. 11. Choose Next. 12. On the Encryption Level page, choose Next. 13. Enter your user credentials. 14. Choose Next. 15. Verify that the Windows colors are set to Default. 16. Choose Next. 17. Choose Finish. Tip: If you receive a restart prompt, Adobe strongly recommends that you restart the system. 18. Perform the tests as described in Appendix 16, “Basic Acceptance Tests”. 10.4.4 Removing the product Uninstall an Acrobat product by using either Add or Remove Programs or the Citrix Installation Manager on the computer running Citrix Presentation Server. To remove an application using Add or Remove Programs: 1. Choose Start > Settings > Control Panel > Add or Remove Programs. 2. Select the application. 3. Choose Remove. 4. Restart the server to ensure that all the appropriate files are removed. 10.4.5 Known Citrix limitations: with Acrobat 9.x The following are known issues for Acrobat products and Citrix clients:  Acrobat PDFMaker and Adobe PDF Printer do not currently check Citrix licensing restrictions. Even users who don’t have access to the Acrobat application may be able to use Acrobat PDFMaker and Adobe PDF Printer.  Issue #1451407: The Acrobat 9 graphical interface renders poorly when displayed using 8-bit resolution on a Citrix client.  TechNote #326511: (http://www.adobe.com/support/techdocs/326511.html): Acrobat closes when a user right-clicks inside the main window. This applies to Acrobat and Reader versions 7, 8 and 9running on Citrix Presentation Server 4.0. To fix this problem, install the Hotfix Rollup Pack PSE400W2K3R03 for Citrix Server Deployments Known Citrix limitations: with Acrobat 9.x 3/2/12: Enterprise Administration for the Acrobat Family of Products 110  Citrix Presentation Server 4.0, Citrix Access Essentials 1.0 and 1.5 for Windows Server 2003. For more information on this series of fixes, refer to the Citrix Systems KB article CTX111419 at http:// support.citrix.com/article/CTX111419.  Issue #1520296: Mail does not launch when taking a shared review offline and attempting to send comments by Email.  Issue #1760973: Users are unable to Browse to Network folder via Add Existing folder. 11 111 Windows Terminal Services Deployments 11.1 Tested environments Adobe has validated all of the Acrobat family of products in a Windows Terminal Services environment. The environments used for validation were set up in the following ways:  Acrobat 9:  The WTS environment used Remote Desktop Client version 6.0.2448.0 with Microsoft Windows Server 2003 Enterprise Edition with Service Pack 2 and version 5.1.2600.2180 with Windows XP Professional Service Pack 2.  Client operating systems tested were Windows XP Professional Service Pack 2 and above, and Windows Vista Professional with and without Service Pack 1.  A user account was set up using a Microsoft Active Directory domain user group. Note The Anonymous User profile was not tested.  The user account was set up on the server with a restricted Common User profile, with Read, Read and Execute, and List Folder Contents permissions. These permissions enable the user to operate the computer and save documents; they do not allow the user to install programs or make changes to the system files or settings.  The server machine was running Microsoft Office Professional Edition 2003 and 2007, Microsoft Internet Explorer® 6.x and 7.0, Microsoft Office Publisher 2003, Microsoft Office Project Professional 2003, Lotus Notes® 7.0 and 8.0, and McAfee® VirusScan® Enterprise 8.5.  Acrobat 10.0:  Windows Server 2008 R2 Enterprise Edition 64-bit.  Client operating systems: Windows XP Professional SP3, Windows Vista SP2 and Windows 7 (both 32-bit and 64-bit).  Standard/Administrator user profiles were set up via Active Directory. 11.2 Installing Acrobat products You must install applications by using Add or Remove Programs on the WTS server. To install Acrobat products: 1. Choose Start > Settings > Control Panel > Add or Remove Programs. 2. Choose Install. Windows Terminal Services Deployments Installing Acrobat products 3/2/12: Enterprise Administration for the Acrobat Family of Products 112 3. Do one of the following:  If you are installing from a DVD, insert the disk, and then choose Next.  If you are installing from an executable file on your network, choose Next > Browse to locate the file. 4. Choose Finish. Note: Some users have experienced issues where Sophos Anti Virus software conflicts with Acrobat’s licensing components (e.g. PDApp.exe). If you are experiencing problems, try uninstalling Sophos. 12 113 Systems Management Server Deployments Acrobat products support workflows that use Microsoft’s Systems Management Server (SMS) to deploy applications across your enterprise. The Adobe installer uses SMS features to create an installation package within the SMS administrator console. Note: While SMS workflows are likely to work, Adobe has focused software distribution testing on System Center Configuration Manager (SCCM) 2007 and patch distribution through SCUP for the Acrobat X family of products. Since SMS is a legacy product for Microsoft, it is expected that most organizations have migrated or will migrate to SCCM or System Center Essentials (SCE). 12.1 Tested environments The following has been tested:  Acrobat 8:  SMS 2003 Service Pack 1 running on Windows Server 2003 Standard Edition with Service Pack 1.  Desktop client systems running on the following operating systems: Microsoft Windows 2000 Professional Service Pack 4 and Windows XP Professional Service Pack 2. Each system was also running Microsoft Office 2003 Professional Edition, McAfee® VirusScan® Enterprise 8.0, and Microsoft Internet Explorer® 6.0.  Localized versions that were tested are English, French, German, and Japanese. Adobe tested the deployment of the localized version of the application (for example, Adobe Acrobat 8 Professional Japanese) to the localized version of the operating system (for example, Windows XP Professional Japanese).  Acrobat 9:  SMS 2003 Service Pack 2 running on Windows Server 2003 Edition with Service Pack 2.  Desktop client systems running on the following operating systems: Microsoft Windows 2000 Professional Service Pack 4 (Adobe Reader only), Windows XP Professional Service Pack 2 and Microsoft Vista with and without Service Pack 1. Each system was also running Microsoft Office 2003 and 2007 Professional Edition, McAfee® VirusScan® Enterprise 8.5, and Microsoft Internet Explorer® 6.x and 7.0.  The localized versions that were tested are English, French, German, and Japanese. Adobe tested the deployment of the localized version of the application (for example, Adobe Acrobat 9 Professional Japanese) to the localized version of the operating system (for example, Windows XP Professional Japanese).  Acrobat X: Deprecated and untested. Emphasis is now on SCCM and SCUP. Systems Management Server Deployments Installing Acrobat products with SMS 3/2/12: Enterprise Administration for the Acrobat Family of Products 114 12.2 Installing Acrobat products with SMS Acrobat product installation is pushed to the client computer and requires no user interaction. You simply create a package and deploy the installation. If you are using the Customization Wizard to configure the client prior to deployment, the Wizard can create an SMS package for you. 12.2.1 Removing previous versions You should remove any previous versions of the product you are about to install before you install. If you are installing Reader, you must install previous versions. With the X family of products, it is possible to have an earlier version of Acrobat and the most recent version of Reader on the same machine. To remove an application using Add or Remove Programs: 1. Choose Start > Settings > Control Panel > Add or Remove Programs. 2. Select the application. 3. Choose Remove. 4. Restart the machine to ensure that all the appropriate files are removed. 12.2.2 Creating the SMS package Tip: If you use Adobe Customization Wizard to create an SMS package, the wizard outputs a package definition file. A package definition file is a text file with an .sms filename extension that has all the information and command lines necessary to create a software distribution package for Acrobat and Reader application deployment. To create the package that SMS uses for distribution: 1. Open the Systems Management Server console. 2. Right-click Packages. 3. Choose New > Package. 4. On the General tab, provide the following information:  Package name (up to 50 characters),  Version number of the software package, up to 32 characters  Name of the software publisher, up to 32 characters  Language version, up to 32 characters  Description of the package, up to 127 characters 5. On the Data Source tab, select This Package Contains Source Files. 6. In Source Directory, select the type of connection for the source files. 7. Choose Apply. 8. On the Distribution Settings tab, select High on the Sending Priority menu. Systems Management Server Deployments Creating the SMS package 3/2/12: Enterprise Administration for the Acrobat Family of Products 115 9. Choose OK. The package should appear under the Packages node of the Site Database tree on the SMS console. 10. Expand the package under the Packages node. 11. Right-click Distribution Points. 12. In the New Distribution Points Wizard dialog box, select the servers to designate as the distribution points. 13. Choose Finish. 14. Under the Packages node, right-click Programs. 15. Choose New > Program. 16. In the Command Line panel of the Program Properties dialog box, choose Browse to locate the install folder. 17. Do one of the following:  To run the installer by using setup.exe, enter: Setup.exe ISX_SERIALNUMBER="" /sAll  To run the installer by using the msiexec program, enter: msiexec.exe /qn /i".msi" ISX_SERIALNUMBER="" Note: Use this option only if Windows Installer 3.1 is installed on all of the client computers. 