1. Request the destribution and download

Go to https://get.adobe.com/reader/enterprise/ or search adobe reader distribution in google.com

Download the right version and language ( or else you have to do extra configuration) for your deployment. Extract the exe file with 7zip or similar software.

Before installation, also make sure the installer have enough privilege, and the policy is deployed synchronous:

You can set this in the default Domain Policy or in the installer GPO:

 

  1. In the Group Policy Object Editor window, in the console tree, display and enable the following settings:
    • Computer Configuration > Policies> Administrative Templates > System > Logon > Always wait for the network at computer startup and logon
    • Computer Configuration > Policies> Administrative Templates > System > Group Policy > Software Installation policy processing ( in 2012R2 it is called Always wait for the network at computer startup and logon)
    • User Configuration > Policies> Administrative Templates > Windows Components > Windows Installer > Always Install with elevated privileges
  2. Close the Group Policy Object Editor window.
  3. In the Group Policy Management window, in the left pane, right-click the GPO that you edited, and then click Enforced.
  4. In the right pane, under Security Filtering, click Add.
  5. In the dialog box, under Enter the object name to select, type Domain Computers, and then click OK.

Note that Authenticated Users includes every authenticated object to Active Directory, which would include all domain users, groups (defined and part of AD), and computers that have been joined to the domain. So default user group should be ok.

2. Create a central shared MSI file,  patch it , and customize it

Right click the exe file and extract. Open the folder where you extracted the files (eg. E:\download\adobeReaderDC), You will see a couple of files, we will work on two files, AcroRead.msi and AcroRdrDCUpd1700920044.msp.

Now we will install the first package to a folder and patch it with the second file.

In eg. E:\download\adobeReaderDC click the address bar, enter cmd, press enter.

enter the command:

msiexec /a AcroRead.msi

Then select the address of the shared location where to store the software package (eg. \\fileserver\software\adobeReaderDCEn), make sure this location is shared and can be read by all client computer.

Then go to the folder you just installed above (eg. \\fileserver\software\adobeReaderDCEn), call CMD again, enter command:

msiexec /a AcroRead.msi /p E:\download\adobeReaderDC\AcroRd rDCUpd1700920039.msp

This time, the location of the original file will automatically filled. Now the file is ready for distribute, but it will install with the default options, which includes enable file update by default, pop up the EULA page, etc. Next we will customize the package.

Customize the package

Search Adobe customization wizard in google, and download it, install with default options.

Open the wizard, go to following pages:

Go to the shared location, create a txt file, name it as Setup.ini, leave it empty.

  • Personalization Options: Suppress display of End User License agreement
  • Installation Options: Interactively > Silently or unattended
  • Shortcuts: determine if you want to create shortcuts
  • Server locations: The Server Locations settings allow you to add server location paths and redundancy. You can add, rearrange, or remove locations. This feature sets the SOURCELIST property which is a semicolon-delimited list of network or URL source paths to the installation package which is appended to each user’s existing source list. The installer uses the first accessible location it finds and only this source is used for the remainder of the installation.
  • Online Services and Features: Disable product updates, cause we don’t give end user the right to update or install new software.
  • Generate transform, save as mst file,eg mypref.mst.
3. Deploy via GP:

Go to Computer configuration> Policies > Software Installation > right click select New > package. after select the MSI, choose advanced,
Modification: Add, choose the  the mst file created in the Customization wizard.
Deployment:  Uninstall this application when it falls out of the scope of management: if you unlink the GPO to the OU, the software will be uninstalled.

  • Advanced, ignore language when deploying this package.If your company have machines with different language machines, the machines will not install the Reader if the language does not match.
  • Make this 32-bit X86 application to Win64 machines: prevent install 32 bit software on 64 bit machine, note that 64 bit software will not be installed on 32 bit machine.

Link the GPO to the desired OU, on the client machine, issue command gpupdate /force.

The following message will show:

User Policy update has completed successfully.
Computer Policy update has completed successfully.

The following warnings were encountered during computer policy processing:

The Group Policy Client Side Extension Software Installation was unable to apply
 one or more settings because the changes must be processed before system startu
p or user logon. The system will wait for Group Policy processing to finish comp
letely before the next startup or logon for this user, and this may result in sl
ow startup and boot performance.

For more detailed information, review the event log or run GPRESULT /H GPReport.
html from the command line to access information about Group Policy results.

Certain User policies are enabled that can only run during logon.
Certain Computer policies are enabled that can only run during startup.

OK to Restart?. (Y/N)
4. Upgrade

http://www.adobe.com/au/downloads/updates.html and search Reader, click windows. Download the msp file.

Create a new folder and name it in the shared location(eg. \\fileserver\software\adobeReaderDCEn\update1700920044),  copy all the files in old shared location(\\fileserver\software\adobeReaderDCEn) to here and place the msp file here as well, then copy the preference file mst created in step2 to this folder as well.

msiexec /a AcroRead.msi /p AcroRd rDCUpd1700920044.msp

Find the gpo created in step3, Computer configuration> Policies > Software Installation > right click the Package (Adobe Acrobat Reader DC), properties. Go to Upgrades tab, in the Packages that this package will upgrade: click Add…, choose the older version software to replace.

Problems

Software can not be installed:

1.  In the event viewer, Windows Logs,system. Filter the warning and error (101, 103)

  • The assignment of application xxxxxx from policy install failed. The error was : %%1274
  • The removal of the assignment of application xxxxxx from policy install failed. The error was : %%2
  • Failed to apply changes to software installation settings. The installation of software deployed through Group Policy for this user has been delayed until the next logon because the changes must be applied before the user logon. The error was : %%1274
  • The Group Policy Client Side Extension Software Installation was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

Solution:

In a GPO that applies to that computer, add the following setting:

  • Computer Settings
    • Administrative Templates
      • System
        • Logon
          • Always wait for the network at computer startup and logon – Enabled

Another possible solution:

In a Group Policy applied to these workstations, navigate to:

Computer Configuration > Policies > Administrative Templates > System > Group Policy

Enable the Specify startup policy processing wait time. Set Amount of time to wait (in seconds): = 120

120 might be overkill, but that worked for me. Other forums suggested setting that to 30 seconds. Even though 30 seconds default (when policy is not set), forcing it to 30 seconds worked for them.

2. Check the language and version(32 bit, 64 bit) of the software, see if they match the target system.

  • Advanced, ignore language when deploying this package.If your company have machines with different language machines, the machines will not install the Reader if the language does not match.
  • Make this 32-bit X86 application to Win64 machines: prevent install 32 bit software on 64 bit machine, note that 64 bit software will not be installed on 32 bit machine.

3. The client GroupPolicy operational log reveals: error event id 7016. Completed Software Installation Extension Processing in xxxx milliseconds

Use Group Policy Results to find the possible reason, it may be due to the unavailable of the shared folder or does not have read permission, which was my case. If you don’t want to give all authenticated user read permission, at least give the target computers read permission or give Domain Computers read permission.

Reference: