Adobe Reader Auto Upgrades...

[Michael]

Hello all,

 

Just for your reference, I came across a workstation today that was running Adobe Reader 9 but is being offered Adobe Reader 11 to be downloaded.

 

It appears Adobe are beginning to force users onto newer versions of Adobe Reader, and not just incremental patches, such as 9.5.6 etc...

 

There are two immediate problems with this:

 

HR Portal (for the Birmingham LA) will not work with anything but Adobe Reader 9.

 

Policy Central 5.1.4.5 and Adobe Reader 11 crashes Internet Explorer 8 and 9. Policy Central 5.1.4.6 fixes this, but hasn't been deployed as yet.

 

The problem is this - if I disable auto updates, it means Adobe Reader 9 is no longer going to receive the latest patch, however it means Adobe Reader 11 cannot install itself. I can't win, any suggestions?

[free780]

Why don't you just deploy the 9.x msi. You can use the adobe customization wizard to turn of updates. The built in updater would need admin privileges. Where as a gpo will install using the system account.

[Arthur]

HR Portal (for the Birmingham LA) will not work with anything but Adobe Reader 9.

Surely they must realize that forcing users to use anything other than the latest version of Adobe Reader is incredibly risky from a security standpoint?

 

Is there a way to trick it into thinking you have v9.0 installed, even though you have v11.0.2?

[Michael]

Why don't you just deploy the 9.x msi. You can use the adobe customization wizard to turn of updates. The built in updater would need admin privileges. Where as a gpo will install using the system account.

 

I could, but these are workstations which already have Adobe Reader 9 installed. I'd have to uninstall and re-install in theory.

[Michael]

Surely they must realize that forcing users to use anything other than the latest version of Adobe Reader is incredibly risky from a security standpoint?

 

Is there a way to trick it into thinking you have v9.0 installed, even though you have v11.0.2?

 

It's been like this for a number of years and there's no light at the end of the tunnel when it'll get properly fixed. There's no known workaround unfortunately. I believe it's because since Adobe Reader 10 it uses sandboxing technology to reduce the surface area of attack.

[Arthur]

I believe it's because since Adobe Reader 10 it uses sandboxing technology to reduce the surface area of attack.

If it's due to the sandbox, you can turn that off using the registry settings below. Obviously not ideal, but it should make v11.0 work.

 

Windows Registry Editor Version 5.00

; Disable 'Protected Mode at Startup'
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown]
"bProtectedMode"=dword:00000000

 

; Disable 'Protected View' (the default)
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown]
"iProtectedView"=dword:00000000

 

; Disable 'Enhanced Security'
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown]
"bEnhancedSecurityInBrowser"=dword:00000000
"bEnhancedSecurityStandalone"=dword:00000000

 

http://i.imgur.com/qoPhRkQ.png

 

The settings can easily be added to the Adobe Reader MSI in the Customization Wizard.