18. On the Environment tab, select whether the user is logged on or not. 19. Choose OK to display the SMS package. SMS distribution package creation 1. Open the Systems Management Server console. 2. Right-click Packages. 3. Choose New > Package from Definition. 4. In the Create Package from Definition Wizard panel, choose Browse, 5. Select the SMS definition file you want to use. 6. Choose Open. 7. Verify the product name, version, and language for the package. 8. Choose Next. 9. On the Source Files page, select Always Obtain Files from a Source Directory. 10. Choose Next. 11. On the Source Directory page, specify the path to the source directory for the package. Systems Management Server Deployments Creating the SMS package 3/2/12: Enterprise Administration for the Acrobat Family of Products 116 12. Choose Next. 13. On the last page, confirm all of the information for the package. 14. Choose Finish. SMS advertisement creation You can create an advertisement that offers the SMS package to the clients. To create an advertisement: 1. On the Site Database tree, expand Collections. 2. Right-click the collection that will receive the package. 3. On the first page of the Distribute Software Wizard, choose Next. 4. In the Package dialog box, select Distribute an Existing Package. 5. Choose Next. 6. In the Distribution Points dialog box, make sure that the distribution point is selected. 7. Choose Next. 8. In the Advertise a Program dialog box, choose Yes. 9. Choose Next. 10. In the Advertisement Target dialog box, select Advertise the Program to an Existing Collection. choose Browse to locate the collection if it is not already displayed. 11. Choose Next. 12. In the Advertisement Name dialog box, make sure that the correct package and collection names appear. 13. Choose Next. 14. In the Advertise to Subcollections dialog box, specify any subcollections that should also receive the advertisement. 15. Choose Next. 16. In the Advertisement Schedule dialog box, confirm or change the time that the advertisement is offered; and then specify whether the advertisement should expire and when. Systems Management Server Deployments Removing Acrobat 9 3/2/12: Enterprise Administration for the Acrobat Family of Products 117 17. In the Assign Program dialog box, choose Yes to assign the program. 18. Choose Next. 19. In the Completing the Distribute Software Wizard dialog box, review your settings. 20. Choose Finish. 21. Perform the tests as described in Appendix 16, “Basic Acceptance Tests”. 12.3 Removing Acrobat 9 To remove the application using SMS: 1. Open the Systems Management Server console. 2. Expand the package that contains it. 3. Open the Program Properties dialog box. 4. On the General tab, enter the following command line: msiexec /x "AcroPro.msi" /qn 12.4 Known limitations The following are known issues for Acrobat products and SMS deployments:  None. 13 118 SharePoint Integration Acrobat and Adobe Reader X introduces a SharePoint integration feature that provides the following features:  Associating Adobe's PDF icon with PDF files in the SharePoint browser user interface.  Clicking a PDF link in the SharePoint browser user interface opens the PDF in an Acrobat product and the user is given an option to check out the PDF file.  The SharePoint browser user interface indicates when a PDF is checked out.  The File > SharePoint Server menu appears in the Acrobat product. Items include:  Check In  Discard Check-Out  Prepare Document Properties 13.1 SharePoint System Requirements The following is required:  A valid Acrobat software license for every computer that has access to Acrobat software on the Server.  SharePoint 2007 or SharePoint 2010.  Client Machines: Windows, Internet Explorer, and Reader X or Acrobat X. 13.1.1 Tested environments Because there is an unlimited number of possible execution environments, Adobe confines its testing to common scenarios. Environments used for testing were as follows: 13.1.2 Changes across releases Table 1 SharePoint changes across releases Version Description 10.0 Introduced SharePoint support. 10.1 Added bDisableSharePointFeatures. Signature workflow improvements 10.1.2 Support for the additional ActiveX control PdfFile.OpenDocuments appears in Acrobat and Reader. SharePoint Integration SharePoint Configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 119 13.1.2.1 Digital signature changes for 10.1 10.1 improves the SharePoint end user experience during signature workflows by eliminating the Save step. Prior to 10.1, users were prompted to save a file locally after digitally signing a SharePoint-hosted PDF and then save a new version of the file separately in to SharePoint. With 10.1, the behavior for digitally signing a SharePoint-hosted PDF file is as follows:  Signed files are saved directly to SharePoint if that PDF file is already checked out.  The user is prompted to check out the file if that PDF is not already checked out. 13.2 SharePoint Configuration 13.2.1 Configuration for 10.1.2 and later Starting Acrobat/Reader 10.1.2, the ActiveX control PdfFile.OpenDocuments is supported in addition to AdobeAcrobat.OpenDocuments. The rationale behind this change is that Microsoft is pushing an update to Sharepoint Online and on-premise Sharepoint servers which automatically updates DocIcon.xml to associate PDFs with the ActiveX control named PdfFile.OpenDocuments. If you’ve received this update, you don't need to change your DocIcon.xml manually as described below. To verify you have latest update or not, open DocIcon.xml in a text-editor and look for PdfFile.OpenDocuments. If it's there, then no additional configuration is needed. If it's not there, manually modify the DocIcon.xml file as described below. 13.2.2 Manual configuration The DocIcon.xml file is present on every front-end Web server in a Microsoft SharePoint 2007 or SharePoint 2010 deployment. It is used to specify the icon that displays for different file types. Optionally, it can specify whether an ActiveX control opens the file. See“Understanding DocIcon.xml Files” on MSDN to understand the functions of DocIcon.xml file. The DocIcon.xml performs three basic functions:  Associates display icons with file types.  Assigns an ActiveX control to open the file for viewing or editing.  Configures the text that displays in the SharePoint pop-up menus. Settings in the DocIcon.xml file are global to a SharePoint deployment and impact site definitions on all front-end Web servers. Each filename extension or ProgId can map to only one editing control, one icon, and one string of display text. This mapping is identical throughout a SharePoint deployment. You can add mapping elements to support additional filename extensions and ProgIds. The ActiveX control AdobeAcrobat.OpenDocuments is installed on the client computer with Acrobat X or Reader X. To use that ActiveX control for opening PDFs on a user's computer, modify the DocIcon.xml file to associate an icon and assign an ActiveX control for PDF files as follows: 1. Find the DocIcon.xml file: SharePoint Integration Allow HTTP methods in IIS 7 or later 3/2/12: Enterprise Administration for the Acrobat Family of Products 120  SharePoint 2007: %ProgramFiles%\Common Files\Microsoft Shared\web server extensions\ 12\TEMPLATE\XML  SharePoint 2010: %ProgramFiles%\Common Files\Microsoft Shared\web server extensions\ 14\TEMPLATE\XML 2. Open the DocIcon.xml file for editing. 3. Search for the tag. It is a child tag of the root tag . Create it If it does not exist. 4. Add a child tag inside , with the following content: 5. Save the DocIcon.xml file. 6. Download AdobePDF.png from http://www.adobe.com/go/acrobatitinfo. 7. Copy the icon to the following folder:  SharePoint 2007: %ProgramFiles%\Common Files\Microsoft Shared\web server extensions\ 12\TEMPLATE\Images\  SharePoint 2010: %ProgramFiles%\Common Files\Microsoft Shared\web server extensions\ 14\TEMPLATE\Images\ 8. Launch the IIS Manager and either restart IIS or refresh all the sites. IIS manager reads the xml once when it starts. Any new changes are not read again until a restart. 13.2.3 Allow HTTP methods in IIS 7 or later SharePoint has its own WebDAV implementation. If the WebDAVModule is running, requests are routed to it and not to the SharePoint WebDAV component. Disable the WebDAVModule to route the requests to the WebDAV component. To disable webDAVModule: 1. Choose Start > Administrative Tools > IIS Manager. 2. In the left pane, expand the tree, and navigate to your site. 3. In the center pane, double-click Modules. 4. In the Modules window, If WebDAVModule is present, remove it. 5. Restart IIS. 13.2.4 Disabling SharePoint integration 10.1 adds support for disabling SharePoint integration via the bDisableSharePointFeatures preference. A value of one turns off all SharePoint related functionality such as the check out prompt and SharePoint menu items. To disable SharePoint integration: SharePoint Integration Disabling SharePoint integration 3/2/12: Enterprise Administration for the Acrobat Family of Products 121 1. Open the registry. 2. Go to HKLM\SOFTWARE\Policies\Adobe\\\FeatureLockDown. 3. Create a key called cSharePoint. 4. Create a DWORD value called bDisableSharePointFeatures. 5. Set its value to 1. 