Skip to main content
tim.wilkinson
Participant
July 21, 2026
Answered

Deploying Adobe Reader Via MSI

  • July 21, 2026
  • 3 replies
  • 313 views

I am trying to deploy Adobe Reader via Intune package and Script. I got sent a link from Adobe for an exe that needed to extracted so as I can get the msi. When I have tested this Defender kicked off as the msi installs an old version which still has Flash. I tried installing via the exe. It installed 26.001.21662 but the latest version is 26.001.21691. Does anyone know where to get an uptodate Intune deployable package for Adobe Reader that won’t send Defender into melt down.

    Correct answer Anand Sri Bhattacharya

    Hello @tim.wilkinson


    Thanks for clarifying. For a Windows 11 deployment through Microsoft Intune, the suggestion is to build the Intune Win32 app from a fresh Adobe Reader enterprise/volume distribution installer and include the latest matching Continuous-track update MSP in the same deployment package.

    Please note that you have to apply for the redistributing Reader across your estate needs Adobe's free Reader Distribution License Agreement: https://adobe.ly/4frKgBt


    The version difference you saw can happen when the installer media you packaged is not at the same patch level as the latest update that is available from the Acrobat Enterprise Release Notes. In this case, 26.001.21662 was the June planned/security update level, while 26.001.21691 is a later planned update. If the EXE you packaged installs 26.001.21662, Intune will deploy that build unless the package also applies the newer 26.001.21691 update, or the Acrobat/Reader updater is allowed to bring it current after installation. See the release notes for more information: https://adobe.ly/44DIj03


    Download a fresh Acrobat Reader enterprise installer from Adobe’s Reader distribution page: https://adobe.ly/4frKgBt

    Download the latest matching Reader update MSP from the Acrobat Enterprise Release Notes, Windows 64-bit Reader MSP, or the MUI MSP if you are deploying the MUI package: https://adobe.ly/44DIj03

    Package the installer and the MSP together as an Intune Win32 app. For details, check this article on: Deploy Adobe packages on Windows using Microsoft Intune.

    Run the base Reader install and apply the MSP as part of the same Intune install workflow.

    Configure your Intune detection rule to check that the installed Reader/Acrobat build is 26.001.21691 or later before marking the deployment successful.


    Also confirm that Acrobat/Reader updates are not disabled by policy. If your organization disables automatic updates, then the latest MSP should be deployed through Intune, SCCM, or your normal software update process each time Adobe publishes a new planned or security update.

    So, either MSI or EXE can work for Intune, but the key point is: do not deploy only the base installer if you need the endpoint to be current immediately. Include and apply the latest Reader MSP in the same deployment package.


    And, if you have Acrobat Enterprise licenses, then you may also get in touch with the Enterprise support team to get assistance on this.


    I hope this helps, and let us know if you need any assistance.

    Regards,

    Anand Sri.

    3 replies

    tim.wilkinsonAuthor
    Participant
    July 22, 2026

    We are deploying Adobe Reader to Windows 11. It can be either msi or exe - it just needs to be deployed from InTune and as soon as it is installed it is the latest version without any security vulnerabilities. 

    Anand Sri Bhattacharya
    Community Manager
    Anand Sri BhattacharyaCommunity ManagerCorrect answer
    Community Manager
    July 22, 2026

    Hello @tim.wilkinson


    Thanks for clarifying. For a Windows 11 deployment through Microsoft Intune, the suggestion is to build the Intune Win32 app from a fresh Adobe Reader enterprise/volume distribution installer and include the latest matching Continuous-track update MSP in the same deployment package.

