Adobe Flash 10.3 deployment via GPO

This article has been superseded by a new article that includes Adobe Flash 11 (including 32Bit and 64Bit deployments)
https://ivan.dretvic.com/2011/10/adobe-flash-11-deployment-via-gpo/

So we need to update Adobe Flash for our users…again. With all the security vulnerabilities this one I like to keep on top of as much as I can even though it slips from time to time. Below is a quick summary of how I deploy Adobe Flash using Group Policy.

In brief i will document:

• Where to download the distribution version
• How to deploy it via GPO
• How to prevent the automatic updating

Downloading Adobe Flash

Download the .MSI from Adobe. Note you need to register to redistribute the software (quick form to fill out).It may take up to 24 hours to get the link sent to you via email.

http://www.adobe.com/products/players/fpsh_distribution1.html

There are also places that have advertised the direct link to download the software if you ‘misplaced’ your email with the link. Check the Useful Links section at the bottom for more info.

The files that I downloaded were:

• install_flash_player_10_active_x.msi – Internet Explorer version – Ver 10.3.181.23
• install_flash_player_10_plugin.msi – plugin based version – Ver 10.3.181.22

Deploying Adobe Flash via Group Policy

Although you may think you can modify the MSI prior to deployment I have to disappointingly say you cant. It breaks the package and wont install. The reason this happens is because of the mechanism that Adobe use to package the install.

To deploy the package via GPO please follow my article below:

• How I deploy GPO software in my environment
  https://ivan.dretvic.com/2011/06/how-i-deploy-gpo-software-in-my-enviroment/

How to disable Adobe Flash AutoUpdate

Although you cant change the MSI package to prevent Automatic Updates you can use another method that Adobe have provided. What you need to do is place a configuration file that tells Adobe Flash to disable automatic updates. The details are below:

Filename:

[code]mms.cfg[/code]

Contents:

[code]AutoUpdateDisable=1[/code]

File Location on 32-Bit machine:

[code]%systemroot%\System32\Macromed\Flash
so the default location is:
c:\Windows\System32\Macromed\Flash[/code]

File Location on 32-Bit install of Flash on 64-Bit machine:

[code]%systemroot%\SysWOW64\Macromed\Flash
so the default location is:
c:\Windows\SysWOW64\Macromed\Flash[/code]

As you can see its a simple 1 liner cfg file that needs to be created\copied in the corresponding folder. What I do is actually copy a file (that I have copied over to the GPO location eg. \\Domain.local\DFS\Install\AdobeFlash\mms.cfg) to the correct folder.

To do this copy process I use Group Policy Preferences. Here are the specific details:

32-Bit flash deployed to 32-Bit OS:

1. Open you Adobe Flash Group Policy object. Expand Computer Configuration -> Preferences -> Windows Settings -> Files
   
2. Right click -> New -> File
3. On the General tab set:
   1. Action = Create
   2. Source file(s) = \\Domain.local\DFS\Install\AdobeFlash\mms.cfg (example)
   3. Destination = %WindowsDir%\System32\Macromed\Flash\mms.cfg
   4. Attributes = Archive
4. On the Common tab set:
   1. Apply once and do not reapply = Ticked
   2. Item-level targeting = ticked
   3. Item-Level targeting conditions:
      Environment variable %PROCESSOR_ARCHITECTURE% = x86
   4. Description = “mms.cfg deployment to 32-Bit architecture only”

32-Bit flash deployed to 64-Bit OS:

1. Open you Adobe Flash Group Policy object. Expand Computer Configuration -> Preferences -> Windows Settings -> Files
   
2. Right click -> New -> File
3. On the General tab set:
   1. Action = Create
   2. Source file(s) = \\Domain.local\DFS\Install\AdobeFlash\mms.cfg (example)
   3. Destination = %WindowsDir%\SysWOW64\Macromed\Flash\mms.cfg
      Note the difference for 64Bit OS version.
   4. Attributes = Archive
4. On the Common tab set:
   1. Apply once and do not reapply = Ticked
   2. Item-level targeting = ticked
   3. Item-Level targeting conditions:
      Environment variable %PROCESSOR_ARCHITECTURE% = AMD64
      Note the difference for 64Bit OS version.
   4. Description = “mms.cfg deployment to 64-Bit architecture only”

The final view should look somehting like this:

Important Links

About Flash Player:
http://www.adobe.com/software/flash/about/
This link tells you the exact version you are currently running, along with the most recent version available for download.

Flash Uninstall Utility info:
http://kb2.adobe.com/cps/141/tn_14157.html

Flash Uninstall Utility download:
http://download.macromedia.com/pub/flashplayer/current/uninstall_flash_player.exe

AppDeploy Package Deployment info
http://www.appdeploy.com/packages/detail.asp?id=1382

Adobe Flash Player Administration Guide for Flash Player 10
http://www.adobe.com/devnet/flashplayer/articles/flash_player_admin_guide.html

Adobe Flash player distribution license
http://www.adobe.com/products/players/fpsh_distribution1.html

Adobe link for Enterprise deployment
http://www.adobe.com/devnet/flashplayer/enterprise_deployment.html