14 122 Multi-User Reader Desktop Configuration 14.1 What is MURD? Adobe Reader’s new Multi-User Reader Desktop (MURD) feature hosted on LABs allows enterprise users to install multiple Reader versions and define which version should open PDFs with a certain file extension. Organizations often have competing needs for mission critical workflows that present unique challenges for IT: On the one hand, security concerns and new features drive the need to install the latest product versions. On the other hand, certified and regulated workflows may require the continued use of earlier product versions. For example, Reader 10.0 offers the highly secure Protected Mode as well as new features like commenting. However, workflows that require certification as part of government regulations may demand continued use of 9.x products. MURD enables the adoption of the latest products and product updates for most users while avoiding the time and expense of recertification. Note: Acrobat cannot be MURD-enabled, but with 10.1 it is MURD-aware. That is, if there is a MURD-enabled Reader present, Acrobat will open any PDF with a MURD extension. At a high level, the MURD feature is simply a way of creating custom file extensions that are either blacklisted or white-listed for the specified version of the PDF viewer. MURD allows you to:  Define custom file extensions.  Map a specific version of Reader to files with a particular extension.  Prevent Acrobat from opening files with MURD extensions.  Update the operating system so that double clicking a file with a MURD extension opens the required version of Adobe Reader. Figure 1 Custom MURD workflow example Multi-User Reader Desktop Configuration Why LABs? 3/2/12: Enterprise Administration for the Acrobat Family of Products 123 14.1.1 Why LABs? Adobe intends to periodically release beta and experimental tools, utilities, and scripts on LABS at http:/ /labs.adobe.com/technologies/acrobat/. This informal pre-release program provides a way to help customers while opening up channels for feedback that will help improve the product and related enterprise resources. Items posted on LABs should be tested by your organization in order to determine their compatibility with the particulars of your environment. 14.1.2 What’s supported? Due to an almost limitless number of possible version variations for Reader, OS, browser, etc, testing focused on a few common scenarios--primarily Windows XP with IE 7 and 8 and Windows 7 with IE 8. Because MURD is designed to allow more than one PDF viewer on a machine, the configurations listed in Table 2 are supported. 14.2 Deploying a multi-Reader desktop At its simplest, setting up a MURD-compatible workflow involves these steps:  Install the non-MURD PDF viewer if it is not already installed.  Install zero or more PDF viewers that will be MURD-enabled.  Configure the MURD-enabled PDF viewer.  Configure any servers used for this workflow to serve the requisite extensions and mime types. Table 1 System requirements Component Version non-MURD PDF viewer 9.4.2 and later and/or 10.1 and later. On a system that has any MURD Reader, all 9.x versions MUST be 9.4.2 or later, and all 10 versions MUST be 10.1 or later even if they're not MURD. MURD viewer 9.4.2 and later and 10.1 and later OS Windows Browser Internet Explorer 7 and 8 Table 2 Supported PDF viewer configurations Non-MURD MURD-enabled MURD-enabled 9.4.2 and later Acrobat or Reader 9.4.2 Reader and later x 9.4.2 and later Acrobat or Reader 10.1 Reader and later x 10.1 and later Acrobat or Reader 9.4.2 Reader and later x 10.1 and later Acrobat or Reader 9.4.2 Reader and later 10.1 Reader and later Multi-User Reader Desktop Configuration Download the requisite files 3/2/12: Enterprise Administration for the Acrobat Family of Products 124 14.2.1 Download the requisite files Before continuing, download the following: 1. The requisite product installers. Only the installers listed in Table 1 support MURD. 2. The MURD tool files from http://labs.adobe.com/technologies/acrobat/. 3. Extract MURD.zip to any location convenient for accessing the files from the command line.The new directory contains two folders called MURDTool and Browser that contain the files listed in Table 3. 14.2.2 Client installation To install and configure a MURD-capable machine, install all the applications you need whether or not they are to be MURD enabled: 1. Install the requisite 9.x clients. In most scenarios, a non-MURD client will already be installed, and you will only need to install or update the client that will be MURD-enabled (either 9.4.2 and later or 10.1 and later). Note: Regardless of what you have installed or will install, the applications MUST be installed in sequential version order. For example, install Reader 9.4.2 before Reader 10.1. 2. Verify the EULA has been accepted and exit the application. 3. Install the requisite 10.x Reader application (if needed): 1. Open a command prompt. 2. Run the following command: msiexec /i \AcroRead.msi REMOVE_PREVIOUS=NO 3. Start the application. 4. From the menu, choose Edit > Preferences > General. 5. Uncheck Enable Protected Mode at startup. 6. Verify the EULA has been accepted and exit the application. 4. Configure the registry to recognize the client that will by MURD enabled: 1. Open a cmd prompt. Table 3 MURD files MURDTool.js Configures the system to be MURD-enabled MURDConfig.txt A configuration file read by MURDTool.js Rdr09PDF.dll The dll used in Internet Explorer for Reader 9.4.2 when it is MURD-enabled Rdr10PDF.dll The dll used when Reader 10.1 is MURD-enabled. Multi-User Reader Desktop Configuration MURD configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 125 2. Run the following: regsvr32 \Browser\Rdr<09 or 10>PDF.dll 14.2.3 MURD configuration After installing Reader onto the managed desktops, run the MURD tool locally. 1. Go to \MURDTool\. 2. Open the MURD configuration file murdconfig.txt. 3. Configure murdconfig.txt using the parameters listed in Table 3. At a minimum, you will need to configure the following:  COMMAND: Enable or disable MURD.  PATH: The path to the client .exe.  VERSION: The application version.  EXTENSION: You custom extensions. Note: Do not leave spaces before or after the colon delimiter. Parameters are case sensitive. 4. Run MurdConfig.js. On Windows 7, the file must be run from the command prompt with administrative privileges. Example 14.1: Sample configuration file COMMAND:ENABLE VERSION:09 PATH:C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe ICON:C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A93000000001}\PDFFile_8.ico,0 EXTENSION:murd09 EXTENSION: 5. Reboot the machine. Multi-User Reader Desktop Configuration MURD server configuration 3/2/12: Enterprise Administration for the Acrobat Family of Products 126 14.2.4 MURD server configuration When a server is used in the PDF workflow, configure it to serve the MURD-specific content of the desired mime type. The table below provides example mappings. In this example, the business workflow that requires a specific PDF viewer consumes PDFs with“murd” in the extension’s name. Here a hyphen and business workflow name (-murd” ) is simply appended to the original Reader extensions and MIME types. 14.3 Updates and patches Upgrading to a higher version of a MURD-enabled application requires removing any previously installed versions. Table 3 murdconfig.txt configuration parameters Parameter Description COMMAND Required. Options include:  ENABLE: Adds MURD capabilities to Reader and the OS.  ENABLE_MURDONLY: Adds MURD capabilities to Reader and the OS. Reader 9.4.2 and later only supports MURDOnly (not ENABLE) For Reader X it is treated the same as ENABLE.  DISABLE: Disables MURD capabilities from Reader.  DISABLE_AND_CLEANALL: Disables MURD capabilities from Reader and removes the versionspecific MURD registry entries. Note that the extensions to remove must be identical to the extensions previously added via ENABLE or ENABLE_MURDONLY. VERSION Required. The two digit major version of Reader that should be MURD-enabled. For example, for Reader 9.3.1, you would only put 09. PATH Required. The path of the installed application. ICON Optional. The file location of the icon that you want to represent your business workflow PDF document (MURD document). If this parameter is not specified, then the default PDF icon is used. EXTENSION Required. If you wish to specify multiple extensions to use for business workflow PDFs, then list them as separate parameter-value pairs. Naming restraints include:  Only upper/lowercase characters, digits, and hyphens can be used.  No spaces in the extension name. Table 4 Example MURD extensions and mime types MURD Extension MURD Mime Type .pdf-murd application/pdf-murd .fdf-murd application/vnd.fdf-murd .xfdf-murd application/vnd.adobe.xfdf-murd .xfd-murd application/vnd.adobe.xfd+xml-murd .xdp-murd application/vnd.adobe.xdp+xml-murd Multi-User Reader Desktop Configuration FAQ 3/2/12: Enterprise Administration for the Acrobat Family of Products 127 14.4 FAQ Does the MURD tool change the registry? Yes. The MURD Tool is a JavaScript file that modifies the Windows registry for MURD-enabled versions of Reader. By changing the GUID of PDF file types to use the browser integration component Rdr09PDF.dll. GUIDs after MURD enablement as follows:  AcroPDF GUID: CA8A9780-280D-11CF-A24D-444553540000  Rdr09PDF GUID: 5CE32390-7AFA-4FF2-8224-8596307ED852  Rdr10PDF GUID: 5D3C3CE1-7D27-41e3-A2FE-760E69BB3D56 What happens when a non-MURD Reader tries to open a MURD document? An error dialog appears. Figure 2 MURD error dialog Macintosh Deployments 15 129 Deployment Methods (Mac) The Acrobat X and Reader X release (10.0) introduces an installer for the Macintosh platform and support for the Apple Remote Desktop (ARD). Unlike previous product versions which required manual installs, product installation and some configuration can be managed automatically for enterprise deployments. 15.1 Installation scenarios The Acrobat installer for Apple platforms can leverage either the command-line (CLI) or graphical (GUI) interfaces provided by the Apple installer. Support for Apple’s installer format and conventions allow customers install the product to managed systems via their preferred methods, including:  CLI: Supports any custom installation solutions required in the enterprise. Acrobat X products support the Apple Remote Desktop (ARD) which provides built-in support for pushing Apple installer packages to groups of machines. For ARD details, see http://www.apple.com/ remotedesktop/.  