    Please note that you have to apply for the redistributing Reader across your estate needs Adobe's free Reader Distribution License Agreement: https://adobe.ly/4frKgBt


    The version difference you saw can happen when the installer media you packaged is not at the same patch level as the latest update that is available from the Acrobat Enterprise Release Notes. In this case, 26.001.21662 was the June planned/security update level, while 26.001.21691 is a later planned update. If the EXE you packaged installs 26.001.21662, Intune will deploy that build unless the package also applies the newer 26.001.21691 update, or the Acrobat/Reader updater is allowed to bring it current after installation. See the release notes for more information: https://adobe.ly/44DIj03


    Download a fresh Acrobat Reader enterprise installer from Adobe’s Reader distribution page: https://adobe.ly/4frKgBt

    Download the latest matching Reader update MSP from the Acrobat Enterprise Release Notes, Windows 64-bit Reader MSP, or the MUI MSP if you are deploying the MUI package: https://adobe.ly/44DIj03

    Package the installer and the MSP together as an Intune Win32 app. For details, check this article on: Deploy Adobe packages on Windows using Microsoft Intune.

    Run the base Reader install and apply the MSP as part of the same Intune install workflow.

    Configure your Intune detection rule to check that the installed Reader/Acrobat build is 26.001.21691 or later before marking the deployment successful.


    Also confirm that Acrobat/Reader updates are not disabled by policy. If your organization disables automatic updates, then the latest MSP should be deployed through Intune, SCCM, or your normal software update process each time Adobe publishes a new planned or security update.

    So, either MSI or EXE can work for Intune, but the key point is: do not deploy only the base installer if you need the endpoint to be current immediately. Include and apply the latest Reader MSP in the same deployment package.


    And, if you have Acrobat Enterprise licenses, then you may also get in touch with the Enterprise support team to get assistance on this.


    I hope this helps, and let us know if you need any assistance.

    Regards,

    Anand Sri.

    Anand Sri Bhattacharya
    Community Manager
    Anand Sri BhattacharyaCommunity Manager
    Community Manager
    July 21, 2026

    Hello @tim.wilkinson,


    I hope you are doing well, and thanks for reaching out and sharing the details. We're sorry for the trouble you had.


    Could you please share more details about the issue?


    1. Which OS are you targeting? A) Windows 10, B) Windows 11, C) Both

    2. Are you deploying Adobe Acrobat Reader (free) or Acrobat (paid)? A) Reader, B) Acrobat

    3. Do you specifically need MSI-based deployment via Intune, or is EXE + switches acceptable? A) MSI only, B) Either

    4. Are you using Microsoft Defender for Endpoint with strict policies? A) Yes, B) No


    Reasons and Suggestions:


    Why the extracted MSI is old and Flash-bearing: Adobe's Reader enterprise EXE is a self-extracting bootstrapper that contains a fixed base MSI (AcroRead.msi, version 15.007.20033 from 2015) plus a cumulative patch (MSP). When you extract the EXE and deploy only the raw AcroRead.msi, you install that 2015 base, which predates Flash end-of-life and still bundles the legacy Flash/rich-media component. That is what sends Defender into meltdown. Adobe never ships a fresh full Reader MSI per release; the base MSI stays at 15.007.20033, and you patch it forward with the latest cumulative MSP.


    The current build is 26.001.21691 (June 25, 2026), delivered as a separate cumulative MSP. The fix, which also solves the Defender problem, is to build your package from the base MSI plus the latest MSP, because the current version contains no Flash.

    Get the latest MSP from the authoritative source, the ETK release notes page for this build
    https://adobe.ly/4vDAhiz
    For 64-bit, that is AcroRdrDCx64Upd2600121691.msp (32-bit: AcroRdrDCUpd2600121691.msp). The release notes index that always shows the newest build is here:
    https://adobe.ly/4bDh7lP


    Extract the enterprise EXE to get the base MSI. Slipstream the MSP into an administrative install so the source is already at 26.001.21691:
    msiexec /a "C:\ReaderExtract\AcroRead.msi" /p "C:\path\AcroRdrDCx64Upd2600121691.msp"


    Optionally build a transform (MST) with the Adobe Customization Wizard to accept the EULA, set your update policy, and set the default PDF handler:
    https://adobe.ly/4fiKV8g


    Wrap that folder with the Microsoft Win32 Content Prep Tool into a .intunewin and add it in Intune as a Win32 app


    For more information, please check this article: https://adobe.ly/4pwTaCx


    I hope this helps, and, please reach out if you need any assistance.

    Regards,

    Anand Sri.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices