Multiple App-V packages are common

Microsoft recommends sequencing applications on the same operating system as the target clients are running. This means that if your target clients are running Windows XP and Windows 7, then you should create two App-V packages for each application – one for each operating system.

However, in practice it is often advisable to sequence on the lowest common denominator. In the example with Windows XP and Windows 7 clients, sequencing should be performed on Windows XP. In the event that a package does not then execute correctly on Windows 7, then the application should be re-sequenced on Windows 7.

The same applies to x86 and x64 processor architectures – if you are deliverying 32-bit applications to both x86 and x64 Windows, you should sequence in a 32-bit Windows environment. If you find that a 32-bit virtual application package executes OK on x86 Windows but not on x64 Windows, you will have to create two packages, one for each processor architecture.

There are several reasons for this, but they’re out of scope of a discussion on profile management; however what this highlights is that if you have multiple packages for the same application due to different operating systems and/or processor architectures, again the only way to improve the user experience is to rely on a third party profile management solution that works independently of the App-V package.

App-V and User Profiles

The default behaviour of App-V is to not only virtualize the application, but also the user profile locations for that application (HKEY_CURRENT_USER and %APPDATA%). This means that that profile information for the Microsoft Office packages will be stored, in its entirety, in the PKG.

The implication of this is that the settings for a virtualized Office package will be specific to that package – that is, a user’s Office settings will not only be specific to a version of Office but also specific to an individual Office package.

Consider the following scenarios:

• A user moves between desktops where Office Standard has been deployed to the first desktop, but Office Professional has been deployed to the second. These will be different App-V packages, so by default, no user preferences will be shared
• You create an Office package which has been released to production and later find issues with the package that requires re-creating it from scratch – user preferences from the old package will not be shared with the new package
• You find that you need to create multiple Office packages for different platforms – for example a package for desktops and a package for Remote Desktop Session Host servers. These are separate App-V packages and user preferences will not be consistent across those packages

Each scenario will result in separate App-V packages for the same applications.

If you need to upgrade a package or migrate between Office versions, you now have a further challenge that you would not have if Office were installed instead of virtualized.

By implementing a 3^rd party profile management solution, you gain the ability to manage user’s Office preferences independent of the Office version (App-V package version or Office version) and remove the reliance on a specific Office package. A profile management solution will allow you to create, update and re-create Office packages without affecting the end-user experience.

What solution should I use?

The user profile management or user state virtualization tools built into Windows aren’t able to see into the App-V virtual environment and therefore aren’t able to manage an application user preferences independent of the App-V package. If you would like to manage user preferences more granularly, a 3^rd party solution will be required.

A profile management solution that is capable of managing user preferences inside and across App-V packages will provide you with the flexibility and consistency of user experience required to support a core application like Microsoft Office. Without providing users with a consistent user experience or one that matches their existing Office deployments, user acceptance will be low.

For an objective comparison of the 3^rd party solutions available, see the following white paper: UEM Smackdown: Head-to-head analysis of Appsense, Citrix, Immidio, Liquidware Labs, Microsoft, Quest, RES, Scense, Tricerat and others

Delivering Office with App-V – The Need for Profile Management is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Here’s a look at my user profile where I’ve been running Office 2010, Office 2007 and Office 2003 and capturing the user preferences for those applications with a third-party management tool:

In this screenshot, the profile sizes for each versions of Office breaks down like this:

• Office 2010 – 7150Kb
• Office 2007 – 767Kb
• Office 2003 – 33Kb

And that’s compressed too. So in my profile, the user preferences for Office 2010 are 9 times larger than for Office 2007 and 216 times larger than the preferences for Office 2003!

If you’re in the process of or have upgraded to Office 2010, have you thought about the additional data that you’ll be managing (whether proactively or not)? If you’re stuck with “managing” user preferences with Roaming Profiles, you’re just masking this issue and will have no real insight into how much space this stuff is consuming.

What do you do about it? I think the only solution is to use a third party user environment management (or user virtualization, if you like) solution from one of the vendors covered in this white paper: User Environment Management Smackdown*. Go read it to find out what you can do with a solution that actually manages the user layer.

*OK, yes it’s a shameless plug – I helped write the paper.

Comparing User Profiles Sizes for Microsoft Office Suites is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

START /WAIT MSIEXEC /I OffVirt.msi PROPLUS=1 PROJECTPRO=1 VISIOPRO=1

However, by default OffVirt.msi runs silently and offers no errors, so to troubleshoot we need to log the install to a file (using the /l*v switch). In the log, you might find lines similar to the following:

CAInstallLicenses: OMSICA : Initializing CustomAction CAInstallLicenses
CAInstallLicenses: Populating the Token Store
CAInstallLicenses: Installing license: sl.RAC.GENERIC.PRIVATE
CAInstallLicenses: Error: Failed to open Token Store HResult: 0x80070424.

Toward the end of the log, the Windows Installer will report a return code of 1603:

CustomAction CAInstallLicenses returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)

Fortunately the fix is easy – ensure the correct OffVirt.msi for your target platform is used. Windows x86 requires the 32-bit version and Windows x64 requires the 64-bit version. Note that the version of OffVirt.msi that you use is for the target Windows platform, not the Office 2010 package you have sequenced.

Delivering Office with App-V – Error 0×80070424 installing the Office 2010 Deployment Kit is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Update 20 June 2011: updated for Reader 10.1. Release notes for 10.1 can be found here.

Adobe Reader X is here and with the new protected mode feature to improve security you should be considering your deployment plans now.

Note: These instructions are based on the US English version of Reader, so you may need to adjust some specifics to suit your environment and language.

Licensing Your Deployment

Although Adobe Reader is free you’ll need to agree to and obtain a license to distribute it in your own environment. Obtaining a license is simple, you’ll just need to answer a few questions such as the number of copies, how you will distribute Reader, which platforms and some information on your company including contact information. The same license can be used for distributing Flash player and Adobe AIR. To apply for the license go to the Adobe Runtimes / Reader Distribution License Agreement.

Obtaining the Adobe Customization Wizard

Unfortunately Adobe doesn’t use the same installer across all of their products – the installers for the Acrobat products are different to the Creative Suite products. For anyone who’s attempted deployment of the CS products would probably consider this a good thing.

To start customising Reader before deploying, you’ll need access to the Adobe Customization Wizard. The Customization Wizard X hasn’t changed much since the Customization Wizard 9, so if you have experience deploying Adobe Reader 8 or Reader 9, you’ll be comfortable customising and deploying the new version.

The Adobe Customization Wizard X should be available from here – Adobe Customization Wizard X. Otherwise you can use this direct download link: Adobe Customization Wizard X. An FTP site is also available – Adobe FTP site.

The Customization Wizard should be installed to an administrative workstation and it will allow you to create a custom Windows Installer transform that can configure the Reader installation, including settings to:

• Optimise the behaviour of the installer by including silent installation, multilingual, and custom setup choices
• Remove previous versions of Acrobat and Reader
• Suppress the EULA, registration prompts, and the Getting Started window
• Customise key application preferences — turn off automatic updates, add and set default job options, and customize collaboration and security settings
• Remove shortcuts from the desktop and the Start menu
• Edit each Adobe Acrobat application’s registry and installer tables
• Customize file attachment handling within PDF files, including specifying which file types you want to block
• Add or edit files that will be installed, including customized JavaScript or plug-ins
• Preconfigure and lock Enhanced Security settings

Downloading the Reader X MSI

When creating a custom installer for Reader, always start with the latest version which you may need to obtain from the Adobe Reader download page. For an installer that you can extract and doesn’t include Google Chrome or Toolbar download the EXE installer from Adobe’s FTP site: ftp://ftp.adobe.com/pub/adobe/reader/win/10.x/10.1.0

Note: if you need to download the latest installer, always grab a copy from the Adobe site to guarantee you have a source you can trust

Once you’ve downloaded the Reader installer, extract the setup files so that you can create a custom transform file. To extract, run the following command line:

AdbeRdr1010_en_US.exe.exe -nos_o"C:\Folder" -nos_ne

Replace C:\Folder with the path to a local folder. If you don’t specific the -nos_o switch, the files will be extracted here:

• %ProgramData%\Adobe\Setup (Windows Vista and above)
• %ALLUSERSPROFILE%\Application Data\Adobe\Setup (Windows XP / Windows Server 2003)

Once extracted, you should have the following files required for Reader deployment:

• ABCPY.INI
• AcroRead.msi
• Data1.cab
• setup.exe
• Setup.ini

Creating a custom Transform for Reader X

Here I’ll step through creating a custom installation for Reader, providing some recommended settings for your deployment and add links to further information that you may need to consider for your specific environment.

Step 1 Personalisation Options: Open the Customization Wizard, click File / Open Package… and browse to AcroRead.MSI located in the folder that contains the extract Reader setup files. You can change the installation path if required:

Step 2 Installation Options: there a few options to consider here:

• Default viewer for PDF files – if you are installing both Acrobat and Reader on the same machine, which application do you want to open PDF files by default.
• Enable Optimization – Windows Installer will defrag the installation post install, leave this option enabled. [Windows Installer property: ENABLE_OPTIMIZATION]
• Enable Caching of installer files on local hard drive – a copy of the Reader install files will be stored on the target machine ( in %ProgramFiles%\Adobe\Reader 10.0\Setup Files or %ProgramFiles(x86)%\Adobe\Reader 10.0\Setup Files). If you are deploying Reader with a deployment solution or virtualizing Reader, I recommend disabling this option. [Windows Installer property: ENABLE_CACHE_FILES]
• Run installation – run the installer Unattended by default unless your specific deployment requires the installer to run completely silently (you can control this on the command line as well).
• If reboot required at the end of installation – choose Suppress reboot and control reboots with an external process (such as a script or your deployment solution).

Step 3 Files and Folders: additional files (such as a JavaScript file to restrict menu items) can be added here:

Step 4 Registry: add additional Registry values here to control the Reader installation. You can browse the local computer’s Registry to make adding entries simpler.

There are two edits I recommend making – browse to Destination Computer / HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and modify these startup items, if they exist:

• Adobe ARM
• Adobe Reader Speed Launcher

Right-click each of these entries and choose Modify. Set Action to Remove value. This will prevent the installer from adding these entries and starting unnecessary processes at user logon. This step is very important for Terminal Server / Remote Desktop Session Host environments to reduce the processes that will run in each user’s session.

Step 5 Shortcuts: for whatever reason, Adobe deems in necessary to add a superfluous shortcut for Reader to the desktop. Don’t forget to remove that here – if you don’t remove the shortcut in the transform, it will be created when you patch Reader.

Step 6 Server Locations: the Server Locations settings allow you to configure additional server location paths to ensure source resiliency for the Windows Installer package.

Step 7 Security: further information on Adobe Reader and Acrobat security can be found here: Acrobat 9 Security Administration Guide. Options to consider include:

• Enhanced Security Settings: Standalone and Browser (choose Enable & Lock)
• Prevent end-user to add trusted Files and Folders
• Prevent end-user to add trusted Hosts

Step 8 Digital Signature: the Digital Signature settings allow you to specify the security options (verification, creation, reasons) for digital signatures. Read more about Digital Signatures in the security guide and this document: Digital Signature Validation Cheat Sheet

Step 9 EULA: here you can suppress the display of the End User License Agreement when the user first launches Reader. [Windows Installer property: EULA_ACCEPT]

Step 10 Online and Acrobat.com Features: access to several features can be controlled here:

• Disable all updates: this will prevent the Adobe Updater from running automatically (but won’t prevent it from installing). The Check for Updates menu option will also be removed.

Warning: It is extremely important to disable Adobe Updater on shared systems such as Terminal Server/Remote Desktop Servers – a standard user can initiate a reboot of a computer if Updater applies a Reader update. This is because the update is applied using Windows Installer which runs in the System context.

• Browser integration can be controlled here – you can force Reader to open PDFs outside of the browser rather than embedded in the browser window
• Various menu items and features (such as Purchase Adobe Acrobat, Digital Editions) can be disabled
• The Product Improvement Program can be disabled
• The Acrobat.com integration in Reader can be disabled

Step 11 Comments and Forms: control and set options for comments in PDFs and forms.

Step 12 File Attachments: control the launching of file types from PDF documents. You may want to set this option:

• Default Action for Unspecified File Types: Never launch files of Unspecified Types

Step 13 Launch Other Applications: the Launch Other Applications settings allow you to specify additional applications to be installed with Reader.

Step 14 Direct Editor: if you want to make further edits to the transform file you can do so here; however I often prefer to save the transform and open it with a 3rd party MSI editor.

To disable the Adobe Acrobat Update Service introduced with Reader 10.1, navigate to the ServiceInstall table and take one of two actions

• Drop the row ServiceInstall1 to prevent the install of the service
• Change the value of StartType to 3 (manual) or 4 (disabled)

Disabling Additional Menu Items

After creating a custom installation there are a few menu items (less than previous versions) that you may want to remove for end-users:

These menu items are:

• Help / Online Support… / Knowledge Base
• Help / Online Support… / Adobe Support Programs…
• Help / Online Support… / Adobe User Community…
• Help / Online Support… / Accessibility Resource Center…
• Help / Online Support… / Generate System Report…
• Help / Repair Adobe Reader Installation

Warning: It is extremely important to remove the Repair Adobe Reader Installation menu item on shared systems such as Terminal Server/Remote Desktop Servers – a standard user can initiate a reboot of a computer if the repair kicks in. This is because the repair is applied using Windows Installer which runs in the System context.

Just like previous versions, the only way to disable certain UI elements such as menu items and toolbars is to use JavaScript. This is a two step process – first we need to find out the name of the items we want to disable. To do that you will need to place some JavaScript in a file in the JavaScripts folder where Reader is installed. For example this on x64 Windows, place the file here: %ProgramFiles (x86)%\Adobe\Reader 10.0\Reader\Javascripts. Add the following code into the file and save it as ListItems.js

//ListItems.js
//Open Javascript Console
console.show();

//List Toolbar Buttons in the Console
var toolbarItems = app.listToolbarButtons()
for( var i in toolbarItems)
console.println(toolbarItems + "\n")

//List Menu Items in the Console
var menuItems = app.listMenuItems()
for( var i in menuItems)
console.println(menuItems + "\n")

When you start Reader a list of the user interface elements will be displayed:

The list is quite long, but you can use it to control the display of both menu items and buttons.

To hide the menu items listed above, save the following code in HideItems.js in the same JavaScripts folder. When Reader is run, the JavaScript will be executed and the items removed.

//HideMenu.js

// [Help - Repair Adobe Reader Installation]
app.hideMenuItem("DetectAndRepair");

// [Help - Online Support]
app.hideMenuItem("OnlineSupport");

// [Help - Online Support - Knowledge Base]
app.hideMenuItem("KnowledgeBase");

// [Help - Online Support - Adobe Support Programs]
app.hideMenuItem("AdobeExpertSupport");

// [Help - Online Support - Adobe User Community]
app.hideMenuItem("AdobeUserCommunity");

// [Help - Online Support - Accessibility Resource Center]
app.hideMenuItem("AccessOnline");

// [Help - Online Support - Generate System Report]
app.hideMenuItem("SystemInformation");

To deliver the script with the Reader package, use the Files and Folders section in the Customization Wizard. Add the files to Destination Computer / ProgramFilesFolder / Adobe / Reader 10.0 / Reader / JavaScripts (see Step 3 above).

Enforcing Protected Mode

Adobe Reader X Protected Mode will assist in reducing the potential security threats when opening or viewing PDF files, so it’s a feature you’ll want to ensure remains enabled on client computers. However, by default, users can turn this feature off – this option is available in the Preferences dialog box under General:

In the user’s context, Protected Mode is controlled with the following Registry value:

Fortunately, Protected Mode can also be enforced per-machine instead by setting this Registry value:

• Key: HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\10.0\FeatureLockDown
• Value: bProtectedMode
• Type: REG_DWORD
• Data: 1

With this set, users will be unable to disable Protected Mode. Use the Registry option in the Adobe Customization Wizard (covered in step 4 above) to set this value in your deployment package.

With the release of Reader 10.1, Protected Mode is now supported on Terminal Servers/Remote Desktop Servers.

Finding more Reader Preferences and Policies

To find the complete list of preferences for Reader and Acrobat you should refer to the Administrator’s Information Manager. This tool also contains the Reader and Acrobat Admin and Security guides.

The Administrator’s Information Manager (AIM) is an auto-updating and customizable AIR application containing the Preference Reference. AIM also includes and a growing list of other resources of interest to administrators in enterprise settings.

Additional Reading

• Enterprise administration | Acrobat family of products
• 5 Things to Think About Before Deploying Adobe Reader or Acrobat X
• Protected Mode Troubleshooting | Adobe Reader
• Adobe Reader Forums
• Adobe Acrobat and Reader Security
• Adobe Acrobat 9 Deployment on Microsoft Windows Group Policy and the Active Directory Service
• Acrobat 9 Deployment on Microsoft Systems Management Server
• Acrobat 9 Deployment on Microsoft Windows Terminal Services
• Acrobat 9 Deployment on Citrix Presentation Server

Deploying Adobe Reader X is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Today’s FAQ has been written by Justin Zarb, all around good guy and a Premier Field Engineer with Microsoft in the UK. You can read more App-V articles written by Justin at his blog:

This terminology is a little confusing. The “Active” was added in 4.x and referred to the fact that we could add and begin serving an updated version while the current version was still actively in use. The RTSP, HTTP, FILE (SMB) protocols all allow this functionality.

However with RTSP, an App-V Management Server or Streaming Server sits between the client and the content (the SFT file containing the application). Clients never need to be told that there is an update because the server is checking every launch and streams the updated SFT. The client requests a Package GUID not a specific file.

An RTSP streaming client will get an update the next time they launch the app – no refresh is required. There is an exception here – all instances of an application running on Terminal Servers or Remote Desktop Servers have be inactive (i.e. no one using it), then the next user to launch the application will trigger the update for everyone else.

The App-V Streaming Server does not even need the updated version to publish. Once the updated package is fully in the Content share and the Package Detection Interval (the configured amount of time that the Streaming Server detects changes in the Content share) kicks in, it is served on next launch.

HTTP/FILE streaming is a little different – there is no middleman so the client makes a direct request for the SFT file. If the HREF is http://websvr/content/Visio/Visio.sft, the client asks specifically for that path even if there happens to be Visio_2.sft (version 2 of the package) in the same directory. The publishing information must be updated on the client by some other means.

An admin would have added the updated SFT and OSDs to Content and on the next Desktop Refresh the updated OSD with HREF=http://websvr/content/Visio/Visio_2.sft would come down and on the next launch the updates will stream. Still an active upgrade, but only after a refresh. NOTE: Streaming is not tied to a publishing method, so a refresh can be:

• App-V Management Server over RTSP
• IIS with ASP over HTTP (rare as you must code your own provisioning logic)
• MSI with MODE=STREAMING via ESD
• SFTMIME commands via ESD

Resources

• App-V Application Publishing and Client Interaction
• Methods for Upgrading or Updating Virtualized Applications
• App-V: Sequencing and Deploying Using MSI and Active Upgrade, a video from BriForum 2009
• How to Configure the App-V System for Package Upgrade
• How Do I: Updating and Upgrading a Sequenced Application Using Microsoft App-V?
• TechNet Virtual Lab: Learning App-V Intermediate Skills
• How to Use the Differential SFT File

App-V FAQ: Can I use Active Upgrade without RTSP(S)? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The options chosen in the Sequencer will produce a URL to the SFT file (the file in the App-V packages that contains the application binaries), which will look something like this:

rtsps://%SFT_SOFTGRIDSERVER%:322/Adobe/Adobe_Reader_9/AdobeReader9x.sft

It is then reasonable to assume that the options chosen in the Sequencer will drive your deployment solution or that the deployment solution will dictate the URL listed in your package OSD files.

Fortunately, this isn’t the case. There are two methods that can be used to change the stream location for packages:

• The SFT_SOFTGRIDSERVER environment variable
• The ApplicationSourceRoot registry value (available in App-V 4.5 and above)

The default hostname added to an OSD file is %SFT_SOFTGRIDSERVER%, which should then be defined on the client computer for the App-V client to be able to stream packages from the correct source. This makes changing the source server simple when using the native App-V infrastructure (such as when moving packages between test and production environments); however this approach isn’t as flexible as changing ApplicationSourceRoot as it only changes the source server hostname and requires a reboot (or a restart of the App-V client) to take effect.

The ApplicationSourceRoot registry value can be modified during the client install or managed with Group Policy and it enables you to change the protocol, server hostname, port and the path from which packages are streamed.

If you want the client to obtain the package content (SFT file) from a local App-V Streaming Server or other alternate source such as a Web server or file server, instead of from the App-V Management Server, you can configure the ApplicationSourceRoot registry key value on the computer to point to the local content share on the other server. The OSD file still defines the original source path for the package content. However the client uses the value of the ApplicationSourceRoot setting in place of the server and share that are specified in the content path in the OSD file. This redirects the client to retrieve the content from the other server.

Changing this value takes effect immediately and in the registry it looks something like this:

This registry value (along with OSDSourceRoot and IconSourceRoot) is used by SCCM 2007 R2 to manage the App-V client and stream from distribution points or from the local SCCM client cache.

Guidelines for URLs in OSD files

So if what you choose to place in the OSD URL does not impact your deployment solution, does that mean you can choose to put anything in the URL? Like anything there are a set of guidelines that you should stick to, so that you get some consistency in your packages:

• Choose the protocol and port that will be used most commonly.
• Leave the hostname as  %SFT_SOFTGRIDSERVER%. Add this environment variable on the client if you won’t be using the ApplicationSourceRoot value. This will make packages more flexible if your server hostname changes
• Specify a path for each package that matches the folder name to which the package has been saved.

Conclusion

The method and processes you use for sequencing an application is not affected by the delivery method. There are some basic guidelines that you should follow when sequencing; however if they haven’t been followed you can still deliver those packages, you just may have some client configuration to take care of. Bottom-line: create a standard for your environment and stick to it.

Resources

• How to Configure the Client for Application Package Retrieval (read this one for information on ApplicationSourceRoot)
• How to Configure the App-V System for Package Upgrade
• About the Deployment Tab
• How to Change Deployment Properties
• The Top Three Rookie Mistakes – Part 3
• Error message when you start an application or update a Desktop Configuration Server in Microsoft SoftGrid: “The SoftGrid Client could not update desktop configuration information”

App-V FAQ: Does the delivery method change how applications are sequenced? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Native infrastructure – App-V includes server infrastructure that be used to stream packages to clients. A central management server is used to authorise applications and streaming servers can be used for branch offices. Replication (such as that provided by DFS-R) is required for keeping package sources in sync. This is the most dynamic method for delivering App-V packages but it doesn’t scale as well as other methods – the App-V Management Server database does not support replication.
• System Centre Configuration Manager 2007 R2 – SCCM has native support for App-V 4.5 and 4.6. It supports importing App-V packages and deploying them to client computers and can stream packages or deliver them completely.
• Stand-alone using Windows Installer deployment – The App-V Sequencer can create a Windows Installer (MSI) file when saving a package. The MSI file can be used with your existing software deployment tool (ESD) such as Group Policy or Altiris Client Management Suite. If the 3rd party ESD is aware of the package manifest file (an XML file produced by the sequencer) it can deploy App-V packages with a finer level of control. Using the MSI file, App-V packages are deployed to the machine rather than being able to target users.

The Microsoft infrastructure deployment solutions are outlined in this diagram:

• Stand-alone using the SFTMIME command (or the roll-your-own deployment tool) – The final method is not widely used; however I have designed an App-V deployment for a client who use an in-house developed software deployment solution. The product has been extended to use SFTMIME commands to add packages to client machines and control user access to virtual applications. Tim Mangan makes this type of solution freely available from his site with App-V_DeployNPublishApp.

Use the following links to read more on the infrastructure solutions. Be sure to start with the Infrastructure Planning and Design guide from Microsoft.

Resources

• Infrastructure Planning and Design downloadable documents and more on TechNet
• Application Virtualization Server-based scenario
• Electronic Software Distribution-based scenario
• Stand-Alone Delivery scenario
• Centralized Management & Scalable Infrastructure
• Microsoft Assessment and Planning Toolkit
• Microsoft Application Virtualization and Configuration Manager 2007 R2
• Virtual Application Management with Microsoft Application Virtualization 4.5 and System Center Configuration Manager 2007 R2
• Virtual Application Management with Microsoft Application Virtualization 4.6 and System Center Configuration Manager 2007 R2
• App-V 4.5 Server Sizing Guide
• How Microsoft Is Architecting the Virtual Application Infrastructure
• Choosing the right App-V delivery model
• Choosing the right App-V Delivery Model (App-v integration: possibilities and impossibilities)
• App-V 4.6 and ConfigMgr 2007 SP2: even better together
• AppV_DeployNPublishApp
• How to integrate App-V with SCCM without losing the features you care about

App-V FAQ: What are the deployment methods for App-V? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

“Does App-V replace Citrix XenApp?” or “Is App-V a Citrix killer?” I’m surprised that this one keeps coming up although I’ve been hearing it for years. People make assumptions about the ability to stream applications to end-points with App-V and confuse this with remote presentation of applications. See the comments on this post as an example. If you’ve come here seeking an answer to this question, then you should first read about what App-V is.

There’s a couple of points to consider when understanding where App-V fits within the application deployment puzzle:

• App-V doesn’t change where applications are executed – applications delivered by App-V still use local resources just like installed applications
• App-V requires far more bandwidth to deliver applications than Remote Desktop Services or Citrix XenApp because the complete application (and often a bit more) is delivered to the client

Here’s the good news though, you can combine both solutions – deliver via App-V to your RDS servers and then present the applications remotely using the ICA (XenApp) or RDP (RemoteApp) protocols. Because App-V runs on Windows and has no dependencies on the the desktop deployment solution itself it will work with other products such as VMware View, Quest vWorkspace, Citrix XenDesktop and even Microsoft MED-V.

Resources

• Using Application Virtualization (App-V) and Microsoft Enterprise Desktop Virtualization (MED-V) to Enhance Your Windows 7 Deployment
• Microsoft Application Virtualization for Remote Desktop Services 4.6
• Microsoft App-V and Hosted VM-Based VDI Desktops
• Go ahead use App-V, no really, please…
• How to publish an App-V-enabled application in Citrix XenApp
• The deep integration of vWorkspace and App-V (video)
• Recommended configuration settings for Application Virtualization 4.5 Terminal Server clients

App-V FAQ: Does App-V replace Citrix XenApp or Remote Desktop Services? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

No, unfortunately you cannot use App-V to virtualise Internet Explorer today. Other application virtualisation solutions such as VMware ThinApp, Symantec Workspace Virtualization, and InstallFree Bridge can virtualise Internet Explorer, so why can’t App-V?

There’s no technical reason why App-V can’t virtualise Internet Explorer; however at this time Microsoft’s stance on running multiple versions of Internet Explorer on a single operating system is preventing this from becoming a reality – Running Multiple Versions of Internet Explorer On Single Operating System is Unsupported.

Microsoft’s recommend solutions

Microsoft does offer several solutions for running older versions of Internet Explorer on current operating systems. These are outlined in the white paper Solutions for Virtualizing Internet Explorer and include:

• Terminal Services – using Terminal Services built into Windows Server 2003, Internet Explorer 6 or 7 can be delivered centrally. Citrix XenApp or Quest vWorkspace would required to deliver Internet Explorer as a seamless window. An overview video of this method is available on TechNet Edge.

• MED-V – Windows XP running in a virtual machine managed with MED-V can be used to deliver Internet Explorer locally. MED-V offers URL redirection so that you can control which sites are directed to the older versions of IE. MED-V is only available as a component of MDOP. An overview video of this method is available on TechNet Edge:

• Windows Virtual PC – teamed with Windows XP Mode, available to customers with Windows 7 Professional, Enterprise and Ultimate. Windows Virtual PC and Windows XP Mode are available to Windows customers at no additional cost, but may require a little more management overhead that the previous solutions.

A overview video of all of the Microsoft solutions is available here:

Microsoft does provide developers with tools for running the Internet Explorer 6 and 7 render engines on Windows 7 with Expression Web.  Although the full Expression Web is a paid product, a free version is available: Microsoft Expression Web SuperPreview for Windows Internet Explorer. If you are looking to provide developers a method of viewing sites in the older render engines, Expression Web is the recommend solution.

Other methods of delivering Internet Explorer

There are some other ways that you could consider for delivering older versions of Internet Explorer:

• RemoteApp – Internet Explorer can be published from Windows XP or Windows Vista using RemoteApp. The older operating systems could be running in a local or remote virtual machine.
• VMware Workstation – Unity mode can be used to provide a seamless Internet Explorer on the host operating system.
• Oracle VirtualBox – VirtualBox also offers a seamless window mode.

Conclusion

Microsoft would only extend the life of older versions of IE it they were to provide them as App-V packages. Microsoft wants to see the end of Internet Explorer 6 and apart from some hold outs (home users who don’t know any better and businesses who have web applications that rely on IE6 – they have had since October 2006 to start their migrations) most of us have moved on.

Although you cannot deliver older versions of Internet Explorer with App-V, Microsoft does offer alternate methods; however many of these do require additional infrastructure which may remove them from consideration. If you absolutely must be able to deliver Internet Explorer with App-V, have a chat with your Microsoft TAM. The more customers that do, the more likely that Microsoft may consider providing this functionality.

Resources

• Addressing Application Compatibility When Migrating to Internet Explorer 8 – Information for Corporate Developers

App-V FAQ: Can I virtualise Internet Explorer with App-V? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Note: while you can manage the App-V with Group Policy, I recommend that you first create a baseline configuration via a custom App-V Client installer, and then use Group Policy to either change or enforce your defaults. This will ensure that the client is configured correctly at install time without having to wait for Group Policy to apply.

Microsoft have made available an administrative template for use with App-V 4.5 and App-V 4.6, which you can find here: Microsoft Application Virtualization Administrative Template (ADM Template).