GUI: User interface installations manage the install on a per user basis. These are seldom used in enterprise settings. 15.1.1 Standalone products vs Creative Suite bundles Installation workflows vary depending on whether you are installing Acrobat as a standalone application or as part of a Create Suite (CS) bundle. Standalone Acrobat deployments use a standard installer and should adhere to the instructions in this document. Tip: For Acrobat bundled and installed with Creative Suite, use the tools and methodologies described in the CS documentation available at http://www.adobe.com/devnet/ creativesuite/enterprisedeployment.html. 15.2 Installer details 15.2.1 Installer behavior for existing installations When installing the application on a system where it already exists in the installation location, several factors may affect the installation workflow:  Installing over an earlier version (Reader only): When an earlier version already exists in the target install location, then:  For GUI installations, a prompt informs the user that the product already exists and asks whether the installation should proceed. If YES, the existing .app is moved to Deployment Methods (Mac) Install locations 3/2/12: Enterprise Administration for the Acrobat Family of Products 130 Trash and the new Reader is installed. If NO, then the existing Reader is not touched and the installer returns with an error.  For CLI installations, then the installer silently moves .app toTrash and installs the newer one without further input. The old application is moved to Trash so that if installation fails then the user can restore old application.  Installing over the same base version: If the existing application has the same base version as the new one, then both GUI and CLI installations proceed as normal upgrades.  Installing over a new version: If the existing application has a higher version than the installing one, then the installation fails.  For GUI installations, an alert informs the user that a new version is already present.  For CLI installations, a log entry in the system's installer log (/var/log/install.log) indicates that a new version is already present. 15.2.2 Install locations For command line installations, the default locations are configurable as described in Pre-deployment customization. GUI installations of Acrobat and Reader options are as follows:  Reader: Reader is always installed in /Applications of the root volume.The location is not customizable.  Acrobat: Acrobat can be installed to any custom folder on 10.6 and later. Customization is not supported in 10.5 and the application installs in the default location at /Applications/Adobe Acrobat X Pro. 15.2.3 Components Adobe’s Mac installer is a flat package installer. The .pkg can be expanded using the system's pkgutil command. Once expanded, one can see the distribution file and its Components. Acrobat The choices available in Acrobat's distribution file are shown in Table 1. Note: The Application check box that allows selection of that component does not appear on 10.5 due to an Apple bug. Table 1 Distribution file: for Acrobat Component Description acropreinstall Required: Validates if the installation should proceed or not. aam Required: Installs Adobe's licensing module in the /Library/Application Support/Adobe/OOBE folder. coreapp Required: Installs Acrobat.app and Distiller.app. The default location is /Applications/Adobe Acrobat X Pro/. appsupport Required: Installs various support files in the /Library/Application Support/Adobe/ folder. Deployment Methods (Mac) Language 3/2/12: Enterprise Administration for the Acrobat Family of Products 131 Reader The choices available in Reader's distribution file are shown in Table 2. 15.2.4 Language Language is determined by the system OS language. Adobe ships strings, a ReadMe, custom installer plugins, and related resources in all locales with the installer in order to provide a seamless user experience. The installer GUI itself is provided by the built-in Mac OS X system installer, with the application localized by Apple and using the current system language. For Adobe files like ReadMe’s, the Mac OS X system installer simply offers the user to view the ReadMe in the system language. 15.3 Pre-deployment customization Adobe installers can be deployed over the network using standard deployment tools. As described below, some installation and application customization is available by creating and configuring com.adobe.Acrobat.InstallerOverrides.plist. 15.3.1 Install location The default install location for Acrobat products is:  Acrobat: /Applications/Adobe Acrobat X Pro/Adobe Acrobat Pro.app  Reader: /Applications/Adobe Reader.app The default location can be customized by choosing a custom location during a GUI install or modifying the installer package manually. The standard Updater normally determines the application location on prefs Required: Installs files in the /Library/Preferences area. browserplugin Optional: Installs the Internet plug-in which integrates Acrobat with Safari. printerworkflow Optional: Installs the Automator Print workflow called Save as Adobe PDF. Table 2 Distribution file: for Reader Component Description coreapp Required: Installs Acrobat.app and Distiller.app. The default location is /Applications/Adobe Acrobat X Pro.app/Adobe Acrobat Pro.app and /Applications/Adobe Reader.app browserplugin Optional: Installs the Internet plug-in which integrates Acrobat with Safari. appsupport Required: Installs various support files in the /Library/Application Support/Adobe/ folder. Table 1 Distribution file: for Acrobat Component Description Deployment Methods (Mac) Choosing what components are installed 3/2/12: Enterprise Administration for the Acrobat Family of Products 132 its own, if for some reason that search fails, the Updater looks at the AppPath preferences described below. However, the Updater is rarely used in enterprise settings, and non-default install locations are sometimes needed. When either or both of those conditions are true, set the AppPath preferences as follows: 1. Navigate (or create) to /Library/Application Support/Adobe///. For example, the Acrobat X path would be /Library/Application Support/Adobe/Acrobat/10.0/. 2. Create a file called com.adobe..InstallerOverrides.plist if it doesn’t exist. 3. Add a key called ReaderAppPath or AcrobatAppPath. Note: Only standalone installers consume the ReaderAppPath. Updates and patches consume both ReaderAppPath and AcrobatAppPath. 4. Set the key value to the application’s path. For example, for Reader it could be /Applications/ MyCustomFolder/Adobe Reader.app (note the missing trailing /). Location determination for Acrobat and Reader  Updater workflow: When invoked by Help > Check for Updates, the Updater checks its own files for an ID, version, and the application’s absolute path. The default installation path is :  Acrobat: /Applications/Adobe Acrobat Pro/Adobe Acrobat X Pro.app  Reader: /Applications/Adobe Reader.app  Installer workflow: The Updater is typically not used in enterprise settings so that IT can manage what versions are installed. When updates are invoked by using the installer command from the command line: 1. The installer looks for InstallerOverrides.plist. to see if it exists (see above). 2. If the file is absent:  The machine is searched for all valid applications by OS calls.  The first valid application found is patched.  If no valid application is found the patch installation fails giving appropriate message. 3. If the file is present:  The installer checks for the presence of an AcrobatAppPath or ReaderAppPath key.  If no valid path is found, the Updater looks for key BreakIfAppPathInvalid.  If BreakIfAppPathInvalid is TRUE, the Updater stops.  If FALSE, it again tries to sniff the application path from the OS.  If no valid path can be found, the installation fails with an error. 15.3.2 Choosing what components are installed There are several ways to control what components get installed. These include:  Using the installer command Deployment Methods (Mac) Choosing what components are installed 3/2/12: Enterprise Administration for the Acrobat Family of Products 133  Modifying the distribution file 15.3.2.1 Using the installer command The installer command allows you to perform a number of installer-related actions. For example, you can select particular components for install during a command line installation via a choices file. Viewing a list of what can be installed Viewing a list of available choices within the pkg, run: installer -package -showChoicesXML -target / | grep -A 1 choiceIdentifier Tip: Every choiceIdentifier maps to one of the choices in the installer. The installer choices for Acrobat products are listed in Table 1 and Table 2. Controlling what gets installed The choices XML file is an array of choiceIdentifiers that toggles the installer to behave the opposite of its default. For example, since everything is installed by default, including any component deselects that component for install. For example, to not install the optional Acrobat components, include the two optional components in choices as shown in Example 15.1. Example 15.1: choices XML browserplugin printerworkflow Verifying what will be installed To verify which components will be installed, run: installer -package -target / -showChoicesAfterApplyingChangesXML For Example 15.1, both the browserplugin and printerworkflow’s selected attribute should be set to 0. Applying choices.xml To apply the choices.xml file during installation, run: installer -package "path to Adobe Reader X Installer.pkg" -target / -applyChoiceChangesXML 15.3.2.2 Modifying the distribution file The Acrobat product installer pkg contains a customizable distribution file you can use to permanently update the installer. Todo so: 1. Expand the flat package distribution file at pkg-path into a new directory specified by dir-path with --expand pkg-path dir-path. For example: --expand Deployment Methods (Mac) Installing special fonts 3/2/12: Enterprise Administration for the Acrobat Family of Products 134 Tip: The target install directory can’t exist on the machine (even in Trash). 