Reader Security popup after X to XI upgrade - have tried customization wizard, reg edits, everything

[Mijunkin]

Title: Adobe Reader Security

Body: Trusted certificates from your previous version of Adobe Reader were found.

Would you like to import them?

Any certificates that are not imported in this step will not be available in this version of Adobe Reader.

Buttons: [Import] [Use Default]

I've read through at least a dozen posts on many sites about this and no one has a real resolution.  Let me tell you what I've tried.  Each attempt was a clean upgrade from X to XI.

1 - First I tried the Customization Wizard, which did everything I want except get rid of this popup.

2 - Then again I went back in the Wizard and set the Directory Servers (C:\Users\myusername\AppData\Roaming\Adobe\Acrobat\11.0\Security\directories.acrodata) and Trusted Identities (C:\Users\myusername\AppData\Roaming\Adobe\Acrobat\11.0\Security\addressbook.acrodata) to copies of my own files on my own computer that did not get the post-install popup.

3 - I tried the same as #2, but with copies of my files from the C:\Users\myusername\AppData\Roaming\Adobe\Acrobat\10.0\Security\ folder (rather than version 11.

4 - I tried in the Wizard to add keys to HKCU\SOFTWARE\Adobe\Acrobat Reader\11.0\Security\cDigSig\cAdobeDownload for bAskBeforInstalling and bLoadSettingsFromURL both to 0.

5 - I tried on the cliet PC to change HKEY_USERS\clientusername\Software\Adobe\Acrobat Reader\10.0\Security\cPPKHandler\bCustomPrefsCreated to 0 prior to installation.

All of these still resulted in prompts to import the old certificates.  I'm out of ideas.

[EnterpriseHelp]

You haven't stated clearly what you are trying to do. Are you trying to avoid having the popup appear for end users on first launch? If so, then all of your methods won't work.

The solution would be to simply script the removal of the addressbook.acrodata files on end user machines. However, doing so would remove all address book/trusted identity entries which would likely have an adverse impact on any current or future digital signature and certificate security workflows.

hth,

Ben

[Mijunkin]

Yes, I would like to prevent the popup I described from appearing on initial start of Reader XI.

Exactly what you described is why I do not want to script the removal of those files.  Is there no way to silently import those files from Reader X to XI?

[EnterpriseHelp]

Ah, now I see. Good question.Could you script moving the files? There could be a better way, and I'll ask around.

Ben

[EnterpriseHelp]

Hey, I just realized you should use the Wizard's Files and Folders feature for this.

http://www.adobe.com/devnet-docs/acrobatetk/tools/Wizard/filesfolders.html?highlight=acrodata#use-ca...

Ben

[Mijunkin]

Attempts 2 and 3 listed in my first post were accomplished via the Files and Folders part of the Wizard.  So I'm not sure that would work.  Which makes me think my scripting idea wouldn't either.  But I've dug the hole this deep I might as well test the script. haha

[EnterpriseHelp]

#2, 3, and 4 are not using the Files/Folders feature. Try it. Read the Wizard doc at the link I sent.

[Mijunkin]

I just went back to edit that post, but since you posted it blocked me.  I misspoke there.  I will try Files and Folders first.  If that doesn't work, I will try scripting.  I will post the results (and hopefully find the solution).

[Mijunkin]

I used Files and Folders to copy completely blank .acrodata files from a clean and unused installation of 10.1.0 (current version my users have) to the CommonAppDataFolder\Adobe\Acrobat\11.0\Replicate\Security folder.  Now I get a different popup:

Title: Acrobat Security

Body: Your computer administrator has provided a list of trusted certificates that will be used.  Would you also like to import your trusted certificates from a previous version of Acrobat?

Buttons: [Yes] [No]

So, that's better, but not as good as no popup.  I will try the script and post results.

[Mijunkin]

Tried one more time with files and folders.  This time specifically added the folder CommonAppDataFolder\Adobe\Acrobat\10.0\Security and added the .acrodata files there, but with the Remove action for them.

Result: same error, and it didn't remove those files.

Going to the script now.

[Mijunkin]

My script is simply:

move "%appdata%\Adobe\Acrobat\10.0\Security\*.acrodata" "C:\Local Saves"

And it works well when run on it's own, and moving the .acrodata files does prevent the popup.  While the installer I customized in the wizard will copy the file to the computer using Files and Folders, it will not then run the script.  It similarly won't run the script if it is in a network location.

