Adobe Reader/Acrobat 9 ADM file for group policy

[_Rick_Patterson_]

Adobe Reader 9 and Adobe Acrobat 9 do support the use of group policies for configuring these applications. However, I cannot find anywhere that Adobe provides an ADM file with the settings and descriptions that allow these group policy settings to be easily configured and applied. So i made my own ADM file, which I now share with you. i have tested most of these settings and they work very well.

To get your own ADM file, create a new TXT file and name it Adobe9.adm. Then copy all of the text below out of this posting and paste it into your ADM file. Enjoy!

; Administrative Template for Adobe Acrobat 9.0 and Adobe Reader 9.0
; Rick Patterson
; Version 1.0
; 1/23/2009

CLASS MACHINE

CATEGORY !!Reader

POLICY !!Checkforupdatesatstart
KEYNAME "Software\Adobe\Acrobat Reader\9.0\AVGeneral"
EXPLAIN !!Checkforupdatesatstart_Help
VALUENAME "bCheckForUpdatesAtStartup"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!DonotdisplayEULA
KEYNAME "Software\Adobe\Acrobat Reader\9.0\AdobeViewer"
EXPLAIN !!DonotdisplayEULA_Help
VALUENAME "EULA"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableDisplayPDFinBrowser
KEYNAME "SOFTWARE\Adobe\Acrobat Reader\9.0\Originals"
EXPLAIN !!EnableDisplayPDFinBrowser_Help
VALUENAME "bBrowserIntegration"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableAdobeUpdater
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnableAdobeUpdater_Help
VALUENAME "bUpdater"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnablePurchaseAdobeAcrobat
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnablePurchaseAdobeAcrobat_Help
VALUENAME "bPurchaseAcro"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableDigitalEditions
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnableDigitalEditions_Help
VALUENAME "bShowEbookMenu"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableProductImprovementProgram
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnableProductImprovementProgram_Help
VALUENAME "bUsageMeasurement"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableCreateBuzzwordDocument
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnableCreateBuzzwordDocument_Help
VALUENAME "bCreateBuzzwordDoc"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableCreateAdobePDFUsingAcrobatcom
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnableCreateAdobePDFUsingAcrobatcom_Help
VALUENAME "bCreatePDFOnline"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnforceDisplayPDFinBrowser
KEYNAME "SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown"
EXPLAIN !!EnforceDisplayPDFinBrowser_Help
VALUENAME "bBrowserIntegration"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

POLICY !!EnableDocumentMessageBar
KEYNAME "S

[_Rick_Patterson_]

It appears that the ADM file may have been truncated. Send me an e-mail at pattersonrichardr@johndeere.com and I will send the ADM file to you via e-mail.

[BUNDES01240]

Hi Rick,

Is it still possible to send the adm file to bimosekin@hotmail.com

Thanks

topokin

[_Kim_Hansen_]

Hi Rick,
This is really nice!
Could you send me the whole adm file to kim.hansen@snla.no ?

Thanks again for this nice work :-)

Kim Hansen
SNLA

[_Ryan_BUnce_]

I'll add a 'me too!' to the above requests.

Many thanks.

rbunce **aT*** micatholicconference *****DoT****** org
Ryan

[_Pier_Luigi_]

Please, me too!!!
catmaster ##AT## libero ##DOT## it
Thank you.

By the way: Do you think it's possible to silently apply all (or part of all) these via a .REG file?

[_Christoph_Hackstein_]

Could you send me the adm too? Cause in your post it's not complete. hackstein(at)trimet.de

[_Rick_Patterson_]

Everyone... If you want a copy of this ADM file, you will need to send me an e-mail at pattersonrichardr@johndeere.com. I will reply to your e-mail and attach my ADM file. I do not check this forum very often.

[_Rick_Patterson_]

Several people have asked if it is possible to deploy registry keys via a reg file. The answer is yes. If you have a REG file named adobe.reg, you can create a BAT file and put this command in it...

REGEDIT /S adobe.reg

This will apply the REG file to any computer that runs the BAT file. But your users will see the black command prompt window when the BAT file runs. It is easier to use group policy, or write a VBS script, to apply registry keys.