2. Open the distribution file in a text editor. 3. Navigate to choices-outline and note the list of choices (For a description of these components, see Table 1 and Table 2). 4. Add a start_selected attribute to each choice node and set it to true or false as desired: Note: For additional distribution file details, see http://developer.apple.com/library/mac/ documentation/DeveloperTools/Reference/DistributionDefinitionRef/ DistributionDefinitionRef.pdf. 5. Save the distribution file. 6. Flatten the expanded package: pkgutil --flatten You can now deploy the new package via your preferred method. 15.3.3 Installing special fonts Acrobat products ship with a number of fonts. However, you may need to install certain fonts manually or customize the installer to perform that task. For example, non-Japanese Reader installers do not come with Japanese fonts, but such fonts can be included at installation time. Note: The font packs and spelling dictionary only need to be installed with Reader as they are already present in Acrobat. To enable the application to render non-default fonts do the following (this example uses the Japanese font pack): 1. Install the application. 2. Download the requisite font pack installers. For example, the Japanese package identifier is com.adobe.Reader.fontpack.10.ja_JP.pkg. 3. Run the installer via the GUI or command line: sudo installer -pkg JPNLanguagePack Installer.pkg -target / 15.4 Apple Remote Desktop Starting with the release of Acrobat X products, administrators can remotely deploy Acrobat/Reader to multiple Macintosh systems running Mac OS 10.5 or later across their network. Using Apple Remote Desktop 3 (commonly referred to as ARD), an administrator can install Acrobat/Reader automatically, Deployment Methods (Mac) Install Acrobat products using ARD 3/2/12: Enterprise Administration for the Acrobat Family of Products 135 without user intervention, to one or more remote computers. ARD copies the package to the computers selected for installation, runs the installer with no visible window or user interaction required, and then erases the installer files on completion. The Acrobat Macintosh installer will perform initialization work such as the Adobe Application Manager installation as well as components needed for the serialization of the application. While serialization happens at launch time by default, enterprises can preserialize using a provisioning tool described in Apple Remote Desktop. Note: The locale of the launched installation depends upon the current locale set on the user's machine. The Installer application picks up strings from within our installation package in the order of locales specified in the system locale preference panel. 15.4.1 Install Acrobat products using ARD These instructions provide only an overview. If you are not familiar with Apple Remote Desktop, refer to Apple’s documentation http://www.apple.com/remotedesktop/. Note: This workflow is a two step process, for another scenario, see One step ARD deployments. To deploy the product via ARD: 1. Open ARD. 2. Select one or more Macintosh computers on which you want to install Acrobat or Reader. Tip: Remote Management and Sharing must be enabled for every target computer. 3. Choose Install on the top of the Remote Desktop window. 4. When the Install Packages window appears, choose the + button at the top left of the Install Packages window. 5. Locate and select the Acrobat or Reader .pkg file. 6. Choose Open to add it to the Install Packages List. 7. Choose Install to perform a complete installation of Acrobat or Reader on the selected machines. Apple Remote Desktop shows a progress bar and task status of the installation for each of the machines selected for the installation. 15.4.2 Deploy the Adobe Provisioning Tool (APT) Note: This tool was released in December, 2010. The provisioning tool is only for Acrobat deployments and does not work with Reader. The Adobe Provisioning Tool streamlines enterprise deployment by enabling control of installation workflows such as:  Configuring licenses for X number of users (pre-serializes the keys).  Suppressing the end user license agreement (EULA). Deployment Methods (Mac) Customizing Acrobat installs with APT 3/2/12: Enterprise Administration for the Acrobat Family of Products 136  Suppressing the Adobe ID dialog. To use the provisioning tool: 1. Download the provisioning tool from ftp://ftp.adobe.com/pub/adobe/acrobat/mac/10.x/10.0.0/ misc/. 2. Open ARD. 3. Select one or more Macintosh computers on which you want to configure Acrobat products. 4. Choose Copy. 5. In the Copy Items screen’s Place Items drop down list, choose Applications Folder. 6. Verify the Set Item ownership drop down list is selected to Inherit from destination folder. 7. In the Items To Copy list, navigate to the .dmg that you downloaded. 8. Select the Adobe provisioning tool. 9. Choose Copy. Once the Adobe provisioning tool is copied to the client machines, use a UNIX command to configure licensing and to suppress EULA and Adobe ID dialog. 15.4.3 Customizing Acrobat installs with APT The APT is not for use with Adobe Reader. Acrobat installs can be customized with the APT as follows. 1. Open ARD. 2. Select one or more Macintosh computers on which you want to license an Acrobat product. 3. Choose Manage > Send UNIX Command. 4. Type the desired command shown in Table 4 or run the command from a script as follows: sudo “/adobe_provisioning_tool.app/Contents/MacOS/adobe_provisioning_tool" 5. Run the command as the user "root." 6. Choose Send. Table 4 Provisioning tool commands: Acrobat Feature Command Configure enterprise licensing -C -a "/Library/Application Support/Adobe/Acrobat 10 AMT/AMT" -s Suppress the end user license agreement (EULA) -S -a "/Library/Application Support/Adobe/Acrobat 10 AMT/AMT" Suppress the Adobe ID dialog -R -a "/Library/Application Support/Adobe/Acrobat 10 AMT/AMT" Deployment Methods (Mac) One step ARD deployments 3/2/12: Enterprise Administration for the Acrobat Family of Products 137 15.4.4 One step ARD deployments It is also possible to deploy the product in one step via ARD using a script. To do create a wrapper installer and write a script to trigger the provisioning tool and ARD in the correct sequence. For example: 1. Compress the Adobe Acrobat X Pro Installer PKG file into a .zip file. For example: zip AcroProX.pkg.zip "Adobe Acrobat X Pro Installer.pkg" 2. Create a new package in PackageMaker. 3. Add AcroProX.pkg.zip a a s payload to the new package and set its destination to /private/tmp. 4. Add the adobe_provisioning_tool.app application to the new package. 5. Set its destination to /private/tmp. Verify relocation is off. 6. Create a deployment sh file as shown in Example 15.2. Example 15.2: postintall.sh unzipPkg() { rm -rf "/private/tmp/Adobe Acrobat X Pro Installer.pkg" unzip /private/tmp/AcroProX.pkg.zip -d /private/tmp } installAcrobat() { installer -pkg "/private/tmp/Adobe Acrobat X Pro Installer.pkg" -target / rm -rf "/private/tmp/Adobe Acrobat X Pro Installer.pkg" if (test $? = 0) then echo "Acrobat X installed." else echo "ERROR: Acrobat X installation failed." exit 1 fi } serializeAcrobat() { "/private/tmp/adobe_provisioning_tool.app/Contents/MacOS/adobe_provisioning_ tool" -C -a "/Library/Application Support/Adobe/Acrobat 10 AMT/AMT" -s 1118-xxxx-xxxx-xxxx-xxxx-xxxx if (test $? = 0) then echo "Acrobat X serialized." else echo "ERROR: Acrobat X serialization failed." fi } suppressAcrobatEULA() { "/private/tmp/adobe_provisioning_tool.app/Contents/MacOS/adobe_provisioning_ tool" -S -a "/Library/Application Support/Adobe/Acrobat 10 AMT/AMT" if (test $? = 0) then Deployment Methods (Mac) Uninstalling via the command line 3/2/12: Enterprise Administration for the Acrobat Family of Products 138 echo "Acrobat X EULA suppressed." else echo "ERROR: Acrobat X EULA suppression failed." fi } suppressAdobeIDDialog() { "/private/tmp/adobe_provisioning_tool.app/Contents/MacOS/adobe_provisioning_ tool" -R -a "/Library/Application Support/Adobe/Acrobat 10 AMT/AMT" if (test $? = 0) then echo "Acrobat X Adobe ID suppressed." else echo "ERROR: Acrobat X Adobe ID suppression failed." fi } unzipPkg installAcrobat serializeAcrobat suppressAcrobatEULA suppressAdobeIDDialog 7. Add the postInstall.sh script as the post install step for the component package created in Step 4 8. Create a pkg from the new package. 9. Deploy the new pkg using ARD. 15.5 Uninstalling via the command line Product installs also provide an uninstaller along with the application at Applications/. For example, the path might be Applications/Adobe Acrobat X Pro>. End users will uninstall the product via the user interface. However, it’s also possible to uninstall via the command line. Differences between the 9.x and 10.x uninstaller The improved 10.x uninstaller differs from the 9.x uninstaller as follows:  9.x removes all application files except Acrobat Uninstaller.app and its folder. While it removes licensing files, it doesn’t remove the license, or uninstall the application files or Distiller. During uninstallation, the uninstaller displays detailed output about what it is doing.  10.x removes all application files, the license, and provides a detailed output of what does and doesn’t get found and removed. To uninstall from the Terminal in Mac OS X: 1. Close any running Acrobat products. 2. 