TechNet has the documentation you need for creating a silent or unattended installation of the App-V client for deployment to existing workstations or during your base image build. Before embarking on customising the install, I usually recommend first understanding how to perform a manual installation of the App-V Client.

There are two ways to deploy the App-V Client – via SETUP.EXE, which will deploy dependencies too, or use the Windows Installer package and deploy the dependencies separately.

Whilst SETUP.EXE might be the easiest method, it won’t give most organisations the flexibility they would prefer when deploying software. In most cases organisations may customise the Windows Installer with a transform to set client properties and deploy the dependencies (MSXML, Application Error Reporting and Visual C++ Redistributables) which may also be required by other applications.

Quick Tip

When working with the App-V Client MSI installer, administrators most commonly come up against missing dependencies. This is usually due to the Application Error Reporting component which requires use of a specific GUID that must match the App-V Client. To test that the required dependencies are installed as the App-V Client setup expects, use SETUP.EXE to check the dependencies for you – just run SETUP.EXE manually and it will stop at the following dialog box that will list missing dependencies:

Resources

• How to Install the Client by Using the Command Line
• How to Install the App-V Client by Using Setup.exe
• How to Install the App-V Client by Using Setup.msi
• Application Virtualization Client Installer Command-Line Parameters
• How to Configure the App-V Client Registry Settings by Using the Command Line
• Setting App-V client permissions during install
• Group Policy Object (GPO) upgrade of SoftGrid may fail with Installer errors 1642, 1606 or 1603

App-V FAQ #12: How do I create a silent installation for the App-V Client? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The current versions of App-V have similar dependencies; however there are some differences with the newer 4.6 client. Of course the main dependency of the App-V Client is Windows itself.

App-V 4.5

The App-V 4.5 client supports the following 32-bit operating systems:

• Windows XP SP2+ – note that support for Windows XP Service Pack 2 has ended. Upgrade to Service Pack 3 now.
• Windows Vista RTM+ – note that support for Windows Vista RTM has ended. Upgrade to Service Pack 2 now.
• Windows 7 RTM+
• Windows Server 2003 SP1+
• Windows Server 2008 SP1+

The following dependencies are required

• MSXML 6.0 (included in Windows XP Service Pack 3 and all newer operating systems)
• Microsoft Application Error Reporting
• Microsoft Visual C++ 2005 Redistributable

If you are deploying any 64-bit operating systems which will include any Windows Server 2008 R2 Remote Desktop Services deployments, you will need to deploy the App-V Client 4.6.

App-V 4.6

The App-V 4.6 client supports the following 32-bit and 64-bit operating systems:

• Windows XP SP2+ – note that support for Windows XP Service Pack 2 has ended. Upgrade to Service Pack 3 now.
• Windows Vista RTM+ – note that support for Windows Vista RTM has ended. Upgrade to Service Pack 2 now.
• Windows 7 RTM+
• Windows Server 2003 SP1+
• Windows Server 2008 SP1+
• Windows Server 2008 R2 RTM+

The following dependencies are required

• MSXML 6.0 (included in Windows XP Service Pack 3 and all newer operating systems)
• Microsoft Application Error Reporting
• Microsoft Visual C++ 2005 Redistributable
• Microsoft Visual C++ 2008 Redistributable

All dependencies will be installed by SETUP.EXE; however for custom deployments of the operating system (using the Windows Installer file), the dependencies can be deployed separately.

App-V FAQ #11: What are the dependencies of the App-V Client? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Applications virtualised and delivered by App-V will work with application compatibility shims. You should consider application compatibility testing and remediation as a part of any operating system upgrade, because App-V is not a compatibility solution.

Microsoft’s Chris Jackson has written an excellent resource on TechNet that is essential reading if you want to understand App-V and compatibility shims: Making Applications Compatible with Windows 7 in a Virtualized Environment

Microsoft Application Virtualization is a powerful application management and deployment tool. When working it in to your plans for a Windows 7 migration, you can benefit from the potential for reduced cost during installation testing (though this cost is not promised to be zero).

You can also continue to leverage most of the same processes for resolving application compatibility issues using shims. If you’re deploying a single, organization-wide shim database, the transition will be very minimal—you need only be careful to avoid elevation shims (in much the same way you should avoid elevation in general in an App-V environment).

Resources

• Making Applications Compatible with Windows 7 in a Virtualized Environment
• Application Compatibility TechCentre on TechNet
• Application Compatibility Toolkit 5.6
• 3rd Party application compatibility solutions that work with App-V include: App-DNA AppTitude and ChangeBase AOK
• Top 5x5x5 Microsoft App-V Issues
• 5x5x5 App-V Application Compatibility Issues: Part 2
• App-V posts at the App-DNA blog
• App-V and Application Compatibility Shims

App-V FAQ #8: Can I use Application Compatibility Shims with App-V? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Operating system support for App-V is ultimately determined by the Microsoft Product Support Lifecycle. Note that the App-V 4.6 Client and Sequencer is required for 64-bit operating systems.

App-V Desktop Client

Full details for the client system requirements can be found on TechNet here:  Application Virtualization Client Hardware and Software Requirements. The App-V 4.5 and App-V 4.6 clients can be installed to the following operating systems ¹:

• Windows XP Professional Service Pack 2 and Service Pack 3
• Windows Vista RTM/SP1/SP2 Business, Enterprise and Ultimate
• Windows 7 Home Premium, Professional, Enterprise and Ultimate

Note, these are the operating system versions that Microsoft currently support, if you install the App-V client on other operating systems, Microsoft will not support the client on that OS.

App-V Remote Desktop Services Client

Full details for the client system requirements (including RDS) can be found on TechNet here:  Application Virtualization Client Hardware and Software Requirements. The App-V 4.5 and App-V 4.6 clients can be installed to the following operating systems ¹:

• Windows Server 2003 (Standard, Enterprise, Datacenter; SP1, SP2, R2, SP2+R2)
• Windows Server 2008 (Standard, Enterprise, Datacenter; SP1, SP2)
• Windows Server 2008 R2 (Standard, Enterprise, Datacenter)

App-V Management Server and Streaming  Server

The App-V Management Server and Streaming Server are 32-bit only but will install on 64-bit Windows. Full details for the server system requirements can be found on TechNet here: Application Virtualization System Requirements. The App-V 4.5 SP1 and SP2 server components can be installed on the following operating systems ¹:

• Windows Server 2003 (Standard, Enterprise, Datacenter; SP1, SP2, R2, SP2+R2)
• Windows Server 2008 (Standard, Enterprise, Datacenter; SP1, SP2)
• Windows Server 2008 R2 (Standard, Enterprise, Datacenter)

The App-V Management Console can be installed on all supported operating systems (included desktop OS’s).

SQL Server

The App-V Management Server relies on SQL Server to host the data store. The following versions of SQL Server are supported ¹:

• SQL Server 2000 (SP3a, SP4)
• SQL Server 2005 (SP1, SP2, SP3)
• SQL Server 2005 Express (all versions – non production only)
• SQL Server 2008 Express (all versions – non production only)
• SQL Server 2008 (SP0, SP1)

The Management Server should work with SQL Server 2008 R2; however I’m unaware if this is official policy.

App-V Sequencer

The App-V 4.6 Sequencer comes as 32-bit and 64-bit versions (the 4.5 Sequencer supports 32-bit only). Full details for the App-V Sequencer system requirements can be found on TechNet here: Application Virtualization Sequencer Hardware and Software Requirements. The App-V Sequencer is supported on the following operating systems ²:

• Windows XP Professional Service Pack 2 and Service Pack 3
• Windows Vista RTM/SP1/SP2 Business, Enterprise and Ultimate
• Windows 7 Home Premium, Professional, Enterprise and Ultimate
• Windows Server 2003 (Standard, Enterprise, Datacenter; SP1, SP2, R2, SP2+R2)
• Windows Server 2008 (Standard, Enterprise, Datacenter; SP1, SP2)
• Windows Server 2008 R2 (Standard, Enterprise, Datacenter – 4.6 only)

Note that the Sequencer is single threaded only – a fast CPU will help, but multiple CPUs will not.

Virtualisation

If you are considering running any of the App-V components on virtualised hardware, system requirements will remain the same. You can find support Microsoft’s support policies on virtualisation here:

• Microsoft server software and supported virtualization environments
• Support policy for Microsoft software running in non-Microsoft hardware virtualization software

App-V FAQ #6: What are the system requirements for App-V? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Microsoft App-V is available in two flavours: for desktops (this includes laptops and virtual desktops – essentially anything that will run Windows XP, Windows Vista or Windows 7) and for Remote Desktop Services (RDS).

Microsoft App-V for Desktops

If you are looking at App-V for your desktop machines, then you will need to license the Microsoft Desktop Optimisation Pack (MDOP), as App-V for Desktops only comes as a part of MDOP. The downloadable ISO for App-V for Desktops includes the App-V Client for Desktops, the App-V Sequencer and the App-V Management Server and the App-V Streaming Server.

MDOP includes the following components:

• Microsoft Application Virtualization (App-V)
• Microsoft Enterprise Desktop Virtualization (MED-V)
• Advanced Group Policy Management (AGPM)
• Microsoft Diagnostics and Recovery Toolset (DaRT)
• System Center Desktop Error Monitoring (DEM)
• Microsoft Asset Inventory Service (AIS)

MDOP is available to customers that have first purchased Software Assurance. MDOP is then an additional cost per seat. From the MDOP page on the Microsoft Volume Licensing site:

Available exclusively to Software Assurance customers as an add-on subscription, the Microsoft Desktop Optimization Pack (MDOP) employs six innovative technologies to improve desktop management, including application virtualization, asset management, and desktop diagnostic tools.

