We have deployed Adobe Arcrobat Pro 2017 via customisation wizard, but having issues with what file path we need to allow within Windows 10 to allow for updates

[dafyddp89067912]

Hi, we have deployed Adobe Acrobat 2017 via customisation wizard, which is working fine. But we are having issues with knowing what file path we need to allow within Windows 10 to allow for Adobe updates to install, without being logged on as an admin user.  As we use software restriction policies on our Windows 10 devices. Do we need to allow the following paths to be unrestricted ?

C:\Program Files (x86)\Adobe\Adobe 2017\*

C:\Users\*\AppData\Local\Adobe\*

C:\Program Files (x86)\Common Files\Adobe\ARM\*

Or can they be locked down further?

Many thanks

Daf

[Steve Cordero]

Here are some suggestions:

You may want to open the following path "C:\Program Files (x86)\Common Files\Adobe\ARM\*" to a wider scope: 

C:\Program Files (x86)\Common Files\Adobe\*

I say this because the Adobe folder has several folders and files that may be updated in that process.

Also you may want to add both LocalLow and Roaming in the AppData folder path.

C:\Users\*\AppData\LocalLow\Adobe\*

C:\Users\*\AppData\Roaming\Adobe\*

[dafyddp89067912]

This is great thank you Steve

[LeoUpdaterX]

Daf,

In automatic mode (default) updates are installed under Local System account, meaning that Standard users should be updated without any need of unlocking anything.

[dafyddp89067912]

Hi Leo, are tablets are locked down by group policies so users cant install software etc, and we have software restriction policies set. Previously when trying to run the Adobe update, it prompts for a domain admin, or local admin to install the update.  

[LeoUpdaterX]

Daf, you will need to provide more details to get meaningful help.

For example, exact details on "Previously when trying to run the Adobe update...". Did you try manual update or allowed Updater to update your product?

If your policies do not allow access for Local System account, you might not be able to install updates at all. Updater does not install updates; it calls Windows Installer Service (MSI) to do actual installation. MSI would need to have access to many things on the system and it would not be easy task to provide the list of what is required.

What about Registries? These also need to be accessed by Updater and MSI.

[dafyddp89067912]

Thank you Leo, only local admin or domain admin can install MSI's. 

We have the following software restrictions enabled, then have software restriction policies to allow certain folders such as the adobe ones listed above.

Is it better to deploy adobe Pro updates the following method via GPO when each Pro 2017 update comes out?

Group Policy-Active Directory — DC Windows Desktop Deployment​

Many thanks

Daf

[dafyddp89067912]

Also where can I manually get the latest Adobe DC 2017 version?

[Steve Cordero]

You can download it here:  Download Acrobat 2017