The Microsoft Application Virtualization ADM template configures client settings for the App-V Windows Desktop Client and for the Terminal Services (RDS) client. The ADM template centrally manages common client configurations by using an existing Group Policy infrastructure and includes settings for communication, client interface, and permissions.

• The ADM Template for App-V 4.5/4.6 provides central client settings administration for App-V 4.5/4.6 deployment, including the following:
• Client permissions
• Client interface behaviour
• Client communication settings

Unfortunately, the administrative template from Microsoft doesn’t include all of the registry options that you can configure in the App-V Client. Luckily, Login Consultants have written an administrative template that provides those missing values. You can download their administrative template from here.

Group Policy Preferences

While administrative templates are provided for the App-V Client, be aware that using Group Policy in this manner will tattoo the settings to the client – you won’t be able to automatically revert the settings back to their defaults. If you use Group Policy Preferences instead, you can create policy that will be more dynamic and can be removed easily if required.

Resources

• Microsoft Application Virtualization Administrative Template (ADM Template)
• Login Consultants App-V Administrative Template
• How to Configure App-V using Group Policy Objects

App-V FAQ: Can I configure the App-V Client via Group Policy? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Stand-alone mode in App-V is useful where you are deploying App-V applications via Group Policy or a 3rd party ESD (using the MSI file), or you have the App-V packages available on a file share and import them with the SFTMIME command.

There are a couple of properties that you’ll need to set to allow the App-V Client to run in stand-alone mode, which you can set at install time, or configure in the registry post-install:

Importing a Package in Stand-Alone mode

A common scenario for stand-alone mode is to test packages. To import a package in this mode, you can use the SFTMIME ADD PACKAGE command.

The simplest way to use this command is to copy your package to the local computer and using an elevated Command Prompt, change to the folder were the package is located. For example, I have a Mozilla Firefox package stored locally – I can use the following commands to import the package:

CD C:\Common\Packages\MozillaFirefox4_US

SFTMIME /ADD PACKAGE:"Mozilla Firefox 4" /MANIFEST MozillaFirefox4_US_manifest.xml /OVERRIDEURL MozillaFirefox4_US.sft /CONSOLE

Resources

There are plenty of resources on the Internet that discuss the configuration of the App-V Client in stand-alone mode:

• Stand-Alone Delivery Scenario for Application Virtualization Clients on TechNet
• Microsoft have a TechNet Virtual Lab: Learning to Configure App-V for Standalone Client Mode, this also has a companion PDF document
• Tim Mangan has written a white paper on configuration of the client and deployment of applications in a stand-alone environment
• Alex Verboon has an article on Configuring App-V Standalone Mode through Group Policy
• Finally, you can see the stand-alone mode App-V Client in action in this video by Ruben Spruijt:

App-V FAQ: How do I configure the App-V Client in stand-alone mode? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

TechNet has the documentation you need for creating a silent or unattended installation of the App-V client for deployment to existing workstations or during your base image build. Before embarking on customising the install, I usually recommend first understanding how to perform a manual installation of the App-V Client.

There are two ways to deploy the App-V Client – via SETUP.EXE, which will deploy dependencies too, or use the Windows Installer package and deploy the dependencies separately.

Whilst SETUP.EXE might be the easiest method, it won’t give most organisations the flexibility they would prefer when deploying software. In most cases organisations may customise the Windows Installer with a transform to set client properties and deploy the dependencies (MSXML, Application Error Reporting and Visual C++ Redistributables) which may also be required by other applications.

Quick Tip

When working with the App-V Client MSI installer, administrators most commonly come up against missing dependencies. This is usually due to the Application Error Reporting component which requires use of a specific GUID that must match the App-V Client. To test that the required dependencies are installed as the App-V Client setup expects, use SETUP.EXE to check the dependencies for you – just run SETUP.EXE manually and it will stop at the following dialog box that will list missing dependencies:

Resources

• How to Install the Client by Using the Command Line
• How to Install the App-V Client by Using Setup.exe
• How to Install the App-V Client by Using Setup.msi
• Application Virtualization Client Installer Command-Line Parameters
• How to Configure the App-V Client Registry Settings by Using the Command Line
• Setting App-V client permissions during install
• Group Policy Object (GPO) upgrade of SoftGrid may fail with Installer errors 1642, 1606 or 1603

App-V FAQ: How do I create a silent installation for the App-V Client? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The current versions of App-V have similar dependencies; however there are some differences with the newer 4.6 client. Of course the main dependency of the App-V Client is Windows itself.

App-V 4.5

The App-V 4.5 client supports the following 32-bit operating systems:

• Windows XP SP2+ – note that support for Windows XP Service Pack 2 has ended. Upgrade to Service Pack 3 now.
• Windows Vista RTM+ – note that support for Windows Vista RTM has ended. Upgrade to Service Pack 2 now.
• Windows 7 RTM+
• Windows Server 2003 SP1+
• Windows Server 2008 SP1+

The following dependencies are required

• MSXML 6.0 (included in Windows XP Service Pack 3 and all newer operating systems)
• Microsoft Application Error Reporting
• Microsoft Visual C++ 2005 Redistributable

If you are deploying any 64-bit operating systems which will include any Windows Server 2008 R2 Remote Desktop Services deployments, you will need to deploy the App-V Client 4.6.

App-V 4.6

The App-V 4.6 client supports the following 32-bit and 64-bit operating systems:

• Windows XP SP2+ – note that support for Windows XP Service Pack 2 has ended. Upgrade to Service Pack 3 now.
• Windows Vista RTM+ – note that support for Windows Vista RTM has ended. Upgrade to Service Pack 2 now.
• Windows 7 RTM+
• Windows Server 2003 SP1+
• Windows Server 2008 SP1+
• Windows Server 2008 R2 RTM+

The following dependencies are required

• MSXML 6.0 (included in Windows XP Service Pack 3 and all newer operating systems)
• Microsoft Application Error Reporting
• Microsoft Visual C++ 2005 Redistributable
• Microsoft Visual C++ 2008 Redistributable

All dependencies will be installed by SETUP.EXE; however for custom deployments of the operating system (using the Windows Installer file), the dependencies can be deployed separately.

App-V FAQ: What are the dependencies of the App-V Client? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Applications virtualised and delivered by App-V will work with application compatibility shims. You should consider application compatibility testing and remediation as a part of any operating system upgrade, because App-V is not a compatibility solution.

Microsoft’s Chris Jackson has written an excellent resource on TechNet that is essential reading if you want to understand App-V and compatibility shims: Making Applications Compatible with Windows 7 in a Virtualized Environment

Microsoft Application Virtualization is a powerful application management and deployment tool. When working it in to your plans for a Windows 7 migration, you can benefit from the potential for reduced cost during installation testing (though this cost is not promised to be zero).

You can also continue to leverage most of the same processes for resolving application compatibility issues using shims. If you’re deploying a single, organization-wide shim database, the transition will be very minimal—you need only be careful to avoid elevation shims (in much the same way you should avoid elevation in general in an App-V environment).

Resources

• Making Applications Compatible with Windows 7 in a Virtualized Environment
• Application Compatibility TechCentre on TechNet
• Application Compatibility Toolkit 5.6
• 3rd Party application compatibility solutions that work with App-V include: App-DNA AppTitude and ChangeBase AOK
• Top 5x5x5 Microsoft App-V Issues
• 5x5x5 App-V Application Compatibility Issues: Part 2
• App-V posts at the App-DNA blog
• App-V and Application Compatibility Shims
• TechNet Virtual Lab: Windows 7: Application Compatibility Toolkit 5.5 and Windows 7
• TechNet Virtual Lab: Windows 7: Mitigating Application Issues Using Shims

App-V FAQ: Can I use Application Compatibility Shims with App-V? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Operating system support for App-V is ultimately determined by the Microsoft Product Support Lifecycle. Note that the App-V 4.6 Client and Sequencer is required for 64-bit operating systems.

App-V Desktop Client

Full details for the client system requirements can be found on TechNet here:  Application Virtualization Client Hardware and Software Requirements. The App-V 4.5 and App-V 4.6 clients can be installed to the following operating systems ¹:

• Windows XP Professional Service Pack 2 and Service Pack 3
• Windows Vista RTM/SP1/SP2 Business, Enterprise and Ultimate
• Windows 7 Home Premium, Professional, Enterprise and Ultimate

Note, these are the operating system versions that Microsoft currently support, if you install the App-V client on other operating systems, Microsoft will not support the client on that OS.

App-V Remote Desktop Services Client

Full details for the client system requirements (including RDS) can be found on TechNet here:  Application Virtualization Client Hardware and Software Requirements. The App-V 4.5 and App-V 4.6 clients can be installed to the following operating systems ¹:

• Windows Server 2003 (Standard, Enterprise, Datacenter; SP1, SP2, R2, SP2+R2)
• Windows Server 2008 (Standard, Enterprise, Datacenter; SP1, SP2)
• Windows Server 2008 R2 (Standard, Enterprise, Datacenter)

App-V Management Server and Streaming  Server

The App-V Management Server and Streaming Server are 32-bit only but will install on 64-bit Windows. Full details for the server system requirements can be found on TechNet here: Application Virtualization System Requirements. The App-V 4.5 SP1 and SP2 server components can be installed on the following operating systems ¹:

• Windows Server 2003 (Standard, Enterprise, Datacenter; SP1, SP2, R2, SP2+R2)
• Windows Server 2008 (Standard, Enterprise, Datacenter; SP1, SP2)
• Windows Server 2008 R2 (Standard, Enterprise, Datacenter)

The App-V Management Console can be installed on all supported operating systems (included desktop OS’s).

SQL Server

The App-V Management Server relies on SQL Server to host the data store. The following versions of SQL Server are supported ¹:

• SQL Server 2000 (SP3a, SP4)
• SQL Server 2005 (SP1, SP2, SP3)
• SQL Server 2005 Express (all versions – non production only)
• SQL Server 2008 Express (all versions – non production only)
• SQL Server 2008 (SP0, SP1)

The Management Server should work with SQL Server 2008 R2; however I’m unaware if this is official policy.