More information on Software Assurance is available at the Microsoft Software Assurance Frequently Asked Questions.

Microsoft App-V for Remote Desktop Services

A recent change to the RDS licensing now makes App-V for RDS available with the RDS Client Access License (CAL). The App-V for RDS license is now no longer available separately as purchasing an RDS CAL automatically gives you access to App-V for RDS. More more information and a list of frequently asked questions on RDS licensing visit this page: Remote Desktop Services Licensing.

The downloadable ISO for App-V for RDS includes the App-V Client for RDS, the App-V Sequencer and the App-V Management Server and the App-V Streaming Server.

TechNet and MSDN Subscribers

If you have a TechNet or MSDN subscription, App-V for Desktop and App-V for RDS is available as a part of your subscription. This allows you to test App-V on various platforms in your environment. Note that TechNet or MSDN subscriptions are for testing or evaluation purposes only and are not intended for running Microsoft products in production.

App-V Management Server and Streaming Server

While you have the right to install and run the components of App-V using the licensing outlined above, you will still need to meet separate licensing requirements for the platform on which the Management Server and the Streaming Server run on.

The Management Server will require Windows Server and SQL Server licenses. The Streaming Server requires only a Windows Server license as it does not connect to a data store.

Are any of the components available separately?

A question that has been asked previously in the TechNet forums is “is the App-V Sequencer available to license separately”. The answer to this is No. The client, sequencer or server components are only available as a part of the App-V for Desktops or App-V for RDS license.

App-V FAQ #3: How is App-V licensed? is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

When installing Microsoft Application Error Reporting, for example as a part of deploying the App-V Client, you may see an event with ID 11708 logged in the Application log. The error logged will be something along the lines of this:

Source: MsiInstaller

Event ID: 11708

Error detail: Product: Microsoft Application Error Reporting — Installation failed.

Additionally the following event may also be logged:

Source: MsiInstaller

Event ID: 1033

Event detail: Windows Installer installed the product. Product Name: Microsoft Application Error Reporting. Product Version: 12.0.6012.5000. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 1603.

This is caused by initiating the installation from non-elevated process (e.g. the Run dialog box) – if the installation starts and UAC subsequently prompts for elevation, the MSI will not install successfully.

If the installation is initiated from a process that has already been elevated (e.g. an Administrator Command Prompt) the installer will complete without errors.

Event ID 11708 logged when installing Application Error Reporting is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The Office 2010 planning, deployment and configuration documentation is far better than what was available for Office 2007 at launch, however it’s worth updating my Office 2007 deployment notes for the changes in Office 2007.

Here’s a walkthrough of the Office 2010 customisation process and some of the key considerations you should make when you’re ready to create your custom Office 2010 deployment. 

Obtaining and running the Office Customisation Tool

Starting with Office 2007, Microsoft included the tools necessary for customising the Office deployment directly within the installation source rather than having to download the tool separately. However this has changed slightly with Office 2010.

If you attempt to run the OCT from the Office 2010 media you have downloaded from TechNet, MSDN or the Volume License site, you will receive the following error:

Taking a look at the Office installation source, you’ll notice that the Admin folder is not included with any of the Office 2010 products, as it was with the 2007 versions:

To obtain the Admin folder and the files necessary to run the Office Customisation Tool (OCT), you will need to first download the Office 2010 Administrative Template files (ADM, ADMX/ADML) and Office Customization Tool (read more about this download here). Files for 32-bit and 64-bit versions of Office 2010 are available, so download the file to suit the version of Office you are deploying.

Extract the files by running AdminTemplates_32.exe or AdminTemplates_64.exe (or use the /extract:<folder path> /quiet switches), then copy the Admin folder to the Office 2010 installation source.

The Admin folder containing the OCT files is suitable for all of the Office 2010 products, for example you can copy the same folder to a Visio 2010 source folder to start creating a customisation file for that product.

Before Customising Office 2010

Before attempting to create an Office customisation for unattended deployment, it’s worth manually installing Office, understanding the components that are installed and seeing the first run experience on a clean machine (and with a clean user profile too).

On first run, Office will prompt users some choices that, in a corporate environment, should probably be made for them. These are Windows Update settings:

And the default file type choice – will you continue to use the Microsoft file types or go with the OpenDocument formats instead?

These dialog boxes can be disabled from within the customisation file.

Creating a custom installation

In this section, I’ve outlined the key steps for creating a customisation file, but you can read about customising your Office 2010 deployment in more detail on TechNet.

The process for creating a customisation file for Office 2010 is almost the same as for Office 2007 – start the Office Customisation Tool (SETUP /ADMIN) and create a new file or open an existing file for modifying.

Tip: to avoid the the UAC prompt when running Setup, set the __COMPAT_LAYER environment variable to run Setup in the current context. Run SET __COMPAT_LAYER=RunAsInvoker before running Setup (both commands should be run from the same Command Prompt.

Just as you would be prompted once Office 2010 is installed, you will need to choose the default file types. Most organisations will probably choose to stick with the Microsoft Open XML formats. Making a choice here will modify the user settings that you will see in a later  step.

A install location for Office can be specified if you don’t want to accept the default. Change this location if you are virtualising Office 2010 with App-V.

Office 2010 enforces activation with Volume Activation 2.0 – the best strategy for activating Office 2010 is to use a KMS host, which will avoid deploying the product key in your deployment and manual activations. If you do not have access to a KMS key, a MAK key is required (without a key, Setup will fail).

Accept the license agreement and choose the type of user interface that setup will display during installation. SCCM and other ESD deployments should use no user interface.

The OCT allows you to choose default security settings for Office 2010. I won’t go into that here, instead read this article on TechNet: Configure security for Office 2010.

One of the most important (and time consuming) aspects of the the customisation file is modifying the default user settings. What you set here will depend on the environment you are deploying to, but it’s worth investing in some time to get these default settings correct.

By modifying these settings in the customisation file, users can get up and running with Office 2010 sooner; however treat these as default preferences. Group Policy should be used to enforce settings, not set defaults – the less settings you have in Group Policy the better (less time spent processing policies at logon).

The table below lists they most common settings to modify based on my experience deploying Office:

Like user settings, feature installation states will impact on the default Office experience, so you will need to know in advance which features you are deploying. Install on First Use for features is no longer available, so features will either be available or not once deployed, although you can change feature states after deployment.

Some features that may not be suitable for some corporate environments include:

• Office Shared Features – Business Connectivity Services
• Office Shared Features – Web Themes
• Office Tools – Hosted Webs

There are several other options available from within the OCT – you can deploy additional files and programs along side Office, automatically configure Outlook profiles when users first start Outlook and configure SharePoint Workspaces.

Once you have finished creating the customisation file, save it and now you’re ready to start the Office 2010 deployment process.

Customising Office 2010 before deployment is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

TechNet has all the information you should need for automating the installation of the App-V client, including using SETUP.EXE or Windows Installer (my preferred method). Most of the client properties you’ll need during install are documented and others are available to set post-install via Group Policy using the App-V ADM template.

However, I generally recommend configuring as many settings as you can during install so that you don’t have to rely on external tools (e.g. Group Policy) that may not apply in a timely manner.

I have had to set permissions during install to make changes to the default permission set. Those permissions aren’t documented on TechNet, so I have listed them here. The following table lists the permissions that you can modify by passing parameters to Setup or via Windows Installer

See the Property table inside SETUP.MSI for the complete list of additional client settings that you can pass to the installer.

I have included here a complete sample script that deploys the App-V client, by first installing the dependencies and setting permissions (and other options) during install, using the MSI:

Microsoft App-V 4.6 client install script

Setting App-V client permissions during install is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

This post has been sitting in my drafts since June 2009 and for whatever reason I haven’t gotten around to posting it. So rather than delete it, I’m posting it as is – apologies in advance for quality of this post

I have used LANguard in the past for vulnerability testing and network discovery but frankly that’s kind of boring stuff. What is interesting in the latest version is the ability to deploy software.

LANguard 9 includes application deployment functions that make deploying software to remote machines quite simple.  I’m going to detail deploying Adobe Reader 9, using the deployment notes outlined in my Deploying Adobe Reader 9 post, then deploy the Reader 9.1.1 update, using that functionality.

I’m going to skip over most of the details of installing LANguard – it’s a simple process, you’ll just need to choose the type of datebase you

In my test environment I have configured three machines:

• a domain controller (DC), which will also host my install files (at \\dc\common)
• a machine running Windows Vista on which I have installed LANguard (LANGUARD)
• and a machine running Windows 7 (WIN7A) to which I will deploy Adobe Reader

To deploy software to a remote machine, I need to be able to authenticate to that machine. Because I am using a domain, authentication is made simple; however I could actually deploy software to workgroup machines if I know an admin username and password for that those machines.