9.x retail users only: By default, two machines can be licensed by a single retail serial number. If you need to install the application on a 3rd machine, deactivate the Acrobat application. Deployment Methods (Mac) Preventing updates 3/2/12: Enterprise Administration for the Acrobat Family of Products 139 Note: For 9x users with a volume license, the serial number will continue to reside on another machine and the license usage count will be increased on the activation server, if tracked. There is no activation/deactivation for 10.x on Mac. 3. Invoke the uninstaller as follows: 9.x: The syntax is as follows: $ sudo . For example: $ sudo "/Applications/Adobe Acrobat 9 Pro/Acrobat Uninstaller.app/Contents/ MacOS/RemoverTool" "/Applications/Adobe Acrobat 9 Pro/Acrobat Uninstaller.app/ Contents/MacOS/RemoverTool" "/Users/myname/Desktop/Adobe Acrobat 9 Pro/Adobe Acrobat Pro.app" 10.x: The syntax is as follows: $ sudo . For example: $ sudo "/Applications/Adobe Acrobat X Pro/Adobe Acrobat Pro.app/Contents/ Support/Acrobat Uninstaller.app/Contents/MacOS/RemoverTool" "/Applications/Adobe Acrobat X Pro/Adobe Acrobat Pro.app/Contents/Support/Acrobat Uninstaller.app/ Contents/MacOS/RemoverTool" "/Applications/Adobe Acrobat X Pro/Adobe Acrobat Pro.app" Note: In Acrobat 10.x, the uninstaller application is located inside the Acrobat App. Successful uninstalls should remove product files, licensing information (including the serial number, EULA acceptance status, and so on. 15.6 Preventing updates There are several ways to prevent automatic updates: Setting the update mode to manual and disabling the application’s ability to update altogether. 15.6.1 Disabling and locking the Updater With version 10.1.1 and later, it is possible for IT to disable and lock the Updater settings so that 1) updates won’t happen and 2) users can’t change the setting. To do so: 1. Navigate to com.adobe..plist. For example, open com.adobe.Acrobat.Pro.plist for Acrobat Pro. 2. Open the plist with an editor. 3. Add the entries shown in Example 15.3. 4. Save and close the plist. Example 15.3: Locking and disabling the Updater 10 Deployment Methods (Mac) Setting the Updater to manual 3/2/12: Enterprise Administration for the Acrobat Family of Products 140 FeatureLockdown bUpdater 15.6.2 Setting the Updater to manual The update mode is set on a per user basis as follows: 1. Go to ~/User/Library/Preferences/. 2. Open one of the following:  10.0: com.adobe..plist  9.x: com.adobe.__.plist 3. Find CheckForUpdatesAtStartup or create the preference if it does not exist. 4. Set the boolean (data type = 0) value as follows:  False: Manual. Do not download or install updates automatically.  True: Semi-automatic. Automatically download updates, but let me choose when to install them. 15.6.3 Preventing any updates To disable the application’s ability to update altogether, use a post install script to move, rename, or delete the Updater.acroplugin file from the /Contents/Plug-ins/Updater.acropluginplug_ins directory. 15.7 Troubleshooting 15.7.1 Logging There are two primary logs: one for the installer application and one for the Updater which is responsible for detecting and downloading updates as well as invoking the installer. 15.7.1.1 Install log Apple’s Installer.app creates an install log that should contain all basic success and failure details.The file is located at /private/var/log/install.log created by Apple’s Installer.app. By default, the installer logs only necessary information in installer log. However, it is possible to configure the log to provide debug output for 10.x and later products. To set this preference, do the following: Deployment Methods (Mac) Installation failures 3/2/12: Enterprise Administration for the Acrobat Family of Products 141 1. Go to /Library/Application Support/Adobe/Acrobat/10.0 or create it if it doesn’t exist. 2. Open com.adobe.acrobat.InstallerOverrides.plist or create it if it doesn’t exist. 3. Create following key-value pair: AcroPatchLogLevel:debug Example 15.4: debug logging AcroPatchLogLevel debug 4. Save and close the file. 15.7.1.2 Updater log The Updater creates a log at ${HOME}/Library/Logs/Adobe/{application name} Updater.log. By default, it provides non-verbose output. To change the default: 1. Go to /Library/Preferences. 2. Open to com.adobe.ARM.plist. Note: Create the file if it does not exist. The file will not exist unless the Updater has run at least once. 3. Create a new key if it does not exist: LogLevel. 4. Set LogLevel:  Brief: -int 0  Verbose: -int 1 5. Save and close the file. The log size limit is as follows: If an existing log is bigger than 1 MB, the Updater truncates the log. Old log files are backed up once as Adobe Acrobat/Reader Updater-old.log and overwrites any existing old.log. 15.7.2 Installation failures Conflicting processes running Installs should take place on machines where there are no instances of an Acrobat product or plugin running. Appendices 143 Basic Acceptance Tests After the installation is complete, test the application on a target computer to ensure that you installed Acrobat successfully. Verify that the Acrobat plug-ins have been loaded 1. Start the application, and verify that no error messages appear on the startup screen. 2. On the Help menu, choose About Adobe Acrobat Plug-ins. 3. Select each plug-in listed in the left column, and verify that the Loaded status is Yes. Check that basic file commands are working 1. Open one or more files. 2. Page through the files by using the up and down arrows. 3. Print the files to a printer on the network. 4. Choose File > Save As to save the files with or without changes. 5. Select Document > Insert Pages. Insert another file into the document, save the file, and then close the file. Reopen the file and verify that the document contains the inserted pages. Verify menu items Select the menu item you want to check, and then do the following:  If a dialog box appears, close it.  If a document opens, close it.  If a Web page opens, close it. Repeat steps for each menu item you want to check. Create a test PDF file: 1. Start the application. 2. On the File menu, choose Create PDF, and then choose From File. 3. In the Open dialog box, browse to any Office Word, Excel, or PowerPoint file, and then choose Open. 4. Verify that a PDF file was created. For example, check file properties to verify that file size is greater than zero, or open the file. Verify viewing a PDF file in a browser 1. Open a browser. Basic Acceptance Tests 3/2/12: Enterprise Administration for the Acrobat Family of Products 144 2. Go to http://kb2.adobe.com/cps/837/cpsid_83709/attachments/Acrobat_Enterprise_ Administration.pdf. 145 Troubleshooting and Support 17.1 Troubleshooting Windows installations Why do I get a Setup.ini not found error? If you get a Setup.ini not found error, create an empty setup.ini file in the AIP’s root. Why does my AIP install result in an“Upgrade can’t be applied error”? Patching of AIP is failing because you are trying to apply a quarterly update over an out of cycle security patch. To fix the problem: 1. Discard your AIP. 2. Create a new AIP to the most recent quarterly. 3. Patch that AIP with the latest out of cycle patch. Figure 1 Windows installer error Why do I get an .error when installing Acrobat from my AIP? Patching of AIP is failing because you may be trying to apply a quarterly update over an out of cycle security patch. See also Why does my AIP install result in an “Upgrade can’t be applied error”? Why am I not getting the right language in the installed product, the logs, or some other feature? When you are using a transform file, select the language as follows: msiexec /i AcroStan.msi TRANSFORMS="1043.mst;Custom.mst" /qf What are some common syntax errors?  All mst files should be separated by semicolon ( ; ).  The entire mst string along with separators must be enclosed in " ". Troubleshooting and Support Troubleshooting Windows installations 3/2/12: Enterprise Administration for the Acrobat Family of Products 146 For example:  Correct: ";"  Incorrect: "";"" Why am I getting a“Cannot use this product under a guest account” error? Acrobat with a volume license will not run for users under a guest account. This error will appear if a local user account is in an administrator group as well as a guest group. Removing the user account from guest group usually resolves this issue. Verify any group policies applied to the user’s profile are not in the“guest” category. Why does my patch or update result in the product being reverted to an earlier version? All browsers must be closed. If they are not, it is possible that the updates will fail and the application version will be reverted to an earlier one. For more information, see this thread: http://forums.adobe. com/message/2902858#2902858. Why does my install fail with a fatal error? If the application event log generates errors similar to those in Example 17.1 every time the PC is started and the installation is started over, verify the license key is correct. Example 17.1: Event log install errors EVENT ID: 1040 Beginning a Windows Installer transaction: {ac76ba86-1033-0000-7760-000000000004}. Client Process Id: 1120. EVENT ID: 1013 Product: Adobe Acrobat 9 Pro -- 1118################ error. EVENT ID: 102 The install of application Adobe Acrobat 9 Professional from policy Install Adobe Acrobat 9 Professional failed. The error was : Fatal error during installation. Why doesn’t my install respect the“silent install” settings I specified with the Wizard? If you command line is something like: MSIEXEC /I C:\A9\AcroPro.msi TRANSFORMS="C:\A9\AcroPro.mst Then you are not using Setup.ini your workflow. The Wizard rewrites Setup.ini when you specify a silent install to include this option. The silent install switch is not saved in the MST. Either run Setup.ini or change your command line to: MSIEXEC /I C:\A9\AcroPro.msi TRANSFORMS="C:\A9\AcroPro.mst" /qn Error 16 appears during GPO deployments This error occurs because one of the product’s subdirectories under Program Files does not have the correct group permissions. To fix the problem, modify your GPO policy so that the Everyone group should have write permissions on the“Adobe PCD\cache” folder. Error 2203: Database : C:\.msi cannot open Database file" AIPs should not be created on the drive root. Use TARGETDIR on the command line or the UI to specify another location. Troubleshooting and Support Generating a crash dump file 3/2/12: Enterprise Administration for the Acrobat Family of Products 147 Why does my new Acrobat installation on WTS result in a crash? Some users have experienced issues where Sophos Anti Virus software conflicts with Acrobat’s licensing components (e.g. PDApp.exe). If you are experiencing problems, try uninstalling Sophos. What is the error“EmiOrientation: Verified that it is NOT a volume binary?” The installer is expecting a volume installer but thinks you are using a retail installer. Possible reasons include:  You are using the wrong installer and may be entering a volume serial key in a retail binary. 