App-V Sequencer

The App-V 4.6 Sequencer comes as 32-bit and 64-bit versions (the 4.5 Sequencer supports 32-bit only). Full details for the App-V Sequencer system requirements can be found on TechNet here: Application Virtualization Sequencer Hardware and Software Requirements. The App-V Sequencer is supported on the following operating systems ²:

• Windows XP Professional Service Pack 2 and Service Pack 3
• Windows Vista RTM/SP1/SP2 Business, Enterprise and Ultimate
• Windows 7 Home Premium, Professional, Enterprise and Ultimate
• Windows Server 2003 (Standard, Enterprise, Datacenter; SP1, SP2, R2, SP2+R2)
• Windows Server 2008 (Standard, Enterprise, Datacenter; SP1, SP2)
• Windows Server 2008 R2 (Standard, Enterprise, Datacenter – 4.6 only)

Note that the Sequencer is single threaded only – a fast CPU will help, but multiple CPUs will not.

Virtualisation

If you are considering running any of the App-V components on virtualised hardware, system requirements will remain the same. You can find support Microsoft’s support policies on virtualisation here:

• Microsoft server software and supported virtualization environments
• Support policy for Microsoft software running in non-Microsoft hardware virtualization software

• Resources

  • ¹ Upgrading to Microsoft Application Virtualization 4.6 Frequently Asked Questions
  • Application Virtualization Client Hardware and Software Requirements
  • Application Virtualization System Requirements
  • ² Application Virtualization Sequencer Hardware and Software Requirements

App-V FAQ: What are the system requirements for App-V? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Microsoft App-V for Desktops

If you are looking at App-V for your desktop machines, then you will need to license the Microsoft Desktop Optimisation Pack (MDOP), as App-V for Desktops only comes as a part of MDOP. The downloadable ISO for App-V for Desktops includes the App-V Client for Desktops, the App-V Sequencer and the App-V Management Server and the App-V Streaming Server.

MDOP includes the following components:

• Microsoft Application Virtualization (App-V)
• Microsoft Enterprise Desktop Virtualization (MED-V)
• Advanced Group Policy Management (AGPM)
• Microsoft Diagnostics and Recovery Toolset (DaRT)
• System Center Desktop Error Monitoring (DEM)
• Microsoft Asset Inventory Service (AIS)

MDOP is available to customers that have first purchased Software Assurance. MDOP is then an additional cost per seat. From the MDOP page on the Microsoft Volume Licensing site:

Available exclusively to Software Assurance customers as an add-on subscription, the Microsoft Desktop Optimization Pack (MDOP) employs six innovative technologies to improve desktop management, including application virtualization, asset management, and desktop diagnostic tools.

More information on Software Assurance is available at the Microsoft Software Assurance Frequently Asked Questions.

Microsoft App-V for Remote Desktop Services

A recent change to the RDS licensing now makes App-V for RDS available with the RDS Client Access License (CAL). The App-V for RDS license is now no longer available separately as purchasing an RDS CAL automatically gives you access to App-V for RDS. More more information and a list of frequently asked questions on RDS licensing visit this page: Remote Desktop Services Licensing.

The downloadable ISO for App-V for RDS includes the App-V Client for RDS, the App-V Sequencer and the App-V Management Server and the App-V Streaming Server.

TechNet and MSDN Subscribers

If you have a TechNet or MSDN subscription, App-V for Desktop and App-V for RDS is available as a part of your subscription. This allows you to test App-V on various platforms in your environment. Note that TechNet or MSDN subscriptions are for testing or evaluation purposes only and are not intended for running Microsoft products in production.

App-V Management Server and Streaming Server

No additional licensing requirements are required for the Management Server or the Streaming Server; however you will still need to meet separate licensing requirements for the platform on which the Management Server and the Streaming Server run on.

The Management Server will require Windows Server and SQL Server licenses. The Streaming Server requires only a Windows Server license as it does not connect to a data store.

Are any of the components available separately?

A question that has been asked previously in the TechNet forums is “is the App-V Sequencer available to license separately”. The answer to this is No. The client, sequencer or server components are only available as a part of the App-V for Desktops or App-V for RDS license.

Resources

• Licensing Microsoft Application Virtualization 4.5 (App-V) for Terminal Services
• Remote Desktop Services Licensing
• Microsoft Software Assurance Frequently Asked Questions

App-V FAQ: How is App-V licensed? is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Source: MsiInstaller

Event ID: 11708

Error detail: Product: Microsoft Application Error Reporting — Installation failed.

Additionally the following event may also be logged:

Source: MsiInstaller

Event ID: 1033

Event detail: Windows Installer installed the product. Product Name: Microsoft Application Error Reporting. Product Version: 12.0.6012.5000. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 1603.

This is caused by initiating the installation from non-elevated process (e.g. the Run dialog box) – if the installation starts and UAC subsequently prompts for elevation, the MSI will not install successfully.

If the installation is initiated from a process that has already been elevated (e.g. an Administrator Command Prompt) the installer will complete without errors.

Event ID 11708 logged when installing Application Error Reporting is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The Office 2010 planning, deployment and configuration documentation is far better than what was available for Office 2007 at launch, however it’s worth updating my Office 2007 deployment notes for the changes in Office 2007.

Here’s a walkthrough of the Office 2010 customisation process and some of the key considerations you should make when you’re ready to create your custom Office 2010 deployment.

Obtaining and running the Office Customization Tool

Starting with Office 2007, Microsoft included the tools necessary for customising the Office deployment directly within the installation source rather than having to download the tool separately. However this has changed slightly with Office 2010.

If you attempt to run the Office Customization Tool (OCT) from the Office 2010 media you have downloaded from TechNet, MSDN or the Volume License site, you may receive the following error:

Taking a look at the Office installation source, you’ll notice that the Admin folder is not included with any of the Office 2010 products, as it was with the 2007 versions:

Volume license editions of Office should include this folder; however to obtain the Admin folder and the files necessary to run the OCT, you will need to first download the Office 2010 Administrative Template files (ADM, ADMX/ADML) and Office Customization Tool (read more about this download here). Files for 32-bit and 64-bit versions of Office 2010 are available; so download the file to suit the version of Office you are deploying.

Extract the files by running AdminTemplates_32.exe or AdminTemplates_64.exe (or use the /extract:<folder path> /quiet switches), then copy the Admin folder to the Office 2010 installation source.

The Admin folder containing the OCT files is suitable for all of the Office 2010 products, for example you can copy the same folder to a Visio 2010 source folder to start creating a customisation file for that product.

Before Customising Office 2010

Before attempting to create an Office customisation for unattended deployment, it’s worth manually installing Office, understanding the components that are installed and seeing the first run experience on a clean machine (and with a clean user profile too).

On first run, Office will prompt users some choices that, in a corporate environment, should probably be made for them. These are Windows Update settings:

And the default file type choice – will you continue to use the Microsoft file types or go with the OpenDocument formats instead?

Both of these dialog boxes can be disabled by setting options in a customisation file.

Creating a custom installation

In this section, I’ve outlined the key steps for creating a customisation file, but you can read about customising your Office 2010 deployment in more detail on TechNet.

The process for creating a customisation file for Office 2010 is almost the same as for Office 2007 – start the Office Customisation Tool (SETUP /ADMIN) and create a new file or open an existing file for modifying.

Tip: to avoid the UAC prompt when running Setup, set the __COMPAT_LAYER environment variable to run Setup in the current context. Run SET __COMPAT_LAYER=RunAsInvoker before running Setup (both commands should be run from the same Command Prompt).

Just as you would be prompted once Office 2010 is installed, you will need to choose the default file types. Most organisations will probably choose to stick with the Microsoft Open XML formats. Making a choice here will modify the user settings that you will see in a later  step.

A install location for Office can be specified if you don’t want to accept the default. Change this location to a folder on the virtual drive, if you are virtualising Office 2010 with App-V.

Office 2010 enforces activation with Volume Activation 2.0 – the best strategy for activating Office 2010 is to use a KMS host, which will avoid deploying the product key in your deployment and manual activations. If you do not have access to a KMS key, a MAK key is required (without a key, Setup will fail).

Accept the license agreement and choose the type of user interface that setup will display during installation. SCCM and other ESD deployments should use no user interface.

The OCT allows you to choose default security settings for Office 2010. I won’t go into that here, instead read this article on TechNet: Configure security for Office 2010.

One of the most important (and time consuming) aspects of the the customisation file is modifying the default user settings. What you set here will depend on the environment you are deploying to, but it’s worth investing in some time to get these default settings correct.

By modifying these settings in the customisation file, users can get up and running with Office 2010 sooner; however treat these as default preferences. Group Policy should be used to enforce settings, not set defaults – the less settings you have in Group Policy the better (less time spent processing policies at logon).

The table below lists they most common settings to modify based on my experience deploying Office:

Like user settings, feature installation states will impact on the default Office experience, so you will need to know in advance which features you are deploying. Install on First Use for features is no longer available, so features will either be available or not once deployed, although you can change feature states after deployment.

Some features that may not be suitable for some corporate environments include:

• Office Shared Features - Business Connectivity Services
• Office Shared Features – Web Themes
• Office Tools – Hosted Webs

There are several other options available from within the OCT – you can deploy additional files and programs along side Office, automatically configure Outlook profiles when users first start Outlook and configure SharePoint Workspaces.

Once you have finished creating the customisation file, save it and now you’re ready to start the Office 2010 deployment process.

Note: a downloadable version of the Office 2010 deployment resources are available in this document – Deployment guide for Microsoft Office 2010. This is a 216 page document that covers every aspect of Office 2010 deployment

This book provides how-to information: the recommended steps to execute specific deployment tasks, such as customizing the installation and installing Microsoft Office 2010.

Customising Office 2010 before deployment is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

However, I generally recommend configuring as many settings as you can during install so that you don’t have to rely on external tools (e.g. Group Policy) that may not apply in a timely manner.

I have had to set permissions during install to make changes to the default permission set. Those permissions aren’t documented on TechNet, so I have listed them here. The following table lists the permissions that you can modify by passing parameters to Setup or via Windows Installer

See the Property table inside SETUP.MSI for the complete list of additional client settings that you can pass to the installer.

I have included here a complete sample script that deploys the App-V client, by first installing the dependencies and setting permissions (and other options) during install, using the MSI:

Microsoft App-V 4.6 client install script

Setting App-V client permissions during install is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I have used LANguard in the past for vulnerability testing and network discovery but frankly that’s kind of boring stuff. What is interesting in the latest version is the ability to deploy software.

LANguard 9 includes application deployment functions that make deploying software to remote machines quite simple.  I’m going to detail deploying Adobe Reader 9, using the deployment notes outlined in my Deploying Adobe Reader 9 post, then deploy the Reader 9.1.1 update, using that functionality.

I’m going to skip over most of the details of installing LANguard – it’s a simple process, you’ll just need to choose the type of datebase you

In my test environment I have configured three machines:

• a domain controller (DC), which will also host my install files (at \\dc\common)
• a machine running Windows Vista on which I have installed LANguard (LANGUARD)
• and a machine running Windows 7 (WIN7A) to which I will deploy Adobe Reader

To deploy software to a remote machine, I need to be able to authenticate to that machine. Because I am using a domain, authentication is made simple; however I could actually deploy software to workgroup machines if I know an admin username and password for that those machines.

The deployment feature of LANguard is geared around installing a single file with parameters; however it’s simple enough to deploy applications like Office or Reader by using a batch file:

Before I start deployment, I’ve configured a source location (\\dc\common\Adobe\Reader91) for Adobe Reader 9.1:

• I have extracted the Reader 9.1 install files from the setup file downloaded from Adobe;
• I have created a transform that will configure Reader as it is installed; and
• I have created a batch file (INSTALL.CMD) that contains the install commands for Adobe Reader

INSTALL.CMD looks like this:

@ECHO OFF
SET SOURCE=\\dc\Common\Adobe\Reader91
MSIEXEC /I %SOURCE%\AcroRead.msi TRANSFORMS=%SOURCE%\AdobeReader91Custom.mst ALLUSERS=TRUE REBOOT=SUPRESS /QB

The script will install Adobe Reader directly from the network, so the only file being copied to the remote machine is the script. Here’s what the install source for Adobe Reader looks like:

Deploying software is a three step process:

1. add the file to deploy to the remote machines (in this case the batch file which will do the work);
2. add the machines (by specifiying the hostname) to deploy the software to;
3. then deploy immediately or choose to install using a schedule:

So how is this actually working? The deployment feature on LANguard is not dissimilar to the Sysinternals tool PSEXEC, where a temporary service is installed on the remote machine to deliver the install commands. Essentially to deploy Adobe Reader 9, I am using LANguard to remotely execute INSTALL.CMD. I need admin rights on the target computers and LANguard does the rest. I even get to see the progress of the deployment:

I can also use the same process to update Reader 9.1 with the 9.11. update patch.

I have downloaded the Adobe Reader 9.1.1 Update (which comes as a Windows Installer Patch file – .MSP) and added it to the the same deployment location (\\dc\common\Adobe\Reader911Update). Again I have created a batch file that will install the 9.1.1 update from the same location:

@ECHO OFF
SET SOURCE=\\dc\common\Adobe\Reader911Update
MSIEXEC /P %SOURCE%\AdbeRdrUpd911_all_incr.msp ALLUSERS=TRUE REBOOT=SUPRESS /QB

By going through the same deployment configuration, but instead using the batch file that will install the update, I can deploy to the machines that have Reader 9.1.

I’ve tested deploying the update while Reader is open on the remote machine and the install was successful. Once I closed and reopened Reader, I could see the 9.1.1 version. This may not work for all applications – I don’t think that my example worked specifically because of LANguard, but you should at least have some success when updating in-use applications.

Deploy and update Adobe Reader with GFI LANguard is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Good news! Office 2010 fixes the Office 2007 issue, where-by you need to resort to implementing fixes yourself, to get Quick Access Toolbar and the new customisable Ribbon to roam between computers. You’ll have to remember to enable this option yourself though – create a Setup customisation with the Office Customization Tool and enable the following option:

Features – Modify user settings – Microsoft Office 2010 System – Global Options – Customize – Allow roaming of all user customisations

Nice and simple with no need for additional work in your user environment management tool of choice to roam those settings – happy users.

If you have already deployed Office 2010 and need to change this setting, there are a couple of ways that this can be done:

1. Change the Registry value that controls customisations roaming. To do that, set the following value:

Key: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Toolbars
Value: CustomUIRoaming
Type: DWORD
Data: 1

2. Add the policy to a GPO controlling your Office 2010 settings. Do do that enable the following policy item:

User Configuration / Policies / Administrative Templates / Microsoft Office 2010 / Global Options / Customize / Allow roaming of all user customizations

Note – Microsoft does provide a fix for Office 2007 (a hotfix and a registry change) which you can implement to make Office store Quick Access Toolbar files in the roaming portion of the profile: Quick Access Toolbar files for 2007 Office applications do not roam with your profile.

Roaming User Customisations in Office 2010 is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

This particular version doesn’t actually work at all, i.e. no sound plays. In addition, media applications, such as Adobe Flash, Windows Media Player and Spotify, and any system components that uses audio locks up when attempting to play sound. These drivers are listed on the Dell support site for the following systems:

• Latitude E4200
• Latitude E4300
• Latitude E5400
• Latitude E5500
• Latitude E6400
• Latitude E6400 ATG
• Latitude E6400 XFR
• Latitude E6500
• Latitude XT2
• Dell Precision Mobile WorkStation M2400
• Dell Precision Mobile WorkStation M4400
• Dell Precision Mobile WorkStation M6400

I’ve tested these on a 32-bit install of Windows 7 on two machines – a Latitude XT2 and a Latitude E4200, with the same result. Fortunately though, the drivers are not required for playing sound – Windows 7 will find the audio hardware out of the box.

If you have the same issue, open Device Manager and uninstall the device labelled IDT High Definition Audio CODEC, be sure to also tick the option Delete the driver software for this device to remove the driver completely. Here’s what you’ll see in Device Manager:

Now here’s the weird part, these audio drivers also prevent the Hyper-V virtual machine remote console client (VMCONNECT.EXE) from connecting to a VM. You’ll see the client window open but no remote console will be displayed. Odd stuff.

Dell owners – avoid the IDT 92HDxxx HD Audio driver is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

I’m picking on IRM in this post about disabling UI elements, but you can disable all of the IRM features in Office by enabling a single policy: User Configuration / Policies / Administrative Templates / Microsoft Office 2007 system / Manage Restricted Permissions / Disable Information Rights Management User Interface

If you haven’t yet, or are not ever, planning to roll out Active Directory Rights Management Services you’ll want to remove these features from Office which would lead users to dialog boxes such as this one (not particularly ideal):

To disable menu items in Office you’ll first need to know the control ID’s of those items. This means you’ll need to wade through the 23 spreadsheets including in the 2007 Office System Document: Lists of Control IDs to find the ID listed amongst thousands. Fortunately most of the IDs are the same across each of the Office applications.

So to hide the IRM features in Office 2007 Professional Plus, Enterprise and Ultimate, I need to add the following IDs to Group Policy:

These are the policy settings you’ll need to enable and add the IDs to:

• User Configuration / Policies / Administrative Templates / Microsoft Office Excel 2007 / Disable Items in User Interface / Custom / Disable commands
• User Configuration / Policies / Administrative Templates / Microsoft Office Outlook 2007 / Disable Items in User Interface / Custom / Disable command bar and menu items
• User Configuration / Policies / Administrative Templates / Microsoft Office PowerPoint 2007 / Disable Items in User Interface / Custom / Disable commands
• User Configuration / Policies / Administrative Templates / Microsoft Office Word 2007 / Disable Items in User Interface / Custom / Disable commands

Which then results in something like this:

Disable Office User Interface Elements is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

Good news is that this allows you to disable the Adobe Product Improvement Program window that some people have been having trouble disabling. I’m now in the process of updating my post on deploying Adobe Reader 9.

Adobe Customisation Wizard 9 Available is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

• Create a user account, configure the profile, then copy over the top of the local default profile or save a copy to your NETLOGON share;
• Use the [GuiRunOnce] section in an unattended answer file for Windows XP/2003.

The first option carries over to Windows Vista and Windows Server 2008 however the second option is not available in quite the same way. Windows Vista’s setup is a very different beast and customising the default profile with scripts requires using the auditUser pass and setting the CopyProfile value.

There’s some great detail about using this process to modify the default user profile at FireGeier’s Unattended Vista Guide plus there’s a post at MSFN.org that my help you understand the process too. However, I think there’s a simpler way. It’s perhaps not a flexible as deploying via the UNATTEND.XML file but it doesn’t require running SYSPREP to get the job done.

You can edit the default profile by directly modifying the Windows Vista or Windows Server 2008 image. This involves mounting the image and making your changes:

• Mount the image in read/write mode;
• Load the \Users\Default\NTUSER.DAT hive into the Registry. It’s worth looking around at this registry hive to see the differences between it and the user hive once a user has logged in;
• Add the required modifications and unload the hive;
• Commit changes to the Windows image.