Ideas?

[John-m-l]

I am dealing with the same problem.  I recently inherited ownership of Acrobat at my firm so I'm not as familiar with it, but it appears that what we need to do is automatically copy c:\users\[userID]\appdata\roaming\Adobe\Acrobat\10.0\security\*.acrodata to c:\users\[userID]\appdata\roaming\Adobe\Acrobat\11.0\security.

I did not see a way to do this using the customization wizard so that it happens automatically for all users on each workstation when Acrobat 11 is installed, nor did I see a checkbox of some sort to the effect of "Automatically import trusted certificates from 10.0" which would be incredibly helpful.

It appears that the wizard will allow me to copy files from a specific known user profile on a machine but that's obviously not much use for a wide rollout.

Am I missing something obvious?  What is the simplest way to accomplish this?  Is there a Registry setting that will handle this?

Thank in advance.

[Mijunkin]

Fortunately we do not actually import any specific certificates, so my solution is my simple script (in my post from May 3rd above) that just moves the old version's .acrodata files so they don't even try to get imported..  I could not get it to run as part of the "Other Programs" part of the Wizard, be we use a Kace 1000 appliance for management, so I simply made a script to run that before installing the program.  It's not a very clean workaround, but it works for what I need.

There seems to be no options in the wizard to do what we need, and I tested (as listed above) a lot of registry keys and other fixes with no improvement.  The only option seems to be to move or delete the .acrodata files to prevent the popup asking to import certificates, or to live with the popup.  I hope someone proves me wrong.

[John-m-l]

Taking a step back, what are those .acrodata files actually used for?  If they just store trusted certificate information that, if needed and the file isn't present, is automatically downloaded again from a trusted source (e.g. Adobe.com) then it would seem to not be a particular problem to just rename/move the old files, and I can let users know that they might experience a brief delay when they open a document the first time.

However if those files store something unique per user then finding a way to import them will be necessary.  In our environment, telling a lot of people how to manually handle a popup will not be seen as a great approach.

[Mijunkin]

As far as I understand them, the .acrodata files just store certificate information.  My script simply moves them (I'd rather move them than delete them, just in case some unforseen issue requires the old files) so that the new installer does not see them or try to import them.  This eliminates the security prompt for the user, and has no ill-effect on functionality.

[EnterpriseHelp]

There are several acrodata files.

The main one in question seems to be addressbook.acrodata. This contains the trusted identity information (certificate info) that users leverage to validate signatures and participate in certificate security workflows.

With respect to this file, nothing is ever downloaded from Adobe.

What admins typically do is let the file be migrated so that functionality that depends on this file does not break after migrating to a new version.

Ben

[John-m-l]

With my test users, some of them have chosen "Import" and some have not and so far nobody has reported any problems with either option, however I don't know if that means it's really not used here or if somewhere down the road this will cause a problem for one of those folks.

Ben, per above, is there any way to automatically migrate that file from each user's profile on a given workstation when we upgrade from Acrobat X to XI?

[Simpsonehh]

Hi,

i am currently trending down this path.  i have the same question:

is there any way to automatically migrate that file from each user's profile on a given workstation when we upgrade from Acrobat 9 or X to XI?

please let me know if anyone's solution worked.

Thanks.

[EnterpriseHelp]

Hi John,

There won't be problems unless you have certificate-based workflows in place. The files are used for signature workflows and certificate security workflows. 

However, you could create one generic enterprise acrodata file and use the Wizard to preinstall it.

Ben

[Mijunkin]

I could make a batch file something like:

xcopy "C:\Users\%username%\AppData\Roaming\Adobe\Acrobat\10.0\Security\*.acrodata" "C:\Users\%username%\AppData\Roaming\Adobe\Acrobat\11.0\Security\"

move "C:\Users\%username%\AppData\Roaming\Adobe\Acrobat\10.0\Security\*.acrodata" C:\Backup

(Translation: xcopy command would copy all .acrodata files to the version 11 folder where .acrodata files live.  The move command would them get them out of the version 10 folder which should prevent version 11 from seeing them there on startup.)

And add the batch file to the Launch Other Applications part of the Customization Wizard.

Think it would just silently accept the copied files?  I can test tomorrow.

[EnterpriseHelp]

Sure, test it. However, the Files and Folders feature is simpler. Also, you can deploy headers, footers, watermarks, and dozens of other files useful to your enterprise.

Ben