9.x products have separate installers for Retail and Volume.  A volume serial number requires that it be used with a volume installer with its signature intact. For example, if you change the installer tables in the MSI via Orca, Admin Studio, or some other tool, the installer logic will mark that MSI as RETAIL build instead of volume build. It is unlikely (but possible) that the MSI’s digital signature was lost for some reason or that CryptQueryObject failed because the Crypto library on the system is missing or not functioning. I modified the installer tables directly, and now my install fails. Why? See What is the error “EmiOrientation: Verified that it is NOT a volume binary?”. Note that using the Wizard’s Direct Editor does not modify the original MSI. The Wizard operates on temporary copy which is later used to create MST. Why do I see a“The upgrade cannot be installed by the windows installer service” error? Error: "The upgrade cannot be installed by the windows installer service because the program to be upgraded may be missing, or the upgrade may update a different version of the program. Verify that the program to be upgraded exists on your computer and that you have the correct upgrade." If you see this error in the log file, you may be updating the product in an unsupported order. For example, 10.x installers are cumulative. You cannot install 10.1.1 over 10.1. 10.1.1 should be installed over 10.0. 17.2 Generating a crash dump file If you are experiencing application crashes, it may be useful to create a dump file. To do so: 1. Install WinDbg from http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx. 2. Launch WinDbg via the shortcut. 3. Choose File > Open Executable. 4. Select the program exe. For example, choose Acrobat.exe from "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe. 5. Choose OK. 6. Press“g” and Enter when you encounter the first breakpoint. You should see the text Debugger is running, and the application should launch. Troubleshooting and Support Contacting support 3/2/12: Enterprise Administration for the Acrobat Family of Products 148 7. Open the file that produces the crash. 8. After you successfully reproduce the crash scenario, enter the following in the WinDbg terminal: .dump /ma c:\temp.dmp 9. Choose Enter. These steps produce the crash dump at C:\temp.dmp. Use this file for troubleshooting or provide it to your support contact. Support may also need the PDF file that cause the crash. 17.3 Contacting support If you need to contact Adobe Technical Support, please prepare answers to the following questions:  Server software:  Management tool software version (e.g. Citrix, SMS, WTS, etc):  Operating system:  Service Packs:  Are the system requirements met?  Client software:  Operating system:  Service Packs:  Adobe product  Are the system requirements met?  Problem details:  Type of problem:  Error message (if any):  Logged on as administrator or user?  Problem persists as administrator?  Can you reproduce the problem when you test the problem on the server? Deployment details If you are having deployment problems, also record the following:  Base version  Any patching/chaining you are using  Using MSI or EXE?  Using the Customization Wizard?  Deployment method (AIP, GPO, SCCM, ARD?)  Installing over other products? Troubleshooting and Support Installation FAQs 3/2/12: Enterprise Administration for the Acrobat Family of Products 149  Did you attempt to install any third-party scripts or application programming interfaces (APIs) with Acrobat during deployment? If so, does the problem reside with these elements? (To find out, create a test package containing only Acrobat.)  How did you create the package?  Does the problem occur when you install the application from a DVD? If so, does the problem occur when you copy the contents of the DVD to a local or network drive? 17.4 Installation FAQs For FAQs about a particular deployment method, refer to the documentation for that method. Why does my installation of one product over another fail with a file-related error? When installing a product of one type over another type, always uninstall the other product first. For example, when installing Acrobat Pro Extended on machines where Acrobat Standard is already installed, it is a best practice to uninstall the existing product first. You should not rely on MSI parameters such as REINSTALLMODE=amus (where "a" forces all files to be reinstalled), as this may result in a mixture of product files on the target machines. 150 Index ^ _all 18 _cum 18 _en_US 18 _i386 18 _mui 19, 40 _ppc 18 . . 68 .dmg 18 .exe 18 .msi 18 .msp 18 .pkg 18 { /?| /h} 61 *? /a 61 /f 61 /g 61 /i 61 /ini "PATH" 82 /j 61 /L 62 /l 82 /p 62 /q 62 /qb 62 /rps 82 /rs 82 /sAll 82 /sl 41 /sl "LANG_ID" 82 /sPB 82 /t 62 /x 62 /y 62 /z 62 1 10.x updates 21, 22 1026 16 1027 16 1028 16 1029 16 1030 16 1031 17 1033 16 1034 17 1035 17 1036 17 1038 17 1040 17 1041 17 1042 17 1043 16 1044 17 1046 16, 17 1048 17 1049 17 1050 16 1051 17 1053 17 1055 17 1058 17 1060 17 1061 16 1062 17 1063 17 1069 16 2 2052 16 3 32 bit Windows 27, 29 6 64 bit Windows 27, 29, 54 7 7760 27 7761 27 7B44 27 7-zip switch (10.x) 20 A a 48 aam 130 Abcpy.ini 24 Abcpy.ini file 24 Access published files via the Citrix Program Neighborhood client 108 Accessing Citrix from a client 104, 107 Accessing Citrix via Program Neighborhood Client 105 Accessing Published Applications through the Citrix Web Interface 104 Acrobat 130 Acrobat deployments 23 Acrobat Elements 26 Acrobat major version 27 Enterprise Administration for the Acrobat Family of Products. © 2009 Adobe Systems Inc. 151 Acrobat.com integration 35 AcrobatAppPath 132 acropreinstall 130 AcroPro7 EFG –Tuned for silent, transformed, German destination 83 Add a new Citrix client connection 108 additional languages 27 ADDLOCAL 64 Administrative (full-file) updates 13 Administrative installation points (AIP) 70 Adobe installer properties 67 Adobe-specific installer properties deprecated with 10.0 69 deprecated with 9.0 69 for 10.x and later 67 Advanced Wizard tuning for new installations 39 aFS 48 AIP creation 70 AIP expanded server image 73 AIP troubleshooting 74 AIR 37 Allow HTTP methods in IIS 7 or later 120 Allow the user to choose the installation language 41 ALLUSERS 63, 64 Apple Remote Desktop 134 Application Preference Basics 44 Applying choices.xml 133 appsupport 130, 131 Architecture 81 ASPath 48 Assign the application to a computer 93 atom 48, 49 B b 48 BA7E 27 Backing up the original files 11 bAllowAPSConfig 56 bAllowInvisibleSig 55 bAllowPasswordSaving 54 Basic Acceptance Tests 143 Basic Wizard Tuning 38 Basque 16 bDisableSharePointFeatures 120 bDisableTrustedFolders 57 bDisableTrustedSites 57 bEnhancedSecurityInBrowser 56 bEnhancedSecurityStandalone 56 Best practices 11, 70, 77, 87 bg 16 bMSStoreTrusted 56 bool 48, 49 Bootstrapper command line switches 82 Bootstrapper configuration 79 Bootstrapper configuration sections 80 Bootstrapper installations 77 Bootstrapper usage 77 bPrivKey 54 bProtectedMode 102 Brazilian Portuguese 16 BreakIfAppPathInvalid 132 bReasons 55 bReqRevCheck 55 browserplugin 131 bSuppressMessageBar 55 bSuppressStatusDialog 55 Bulgarian 16 bValidateOnOpen 55 bVerify 55 bVerifyUseAlways 55 bWinCacheSessionHandles 55 C c 48 ca 16 cab 48, 86 Catalan 16 Catalog import 87 Chained install example 78 Chaining pre 9.3.3 installs 78 Chaining updates 65 Changes across releases 118 Check that basic file commands are working 143 CheckForUpdatesAtStartup 140 Chinese (China) 16 Chinese (Taiwan) 16 choice 134 choices XML 133 Choosing an installer 15 Choosing what components are installed 132 Citrix 100 Authentication 105 Citrix Server Deployments 100 Client (binary) updates 13 CM Update ready for distribution 85 CmdLine 81 com.adobe..InstallerOverrides.plist 132 com.adobe.ARM.plist 45, 141 /msi 82 Command line examples 64 Common tasks and examples 64 COMPANYNAME 64 Components 130 Configuration planning 33 Configure enterprise licensing 136 Conflicting processes running 141 Contacting support 148 Controlling what gets installed 133 coreapp 130, 131 Create a test PDF file 143 Creating an administrative installation 65 Creating the SMS package 114 Croatian 16 Enterprise Administration for the Acrobat Family of Products. © 2009 Adobe Systems Inc. 152 cs 16 CSDVersion 81 cSharePoint 121 Current user keys 45, 53 Customization wizard 52 Customizing Acrobat installs with APT 136 Customizing installations 37 Czech 16 D da_DK 16 Danish 16 data 49 Data types Macintosh 49 Windows 48 de_DE 17 debug logging 141 Decoding product details via Windows GUID 25 Default values 46 DEFAULT_VERB 69 Deploy the Adobe Provisioning Tool (APT) 135 Deploying quarterly updates 65 Deployment details 148 Deployment Methods (Mac) 129 Deployment overview 14 Determining what’s already installed 12 dict 49 Differences between the 9.x and 10.x uninstaller 138 Digital signature changes for 10.1 119 Direct editor in the Customization Wizard 63 Directory and key creation 46 DISABLE_3D 69 DISABLE_ACCESSIBILITY 69 DISABLE_AIR_SHARE 69 DISABLE_ARM_SERVICE_INSTALL 68 DISABLE_ASIAN_FONTS 67 DISABLE_BROWSER_INTEGRATION 67 DISABLE_CACHE 67 DISABLE_CACHE. 