Tips&Tricks – Adobe Reader DC – Disabling Automatic Updates

Here’s a quick tip to completely disable Adobe Reader DC automatic updates.
On this examples, we’ll use a registry configuration for Windows x64 machines:

First things first. There are 3 ways to disable automatic updates. You can choose one of them but…I use all 2 just because we never know if Adobe changes they’re mind about it and one of the ways stops working on next Adobe Reader DC release:

bUpdater	Disables the Updater and removes associated user interface items
Check	Specifies the default time interval in days to check for updates.
Mode	Specifies the Updater’s update mode (manual | automatic)

Now, for the registry keys (that you can apply using Group Policy Preferences for example) here’s what you need:

bUpdater

Path
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\

Value Name
bUpdater

Value Type and Data
REG_DWORD = 0

Mode

Path
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Adobe\Adobe ARM\Legacy\Reader\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}

Value Name
Mode

Value Type and Data
REG_DWORD = 0

Enabling Group Policy Preferences Logging

Group Policy Preferences (GPP) are available since Windows 2008 / Windows 7 and they extend the expand the range of configurable setting within Group Policy Objects (GPO).

Although they provice a better targeting through item-level targeting and action modes, theres something not so good when you need to troubleshoot them.

Instead a quick look in the event viewer for example, you’ll need to enable GPP logging through GPO settings.

To do so, use the following steps:

• Open Group Policy Management Console (GPMC)
• Navigate to Computer Configuration\Policies\Administrative Templates\System\Group Policy
• There you have Logging and Tracing folder
• Configure as desired and restart machine

Inside this folder you’ll get everything you can trace.
You can set what to trace (ex.: Warnings and Errors), where to save the debug logs, maximum log size, etc.

GPOs - Disabling BitLocker Service Fails via Group Policy Preferences [Solved]

Today I've came across a strange issue when trying to disable "BitLocker Drive Encryption Service" with Group Policy Preferences (GPP).

Thanks to Helge Klein - Tools for IT Pros website this was really quick to solve!

After some reading, it seems it's related with the service permissions. This can be proven if you navigate to event viewer and you'll see a warning in application event log with an "Access Denied" for the Group Policy Services source.

"Googling" a little more about this, I've found out a way to solve this one.

So, follow theses steps:

1. First of all, download SetAcl from here
2. Now run following from the command-line (elevated)
   SetACL -on BDESVC -ot srv -actn ace -ace n:Administrators;p:full

And...it's all done! Now just execute "gpupdate /force" or reboot and then BitLocker Drive Encryption Service will be in "Disabled" state.

Oracle Java - Centralized Management and Control

With the release of Java 7 Update 51 and the introduction off the Exception Site List, Oracle just made IT Administrators life...more complicated.
In the search for a way to get back in control over the enterprise desktops and laptops, I've found a way not only to manage Java's Control Panel but also a way to manage the Exception Site List.

On an enterprise with more than 8000 machines to manage, obviously we get a lot of the work done using GPOs so...we needed something similar to make it possible to quickly change whatever we want in a system-wide perspective.

On a default Java installation, the Java Control Panel settings are managed using the file deployment.properties located on "%APPDATA%\LocalLow\Sun\Java\Deployment\" but of course, this is a per-user configuration.
Fortunately this can be bypassed using a file called deployment.config that point to a system-wide deployment.properties file.

Now..with no further delays, here's what you need to do:

deployment.config File

This file is used to specify where the deployment.properties file is located and if it's mandatory or not. On this file you only have to set 2 parameters, here's an example:

deployment.system.config=file\:c\:/Windows/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=true

deployment.properties File

This file manages Java Control Panel settings. For a complete list of parameters, go to http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/jcp/properties.html

So, here's an example of what you can do with deployment.properties:

#REMOVE JAVA DESKTOP SHORTCUT
deployment.javaws.shortcut=never

#SET SECURITY LEVEL AND LOCK IT
deployment.security.level=HIGH
deployment.security.level.locked

#ENABLE USER HOME JAVA POLICY
deployment.security.use.user.home.java.policy=true

#DISABLE AUTOMATIC DOWNLOADS
deployment.javaws.autodownload=never

#DISABLE JAVA OUT OF DATE CHECK
deployment.expiration.check.enabled=false

#SET EXCEPTION SITES LIST PATH
deployment.user.security.exception.sites=c\:/Windows/Sun/Java/Deployment/exception.sites

exception.sites File
Here, you'll enter an url per line for the website you want to whitelist and nothing more is needed.


Pushing the files to all your network
So, now that you have the 3 necessary files, you'll need to put the on the machines. There are several ways to do it, I'll explain here what was the best approach for me, which was, using Group Policy Preferences (GPP).

• Put the 3 files you've previously created on a network share accessible to all machines
  
• Now, create or open an existing GPO and navigate to Computer Configuration -> Preferences -> Windows Settings -> Files
  
• Create 3 file properties matching the name of the 3 files you've created. In each file you'll need to give it an action, a source and a destination path (where the destination path needs to match what you've configure for deployment.system.config.
  For example
  Action: Replace
  Source File(s): \\sharename\javapolicies\deployment.properties
  Destination File: %windir%\Sun\Java\Deployment\deployment.properties

• At the end, you'll have something similar to this:
  
  

And...your done!
After this, just restart the machines so the GPP it's applied.
Everytime you'll need to make a change on Java configuration or add a new website to the Exception Site List, you'll just need to add it centrally!

Hope this helps anyone with similar issues.