Be sure to set the CopyProfile value to False in the UNATTEND.XML, otherwise these changes will be overwritten. Here’s a script that performs those steps for me:

@ECHO OFF
REM -----------------------------------------------------------------------------
REM  Script configures the Default User Profile in a Windows Vista/2008 image
REM -----------------------------------------------------------------------------

REM Mount the Windows image
IMAGEX /MOUNTRW "D:\install.wim" 1 D:\mount

REM Load the default profile hive
REG LOAD HKU\Default D:\mount\Users\Default\NTUSER.DAT

REM Configure the default user profile
REG ADD "HKU\Default\Control Panel\Sound" /v Beep /t REG_SZ /d NO /f
REG ADD "HKU\Default\Control Panel\Sound" /v ExtendedSounds /t REG_SZ /d NO /f
REG ADD "HKU\Default\Control Panel\Desktop" /v HungAppTimeout /t REG_SZ /d 5000 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v AutoEndTasks /t REG_SZ /d 1 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v WaitToKillAppTimeout /t REG_SZ /d 4000 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v FontSmoothing /t REG_SZ /d 2 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v FontSmoothingType /t REG_DWORD /d 2 /f
REG ADD "HKU\Default\Control Panel\Desktop" /v WallPaper /t REG_SZ /d "" /f
REG ADD "HKU\Default\Control Panel\Colors" /v Background /t REG_SZ /d "10 59 118" /f
REG ADD "HKU\Default\Console" /v QuickEdit /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Command Processor" /v CompletionChar /t REG_DWORD /d 9 /f
REG ADD "HKU\Default\Software\Microsoft\Command Processor" /v PathCompletionChar /t REG_DWORD /d 9 /f
REG ADD "HKU\Default\Software\Microsoft\CTF\LangBar" /v ShowStatus /t REG_DWORD /d 3 /f
REG ADD "HKU\Default\Software\Microsoft\CTF\LangBar" /v Label /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\CTF\LangBar" /v ExtraIconsOnMinimized /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v SeparateProcess /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowControlPanel /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_EnableDragDrop /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuFavorites /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuLogoff /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuScrollPrograms /t REG_SZ /d "YES" /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v IntelliMenus /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowHelp /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyComputer /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyDocs /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyMusic /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowMyPics /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowNetPlaces /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowPrinters /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowSetProgramAccessAndDefaults /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_ShowRecentDocs /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_AutoCascade /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_NotifyNewApps /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_AdminToolsRoot /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v StartMenuAdminTools /t REG_SZ /d "NO" /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Start_SortByName /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete" /v "Append Completion" /t REG_SZ /d YES /f
REG ADD "HKU\Default\Software\Microsoft\Internet Explorer\TabbedBrowsing" /v PopupsUseNewWindow /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Internet Explorer\PhishingFilter" /v Enabled /t REG_DWORD /d 1 /f
REG ADD "HKU\Default\Software\Microsoft\Internet Explorer\Main" /v "Enable AutoImageResize" /t REG_SZ /d YES /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{59031a47-3f72-44a7-89c5-5595fe6b30ee}" /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{20D04FE0-3AEA-1069-A2D8-08002B30309D}" /t REG_DWORD /d 0 /f
REG ADD "HKU\Default\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /ve /t REG_EXPAND_SZ /d "" /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Setup\UserOptions" /v DesktopShortcut /d No /t REG_SZ /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Setup\UserOptions" /v QuickLaunchShortcut /d /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v AcceptedPrivacyStatement /d 1 /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v FirstRun /d 0 /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v DisableMRU /d 1 /t REG_DWORD /f
REG ADD "HKU\Default\Software\Microsoft\MediaPlayer\Preferences" /v AutoCopyCD /d 0 /t REG_DWORD /f
REG DELETE "HKU\Default\Software\Microsoft\Windows\CurrentVersion\Run" /v Sidebar /f

REM Unload the default profile hive
REG UNLOAD HKU\Default

REM Unmount the Windows image and commit changes
IMAGEX /UNMOUNT /COMMIT D:\mount

As you can see I’m adding registry entries that will configure the user environment which does mean that there’s a bit of work required to find them in the first place, but it does allow me to document every change to the profile, so I think the effort is worth it.

Extending this process, there are a few other things we can change in the Windows image that will impact the default environment:

• Modify the default theme file in \Windows\Resources\Themes\aero.theme. I’ve used this file to do things such as remove the default wallpaper. Theme files are just text files so they’re easy to maintain;
• Configure Internet Explorer defaults by using INSTALL.INS created with the Internet Explorer Administration Kit. This is useful for preventing IE from adding the default favourites or RSS feeds at first launch. Place a copy of INSTALL.INS in \Program Files\Internet Explorer\SIGNUP and \Program Files\Internet Explorer\CUSTOM.

Then there are a couple of additional tools that I’ve used to make changes to the default user environment once Windows has been installed and added to the domain:

• Group Policy. Some settings such as preventing Windows Media Player from displaying the first run dialog are useful;
• Group Policy Preferences. GPP allows you to set registry values as a preference, i.e. apply once only.

By modifying the Windows image directly, your custom default profile will be available on machines whether you use an unattended or manual deployment.

Here’s a few more articles worth reading:

• Configuring default settings for Windows image deployment
• Support guidelines for migrating roaming user profiles data to Windows Vista or to Windows Server 2008
• Managing Roaming User Data Deployment Guide

Customise the Windows Vista Default User Profile is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

First Impressions

As usual consumers will have the Google toolbar pushed on them if they don’t de-select that option when downloading Reader, and now you’ll also get Adobe AIR along with Reader too. Awesome, more stuff we don’t really need. A default install leaves two icons on the desktop now – Adobe Reader 9 plus one for Acrobat.com.

The good news though, is Reader 9.x is fast. I hadn’t ever found Reader 8 to be slow, but version 9 certainty runs noticeably faster than previous versions.

Downloading Adobe Reader

Adobe Reader 9.1 is available for download for many languages, including:

• Adobe Reader 9.1 English US/UK
• Adobe Reader 9.1 Français
• Adobe Reader 9.1 Deutsch
• Adobe Reader 9.1 Nederlands
• Adobe Reader 9.1 Italiano
• Adobe Reader 9.1 Español
• Adobe Reader 9.1 日本語

Adobe AIR is only bundled with the English and German versions of Reader 9 so far.

What To Do About Adobe Updater

Reader 9 continues to include the Adobe Updater application which has been updated to version 6. While I haven’t seen it misbehave for some time and it no longer drops an Updater folder in your Documents folder, you might still want to disable it.

There are a few ways to do this. You can disable Updater by running it (click Help / Check for Updates) then click the Preferences link. You will then see the Preferences dialog like this, where you can choose to disable Updater:

To problem with this approach is that you need Internet access just to get to the preferences dialog. A bit of a problem if you’ve got Internet access issues. To disable Updater from running automatically you can run the following command line as an administrator (or an elevated command prompt in Windows Vista):

REG ADD "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown" /v bUpdater /d 0 /t REG_DWORD /f

Alternatively, to completely remove Adobe Updater, after installation, delete this folder:

• C:\Program Files\Common Files\Adobe\Updater6 (32-bit Windows)
• C:\Program Files (x86)\Common Files\Adobe\Updater6 (64-bit Windows)

If Adobe Reader is running as a standard (or limited) user account, Adobe Updater won’t run at all, so it shouldn’t be an issue if you don’t give users administrative access to their workstations.

If you are virtualising Adobe Reader, then disabling or removing Updater is a must.

Extracting Reader Setup Files

Before deploying Reader 9, you will want to extract the files from the file you’ve downloaded, so that you can create a custom tranform file. To extract the file, run the following command line:

AdbeRdr910_en_US_Std.exe -nos_ne

You will then find the extracted file in these locations:

• %LOCALAPPDATA%\Adobe\Reader 9.1\Setup Files (on Windows Vista/2008)
• %USERPROFILE%\Local Settings\Application Data\Adobe\Reader 9.1\Setup Files (on Windows XP/2003)

Once extracted, you will have the setup files for both Reader and AIR. The setup files for Reader are in a sub-folder called ‘Reader9’.

Creating a Custom Transform File

When deploying Reader there are some customisations that I recommend making to the installation, including:

• Prevent the installation of Adobe Updater 6 (If you want control over the version of Reader)
• Prevent the Adobe Acrobat SpeedLauncher from being added to the Run key in the registry
• Prevent the ‘Adobe Reader 9’ shortcut from being added to the desktop (Keep the desktop and tidy)
• Prevent the installation of the Adobe Syncronizer [See this comment before removing Syncronizer]
• Accept the EULA

Adobe usually provide a customisation tool for automating the installation of Reader, however the Customisation Wizard for Reader and Acrobat 8 wasn’t released until 6 months after the products themselves were released. To customise the installation I’ve used the excellent InstEd instead.

Here’s what I’ve configured as a minimum in my transform:

Prevent Adobe Updater Installation

• In the Component table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
• In the Feature table, drop any row containing ‘AUM’ or ‘Updater’
• In the FeatureComponents table, drop any row containing ‘AUM’ or ‘Updater’
• In the File table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
• In the ModuleComponents table, drop any row containing ‘AdobeUpdater’ or ‘Adobe_Updater’
• In the MsiFileHash table, drop any row containing ‘AdobeUpdater’
• In the Registry table, drop any row containing ‘Adobe_Updater’

Prevent Adobe Acrobat SpeedLauncher At Startup

• In the Registry table, drop the row containing ‘Registry838’

Prevent the Adobe Reader 9 Desktop Shortcut

• In the Shortcut table, drop the row containing ‘SC_READER_DT’

Prevent Adobe Syncronizer Installation

• In the Property table, set the value for SYNCHRONIZER to YES

Accept the EULA

• In the Property table, set the value for EULA_ACCEPT to YES

Also in the Property table, you could set the value of DISABLE_BROWSER_INTEGRATION to YES, to prevent Reader from opening within the browser. This would be beneficial in Terminal Server environments. When a PDF file is opened within the browser and the user then browses to a different page, the Reader components are stay in memory until the browser is closed.

You can download a transform with all of the modifications listed above here (except disabling Syncronizer; use at your own risk):

Adobe Reader 9.1 Custom Transform

Creating a Custom Transform with Adobe Customisation Wizard 9

Adobe have recently released the Adobe Customisation Wizard 9 which is the best place to start when creating a custom transform for Acrobat or Reader 9. Here are the settings I would recommend you configure when creating a transform:

Under Installation Options set:

• Run Installation to Unattended
• If reboot required at the end of installation to Suppress reboot

Under Files and Folders:

• Add HideMenuItems.js, listed below, to ProgramFilesFolder / Adobe / Reader 9.0 / Reader / JavaScripts

Under Shortcuts:

• Remove the Adobe Reader 9 shortcut added to the Desktop

Under EULA and Document Status set

• Suppress display of End User License Agreement to enabled

Under Online and Acrobat.com Features set

• Disable all updates to enabled to disable Adobe Updater
• When launching PDF in Internet Explorer, prompt user with Open/Save dialog to enabled for Terminal Server environments
• In Adobe Reader, disable Help > Purchase Adobe Acrobat to enabled
• Disable Help > Digital Editions to enabled
• Disable Product Improvement Program to enabled
• Disable Viewing of PDF with Ads for Adobe PDF to enabled
• Display PDF in browser to Disable & Lock for Terminal Server environments
• Disable all Acrobat.Com access, including initiation and participation to enabled

After you created the transform for Reader 9 with the wizard, you may want to open it in your favourite MSI editor to perform further customisations such as disabling SpeedLauncher.

