Deploying Adobe Flash Through GPO

Adobe Flash is a necessary evil nowadays, but until it is phased out with HTML 5, thankfully, deployment is relatively painless. Direct download for the MSI+MST is down the bottom.


To download the latest version head to: http://www.adobe.com/products/flashplayer/distribution3.html
At the time of writing the latest version is 11.9.900.170.


Direct MSI download link

Windows IE:

Windows Plugin based browsers (Chrome, Firefox e.t.c):


Transforms needed to be made

Once downloaded all that needs to be changed is to disable updates/pop-ups for updates.
Using a program such as Orca or InstEd (www.instedit.com/download) edit the Property table to have the following:


AgreeToLicense = Yes


AutoUpdateDisable = 1

AutoUpdateInterval = -1

DisableProductDownload = 1

SilentAutoUpdateEnable = 1


Once that’s all done and you’ve generated/saved your Transform to the network shared "Adobe Flash" folder, load up Microsoft’s Group Policy Management console and right click on the Organisational Unit (OU)  that you’ve added your network computers to and select “Create a GPO…”

Name the policy “Adobe Flash” or whatever you would like it to be named, then under:

“Computer Configuration – Policies – Software Settings – Software Installation”

right click in the right hand window, or on the software installation icon and choose “New… - Package”. Find the "Adobe Flash" folder you put on your server and select the .MSI and choose “Advanced” as the deployment method.

Once the panel opens up, go to the Modifications tab and select Add. Locate your Transform and click Ok. The package will now be loaded into MS GPO and you can exit out of the window as it is already saved.


From the Adobe Manual:


AutoUpdateDisable = [ 0, 1 ] (0 = false, 1 = true)

If this value is set to 0 (the default), Flash Player lets a user with admin rights enable or disable notification updates for all accounts on the machine in the Settings Manager.

Standard users, meaning users without admin rights, cannot change this setting for all accounts on the machine. Standard users can enable or disable notification update for their individual account. That is, you cannot use AutoUpdateDisable = 0 to prevent the user from disabling notification updates for their individual account.

If this value is set to 1, Flash Player disables notification updates.

Note: If this value is set to 1, or if the user disables notification updates, the AutoUpdateInterval, DisableProductDownload , and ProductDisabled options in this section are ignored. However, you can still use the SilentAutoUpdateEnable and SilentAutoUpdateVerboseLogging options because a standard user cannot disable background updates.



AutoUpdateInterval = [ number of days ]

If this is a negative value (the default), Flash Player uses the notification update interval value specified in the Settings Manager. (If users don't make any changes with the Settings Manager, the default is every 7 days.) If this value is set to 0, Flash Player checks for an update every time it starts. If this is a positive value, the value specifies the minimum number of days between update checks.



DisableProductDownload = [ 0, 1 ] (0 = false, 1 = true)

If this value is set to 0 (the default), Flash Player can install native code applications that are digitally signed and delivered by Adobe. Adobe uses this capability to deliver Flash Player updates through the developer-initiated Express Install process, and to deliver the Adobe Acrobat Connect screen-sharing functionality. If this value is set to 1, these capabilities are disabled.

However, if you want to enable some but not all product downloads, set this value to 0 (or omit it) and then use the ProductDisabled option to specify which product downloads are not permitted.



SilentAutoUpdateEnable = [ 0, 1 ] (0 = false, 1 = true)

Availability: Flash Player 11.2 for Microsoft Windows, and Flash Player 11.3 for Macintosh

Enables a Flash Player update to install silently in the background with no user interaction. Installs both the ActiveX and plug-in players when appropriate. This type of update is called a Flash Player background update.

Standard users cannot disable background updates if they are enabled by an administrator. Depending on the type of browser, if the user has a browser open at the time of an update, the browser might not use the updated player immediately. The default value is 0 to disable background updates.


Direct Download:





This post is locked
This website uses cookies. By continuing to use this site and/or clicking the "Accept" button you are providing consent Quest Software and its affiliates do NOT sell the Personal Data you provide to us either when you register on our websites or when you do business with us. For more information about our Privacy Policy and our data protection efforts, please visit GDPR-HQ