[_Rick_Patterson_]

A number of you have asked how to uncheck the Enable Acrobat JavaScript checkbox in Adobe Reader (and Acrobat) 9.0 in response to the latest Adobe apsa09-01 security advisory.

http://www.adobe.com/support/security/advisories/apsa09-01.html

Here's the Reader 9 key.

[HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\9.0\JSPrefs]
"bEnableJS"=dword:00000000

Here's the Acrobat 9 key.

[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\9.0\JSPrefs]
"bEnableJS"=dword:00000000

Just because I am a nice guy, I have updated my ADM file so that you can deploy this key via group policy. Send me your e-mail address at pattersonrichardr@johndeere.com if you want the ADM file. I have not yet determined what effect unchecking this box has. But I offer you a way to uncheck the box if you choose to do so.

[_Rick_Patterson_]

OK... I give. After a hundred or so requests for my ADM file, I am posting it out on the public Internet. The file is currently up at:

http://turboninjas.com/A9adm/AdobeAcrobat&Reader9.adm

Enjoy!

[_Luis_Baez_]

When I import this adm template, non of the user settings show up. I do see the computer settings. Any ideas?

Thanks again for all your help.

Luis

[_sumnermikej_]

Luis, the user settings don't show by default in the GP Management Console because they aren't specifically "policies", they are Preferences - so if the GPO goes away, the settings don't revert to the default, they stay how they were set with these Preferences.

To see them, Edit your policy, then under User Configuration>Administrative Templates, select, then right-click each Acrobat folder and click on View>Filtering. Uncheck the box that says "Only show policy settings that can be fully mananged" and click OK. The User settings should then be visible.

Hope this helps.

And thanks a ton to Rick for making this ADM! :)

Mike

[_Joerg_Nuessle_]

Nice Idea, to block JavaScript with GPO, but it doesn't really work. When trying to open a PDF that contains JavaScript, the User ist prompted to activate it (default-butoon ist "yes"). So JavaScript remains "on" until the next update of GPOs.

Greets

Joerg

[_Rick_Patterson_]

Joerg... In the ADM file that I provided, the setting to disable JavaScript is "non-policy" setting. This means that his "preference" does nothing more than uncheck the Enable JavaScript checkbox. Adobe did not provide a policy setting to enforce (gray out) this JavaScript setting, at least that I know of.

So I agree that all that unchecking this checkbox does is to give the user a prompt before the JavaScript code runs. And the user has the ability to override this setting and turn JavaScript back on. The HELP section in the ADM file does state that if you disable the JavaScript settings that the user will be prompted if a PDF file that contains Javascript is opened by Adobe Reader. But at least now the user gets a security prompt. That's better than nothing.

On a side note, all older Adobe Reader and Acrobat clients (versions 6, 7, 8) also supported the same bEnableJS setting. It is easy to copy my ADM file and mass change all of the 9's to 8's in the copy of the ADM file and have a template that works for Adobe 8 products as well. And so on.

[_Joerg_Nuessle_]

Rick,

that's the only thing I wanted to point out, that disabling JavaScript via GPO is not obligatory for the users. Anyway, Your ADM is a nice work, very useful to configure Acrobat settings.

Meanwhile the problem is getting worse. Secunia reported, that disabling JavaScript doesn't protect against the current 0-Day-Exploit. See
http://secunia.com/blog/44/

Currently there are discussions in progress, if general blocking of PDFs for users ist a practical alternative until Adobe provides a patch. I know some companies that already made that drastic step accepting the flooding of their user help desk.

[_dennis_van_dam_]

what do I do wrong? I ga to this page, see your nice posting about the adm file but your posting ends up with
"
POLICY !!EnableDocumentMessageBar
KEYNAME "S
"
So there is a peace missing, could you perhaps post it again? or email me the file?
Many thanks

[Roonerspism]

Gday Rick, any chance I can get this emailed to niloc@internode.on.net ? Legend if you can!

[Guest]

The poster posted a link to the download which you must have missed.

"OK... I give. After a hundred or so requests for my ADM file, I am posting it out on the public Internet. The file is currently up at:

http://turboninjas.com/A9adm/AdobeAcrobat&Reader9.adm

Enjoy! "