67 DISABLE_CE_FONTS 69 DISABLE_DISTILLER 67 DISABLE_IMAGEVIEWER 69 DISABLE_LINGUISTICS 69 DISABLE_MULTIMEDIA 69 DISABLE_PDFMAKER 67 DISABLE_SEARCH 69 DisablePDFHandlerSwitching 34 Disabling Protected Mode 102 Disabling SharePoint integration 120 Disabling the Updater 139 Distribution file for Acrobat 130 for Reader 131 Dutch 16 E en_US 16 ENABLE_CACHE_FILES 67 ENABLE_CACHE_FILES. 67 End user and EXE installers (Windows) 19 English 16 Enterprise installers 18 es_ES 17 Estonian 16 et 16 eu 16 EULA_ACCEPT 67 Event log install errors 146 Example GUIDs 28 Examples 19 EXE 12 Expanding EXEs 7-zip compressed 20 Nosso compressed 19 Expanding the Reader installer package 19 F fi_FI 17 File location and types 86 File types 12 Finnish 17 fr_FR 17 French 17 G German 17 Getting started 11 GPO deployments 93 GPO examples 95 Group Policy Object-Active Directory Deployments 89 GUID 26 GUID construction 26 GUID deconstruction 26 GUID examples 28 GUID guidelines for Acrobat Standard, Professional and 3D 26 GUID installer package location 28 GUID registry location 27 H hr 16 hu 17 Hungarian 17 I i 48 Identifying deployed applications 25 IGNORE_INTEROP_REQS 68 Importing and exporting preferences 47 Importing the Data 47 Install Acrobat products using ARD 135 Install Language 41 Install location 131 Enterprise Administration for the Acrobat Family of Products. © 2009 Adobe Systems Inc. 153 Install locations 130 Install log 140 Installation failures 141 Installation FAQs 149 Installation scenarios 129 INSTALLDIR 64 Installer behavior for existing installations 129 Installer details 129 Installer identification by name 18 Installer languages 15 Installer MSI GUID 28 Installer naming conventions 18 InstallerOverrides.plist 132 Installing 8.x and 9.x on a Citrix Presentation Server 106 Installing a quarterly update and then an out of cycle patch 66 Installing a trial version without a serial number 30 Installing Acrobat products 111 Installing Acrobat products with SMS 114 Installing from an MST 65 Installing from the management console 102 Installing over a new version 130 Installing over an earlier version (Reader only) 129 Installing over the same base version 130 Installing Reader and Acrobat on a single machine 34 Installing special fonts 134 Installing with Add/Remove Programs 106 Installing X products on a Citrix XenApp Server 5.0 102 INSTALLLEVEL 64 int 48, 49 ISX_SERIALNUMBER 24, 30, 68 it_IT 17 Italian 17 IW_DEFAULT_VERB 68, 69 J ja_JP 17 Japanese 17 K Known Citrix limitations with Acrobat 9.x 109 with Acrobat X 102 Known limitations 117 ko_KR 17 Korean 17 L LANG_ID 81 Language 25, 131 Language based installer behavior 84 language code 27 Language ID 16 Language tiers 15, 16 Languages 81 Latvian 17 LEAVE_PDFOWNERSHIP 68, 69 License type 25 license type 27 Licensing 23 and the Customization Wizard 24 Command line 24 EXE deployments 24 MSI deployments 24 Lithuanian 17 Locale and language codes 16 Locale ID 16 Location determination for Acrobat and Reader 132 Lockable keys For security features (e.g. digital signatures) 54 Lockable keys (32 bit) 45, 53 Lockable keys (64 bit) 45, 53 Lockdown example 57 Locking Preferences 53 Logging 140 LogLevel 45, 141 lt 17 lv 17 M Macintosh 14, 23, 45, 53 MajorVersion 80 Manual 140 Manual configuration 37 MinorVersion 80 Modifying the distribution file 133 MSI 12 msi 81 MSI API 29 MSI best practices 60 MSI properties 63 unsupported 63 81 MsiEnumRelatedProducts() 29 msiexec Chained updates 66 Chained updates for 9.x with REINSTALLMODE 66 Chaining 10.x products 65 Choose network location screen 73 Customized MST install 65 Quarterly update installs 65 Quarterly update installs for 9.x 65 switches and options 61 syntax 60 Welcome screen 72 msiexec command line parameters 61 msiexec usage 60 MsiGetProductInfo() 29 MSI-specific installer properties 64 MSP 12 MST 12 MUI configuration via the Customization Wizard 41 MUI configuration via the registry 41 Multilanguage (MUI) configuration (Reader only) 40 Enterprise Administration for the Acrobat Family of Products. © 2009 Adobe Systems Inc. 154 N N/A 48 Name 18 Naming conventions 18 nb_NO 17 nl_NL 16 Non lockable machine keys 45, 53 Non mui language selection via the command line 41 Norwegian 17 -nos_nd 20 -nos_ne 20 -nos_o 20 Nosso switch (9.x) 20 number 49 O One step ARD deployments 137 Order of precedence 51 OS identification for bootstrapper 81 80 P Package 62 Package Code 62 PATCH 65, 81 Path 81 PKG 12 pkgutil 130 Platform specifics 45, 53 PlatformID 80 Plug-ins 34 Portuguese – Brazilian 17 postintall.sh 137 Precedence order 51 Pre-deployment configuration 51 Pre-deployment customization 131 Pre-Deployment Planning and Customization 33 Preference convention basics 50 Preference relevance keys 50 Preferences 33 UNIX 45 prefs 131 Preventing any updates 140 Preventing End-User Modification 54 printerworkflow 131 81 Product family 25 product family 26 product type 27 Product version via MSI API 29 Provisioning tool commands Acrobat 136 pt_BR 17 pt-br 16 Publishing the application on the server 107 Q Quarterly + patch installation 66 R Reader 131 Reader deployments 23 Reader for individuals from the Reader Download Center 19 Reader ID 27 Reader major version 27 ReaderAppPath 132 REBOOT 64 REG_BINARY 48 REG_DWORD 48 REG_SZ 48 Registry preference data types Versions 8.x and later 48, 49 REINSTALL 64, 66 REINSTALLMODE 64, 66 REMOVE 64 REMOVE_PREVIOUS 68 REMOVE_PREVIOUS_READER 68 Removing Acrobat 9 117 Removing browser integration for an already installed product 67 Removing previous versions 114 Removing products using Group Policy Objects 95 Removing the product 109 Required MSI version 60 Required software 86 RequireIE 80 Requirements 100 RequireMSI 80 RequireOS 80 ro 17 Romanian 17 ru 17 Run Acrobat via the Citrix Web Interface from a client 108 Russian 17 S s 48 SCCM-SCUP basics 86 SCCM-SCUP Deployments 85 SCUP Imported update catalog 88 sDI 48 Selecting a language 17 Semi-automatic 140 ServicePackMajor 81 ServicePackMinor 81 Setting a Mac preference 49 Setting installer properties 62 Setting the Updater to manual 140 Setup.ini 24 chained install 82 Default for 10.x mui Reader 79 Default for 9.x Reader 79, 80 Enterprise Administration for the Acrobat Family of Products. © 2009 Adobe Systems Inc. 155 Setup.ini examples 82 -sfx_nd 20 -sfx_ne 20 -sfx_o 20 -sfx_va 20 SharePoint changes across releases 118 SharePoint Configuration 119 SharePoint Integration 118 SharePoint System Requirements 118 SHORTFILENAMES is no longer supported. Microsoft has removed this property from the Windows 7 Logo Requirements. 63 Silent uninstalls 66 sk 17 sl 17 Slovak 17 Slovenian 17 SMS advertisement creation 116 SMS distribution package creation 115 Spanish 17 Standalone products vs Creative Suite bundles 129 start_selected 134 Startup 80 string 48, 49 Supported products 44 Supported Workflows 12 Suppress the Adobe ID dialog 136 Suppress the end user license agreement (EULA) 136 SUPPRESS_APP_LAUNCH 69 sv_SE 17 Swedish 17 Switches for expanding the Nosso installer 20 Switches for the Setup.exe bootstrap installer 82 SYNCHRONIZER 68 System requirements 85 Systems Management Server Deployments 113 T t 48 t_file path and name 56 t_folder path and name 57 t_host name 57 T1T2 18 tBuiltInPermList 56 tDIText 48 Tested environments 89, 101, 111, 113, 118 text 48, 49 The Command Line and msiexec 60 Tier_# 18 Timeout 81 tr 17 TransferRegistry 33 TRANSFORMS 64 Trial Acrobat installations 30 Troubleshooting 140 Troubleshooting and Support 145 Troubleshooting msiexec 64 Troubleshooting Windows installations 145 tSchemePerms 56 Tuning with the Customization Wizard 37 Turkish 17 tWhiteList 56 U uk 17 Ukrainian 17 Uninstalling via the command line 138 Unix 45, 53 Updater log 141 Updating and patching rules and constraints 20 USERNAME 64 Using the installer command 133 V Verify menu items 143 Verify that the Acrobat plug-ins have been loaded 143 Verify viewing a PDF file in a browser 143 Verifying what will be installed 133 Version 25 Versioning policy 15 VersionMax 29 VersionMax and VersionMin (9.x earlier) 29 VersionMax-Min location 29 VersionMin 26, 28, 29 Viewing a list of what can be installed 133 W W_DEFAULT_VERB 68 W_DEFAULT_VERB to 68 What are some common syntax errors? 145 What is the Bootstrapper? 77 When the last update was an out of cycle patch 74 When the last update was an out of cycle patch (8-9.x only) 74 Why am I getting a “Cannot use this product under a guest account” error? 146 Why am I not getting the right language in the installed product, the logs, or some other feature? 145 Why do I get a Setup.ini not found error? 145 Why do I get an .error when installing Acrobat from my AIP? 145 Why do I get the error "The Wizard cannot modify this MSI package. . ."? 43 Why does my AIP install result in an “Upgrade can’t be applied error”? 145 Why does my install fail with a fatal error? 146 Why does my installation of one product over another fail with a file-related error? 149 Why does my patch or update result in the product being reverted to an earlier version? 146 Why doesn’t my install respect the “silent install” settings I specified with the Wizard? 43, 146 Windows 12, 24, 45, 53 Windows installer error 145 Windows installer naming conventions 18 Enterprise Administration for the Acrobat Family of Products. © 2009 Adobe Systems Inc. 156 Windows NT with different service packs 83 Windows Terminal Services Deployments 111 Wizard Main user interface 39 Wizard FAQs 43 X xml 86 Z zh_CN 16 zh_TW 16