The deployment feature of LANguard is geared around installing a single file with parameters; however it’s simple enough to deploy applications like Office or Reader by using a batch file:

Before I start deployment, I’ve configured a source location (\\dc\common\Adobe\Reader91) for Adobe Reader 9.1:

• I have extracted the Reader 9.1 install files from the setup file downloaded from Adobe;
• I have created a transform that will configure Reader as it is installed; and
• I have created a batch file (INSTALL.CMD) that contains the install commands for Adobe Reader

INSTALL.CMD looks like this:

@ECHO OFF
SET SOURCE=\\dc\Common\Adobe\Reader91
MSIEXEC /I %SOURCE%\AcroRead.msi TRANSFORMS=%SOURCE%\AdobeReader91Custom.mst ALLUSERS=TRUE REBOOT=SUPRESS /QB

The script will install Adobe Reader directly from the network, so the only file being copied to the remote machine is the script. Here’s what the install source for Adobe Reader looks like:

Deploying software is a three step process:

1. add the file to deploy to the remote machines (in this case the batch file which will do the work);
2. add the machines (by specifiying the hostname) to deploy the software to;
3. then deploy immediately or choose to install using a schedule:

So how is this actually working? The deployment feature on LANguard is not dissimilar to the Sysinternals tool PSEXEC, where a temporary service is installed on the remote machine to deliver the install commands. Essentially to deploy Adobe Reader 9, I am using LANguard to remotely execute INSTALL.CMD. I need admin rights on the target computers and LANguard does the rest. I even get to see the progress of the deployment:

I can also use the same process to update Reader 9.1 with the 9.11. update patch.

I have downloaded the Adobe Reader 9.1.1 Update (which comes as a Windows Installer Patch file – .MSP) and added it to the the same deployment location (\\dc\common\Adobe\Reader911Update). Again I have created a batch file that will install the 9.1.1 update from the same location:

@ECHO OFF
SET SOURCE=\\dc\common\Adobe\Reader911Update
MSIEXEC /P %SOURCE%\AdbeRdrUpd911_all_incr.msp ALLUSERS=TRUE REBOOT=SUPRESS /QB

By going through the same deployment configuration, but instead using the batch file that will install the update, I can deploy to the machines that have Reader 9.1.

I’ve tested deploying the update while Reader is open on the remote machine and the install was successful. Once I closed and reopened Reader, I could see the 9.1.1 version. This may not work for all applications – I don’t think that my example worked specifically because of LANguard, but you should at least have some success when updating in-use applications.

Deploy and update Adobe Reader with GFI LANguard is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’ve been mucking around with MDT 2010 lately, which has made it pretty simple to create an unattended install routine for my Dell Latitude XT2 (hopefully more on that soon) and to inject drivers into the build; however in doing so I’ve found a nasty bug in the IDT 92HDxxx HD Audio drivers from Dell (version 6.10.0.6217, A09).

This particular version doesn’t actually work at all, i.e. no sound plays. In addition, media applications, such as Adobe Flash, Windows Media Player and Spotify, and any system components that uses audio locks up when attempting to play sound. These drivers are listed on the Dell support site for the following systems:

• Latitude E4200
• Latitude E4300
• Latitude E5400
• Latitude E5500
• Latitude E6400
• Latitude E6400 ATG
• Latitude E6400 XFR
• Latitude E6500
• Latitude XT2
• Dell Precision Mobile WorkStation M2400
• Dell Precision Mobile WorkStation M4400
• Dell Precision Mobile WorkStation M6400

I’ve tested these on a 32-bit install of Windows 7 on two machines – a Latitude XT2 and a Latitude E4200, with the same result. Fortunately though, the drivers are not required for playing sound – Windows 7 will find the audio hardware out of the box.

If you have the same issue, open Device Manager and uninstall the device labelled IDT High Definition Audio CODEC, be sure to also tick the option Delete the driver software for this device to remove the driver completely. Here’s what you’ll see in Device Manager:

Now here’s the weird part, these audio drivers also prevent the Hyper-V virtual machine remote console client (VMCONNECT.EXE) from connecting to a VM. You’ll see the client window open but no remote console will be displayed. Odd stuff.

Dell owners – avoid the IDT 92HDxxx HD Audio driver is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In This Series: Office 2007 Deployment

1. Office 2007 Deployment via Group Policy
2. Deploying Office 2007 with Group Policy Startup Scripts
3. Installing Office 2007 on Terminal Server
4. Set Default Formats for New Office Documents from Windows Explorer
5. Disable Office User Interface Elements

Group Policy allows you to disable certain UI elements within Office applications, which you might want to do in the case of the Information Rights Management feature built into Office 2003 and 2007.

I’m picking on IRM in this post about disabling UI elements, but you can disable all of the IRM features in Office by enabling a single policy: User Configuration / Policies / Administrative Templates / Microsoft Office 2007 system / Manage Restricted Permissions / Disable Information Rights Management User Interface

If you haven’t yet, or are not ever, planning to roll out Active Directory Rights Management Services you’ll want to remove these features from Office which would lead users to dialog boxes such as this one (not particularly ideal):

To disable menu items in Office you’ll first need to know the control ID’s of those items. This means you’ll need to wade through the 23 spreadsheets including in the 2007 Office System Document: Lists of Control IDs to find the ID listed amongst thousands. Fortunately most of the IDs are the same across each of the Office applications.

So to hide the IRM features in Office 2007 Professional Plus, Enterprise and Ultimate, I need to add the following IDs to Group Policy:

These are the policy settings you’ll need to enable and add the IDs to:

• User Configuration / Policies / Administrative Templates / Microsoft Office Excel 2007 / Disable Items in User Interface / Custom / Disable commands
• User Configuration / Policies / Administrative Templates / Microsoft Office Outlook 2007 / Disable Items in User Interface / Custom / Disable command bar and menu items
• User Configuration / Policies / Administrative Templates / Microsoft Office PowerPoint 2007 / Disable Items in User Interface / Custom / Disable commands
• User Configuration / Policies / Administrative Templates / Microsoft Office Word 2007 / Disable Items in User Interface / Custom / Disable commands

Which then results in something like this:

Disable Office User Interface Elements is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Adobe have made the Adobe Customisation Wizard 9 available for download for use with deploying Acrobat and Reader 9 applications.

Good news is that this allows you to disable the Adobe Product Improvement Program window that some people have been having trouble disabling. I’m now in the process of updating my post on deploying Adobe Reader 9.

Adobe Customisation Wizard 9 Available is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

There are numerous ways to customise the default user profile in earlier versions of Windows, including:

• Create a user account, configure the profile, then copy over the top of the local default profile or save a copy to your NETLOGON share;
• Use the [GuiRunOnce] section in an unattended answer file for Windows XP/2003.

The first option carries over to Windows Vista and Windows Server 2008 however the second option is not available in quite the same way. Windows Vista’s setup is a very different beast and customising the default profile with scripts requires using the auditUser pass and setting the CopyProfile value.

There’s some great detail about using this process to modify the default user profile at FireGeier’s Unattended Vista Guide plus there’s a post at MSFN.org that my help you understand the process too. However, I think there’s a simpler way. It’s perhaps not a flexible as deploying via the UNATTEND.XML file but it doesn’t require running SYSPREP to get the job done.

You can edit the default profile by directly modifying the Windows Vista or Windows Server 2008 image. This involves mounting the image and making your changes:

• Mount the image in read/write mode;
• Load the \Users\Default\NTUSER.DAT hive into the Registry. It’s worth looking around at this registry hive to see the differences between it and the user hive once a user has logged in;
• Add the required modifications and unload the hive;
• Commit changes to the Windows image.

Be sure to set the CopyProfile value to False in the UNATTEND.XML, otherwise these changes will be overwritten. Here’s a script that performs those steps for me:

@ECHO OFF
REM -----------------------------------------------------------------------------
REM  Script configures the Default User Profile in a Windows Vista/2008 image
REM -----------------------------------------------------------------------------

REM Mount the Windows image
IMAGEX /MOUNTRW "D:\install.wim" 1 D:\mount

REM Load the default profile hive
REG LOAD HKU\Default D:\mount\Users\Default\NTUSER.DAT

REM Configure the default user profile
REG ADD "HKU\Default\Control Panel\Sound" /v Beep /t REG_SZ /d NO /f
REG ADD "HKU\Default\Control Panel\Sound" /v ExtendedSounds /t REG_SZ /d NO /f
REG ADD "HKU\Default\Control Panel\Desktop" /v HungAppTimeout /t REG_SZ /d 5000 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v WaitToKillAppTimeout /t REG_SZ /d 4000 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v FontSmoothing /t REG_SZ /d 2 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v FontSmoothingType /t REG_DWORD /d 2 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v WallPaper /t REG_SZ /d "" /f
REG ADD "HKU\Default\Control Panel\Colors" /v Background /t REG_SZ /d "10 59 118" /f
REG ADD "HKU\Default\Console" /v QuickEdit /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Command Processor" /v CompletionChar /t REG_DWORD /d 9 /f
REG ADD "HKU\Default\Software\Microsoft\Command Processor" /v PathCompletionChar /t REG_DWORD /d 9 /f
REG ADD "HKU\Default\Software\Microsoft\CTF\LangBar" /v ShowStatus /t REG_DWORD /d 3 /f
REG ADD "HKU\Default\Software\Microsoft\CTF\LangBar" /v Label /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\CTF\LangBar" /v ExtraIconsOnMinimized /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v SeparateProcess /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowControlPanel /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_EnableDragDrop /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuFavorites /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuLogoff /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuScrollPrograms /t REG_SZ /d "YES" /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v IntelliMenus /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowHelp /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyComputer /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyDocs /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyMusic /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyPics /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowNetPlaces /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowPrinters /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowSetProgramAccessAndDefaults /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowRecentDocs /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_AutoCascade /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_NotifyNewApps /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_AdminToolsRoot /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuAdminTools /t REG_SZ /d "NO" /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_SortByName /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete" /v "Append Completion" /t REG_SZ /d YES /f
REG ADD "HKU\Default\Software\Microsoft\Internet Explorer\TabbedBrowsing" /v PopupsUseNewWindow /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Internet Explorer\PhishingFilter" /v Enabled /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Internet Explorer\Main" /v "Enable AutoImageResize" /t REG_SZ /d YES /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /ve /t REG_EXPAND_SZ /d "" /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Setup\UserOptions" /v DesktopShortcut /d No /t REG_SZ /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Setup\UserOptions" /v QuickLaunchShortcut /d /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v AcceptedPrivacyStatement /d 1 /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v FirstRun /d 0 /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v DisableMRU /d 1 /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v AutoCopyCD /d 0 /t REG_DWORD /f
REG DELETE "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Run" /v Sidebar /f

REM Unload the default profile hive
REG UNLOAD HKU\Default

REM Unmount the Windows image and commit changes
IMAGEX /UNMOUNT /COMMIT D:\mount

As you can see I’m adding registry entries that will configure the user environment which does mean that there’s a bit of work required to find them in the first place, but it does allow me to document every change to the profile, so I think the effort is worth it.

Extending this process, there are a few other things we can change in the Windows image that will impact the default environment:

• Modify the default theme file in \Windows\Resources\Themes\aero.theme. I’ve used this file to do things such as remove the default wallpaper. Theme files are just text files so they’re easy to maintain;
• Configure Internet Explorer defaults by using INSTALL.INS created with the Internet Explorer Administration Kit. This is useful for preventing IE from adding the default favourites or RSS feeds at first launch. Place a copy of INSTALL.INS in \Program Files\Internet Explorer\SIGNUP and \Program Files\Internet Explorer\CUSTOM.

Then there are a couple of additional tools that I’ve used to make changes to the default user environment once Windows has been installed and added to the domain:

• Group Policy. Some settings such as preventing Windows Media Player from displaying the first run dialog are useful;
• Group Policy Preferences. GPP allows you to set registry values as a preference, i.e. apply once only.

By modifying the Windows image directly, your custom default profile will be available on machines whether you use an unattended or manual deployment.

Here’s a few more articles worth reading:

• Configuring default settings for Windows image deployment
• Support guidelines for migrating roaming user profiles data to Windows Vista or to Windows Server 2008
• Managing Roaming User Data Deployment Guide

Customise the Windows Vista Default User Profile is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The latest version of Adobe Reader is available, so here’s a few preliminary details on what you might need to know when deploying it. It seems like only yesterday we were pulling our collective hair out over Adobe Reader 8 and now Adobe Reader 9 has been released and we’ve got to start over again. The Adobe Reader blog has some details on what’s new in this version. You can also find links to all sorts of Adobe Reader resources here too.

First Impressions

As usual consumers will have the Google toolbar pushed on them if they don’t de-select that option when downloading Reader, and now you’ll also get Adobe AIR along with Reader too. Awesome, more stuff we don’t really need. A default install leaves two icons on the desktop now – Adobe Reader 9 plus one for Acrobat.com.

The good news though, is Reader 9.x is fast. I hadn’t ever found Reader 8 to be slow, but version 9 certainty runs noticeably faster than previous versions.

Downloading Adobe Reader

Adobe Reader 9.1 is available for download for many languages, including:

• Adobe Reader 9.1 English US/UK
• Adobe Reader 9.1 Français
• Adobe Reader 9.1 Deutsch
• Adobe Reader 9.1 Nederlands
• Adobe Reader 9.1 Italiano
• Adobe Reader 9.1 Español
• Adobe Reader 9.1 日本語

Adobe AIR is only bundled with the English and German versions of Reader 9 so far.

What To Do About Adobe Updater

Reader 9 continues to include the Adobe Updater application which has been updated to version 6. While I haven’t seen it misbehave for some time and it no longer drops an Updater folder in your Documents folder, you might still want to disable it.

There are a few ways to do this. You can disable Updater by running it (click Help / Check for Updates) then click the Preferences link. You will then see the Preferences dialog like this, where you can choose to disable Updater:

To problem with this approach is that you need Internet access just to get to the preferences dialog. A bit of a problem if you’ve got Internet access issues. To disable Updater from running automatically you can run the following command line as an administrator (or an elevated command prompt in Windows Vista):

REG ADD "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown" /v bUpdater /d 0 /t REG_DWORD /f

Alternatively, to completely remove Adobe Updater, after installation, delete this folder:

• C:\Program Files\Common Files\Adobe\Updater6 (32-bit Windows)
• C:\Program Files (x86)\Common Files\Adobe\Updater6 (64-bit Windows)

If Adobe Reader is running as a standard (or limited) user account, Adobe Updater won’t run at all, so it shouldn’t be an issue if you don’t give users administrative access to their workstations.

If you are virtualising Adobe Reader, then disabling or removing Updater is a must.

Extracting Reader Setup Files

Before deploying Reader 9, you will want to extract the files from the file you’ve downloaded, so that you can create a custom tranform file. To extract the file, run the following command line:

AdbeRdr910_en_US_Std.exe -nos_ne

You will then find the extracted file in these locations:

• %LOCALAPPDATA%\Adobe\Reader 9.1\Setup Files (on Windows Vista/2008)
• %USERPROFILE%\Local Settings\Application Data\Adobe\Reader 9.1\Setup Files (on Windows XP/2003)

Once extracted, you will have the setup files for both Reader and AIR. The setup files for Reader are in a sub-folder called ‘Reader9’.

Creating a Custom Transform File

When deploying Reader there are some customisations that I recommend making to the installation, including:

• Prevent the installation of Adobe Updater 6 (If you want control over the version of Reader)
• Prevent the Adobe Acrobat SpeedLauncher from being added to the Run key in the registry
• Prevent the ‘Adobe Reader 9’ shortcut from being added to the desktop (Keep the desktop and tidy)
• Prevent the installation of the Adobe Syncronizer [See this comment before removing Syncronizer]
• Accept the EULA

Adobe usually provide a customisation tool for automating the installation of Reader, however the Customisation Wizard for Reader and Acrobat 8 wasn’t released until 6 months after the products themselves were released. To customise the installation I’ve used the excellent InstEd instead.

Here’s what I’ve configured as a minimum in my transform:

Prevent Adobe Updater Installation

• In the Component table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
• In the Feature table, drop any row containing ‘AUM’ or ‘Updater’
• In the FeatureComponents table, drop any row containing ‘AUM’ or ‘Updater’
• In the File table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
• In the ModuleComponents table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
• In the MsiFileHash table, drop any row containing ‘AdobeUpdater’
• In the Registry table, drop any row containing ‘Adobe_Updater’

Prevent Adobe Acrobat SpeedLauncher At Startup

• In the Registry table, drop the row containing ‘Registry838’

Prevent the Adobe Reader 9 Desktop Shortcut

• In the Shortcut table, drop the row containing ‘SC_READER_DT’

Prevent Adobe Syncronizer Installation

• In the Property table, set the value for SYNCHRONIZER to YES

Accept the EULA

• In the Property table, set the value for EULA_ACCEPT to YES

Also in the Property table, you could set the value of DISABLE_BROWSER_INTEGRATION to YES, to prevent Reader from opening within the browser. This would be beneficial in Terminal Server environments. When a PDF file is opened within the browser and the user then browses to a different page, the Reader components are stay in memory until the browser is closed.

You can download a transform with all of the modifications listed above here (except disabling Syncronizer; use at your own risk):

Adobe Reader 9.1 Custom Transform

Creating a Custom Transform with Adobe Customisation Wizard 9

Adobe have recently released the Adobe Customisation Wizard 9 which is the best place to start when creating a custom transform for Acrobat or Reader 9. Here are the settings I would recommend you configure when creating a transform:

Under Installation Options set:

• Run Installation to Unattended
• If reboot required at the end of installation to Suppress reboot

Under Files and Folders:

• Add HideMenuItems.js, listed below, to ProgramFilesFolder / Adobe / Reader 9.0 / Reader / JavaScripts

Under Shortcuts:

• Remove the Adobe Reader 9 shortcut added to the Desktop

Under EULA and Document Status set

• Suppress display of End User License Agreement to enabled

Under Online and Acrobat.com Features set

• Disable all updates to enabled to disable Adobe Updater
• When launching PDF in Internet Explorer, prompt user with Open/Save dialog to enabled for Terminal Server environments
• In Adobe Reader, disable Help > Purchase Adobe Acrobat to enabled
• Disable Help > Digital Editions to enabled
• Disable Product Improvement Program to enabled
• Disable Viewing of PDF with Ads for Adobe PDF to enabled
• Display PDF in browser to Disable & Lock for Terminal Server environments
• Disable all Acrobat.Com access, including initiation and participation to enabled

After you created the transform for Reader 9 with the wizard, you may want to open it in your favourite MSI editor to perform further customisations such as disabling SpeedLauncher.

Disabling Menus and Buttons

In a corporate environment, you may want to disable some of the menu items and buttons. Just as in Adobe Reader 8, most of these items are disabled with a JavaScript file. Yes a JavaScript file. Whilst using the registry would make sense to control UI items, Adobe uses JavaScript files. I’d love to know the reason why. It’s not a solution that scales particularly well.

To disable UI elements, you will first need to list all of the elements by name. To do this, save the following script as ListItems.js in %ProgramFiles%\Adobe\Reader 9.0\Reader\JavaScript:

//ListItems.js
//Open Javascript Console
console.show();

//List Toolbar Buttons in the Console
var toolbarItems = app.listToolbarButtons()
for( var i in toolbarItems)
console.println(toolbarItems + "\n")

//List Menu Items in the Console
var menuItems = app.listMenuItems()
for( var i in menuItems)
console.println(menuItems + "\n")

This will open a dialog box when Reader is started, listing the names of each menu item and toolbar button. You can then create a JavaScript file to remove these items from the UI. Reader 9 includes a number of menu items you might want to remove:

Here’s the code you’ll need to hide those items. Copy and paste into HideItems.js, then copy into %ProgramFiles%\Adobe\Reader 9.0\Reader\JavaScripts.

