Howto deploy Adobe Reader (or Acrobat) via Group Policy

For both Adobe Reader and Adobe Acrobat it is possible (and officialy supported by Adobe) to get either MSI-files, or create AIPs, to deploy the software using Group Policy Objects of Windows Server.

However the way how you can obtain them depends on the version, the branch (11 or DC), the track (classic or continuous), and on whether the latest update was a planned one or an emergency update. Also in most cases the files that are provided by Adobe cannot be used directly. Instead you must run several complicated commands to convert them into the ones that are required for GPO deployment.

This web-page helps you to do the required steps, and it provides a script to automate some of the steps of this process.


First you must register with Adobe, because otherwise you are not allowed to distribute Adobe Reader, not even within your own organization. Registration is free and takes only a few minutes. In return they will send you an URL where you can download the enterprise version (which does not try to talk you into using McAffee).

tl;dr (summary) for version 11.0.19:

  1. Download AdbeRdr11010*.exe
  2. Move it to an empty directory
  3. Run AcroRdr-Extract.cmd there.
  4. Go to C:\AdobeFiles
  5. Delete AdbeRdrUpd11010.msp
  6. Save AdbeRdrUpd11019.msp there
  7. Run ApplyMSP2.bat there.
  8. Keep only the subdirectory AIP
  9. Goto section "Configure" below.


Adobe does offer some MSI-files for download on their ftp-server, but they do so only for major versions, so you can hardly ever use them.

In the branch 11 this is only for version 11.0.0. For the branch 12 alias Document Cloud (DC) I'm still trying to rewire my brain to understand the new versioning scheme.

For all other versions they offer only MSP-files.

Thus you must usually extract the MSI-file of an older verison to an AIP, and then slipstream the latest MSP-file(s) into that. The result is an updated AIP, that can be GPO-deployed like an MSI.

As added difficulty, in branch 11 Adobe does not always offer cumulative MSP-files (which are easier to handle). Emergency updates only come as incremental MSPs. The incremental MSPs must be applied on top of the latest cumulative one. If there are several consecutive versions with only incremencal MSP-files, they must be applied one after the other. You can tell incremental MSP files by their file name: it contains "incr".

This description was written for branches 10 and 11. A quick test showed the same principle applies also to branch 12 ("Document Cloud"). The major differences seem to be that the filename of the EXE installer starts with "Acro" instead of "Adbe", the version numbers are difficult, and it refuses to install in Windows-XP.
Update: checkout these notes about RdrCEF.exe

obtain the required files

The easiest way to get the required files (MSI-file, plus MSP-files if applicable) is to extract them from the EXE installer AdbeRdr*.exe.

The latest EXE always contains the same MSI as the first EXE of the same series (the one with zero as third part of the version mumber), plus an MSP which can patch that to bring the version number to the current one. For example the EXE for version 11.0.10 contains the MSI of 11.0.0, plus an MSP to patch that to 11.0.10. The ftp-server also has an incremental MSP to upgrade 11.0.9 to 11.0.10.

However Adobe updates the EXE-installers only for the latest series, which currently is 12 alias Document Cloud (DC). In series 11.x they offered EXE-installers for up to version 11.0.10, because after that they started running series 12.x ("DC") in parallel. Thus for later versions the MSP cannot be extracted from EXE installers, but you can download them from their ftp-server. Go to the directory with the latest version, and there to the subdirectory misc.

extract from installer

Download the installer from the link that Adobe sent you after your registration, or freely available from CENSORED.

You might be tempted to do the extraction with 7zip, but you shouldn't. 7zip cannot see the included MSP-files, so you'll end up in most cases with an outdated MSI-file, and the MSP-file(s) required to do the update is/are missing.

The extraction must be done with a command like
AdbeRdr11002_en_US.exe -nos_oC:\AdobeFiles -nos_ne
If you do not like typing complicated commands, you can instead copy the installer.exe to an empty directory, dowload my script AcroRdr-Extract.cmd and copy it into the same directory, then double-click the script. It will detect the filename of the installer.exe in the same directory, and then issue the above command with the correct filename.

The extracted files will be saved in the newly created directory C:\AdobeFiles. It will contain one MSI-file, one file named, plus in most cases one or more MSP-files, plus some other files like setup.exe that are not needed for deployment with GPO.

If there are MSP-files, then the included MSI-file and are outdated, and you must apply the patches from the MSP-files to get the latest version. If you want to deploy using GPO, you must slipstream them, see below. In the example from above (version 11.0.2) you get two MSP-files: AdbeRdrUpd11001.msp and AdbeRdrSecUpd11002.msp. They must be applied one after the other, in the correct order, according to the version numbers in the filenames.

or try to find the right downloads

The few available MSI-files can be downloaded from CENSORED.

For the MSP-files go to the web-page Downloads and scroll down to Updates, or look on the ftp-server in the directory that has the name 'misc' instead of the language code. If you find there several MSP-files for the version that you want, each one is for a different group of languages. They are using codes in the filenames like TIER and MUI to specify that. That's described for older versions here. The TIERs for Adobe Reader 10 are described here (redirects to here). For more info about their language codes they refer to their 'Enterprise Administration Guide', see below.

