Lorky

Push Acrobat Reader via GPO

December 8, 2021, 10:40 am technology

Hi everyone

Today I will share some step necessary to push by GPO Acrobat Reader if you need it in your environment.

You can download the latest Acrobat Reader installer for offline installation.

For that you need to get to the enterprise portal; https://get.adobe.com/fr/reader/enterprise/

image.png?w=754

After that you need to extract the .exe, as installation GPO need a .MSI.

Go in a command prompt where your download is, and type such command;

AcroRdrDCxxxxxxxxxx_en_US.exe -sfx_o"C:\Temp\Acrobat" -sfx_ne

After that we got our folder with the correct files. Copy that where your computer can access it. I tend to use the netlogon subfolder on my side, but it can be anywhere.

Next step is to modify the .MST to include the correct's option. For that you need to use the Acrobat Wizard, available there; https://www.adobe.com/devnet-docs/acrobatetk/tools/Wizard/index.html (Direct download; https://ardownload2.adobe.com/pub/adobe/acrobat/win/AcrobatDC/misc/CustWiz2000920067_en_US_DC.exe)

image-1.png?w=1024

With the wizard please open Acrobat.MST that you have in your folder where you uncompressed the data (c:\temp\acrobat from my example)

In the first section I click to Accept the EULA, and in the next section I click to enable silent's mode, to have the GPO per machine. Click save.

Now we need create the GPO, click in advanced mode. Point the software installation package to your Acrobat.MSI, and after that go in the deployment option, and click to add the .MST.

Make sure the other files from the download are in the same folder.

After that it should work :)

GPP for Printers and print driver / Mapping problem, part 2

November 10, 2021, 4:44 pm technology

Hi everyone

In my last post I talked about the print driver restriction, but you can fall into another case, where the computer are not updated at all which will cause another problem, they would not be able to connect to the printer share at all...

This may happen for some reason, like LTSC/LTSB IoT device which are restricted for Windows Update, or older OSs.

The registry key to use on your printserver for the time you remediate to the problem is; RpcAuthnLevelPrivacyEnabled

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print

RpcAuthnLevelPrivacyEnabled (DWORD) to 0.

1: Enables Enforcement mode. Before you enable Enforcement mode for server-side, make sure all client devices have installed the Windows update released on January 12, 2021 or a later Windows update. This fix increases the authorization level for printer IRemoteWinspool RPC interface and adds a new policy and registry value on the server-side to enforce the client to use the new authorization level if Enforcement mode is applied. If the client device does not have the January 12, 2021 security update or a later Windows update applied, the printing experience will be broken when the client connects to the server through the IRemoteWinspool interface.

**0*: Not recommended. Disables the increase authentication level for printer IRemoteWinspool*, and your devices are not protected.

Reference: Managing deployment of Printer RPC binding changes for CVE-2021-1678 (KB4599464)

GPP for printers and print driver / Mapping problem

October 6, 2021, 9:27 am technology

Hi everyone

Following KB5005652 from Microsoft that fix some security flaw (CVE-2021-34481) it's now reported that some GPP can have difficulty to map the printer.

If it cause problem a registry key can be changed to allow the mapping and driver installation.

Keep in mind that registry key don't need a restart, so it can be enable and disabled easilly in your GPO sequence.

The registry is: RestrictDriverInstallationToAdministrators

The location is: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint

You need to set it to 0 (DWORD)

It can be scripped that way too;

reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f

You can put it back on 1 after your last GPP has applied.

Thanks

Windows 11 Release

October 6, 2021, 9:09 am technology

Hi everyone !

For a follow-up on another blog post I did, where an Windows 11 ISO was available, but still in preview, now it's available for real.

To get it please go to this link. (https://www.microsoft.com/en-us/software-download/windows11) Happy upgrading :)

Modern Authentication for office on older OS (Windows 2008R2 or 7)

September 8, 2021, 3:45 pm technology

Hi

Today I seen some report, and I tested with some older OS, and the modern authentication now seem broke.

I wanted to discuss it, as not much site talk about the issue.

In my test any Office supported for O365 is impacted, so it really target the underlying OS.

The issue is an blank Windows appear, and it never load the content to authenticate.

I join an printscreen of the error;

office001.jpg?w=620

Some older post from last year talk about ADAL registry key, but touching it just remove the blank windows, so it's of no use.

office005.jpg?w=423

In my case I migrated those system to a newer OS and now it work good, but I just wanted to share the bug if you fall into it.

Thanks

Lorky`s Blog - Techno ressources and general informations for everyone !

Push Acrobat Reader via GPO

GPP for Printers and print driver / Mapping problem, part 2

GPP for printers and print driver / Mapping problem

Windows 11 Release

Modern Authentication for office on older OS (Windows 2008R2 or 7)

Popular Tags

Archives