//HideMenu.js

// [File - Create Adobe PDF Using Acrobat.com], plus toolbar button
app.hideMenuItem("WebServices:CreatePDF");
app.hideToolbarButton("Weblink:CreatePDF");

// [File - Collaborate], plus toolbar button
app.hideMenuItem("Annots:FileCollaboration");
app.hideToolbarButton("Annots:CollabToolButton");

// [File - Digital Editions]
app.hideMenuItem("eBook:Digital Edition Services");

// [Help - Improvement Program Options]
app.hideMenuItem("UsageMeasurement");

// [Help - Online Support], plus sub menu items
app.hideMenuItem("OnlineSupport");
app.hideMenuItem("KnowledgeBase");
app.hideMenuItem("AdobeExpertSupport");
app.hideMenuItem("AccessOnline");
app.hideMenuItem("SystemInformation");

// [Help - Repair Adobe Reader Installation]
app.hideMenuItem("DetectAndRepair");

// [Help - Check for Updates]
app.hideMenuItem("Updates");

// [Help - Purchase Adobe Acrobat]
app.hideMenuItem("Weblink:BuyAcrobat");

Deploying Reader

Deploying Reader should be straight-forward, however you are required to complete a distribution agreement to deploy Reader in your environment.

Using Group Policy Software Installation, or your favourite software deployment tool, create a transform file with your required settings and deploy. If you need to use a script, this command will install Reader:

START /WAIT MSIEXEC /I AcroRead.msi ALLUSERS=TRUE TRANSFORMS=AdobeReader9.mst /QB

Updating Reader

Updating Adobe Reader can be a bit of a challenge, especially for smaller environments using only Group Policy Software Installation. For Reader 8, Adobe released updates as a complete download of the installer rather than patches. I recommend updating using the full installer as updates for version 9 are released.

If you would really prefer to use the Updater to keep Reader current, you could use the following command in a task using Windows Task Scheduler:

"%CommonProgramFiles%\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=1 -AU_DISPLAY_LANG=en_US -AU_LAUNCH_APPID=reader9rdr-en_US

I can’t vouch for the effectiveness of this approach or even if it will work, so you’re on your own there. Of course you’ll also need to keep Updater in the Reader install package.

Managing Reader

Managing Reader via Group Policy is pretty simple – Reader 8 and 9 are even policy aware. That is they use the Software\Policies key in the registry. Unfortunately Adobe don’t supply an ADM/ADMX template file for use with Group Policy. C’mon Adobe it wouldn’t take you much effort and we would be very grateful.

So it’s Group Policy Preferences or your favourite user workspace management tool for managing Reader. Paul has taken the time to create a simple ADM file for managing some of Readers features that might suit you.

I’ve also created my own custom Administrative template, which you can download in ADM and ADMX format. There is still some work to go on this template, so use at your own risk:

Adobe Acrobat and Reader 9 Administrative Template v0.1

What Now?

I would recommend updating to Reader 9 if you can. There’s doesn’t look to be any fantastic new features to get excited over, but the performance improvements should make it worthwhile.

• [11/03/2009] Updated for Adobe Reader 9.1
• [29/07/2008] Adobe have posted a Deploying Adobe Reader 9 document that has some excellent details.
• [07/08/2008] Updated for the release of Adobe Customisation Wizard 9.
• [08/08/2008] Added version 0.1 of custom ADM/ADMX for managing policy settings.

Deploying Adobe Reader 9 for Windows is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’ve updated my Sun Java Runtime Environment 1.6 Update X script, again. Updating this script seems to be a never ending task, usually because I find mistakes but this time around I’ve made a couple of changes including Windows x64 support. The script will now supports installing the 32-bit version of the JRE on x86 and x64 Windows and configures the environment accordingly.

A second change I’ve implemented is in the way the script adds registry entries to fool applications that expect earlier versions of the JRE to use the latest installed version. This change uses a text file that lists the earlier versions for import into the registry.

To use this script, save the script, the versions text file and the JRE installer to a folder on a local drive. Then elevate a command prompt to run the script and install.

Now I’ve got to get XenApp 5.0 Management Console using the latest JRE, but that’s for another post.

Sun JRE Install Script Update is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Sun are preparing a new Java Runtime Environment for release later this year and there’s a couple of changes to this version that have some bearing on deployment. I can’t imagine there is an enterprise out there that doesn’t have to deal with Java applications.

The biggest change is that from this new version onwards, the point releases (read: updates, like 1.6.0_3, 1.6.0_2 etc) will be a thing of the past. New updates will be installed on top of existing installed versions, so you will only see a single version installed to: C:\Program Files\Java\jre6. New releases would then be installed to C:\Program Files\Java\jre7 etc. This is good news as we should no longer have applications that expect a specific point release of the JRE.

Here’s what Sun has to say about the new update process:

For current users of Java SE, the JRE update mechanism has also been improved, using a patch-in-place mechanism that translates in a faster and more reliable update process (the patch in place mechanism will take effect for end users who upgrade from this update release or later to a new update release). As an added benefit, follow-on update releases will no longer be listed as separate items in the Windows “Add or Remove Programs” dialog.

Sounds good to me, so far so good. But there’s a new feature that’s got me asking Why?, it’s the Java Quick Starter service.

This is installed on Windows XP and even though there are indications that the service should not be installed on Windows Vista, it was during my testing. However, this is still beta code. This is Sun’s description of the Java Quick Starter service:

The Quick Starter feature will prefetch portions of the JRE into memory, substantially decreasing the average JRE cold start-up time (the time that it takes to launch a Java application for the first time after a fresh reboot of a PC).

Great, now we’re lumped with yet another application with a quick launch process. To me bundling a quick launch executable that continually runs in the background, is a sign that your application is bloated. If you believe the hype though, your applications run faster with Java. Faster than what? Certaintly not native applications.

Amazingly this service runs as Local System. That’s just asking for trouble, wouldn’t Local Service be a better option? If you want to continue running the Quick Starter service, keep an eye on any security bulletins for the JRE. Owning the service will give you full access to the users machine.

Silent Install

Scripting the installation of the runtime is very simple. It uses the same Windows Installer based setup as previous versions, so you can pass properties to it on the command line.

In testing the JAVAUPDATE property is actually ignored as it is with previous versions, so you will need to add some registry entries to disable the auto-update component. Additionally, I could find no property in the MSI that will prevent the installation of the Java Quick Starter services, it must be removed after installation.

This script will install the Sun JRE, remove the Java Quick Starter service and disable the automatic updater. You could improve on this script by creating your own transform file to set the custom properties and actions instead.

@ECHO OFF
ECHO Sun J2SE Runtime Environment 6 Update N..
START /WAIT jre-6u10-windows-i586-p-s.exe /passive /norestart ADDLOCAL=jrecore JAVAUPDATE=0 JU=0 AUTOUPDATECHECK=0 SYSTRAY=0 IEXPLORER=1 MOZILLA=1 REBOOT=ReallySuppress
"%ProgramFiles%\Java\jre6\bin\jqs.exe" -unregister
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v NotifyDownload /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v NotifyInstall /t REG_DWORD /d 0 /f

The information in this article is based on beta code. Hopefully it also applies to the final code when released but who can tell the future? If I could I certaintly wouldn’t be writing about Java.

New Java Runtime Coming. Set Phasers To Yawn is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Adobe have recently released an update for Adobe Reader and Acrobat 8, updating them to version 8.1.2, to address a serious vulnerability that is leading to infections of Trojan.Zonebac via malicious banner advertisements.

The Sunbelt Software blog has some more detail on the exploit here: If you have Adobe Acrobat 7 or 8, make sure it’s updated, and here: Adobe PDF exploit.

If you’re still using Adobe Reader 6 or 7, you should seriously consider updating now.

Update Adobe Reader Now, PDF Exploits In The Wild is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Looking to bypass the Windows Live Installer and want direct access to the Live suite application installers? Here’s where to find them. Credits go to the Vistax64 forums and Snakodus.

The new Windows Live Installer is a great way for every day users to gain access to each of the new Live applications, but what if you are looking to create a silent install script, deploy them to multiple computers or just don’t have Internet access at the time of install?

There are two ways to get access to the source MSI files for installing these applications. The first way is install the Live applications on a single computer, you can then find a copy of the installers locally:

• 32-bit Windows – C:\Program Files\Common Files\WindowsLiveInstaller\MsiSources
• 64-bit Windows – C:\Program Files (x86)\Common Files\WindowsLiveInstaller\MsiSources
  

Alternatively you can download the installers directly from the Live Suite SkyDrive folder:

In this folder you will find the following Live applications:

• Windows Live Sign-In Assistant 4.200.520.1: Install_{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}.msi
• Windows Live Messenger 8.5.1302.1018: Install_{508CE775-4BA4-4748-82DF-FE28DA9F03B0}.msi
• Windows Live Writer 12.0.1366.1026: Install_{9176251A-4CC1-4DDB-B343-B487195EB397}.msi
• Windows Live Mail 12.0.1606.1023: Install_{184E7118-0295-43C4-B72C-1D54AA75AAF7}.msi
• Windows Live Toolbar 03.01.0000.0146: Install_{D5A145FC-D00C-4F1A-9119-EB4D9D659750}.msi
• Windows Live Photo Gallery 12.0.1308.1023: Install_{257E440F-781F-459B-9A68-A0872B80C1D6}.msi 

Before you install Windows Live Photo Gallery you will need to install Microsoft SQL Server 2005 Compact Edition.

