Version 11.0.7:

Adobe offers MSI-files only for some versions, but not for all. For the other versions (the ones with minor version steps), they offer only MSP-files.

The easiest way to get the required files (MSI-file plus the required MSP-files if applicable) is to extract them from the installer file AdbeRdr*.exe.

However Adobe offers exe-installers only for the latest series (currently 11). In the series 10 they offer it for up to version 10.1.4, but not for later ones, because after that they started running series 11 in parallel.

Register

First you should register with Adobe, because otherwise you are not allowed to distribute Adobe Reader. Registration is free and takes only a few minutes. In return they will send you an URL where you can download the enterprise version (which does not try to talk you into using McAffee).

Extract from installer

Download the installer from the link that Adobe sent you after your registration, or from their ftp-server, because if you download from http://get.adobe.com/de/reader Adobe wants to include McAffee.

You might be tempted to do the extraction with 7zip, but you shouldn’t. 7zip cannot see the included MSP-files, so you’ll end up in most cases with an outdated MSI-file, and the MSP-file(s) required to do the update is/are missing.

The extraction must be done with a command like
AdbeRdr11002_en_US.exe -nos_oC:\AdobeReaderFiles -nos_ne
If you do not like typing complicated commands, you can instead copy the installer.exe to an empty directory, dowload my script AdbeRdr-Extract.bat and copy it into the same directory, then double-click the script. It will detect the filename of the installer.exe in the same directory, and then issue the above command with the correct filename.

The extracted files will be saved in the newly created directory C:\AdobeReaderFiles. It will contain one MSI-file, one file named data1.cab, plus in most cases one or more MSP-files, plus some other files like setup.exe that are not needed for deployment with GPO.

If there are MSP-files, then the included MSI-file and data1.cab are outdated, and you must apply the patches from the MSP-files to get the latest version. If you want to deploy using GPO, you must slipstream them, see below. In the example from above (version 11.0.2) you get two MSP-files: AdbeRdrUpd11001.msp and AdbeRdrSecUpd11002.msp. They must be applied one after the other, in the correct order, according to the version numbers in the filenames.

Or try to find the right downloads

Alternatively the available MSI-files can be downloaded from Adobes ftp-server, and for the MSP-files go to the web-page Downloads and scroll down to Updates, or look on the ftp-server in the directory that has the name ‘misc’ instead of the language code. If the FTP-server offers several MSP-files for the version that you want, each one is for a different group of languages. They are using codes in the filenames like TIER and MUI to specify that. That’s described for older versions here. The TIERs for Adobe Reader 10 are described here (redirects to here). For more info about their language codes they refer to their ‘Enterprise Administration Guide’, see below.

The regular quarterly MSP-files for Adobe Reader are cumulative, i.e. you need to apply only the latest one. But emergency patches are incremental. Thus if Adobe has published emergency patches after the last regular update, you must apply the latest cumulative update, and then all emergency updates that came after it. Thus for version 10.1.6 (an emergency update) you must apply AdbeRdrSecUpd1016.msp to the AIP of version 10.1.5. Version 10.1.5 was a regular update, so you only need the MSP-file for 10.1.5 and must apply it directly to the MSI-file of 10.1.0. The versions inbetween are not required. The link on Adobes download page leads to info which version is required to apply the patch. Also Adobe spells the rule out here for version 7 to 9 and separately for version 10. The release notes tell which update was planned, and which was not.

Slipstream MSP-files

The MSP-files cannot directly be deployed via GPO to patch already existing installations. Instead the MSI-file must be extracted to an AIP-directory, and then the MSP-file must slipstreamed into that, to get an updated AIP. This new AIP-directory can then be deployed like an MSI-file.

My MSP-description offers a script that automates the slipstreaming. Please note that the extraction from the installer.exe as described above is not an AIP, so you must typein MSI when my script asks its question. If there is more than one MSP-file to slipstream, make sure to always have only one of them in the directory when you call the script. Also only the first MSP is applied to the MSI, which creates an AIP. If there is more than one MSP to be applied, all others ones must all be applied to that AIP, one at a time. To do this, copy the script into the AIP directory, and typein AIP when the script asks its question.

Slipstreaming MSP-files of Adobe Reader does not always succeed. In my experience it only works reliably on a PC on which Adobe Reader is not installed, ideally a PC where it has never been installed. Also it requires admin rights, otherwise it aborts with strange error messages.

Configure

For most configuration changes you need the customization wizard. The wizard is version specific. For any Adobe Reader version 10.x.x you need the Wizard 10, for versions 11.x.x you need Wizard version 11.

There you can disable all updates. I also set the option “Display PDF in browser” to disabled, but it still displays PDFs in Firefox. Probably this option affects only Internet Explorer.

The wizard creates a MST-file that you can deploy as modification to the MSI-file or AIP. You can either tell the wizard to write an MST-file, or just quit and it will ask to save changes to the MSI. Even in this case it will also write an MST-file, it will be in the same directory as the MSI-file.

Other options

In the MSI-file the options ARPNOREMOVE and ARPNOMODIFY are not set, ARPNOREPAIR is set to 1. I usually set ARPNOREMOVE and ARPNOMODIFY to 1. Repair can be triggered in the help menu of AdobeReader, even if it is disabled in the MSI-file and does not show up in appwiz.cpl.

GPO templates

Adobe announced that version 11 has “GPO Template for the most common enterprise settings”.

Details can be found here:
http://www.404techsupport.com/2012/10/adobe-reader-11-has-landed-with-gpo-adm-templates/
http://www.grouppolicy.biz/2012/10/how-to-configure-group-policy-for-adobe-reader-xi/

More info

Adobe used to offer PDF-Documents with descriptions how to deploy Adobe Reader. The document for version 9 is still available here. The document for version 10 used to be here (and they still link to that location on the bottom of their page Reader Development Center), but this now redirects to the new web-based Enterprise Administration Guide, which is part of the Enterprise Toolkit, but this seems to be only for version 11. A pdf-file for versions 9, 10, and 11 can be found here.

A lot more info is on http://www.grouppolicy.biz/tag/adobe-reader/