The regular quarterly MSP-files for Adobe Reader are cumulative, i.e. you need to apply only the latest one. But emergency patches are incremental. Thus if Adobe has published emergency patches after the last regular update, you must apply the latest cumulative update, and then all emergency updates that came after it. Thus for version 10.1.6 (an emergency update) you must apply AdbeRdrSecUpd1016.msp to the AIP of version 10.1.5. Version 10.1.5 was a regular update, so you only need the MSP-file for 10.1.5 and must apply it directly to the MSI-file of 10.1.0. The versions inbetween are not required. The link on Adobes download page leads to info which version is required to apply the patch. Also Adobe spells the rule out here for version 7 to 9 and separately for version 10. The release notes tell which update was planned, and which was not.

Slipstream MSP-files

The MSP-files cannot directly be deployed via GPO to patch already existing installations. Instead the MSI-file must be extracted to an AIP-directory, and then the MSP-file must slipstreamed into that, to get an updated AIP. This new AIP-directory can then be deployed like an MSI-file.

My MSP-description offers a script that automates the slipstreaming. Please note that the extraction from the installer.exe as described above is not an AIP, so you must typein MSI when my script asks its question. If there is more than one MSP-file to slipstream, make sure to always have only one of them in the directory when you call the script. Also only the first MSP is applied to the MSI, which creates an AIP. If there is more than one MSP to be applied, all others ones must all be applied to that AIP, one at a time. To do this, copy the script into the AIP directory, and typein AIP when the script asks its question.

Slipstreaming MSP-files of Adobe Reader does not always succeed. In my experience it only works reliably on a PC on which Adobe Reader is not installed, ideally a PC where it has never been installed. Also it requires admin rights, otherwise it aborts with strange error messages.


For most configuration changes you need the Configuration Wizard .

There you can disable all updates. I also set the option "Display PDF in browser" to disabled, but it still displays PDFs in Firefox. Probably this option affects only Internet Explorer.

The wizard creates a MST-file that you can deploy as modification to the MSI-file or AIP. You can either tell the wizard to write an MST-file, or just quit and it will ask to save changes to the MSI. Even in this case it will also write an MST-file, it will be in the same directory as the MSI-file.

The Wizard version 11.0.0 has a bug (fixed in version 11.0.3): Every time you change anything, the property REMOVE_PREVIOUS changes by itself from YES to NO, even if you do not touch the corresponding Install-Option "Remove all versions of reader". You can edit again, load the bad transform, and put the missing checkmark back into the box. Now it's correct. But if you later make another change, the same error will happen again. So you must always edit twice: first for your desired changes, then to re-enable this option. Another possibility is to edit the MSI plus the MST in Orca and restore REMOVE_PREVIOUS to YES there.

Note that this uninstall-option is important, because when upgrading via GPO from version 10 to 11, the default install method autodetected by the server is update, not replace. Thus if you accept the default GPO-setting, and loose the MSI-property because of this bug, then the old version will remain installed.

other options

In the MSI-file the options ARPNOREMOVE and ARPNOMODIFY are not set, ARPNOREPAIR is set to 1. I usually set ARPNOREMOVE and ARPNOMODIFY to 1. Repair can be triggered in the help menu of AdobeReader, even if it is disabled in the MSI-file and does not show up in appwiz.cpl.

Disable Javascript and hide the tools panel of Acrobat Reader DC

These settings are stored in the Registry. Defaults can be set in HKLM. Users can override them.

[HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\2017\AVGeneral]

[HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\2017\JSPrefs]

GPO templates

Adobe announced that version 11 has a "GPO Template for the most common enterprise settings".

Details can be found here:

Error 2753 not marked for installation

If you get "Error 2753. The File 'acrosup64.dll' is not marked for installation." use the Adobe Reader and Acrobat Cleaner Tool.

more info

Adobe used to offer PDF-Documents with descriptions how to deploy Adobe Reader. The document for version 9 is still available here. The document for version 10 used to be here (and they still link to that location on the bottom of their page Reader Development Center), but this now redirects to the new web-based Enterprise Administration Guide, which is part of the Enterprise Toolkit, but this seems to be only for version 11. A pdf-file for versions 9, 10, and 11 can be found here.

A lot more info is on


  • 2023-08-31
    • link to cleaner tool
  • 2017-10-05
    • new version of AcroRdr-Extract.cmd
  • 2016-07-17
    • Censoring even more links, because it is unclear what exactly the Cease and Desist letter refers to.
    • Rewriting a few parts, and adding notes to Adobes Lawyers.
  • 2016-07-15
    • Censoring all download links because Adobe claims they are illegal.
    • Updating summary for version 11.0.17
  • 2015-08-16
    • link to two config tipps for version 12
  • 2015-08-08
    • Added info for version 12 alias Document Cloud (DC).
    • Updated script for extraction of EXE installer for new filename of version 12.
  • 2015-08-07
    • fix link to AdbeRdrUpd11010_incr.msp
    • mention shortcut 11.0.0 to 11.0.12
  • 2015-07-15
    • version 11.0.12 in summary-box
    • updated script ApplyMSP2.bat
  • 2014-05-14
    • version 11.0.7 and summary in "tl;dr"-box
  • 2013-04-06
    • mention GPO template for version 11
  • 2013-03-25
    • bug in Customization Wizard 11
  • 2013-03-24
    • add more details
    • add script for extraction
    • reorder & additional headlines
  • 2013-03-23
    • add extract MSI & MSPs from EXE
    • cleanup
  • 2012-11-11
    • Customization Wizard for version 11 now available
  • 2012-11-07
    • Customization Wizard for version 11 not yet available
  • 2012-01-21
    • update for version 10.1.2