Bypass Windows Live Installer With Direct Install Downloads is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In This Series: Office 2007 Deployment

1. Office 2007 Deployment via Group Policy
2. Deploying Office 2007 with Group Policy Startup Scripts
3. Installing Office 2007 on Terminal Server
4. Set Default Formats for New Office Documents from Windows Explorer
5. Disable Office User Interface Elements

If you’re deploying Office 2007 and haven’t yet standardised on the new file formats, you’re probably already aware of how to set the default file formats via Group Policy, or using the Office Customization Tool to set the defaults before installing Office.

There’s another avenue to creating new Office documents that I hadn’t thought about until I was asked to change the defaults today – creating new documents directly from within Windows Explorer:

If a user creates a new Office document in this manner, it will be created in the new Office 2007 formats. I have no idea how many users actually use this feature but here’s how to change those defaults for Word, Excel and PowerPoint.

This is a machine level change and I recommend documenting your changes so that you can reverse them at some time in the future.

Microsoft Word Document

Word only requires a simple registry change. Delete the following string value

HKEY_CLASSES_ROOT\.docx\Word.Document.12\ShellNew\NullFile

Then create a new string (REG_SZ) value leaving the data blank.

HKEY_CLASSES_ROOT\.doc\Word.Document.8\ShellNew\NullFile

Microsoft Excel Worksheet

Excel is a little different in that it requires a template file to exist on the system from which the new document can be created. Windows stores these templates files in %SYSTEMROOT%\SHELLNEW (or C:\Windows\ShellNew). So you will need to create a blank Excel worksheet and save it as an Excel 97-2003 Workbook in C:\Windows\ShellNew. Then delete the following registry string value:

HKEY_CLASSES_ROOT\.xlsx\Excel.Sheet.12\ShellNew\FileName

And create a new string (REG_SZ) with data pointing to the new template filename; in this case I’ve used EXCEL.XLS.

HKEY_CLASSES_ROOT\.xls\Excel.Sheet.8\ShellNew\FileName

Microsoft PowerPoint Presentation

PowerPoint is the same as Excel, you’ll need to create a blank PowerPoint 97-2003 Presentation and save it to C:\Windows\ShellNew. Then delete the following string value:

HKEY_CLASSES_ROOT\.pptx\PowerPoint.Show.12\ShellNew\FileName

And create a new string (REG_SZ) value with data pointing to the new filename; in this case I’ve used POWERPNT.PPT

HKEY_CLASSES_ROOT\.ppt\PowerPoint.Show.8\ShellNew\FileName

If you made the changes correctly, you should see this reflected in the New menu from within Explorer:

Set Default Formats for New Office Documents from Windows Explorer is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Here’s a really simple method for using running the latest version of the Oracle JInitiator even though your application may require a specific version. DISCLAIMER: This is most likely unsupported by Oracle but it thus far it’s worked for me. If you’re worried about your applications breaking don’t implement this hack.

You can download the latest version of the JInitiator from the JInitiator Download Page. In this case I’ve used version 1.3.1.28 and modified the client to call this version when it actually required version 1.3.1.17.

Getting this to work requires adding the CLSID (or CLASSID) of the older version of JInitiator and modifying it to point to the installed version. You can find the CLSID of each JInitiator version on the download page. Here’s an example of a REG file with the required registry entries, pointing 1.3.1.17 to 1.3.1.28:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}]
@="JInitiator 1.3.1.17"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\Control]

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\InprocServer32]
@="C:\\Program Files\\Oracle\\JInitiator 1.3.1.28\\bin\\npjinit13128.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\MiscStatus\1]
@="2449"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\ProgID]
@="Oracle.JavaBeansBridge.1"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\Programmable]

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\Version]
@="1.1"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CAFECAFE-0013-0001-0017-ABCDEFABCDEF}\VersionIndependentProgID]
@="Oracle.JavaBeansBridge"

This shows the CLSID (the GUID between the {} brackets) for JInitiator 1.3.1.17 and as you can see, the default value for the InprocServer32 is where the “magic” happens.

Secondly you may also want to add another registry value that fools the JRE into seeing version 1.3.1.17 as well. This command will add the correct registry entry for you.

REG ADD HKLM\SOFTWARE\Oracle\JInitiator\1.3.1.17 /v JavaHome /d "C:\Program Files\Oracle\JInitiator 1.3.1.28" /t REG_SZ

You will then see each version listed in the JInitiator Control Panel applet:

This is pretty much the same approach you can use with the Sun JRE to fool applications into seeing older versions, allowing to install only the latest (and greatest?).

Running the latest Oracle JInitiator is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’ve just updated my Java Runtime Environment install script for Sun Java 6 Update 3. Apart from supporting the latest JRE update, this version of the script fixes some registry changes that I hadn’t got quite right previously. If you’ve not seen this script before here’s a breakdown of what it does:

• Installs only the core Java files
• Integrates with Internet Explorer and Mozilla browsers
• Disables the Java Updater from being installed
• Disables the system tray icon
• Deletes any Java Web Start icons that might be added to the the Start Menu or the Desktop

In addition to installing and configuring the JRE there are some example commands there for modifying the registry to provide Java support for applications that are expecting a specific version. For example you can run the Citrix Management Console, which expects version 1.5.0_09, on version 1.6.0_03. Running less Java can only be a good thing right?

Sun Java 6 Update 3 Deployment Script is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Well they came close, really close, but full marks goes to Axialis for first making the command line options for their installer and then making them nice and easy to see too. I got a nice surprise when installing the latest version of Axialis IconWorkshop, which has a link to the command line options right on the setup wizard. Now if only the setup programme was based on Windows Installer I’d be even more impressed.

Here’s a couple of screenshots of what you see during installation::

Hey Look! A Developer Who Gets It! is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Citrix provide a nice installer for the Access Management Console that you can automate to script the installation of the AMC. However, if you’ve ever needed to remove the AMC you’ll find that you need to remove each component one at a time. Because there are 9 components, this can become a little tedious.

So here’s a script that you can use to uninstall the current version of the AMC and its components in one step:

@ECHO OFF
REM Citrix Access Management Console - Hotfix Management
START /WAIT MSIEXEC /QB /UNINSTALL {40E9841C-CF57-4B88-8A06-F944D322E92E}
REM Citrix Access Management Console - Knowledge Base
START /WAIT MSIEXEC /QB /UNINSTALL {557E05DF-F2E6-410A-8C35-2E73552110C8}
REM Citrix Access Management Console - Legacy Tools
START /WAIT MSIEXEC /QB /UNINSTALL {760D0614-9608-4637-919B-3573FC0F0D87}
REM Citrix Access Management Console - Diagnostics
START /WAIT MSIEXEC /QB /UNINSTALL {9B5AEAE3-8CE1-4524-A7C4-1CFD2B98F1E9}
REM Citrix Presentation Server - Administration Snap-in
START /WAIT MSIEXEC /QB /UNINSTALL {BE4DE1B2-10F2-4DB2-A0C3-309FC61FDDA0}
REM Citrix Access Management Console - Web Interface
START /WAIT MSIEXEC /QB /UNINSTALL {D89D16D0-9626-4781-A517-1BE9EFD622F8}
REM Citrix Presentation Server - Presentation Server Reports
START /WAIT MSIEXEC /QB /UNINSTALL {2F97CB0C-7636-4289-B458-282DAC3F42BB}
REM Citrix Access Management Console - Report Center
START /WAIT MSIEXEC /QB /UNINSTALL {23207B10-4855-496B-A099-7B80C4AFD355}
REM Citrix Access Management Console - Framework
START /WAIT MSIEXEC /QB /UNINSTALL {5436F894-39CC-41D7-AEFC-AF5E2C7F0852}

One Click Citrix Access Management Console Uninstall is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

 If you’re looking at deploying the updated Access Management Console you might be interested in how to perform an unattended install. There are really two ways to do this:

1. Use Windows Installer (MSIEXEC) to run each of the installer packages
2. Run the CTXINSTALL setup application

Using the Windows Installer packages is fairly straight-forward, but you’l have to ensure you install the ASC_Framework.MSI package before installing any of the other packages.

The second and probably simplest method to perform an unattended install is to use the SILENT* switch on with the CTXINSTALL application:

START /WAIT CTXINSTALL.EXE /SILENT

*No thanks to Citrix for this. A /? argument on their installers would be really nice..

Unattended Citrix Access Management Console is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

For anyone deploying Adobe Reader, the direct download links for Adobe Reader are far more useful than the standard download that attempts sell you on how great Adobe Photoshop Album Starter Edition and the Google Toolbar are.

Ideally you should be obtaining a Distribution Agreement for Adobe Reader if you are looking to distribute the application over your network or other means such as CDROM. Once you do obtain the agreement, you are given a link to the direct download page where you can get the direct download for various versions of Adobe Reader in your language of choice.