Disabling Menus and Buttons

In a corporate environment, you may want to disable some of the menu items and buttons. Just as in Adobe Reader 8, most of these items are disabled with a JavaScript file. Yes a JavaScript file. Whilst using the registry would make sense to control UI items, Adobe uses JavaScript files. I’d love to know the reason why. It’s not a solution that scales particularly well.

To disable UI elements, you will first need to list all of the elements by name. To do this, save the following script as ListItems.js in %ProgramFiles%\Adobe\Reader 9.0\Reader\JavaScript:

//ListItems.js
//Open Javascript Console
console.show();

//List Toolbar Buttons in the Console
var toolbarItems = app.listToolbarButtons()
for( var i in toolbarItems)
console.println(toolbarItems + "\n")

//List Menu Items in the Console
var menuItems = app.listMenuItems()
for( var i in menuItems)
console.println(menuItems + "\n")

This will open a dialog box when Reader is started, listing the names of each menu item and toolbar button. You can then create a JavaScript file to remove these items from the UI. Reader 9 includes a number of menu items you might want to remove:

Here’s the code you’ll need to hide those items. Copy and paste into HideItems.js, then copy into %ProgramFiles%\Adobe\Reader 9.0\Reader\JavaScripts.

//HideMenu.js

// [File - Create Adobe PDF Using Acrobat.com], plus toolbar button
app.hideMenuItem("WebServices:CreatePDF");
app.hideToolbarButton("Weblink:CreatePDF");

// [File - Collaborate], plus toolbar button
app.hideMenuItem("Annots:FileCollaboration");
app.hideToolbarButton("Annots:CollabToolButton");

// [File - Digital Editions]
app.hideMenuItem("eBook:Digital Edition Services");

// [Help - Improvement Program Options]
app.hideMenuItem("UsageMeasurement");

// [Help - Online Support], plus sub menu items
app.hideMenuItem("OnlineSupport");
app.hideMenuItem("KnowledgeBase");
app.hideMenuItem("AdobeExpertSupport");
app.hideMenuItem("AccessOnline");
app.hideMenuItem("SystemInformation");

// [Help - Repair Adobe Reader Installation]
app.hideMenuItem("DetectAndRepair");

// [Help - Check for Updates]
app.hideMenuItem("Updates");

// [Help - Purchase Adobe Acrobat]
app.hideMenuItem("Weblink:BuyAcrobat");

Deploying Reader

Deploying Reader should be straight-forward, however you are required to complete a distribution agreement to deploy Reader in your environment.

Using Group Policy Software Installation, or your favourite software deployment tool, create a transform file with your required settings and deploy. If you need to use a script, this command will install Reader:

START /WAIT MSIEXEC /I AcroRead.msi ALLUSERS=TRUE TRANSFORMS=AdobeReader9.mst /QB

Updating Reader

Updating Adobe Reader can be a bit of a challenge, especially for smaller environments using only Group Policy Software Installation. For Reader 8, Adobe released updates as a complete download of the installer rather than patches. I recommend updating using the full installer as updates for version 9 are released.

If you would really prefer to use the Updater to keep Reader current, you could use the following command in a task using Windows Task Scheduler:

"%CommonProgramFiles%\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=1 -AU_DISPLAY_LANG=en_US -AU_LAUNCH_APPID=reader9rdr-en_US

I can’t vouch for the effectiveness of this approach or even if it will work, so you’re on your own there. Of course you’ll also need to keep Updater in the Reader install package.

Managing Reader

Managing Reader via Group Policy is pretty simple – Reader 8 and 9 are even policy aware. That is they use the Software\Policies key in the registry. Unfortunately Adobe don’t supply an ADM/ADMX template file for use with Group Policy. C’mon Adobe it wouldn’t take you much effort and we would be very grateful.

So it’s Group Policy Preferences or your favourite user workspace management tool for managing Reader. Paul has taken the time to create a simple ADM file for managing some of Readers features that might suit you.

I’ve also created my own custom Administrative template, which you can download in ADM and ADMX format. There is still some work to go on this template, so use at your own risk:

Adobe Acrobat and Reader 9 Administrative Template v0.1

What Now?

I would recommend updating to Reader 9 if you can. There’s doesn’t look to be any fantastic new features to get excited over, but the performance improvements should make it worthwhile.

• [11/03/2009] Updated for Adobe Reader 9.1
• [29/07/2008] Adobe have posted a Deploying Adobe Reader 9 document that has some excellent details.
• [07/08/2008] Updated for the release of Adobe Customisation Wizard 9.
• [08/08/2008] Added version 0.1 of custom ADM/ADMX for managing policy settings.

Deploying Adobe Reader 9 for Windows is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

A second change I’ve implemented is in the way the script adds registry entries to fool applications that expect earlier versions of the JRE to use the latest installed version. This change uses a text file that lists the earlier versions for import into the registry.

To use this script, save the script, the versions text file and the JRE installer to a folder on a local drive. Then elevate a command prompt to run the script and install.

Now I’ve got to get XenApp 5.0 Management Console using the latest JRE, but that’s for another post.

Sun JRE Install Script Update is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The biggest change is that from this new version onwards, the point releases (read: updates, like 1.6.0_3, 1.6.0_2 etc) will be a thing of the past. New updates will be installed on top of existing installed versions, so you will only see a single version installed to: C:\Program Files\Java\jre6. New releases would then be installed to C:\Program Files\Java\jre7 etc. This is good news as we should no longer have applications that expect a specific point release of the JRE.

Here’s what Sun has to say about the new update process:

For current users of Java SE, the JRE update mechanism has also been improved, using a patch-in-place mechanism that translates in a faster and more reliable update process (the patch in place mechanism will take effect for end users who upgrade from this update release or later to a new update release). As an added benefit, follow-on update releases will no longer be listed as separate items in the Windows “Add or Remove Programs” dialog.

Sounds good to me, so far so good. But there’s a new feature that’s got me asking Why?, it’s the Java Quick Starter service.

This is installed on Windows XP and even though there are indications that the service should not be installed on Windows Vista, it was during my testing. However, this is still beta code. This is Sun’s description of the Java Quick Starter service:

The Quick Starter feature will prefetch portions of the JRE into memory, substantially decreasing the average JRE cold start-up time (the time that it takes to launch a Java application for the first time after a fresh reboot of a PC).

Great, now we’re lumped with yet another application with a quick launch process. To me bundling a quick launch executable that continually runs in the background, is a sign that your application is bloated. If you believe the hype though, your applications run faster with Java. Faster than what? Certaintly not native applications.

Amazingly this service runs as Local System. That’s just asking for trouble, wouldn’t Local Service be a better option? If you want to continue running the Quick Starter service, keep an eye on any security bulletins for the JRE. Owning the service will give you full access to the users machine.

Silent Install

Scripting the installation of the runtime is very simple. It uses the same Windows Installer based setup as previous versions, so you can pass properties to it on the command line.

In testing the JAVAUPDATE property is actually ignored as it is with previous versions, so you will need to add some registry entries to disable the auto-update component. Additionally, I could find no property in the MSI that will prevent the installation of the Java Quick Starter services, it must be removed after installation.

This script will install the Sun JRE, remove the Java Quick Starter service and disable the automatic updater. You could improve on this script by creating your own transform file to set the custom properties and actions instead.

@ECHO OFF
ECHO Sun J2SE Runtime Environment 6 Update N..
START /WAIT jre-6u10-windows-i586-p-s.exe /passive /norestart ADDLOCAL=jrecore JAVAUPDATE=0 JU=0 AUTOUPDATECHECK=0 SYSTRAY=0 IEXPLORER=1 MOZILLA=1 REBOOT=ReallySuppress
"%ProgramFiles%\Java\jre6\bin\jqs.exe" -unregister
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v NotifyDownload /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v NotifyInstall /t REG_DWORD /d 0 /f

The information in this article is based on beta code. Hopefully it also applies to the final code when released but who can tell the future? If I could I certaintly wouldn’t be writing about Java.

New Java Runtime Coming. Set Phasers To Yawn is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The Sunbelt Software blog has some more detail on the exploit here: If you have Adobe Acrobat 7 or 8, make sure it’s updated, and here: Adobe PDF exploit.

If you’re still using Adobe Reader 6 or 7, you should seriously consider updating now.

Update Adobe Reader Now, PDF Exploits In The Wild is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.

The new Windows Live Installer is a great way for every day users to gain access to each of the new Live applications, but what if you are looking to create a silent install script, deploy them to multiple computers or just don’t have Internet access at the time of install?

There are two ways to get access to the source MSI files for installing these applications. The first way is install the Live applications on a single computer, you can then find a copy of the installers locally:

• 32-bit Windows – C:\Program Files\Common Files\WindowsLiveInstaller\MsiSources
• 64-bit Windows – C:\Program Files (x86)\Common Files\WindowsLiveInstaller\MsiSources
  

Alternatively you can download the installers directly from the Live Suite SkyDrive folder:

In this folder you will find the following Live applications:

• Windows Live Sign-In Assistant 4.200.520.1: Install_{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}.msi
• Windows Live Messenger 8.5.1302.1018: Install_{508CE775-4BA4-4748-82DF-FE28DA9F03B0}.msi
• Windows Live Writer 12.0.1366.1026: Install_{9176251A-4CC1-4DDB-B343-B487195EB397}.msi
• Windows Live Mail 12.0.1606.1023: Install_{184E7118-0295-43C4-B72C-1D54AA75AAF7}.msi
• Windows Live Toolbar 03.01.0000.0146: Install_{D5A145FC-D00C-4F1A-9119-EB4D9D659750}.msi
• Windows Live Photo Gallery 12.0.1308.1023: Install_{257E440F-781F-459B-9A68-A0872B80C1D6}.msi 

Before you install Windows Live Photo Gallery you will need to install Microsoft SQL Server 2005 Compact Edition.

Bypass Windows Live Installer With Direct Install Downloads is post from stealthpuppy.com. Except as noted otherwise, this work is © 2005-2012 Aaron Parker and is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License.