Automatic Updates For Creative Cloud Apps

[FN-GM]

Hello,

 

I am wondering if anyone has managed to get Creative Cloud apps to perform automatic forced updates please? The amount of security issues with Adobe software means it's becoming impractical to do it manually. Ideally I would like a solution that would just force the updates to install.

 

What I have seen seems to make the updates optional for the users to install or done pushing out new MSI's manually via InTune or SCCM. Security standards require patches to be applied within 48 hours, so manually pushing is creating compliance issues.

 

Thanks!

[Driftingashore]

I'm just starting to look into this myself, and am currently setting up an AUSST server but looks like that will require redeploying everything.

 

On my hunt around before settling on setting up AUSST I did see this post about deploying a file to users that sets creative cloud to auto update but didn't try it as it's a few years old, presumably unsupported, and less controllable in terms of bandwidth. Let me know if you've found anything good!

[thimon]

I deleted our AUSST server last year, nothing but problems and took up too much of my time diagnosing. Glad it’s gone!

[Driftingashore]

Well that’s ominous haha. How have you been updating - just letting the creative cloud app do it? Manually redeploying new versions? The whole reason I’ve started looking into this is that I found the CC app didn’t seem to be updating the apps unless users signed in and either manually updated or manually chose to automatically update (which seemed crazy to me, but it’s the behavior we see..)

[mrbios]

Adobe RUM with a scheduled task to execute it, deployed via GPP, set it to start with a random delay and/or set a traffic shaping rule on ccmdls.adobe.com so that you don't do what i did and have 200+ machines downloading adobe updates all at once

[thimon]

Well that’s ominous haha. How have you been updating - just letting the creative cloud app do it? Manually redeploying new versions? The whole reason I’ve started looking into this is that I found the CC app didn’t seem to be updating the apps unless users signed in and either manually updated or manually chose to automatically update (which seemed crazy to me, but it’s the behavior we see..)

 

When compiling the Adobe install package, have set users to be able to download apps and update them themselves.

[FN-GM]

Well that’s ominous haha. How have you been updating - just letting the creative cloud app do it? Manually redeploying new versions? The whole reason I’ve started looking into this is that I found the CC app didn’t seem to be updating the apps unless users signed in and either manually updated or manually chose to automatically update (which seemed crazy to me, but it’s the behavior we see..)

 

Current creating new packages in the admin portal and pushing them. But trying to remove this manual handling.

[mrbios]

Current creating new packages in the admin portal and pushing them. But trying to remove this manual handling.

 

Just bare in mind that Adobe RUM will install security updates, but can't modify any major versions.

 

So if you deploy Photoshop 2024 for example, when 2025 comes out, you have to deploy that manually if you want it to replace or install along side 2024.

[FN-GM]

Just bare in mind that Adobe RUM will install security updates, but can't modify any major versions.

 

So if you deploy Photoshop 2024 for example, when 2025 comes out, you have to deploy that manually if you want it to replace or install along side 2024.

 

That should be fine. I am only wanting to do this to address security issues.

[FN-GM]

@mrbios Thanks for the tip about RUM. We are going to do this but via a remediation script In Microsoft InTune. I am testing soon and will share the scripts (one I know they work).

 

I am curious as to how often you run it. I am thinking once every 6 hours.

 

Thanks

[mrbios]

@mrbios Thanks for the tip about RUM. We are going to do this but via a remediation script In Microsoft InTune. I am testing soon and will share the scripts (one I know they work).

 

I am curious as to how often you run it. I am thinking once every 6 hours.

 

Thanks

 

I have my scheduled task set to run at 9am with the option "Delay task for up to (random delay)" set to 8 hours. In theory if i've understood that setting correctly, PCs should run the task at varying times of the day throughout the school day that way.... Must admit i've not delved into the logs to make sure that is the case lol but i imagine i'd have noticed internet usage spikes if they were all kicking off at once. I could also do with checking if the task still runs that day if the PC wasn't online at 9am i guess, not really certain how windows handles scheduled tasks in that sense.... Though my SIEM tool that used to flag up all kinds of Adobe security warnings hasn't given me anything to worry about since i set this up, so i think it's all good.

[FN-GM]

Thanks. I am not too worried about randomising. We have quite a small footprint - maybe 10 users.

 

Adobe Acrobat DC & Reader is patches automatically with Patch My PC. Works great. I don't use RUM as this method will mean it always installs the latest versions.

 

For the legacy Windows 10 stuff (nearly gone!) I wish RUM would do Adobe Reader - Shame really!