Here what I’ve found so far – happy downloading

• Adobe Reader 8.1 US English
• Adobe Reader 8.1 Deutsch
• Adobe Reader 8.1 Français
• Adobe Reader 8.1 日本語

Update: Here’s a few more

• Adobe Reader 8.1 Italiano (Thanks Francesco)
• Adobe Reader 8.1 Español
• Adobe Reader 8.1 Danish
• Adobe Reader 8.1 Chinese Simplified
• Adobe Reader 8.1 Chinese Traditional
• Adobe Reader 8.1 Dutch
• Adobe Reader 8.1 Finnish
• Adobe Reader 8.1 한국어
• Adobe Reader 8.1 Norwegian
• Adobe Reader 8.1 Portuguese
• Adobe Reader 8.1 Swedish

Adobe Reader 8.1 Direct Download Links is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In This Series: Deploying Adobe Reader 8

1. Deploying Adobe Reader 8.x
2. Disable Adobe Updater with Adobe Customization Wizard 8
3. Uninstalling Adobe Reader

Note, this post is now out of date; for an Adobe Reader 9 version of this post, go here.

Deployment of Adobe Reader in an enterprise environment has been much simplified since version 6, however there is still some important preparation before you think about deploying version 8. Adobe have compiled information on enterprise deployment which are available on the following pages – I prefer the developer page over the page aimed at IT professionals because it has more information and is a little easier to read:

• Adobe Developer Centre: Enterprise deployment
• Acrobat Solutions for IT professionals: Deploy Adobe Acrobat and Reader

Obtaining the Installation Files

Adobe has details of extracting the installation files for enterprise deployment on their support site. Download the latest version of Adobe Reader, this is currently Adobe Reader 8.1.2. You can extract the installation files by running AdbeRdr812_en_US.EXE -nos_ne. You will find the installation files extracted to the following locations:

• On Windows Vista/Windows Server 2008 Setup extracts to: \Users\<username>\AppData\Local\Temp\Adobe Reader 8
• On Windows XP/Windows Server 2003 Setup extracts to: \Documents and Settings\<username>\Local Settings\Temp\Adobe Reader 8

Disabling Unwanted Features

Simplifying Adobe Reader in an enterprise environment is something that we’re all looking to do, including disabling the infamous Adobe Updater 5. Disabling features is best done by creating custom transform files. I have instructions on creating your own transform files using the Adobe Customisation Wizard, or you can use the transforms files listed here:First up I have a basic transform that sets the following options:

• Supresses the EULA
• Supresses any reboots after installation (I’ve had mixed results with this)
• Stops the Adobe Reader 8 icon from being added to the Desktop
• Removes the Help/Check for updates menu item and prevents the Updater from running automatically
• Removes the Help/Purchase Adobe Acrobat menu item
• Removes the Help/Digital Editions menu item
• Disables the Start Meeting feature
• Stops Beyond Reader from displaying at startup
• Disables the Adobe Online Services

Adobe Reader 8.1.x Basic transform file

The second transform provides the same settings as above in addition to completely preventing the installation of Adobe Updater:

Adobe Reader 8.1.x Advanced transform file

Terminal Servers and Browser Integration

When installing Adobe Reader on Terminal Servers, it might be advantageous to disable browser integration, i.e. opening PDF files from within the browser window. The reason for this is that the Reader executable (ACRORD32.EXE) does not exit until the browser is closed. This will cause Reader to continue to consume memory even though it is not in use.To disable browser integration set the DISABLE_BROWSER_INTEGRATION property to YES when installing Reader on Terminal Servers. You can do this by editing the transform or using DISABLE_BROWSER_INTEGRATION=YES on the command line. If the command line is not for you, I’ve created another transform which you can get here:

Hiding Menu Items

Thanks to David for the information, you can remove a few more of the menu items in Reader that you might not want hanging around, such as the Beyond Adobe Reader link. Why Adobe has resorted to using JavaScript files to modify the interface is just beyond me. On one hand we can restrict some of the interface via the registry (which even uses the HKLM\Software\Policies key) but on the other we need to resort to a method that must be managed on each individual machine. Sometimes developers just floor me with their stupidity.The first listing here is code you can use to find the name of the menu or toolbar button. The second listing shows you the code required to hide the items. Copy the code and save them to \Program Files\Adobe\Reader 8.0\Reader\Javascripts.

List menu items:

//ListItems.js
//Open Javascript Console
console.show();

//List Toolbar Buttons in the Console
var toolbarItems = app.listToolbarButtons()
for( var i in toolbarItems)
console.println(toolbarItems + "\n")

//List Menu Items in the Console
var menuItems = app.listMenuItems()
for( var i in menuItems)
console.println(menuItems + "\n")

Hide menu items:

//HideMenu.js

//Hides "File" on main toolbar
//app.hideMenuItem("File");

//Hides File - Open
app.hideMenuItem("Open");

//Hides File - Attach to email
app.hideMenuItem("AcroSendMail:SendMail");

//Hides Edit - Check Spelling
app.hideMenuItem("Spelling:Spelling");

//Hides Edit - Preferences
app.hideMenuItem("GeneralPrefs");

//Hides View - Menu Bar
app.hideMenuItem("ShowHideMenuBar");

//Hides View - Toolbars
app.hideMenuItem("Toolbars");

//Hides View - Navigation Panels
app.hideMenuItem("Navigation");

//Hides View - Automatically Scroll
app.hideMenuItem("AutoScroll");

//Hides View - Read Out Loud
app.hideMenuItem("ReadAloud");

//Hides "Document" on main toolbar
app.hideMenuItem("Document");

//Hides "Tools" on main toolbar
//app.hideMenuItem("Tools");

//Hides Tools - Object Data
app.hideMenuItem("DataToolsItem");

//Hides Tools - Customize Toolbars
app.hideMenuItem("CustomizeToolbars");

//Hides Help - Beyond Adobe Reader
app.hideMenuItem("GettingStarted");

//Hides Help - How to
app.hideMenuItem("HelpHowTo");

//Help - Online Support
app.hideMenuItem("OnlineSupport");

//Hides Help - Online Support - Knowledge Base
//app.hideMenuItem("KnowledgeBase");

//Hides Help - Online Support - Adobe Support Programs
//app.hideMenuItem("AdobeExpertSupport");

//Hides Help - Online Support - Accessibility Resource Center
//app.hideMenuItem("AccessOnline");

//Hides Help - Online Support - Generate System Report
//app.hideMenuItem("SystemInformation");

//Hides Help - Repair Adobe Reader Installation
app.hideMenuItem("DetectAndRepair");

//Hides Help - Purchase Adobe Acrobat
//app.hideMenuItem("BuyAcro");

//Hides View - Read Out Loud (Great for Terminal Server)
//app.hideMenuItem("ReadLoud");

Deployment Methods

Most medium to large enterprises will have some sort of application deployment tool already in place, therefore deployment for these organisations should be fairly straight-forward – extract the setup files, create a transform and deploy. Adobe has some fairly straight forward documentation on deploying Adobe Reader via different deployment tools:

• Group Policy and Active Directory; and
• Systems Management Server (now System Centre Configuration Manager).
• Apparently documentation for using IBM Tivoli Configuration Manager to deploy Reader/Acrobat is ‘coming in mid-2007′.

Any organisation utilising Group Policy for application deployment may find things a little more challenging. Check out my post on deploying applications with Group Policy for details on doing it the right way.You will also find information on deploying Reader on:

• Windows Terminal Server; and
• Citrix Presentation Server

Why two documents are required for Terminal Server and Presentation Server, I don’t know – deployment is exactly the same. If you are deploying via a script, I have details on scripting the installation of Adobe Reader 8.x – Unattended Install: Adobe Reader 8.x.

Deploying Adobe Reader 8.x is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In This Series: Office 2007 Deployment

1. Office 2007 Deployment via Group Policy
2. Deploying Office 2007 with Group Policy Startup Scripts
3. Installing Office 2007 on Terminal Server
4. Set Default Formats for New Office Documents from Windows Explorer
5. Disable Office User Interface Elements

When install Office 2007 on your Terminal Servers there are a few things you’ll need to be aware of. The first of which is that you will need an Enterprise or Volume License key, i.e. those keys that use Volume Activation 1.0 and do not require activation. There is also some configuration and installation options that I recommend you set before and after installation.

There are a number of options I recommend setting by using the Office Customisation Tool (SETUP.EXE /ADMIN). These first couple of options aren’t really Terminal Server specific and are worth setting for all Office deployments. You can enforce these via Group Policy, however if you configure them with a custom installation they will be the default settings:

• Disable the Customer Experience Improvement Program from running when users start an Office application: Modify user settings – Microsoft Office 2007 system / Privacy / Trust Center / Enable Customer Experience Improvement Program
• Disable Outlook from prompting users to archive their mailboxes: Modify user settings – Microsoft Office Outlook 2007 / Tools | Options.. / Other / AutoArchive / AutoArchive Settings

You’ll also want to take a look at the feature installation states – set each of these to either ON or OFF, don’t set any feature to Install on First Use. A subset of the options I disable when installing Office on a Terminal Server are:

• Office Shared Features / Proofing Tools / French Proofing Tools / English – French Translation
• Office Shared Features / Proofing Tools / Spanish Proofing Tools / Spanish – French Translation

The first two options should be disabled as a part of preventing CTFMON.EXE from running in each user session. You will also have to unregister MSCTF.DLL as a part of your installation of Office (REGSVR32 /S /U MSCTF.DLL)

One of the cool features of Office 2007 is one that users will appreciate and a tool that you will need to install after Office is installed Save As PDF or XPS. You can install this tool during a custom installation of Office using the Office Customisation Tool or via a script by running SaveAsPDFandXPS.exe /QUIET.

Finally you will have to delete identifying information recorded to the Terminal Server shadow registry key by Setup during installation. Because you now need to use SETUP.EXE to install Office, the Terminal Server will force Install mode before installation can continue. While Install mode is technically not required to install Office on Terminal Server, you will see the user information of the account used to install Office replicated to all users who then run an Office application if you don’t delete this key:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office

An install script for Office might look something like this:

@ECHO OFF
CHANGE USER /INSTALL
START /WAIT \\domain.local\dfs\applications\Office2007Enterprise\Setup.exe
CHANGE USER /EXECUTE
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Office" /f
REGSVR32 /U %SYSTEMROOT%\SYSTEM32\MSCTF.DLL /S

TechNet has more detail on Office 2007 on Terminal Server:

• Deploy the 2007 Office system on a Terminal Services-enabled computer
• Deploy the 2007 Office System with Terminal Services

Installing Office 2007 on Terminal Server is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In This Series: Office 2007 Deployment

1. Office 2007 Deployment via Group Policy
2. Deploying Office 2007 with Group Policy Startup Scripts
3. Installing Office 2007 on Terminal Server
4. Set Default Formats for New Office Documents from Windows Explorer
5. Disable Office User Interface Elements

In a previous post I discussed what you need to do to start deploying Office 2007. In that post I referenced a page that Microsoft linked to, but have not actually posted (Use Group Policy to Assign Startup Scripts for 2007 Office Deployment). So in this article I’ll go through a couple of ways you can use Group Policy startup scripts to deploy Office.

To get the most out of your Office 2007 deployment you will need to deploy using SETUP.EXE, not the MSI file. The reason for this is the changes Microsoft has made to Office 2007 setup there are no more transform files, instead customisation is achieved via Windows Installer patch files (.MSP). Using SETUP.EXE for deployment will automatically apply the patch file during installation.

When deploying applications via a startup script you will need to determine if the software is already installed before attempting to start the install, otherwise the installation will occur on every boot. There are a number of different ways of doing this; the first of which I had hoped would have been a WMI filter such as this:

SELECT * FROM Win32_Product WHERE (IdentifyingNumber <> "{90120000-0030-0000-0000-0000000FF1CE}")

or this:

SELECT * FROM Win32_Product WHERE (Caption <> "Microsoft Office Enterprise 2007")

The problem with either of these filters is that they will cause the GPO to apply whether Office is installed or not because they evaluate to TRUE. So unfortunately using a WMI Filter to control when Office is installed is out of the question.

A method that is similar to the WMI Filter, but uses a VBscript script to detect the presence of the installed Office applications, could work like this:

Set wshShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
Set colSoftware = objWMIService.ExecQuery ("Select * from Win32_Product")
For Each objSoftware in colSoftware
	If objSoftware.Caption = "Microsoft Office Enterprise 2007" Then
		OfficeInstalled = True
		Exit For
	End If
Next
If OfficeInstalled <> True Then
	Set oExec = wshShell.Exec ("\\company.local\Public\Applications\Office2007\SETUP.EXE")
	Do While oExec.Status = 0
		WScript.Sleep 100
	Loop
End If

This script will detect whether Office Enterprise 2007 is installed and if not start the installation. You could also implement some error checking around this to write an event to the Application log to record errors. One problem with using the Win32_Product WMI class to enumerate installed applications is that the process is slow enumeration takes about 20 seconds on my laptop (Intel Core Duo T2300, 1.6GHz).

The simplest way to detect if Office is installed before starting the setup program is to check if a file exists. One of the most common files will be WINWORD.EXE. So a script could look like this:

IF NOT EXIST "%ProgramFiles%\Microsoft Office\Office12\WINWORD.EXE" START /WAIT \\company.local\Public\Applications\Office2007\SETUP.EXE

Deploying Office 2007 via Group Policy will be challenging and may require you to perform more testing than with previous versions. For smaller organisations that have relied on Group Policy previously Office deployment can still be achieved, however perhaps it’s time to look into something a little more flexible. What I’ve seen of System Centre Essentials so far is pretty impressive and I think it’s just the tool for small organisations. Hopefully I’ve given you enough here to get your Office deployment started. I’d be interested in hearing how others are going with their own deployments.

Microsoft have recently blogged about Office 2007 deployment via Group Policy, which is worth checking out too.

Deploying Office 2007 with Group Policy Startup Scripts is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

In this article I’ve outlined what I recommend for best utilising Group Policy to deploy applications. Deploying applications via Group Policy is a fairly straight-forward process, if a little limiting, however if you don’t do it right you could be setting yourself up for some pain down the track.

Successfully deploying applications with Group Policy requires a solid base in Active Directory. There are a few things you’ll need to ensure are in place and working correctly before you start. These include:

• Active Directory;
• DNS; and
• Distributed File System (DFS).

Active Directory

Of course the first thing you are going to need is Active Directory and there are two components of Active Directory that should be configured before you start looking at Group Policy.

1. Sites and subnets. If you haven’t configured your sites and subnets you must look at these. I’ll discuss why in more detail when I get to DFS. You should create a site and corresponding subnets for each physical subnet or subnets that are well connected. Well connected can mean different things to different organisations, but a site should define those subnets where you can afford to distribute applications. If you can’t handle deploying traffic between specific subnets, divide them into separate sites. Also create sites for subnets even if you don’t have domain controllers at those sites.

2. Organisational Units. One of the differences between a good Group Policy implementation and a great one is organisational unit structure. Judicious use of organisational units will allow you to reduce the number of Group Policy objects or links you require.

I have three main rules that I apply to OU structure:

1. Justify the creation of each OU. You should have a good reason for creating organisational units.
2. Keep organisational units to no more than three levels deep.
3. Limit the use of block inheritance.

Organisational unit structure will differ for every organisation, however if you apply these guidelines to application deployment, here’s all that you need to create:

DNS

This one is pretty simple – without DNS you won’t have a functional Active Directory. You must have name resolution in place and working before your workstations can query DNS for the Group Policy objects that will be used to deploy your applications. To get a better understanding of Active Directory and DNS, I recommend you start here: How DNS Support for Active Directory Works

Distributed File System

Once you add an application for deployment to a Group Policy object, you have no way to change the path to that application (other than directly editing the GPO in the SYSVOL share, which I don’t recommend). This can be a problem if you want to move your application source files or have an unrecoverable issue with the server on which they are located. If you remove the application and add it again from a new path, the application will be redeployed (and in some cases be removed before redeployment).

How do we get around this? Distributed File System. DFS provides a path that will always be static while the real path points to an actual share on a server. This allows us to deploy applications from a DFS path and if we need to change real path we can do so without touching Group Policy or affecting the applications at all.

Another great thing about DFS is that you can take advantage of your AD sites – DFS is site aware. If you have a copy of your application share close to your workstations they will pull the installation from a local server rather than across a WAN link. For example, if we have a DFS path \\company.local\Public\Applications that points to \\SERVER1\Apps at site A and \\SERVER2\Apps at site B, workstations at site B will connect to \\SERVER2\Apps when Group Policy is applied to deploy applications.

A third advantage to using DFS is replication. With Windows 2000 and Windows Server 2003 you can use DFS to replicate your applications from a ‘master’ copy to your other sites, thus keeping them in sync. DFS Replication released as a feature of Windows Server 2003 R2 is a huge improvement over the older FRS based replication method and provides the ability to replicate only the changes within files, making replication more efficient.

Summary

In summary there are three points that you should keep in mind when using Group Policy to deploy applications:

• Get your Active Directory Sites into order to provide site awareness
• Make sure your Organisational Units will support your site structure
• Configure Distributed File System to provide a static path from which to deploy your applications.

Although Group Policy isn’t the answer for every organisation as it only provides the basics but if you do use it, you should spend the time planning a successful implementation.

Group Policy Application Deployment Done Right is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Here’s how to create an unattended installation of VMware Tools which I’ve aimed specifically at Terminal Servers, however you can apply the same concepts for any Windows server installed under any of the VMware virtualisation products.

Creating a Transform File

When installing a Terminal Server on VMware Server or ESX, you need to ensure you do not install the memory control driver. To do this we need to create a custom transform file. I found the easiest way to do this was with Wise InstallTailor, unfortunately this tool is no longer available for free, so here’s a copy of the transform that I’ve created, which prevents the Memory Control Driver, Shared Folders and Guest SDK features from installing:

Transform for VMware Tools for Terminal Servers

Enabling Hardware Acceleration

When you install VMware tools you are prompted to enable video hardware acceleration. Here’s an ingenious VBscript from appdeploy.com that will set hardware acceleration to Full, thus avoiding VMware tools prompting you to enable this feature.

Const HKEY_LOCAL_MACHINE = &H80000002
Dim RegValueData
Set objReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")

'Get Path to Acceleration.Level
objReg.GetStringValue HKEY_LOCAL_MACHINE,"HARDWARE\DEVICEMAP\VIDEO","\Device\Video0",RegValueData

'Set Acceleration.Level to Full
objReg.SetDWORDValue HKEY_LOCAL_MACHINE,RIGHT(RegValueData, 82),"Acceleration.Level",0 

Installing VMware Tools

Installing VMware tools is straightforward. The following commands will install VMware Tools using the custom transform file and then remove the VMware Tools icon from the system tray, something which I think is essential on a Terminal Server.

START /WAIT MSIEXEC /I "VMware Tools.msi" TRANSFORMS=VMwareTools-TerminalServer.MST ALLUSERS=TRUE REBOOT=SUPRESS /QB-
REG DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "VMware Tools" /f

Unattended VMware Tools is post from stealthpuppy.com. Except as noted otherwise, this work is ©2005-2010 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.