Steve Jobs couldn’t kill it, Microsoft’s Silverlight couldn’t kill it – it seems that Adobe Flash Player is here to stay! Because you will have to support it, you might as well make it as easy as possible. The first step on that road is to deploy Adobe Flash Player with Group Policy. Here is you how to guide:
Download the Adobe Flash Player MSI
Adobe releases an MSI for nearly every one of their products. Adobe Flash Player is no different. The trick, however, is finding the MSI and securing the rights to distribute it. Head on over to the Adobe Flash Player Distribution Page and register for the MSI.
Be sure to use a generic tech email shared by those in your department. This will make future updates smoother. In our environment, we have a shared IT email called techinfo@.
After applying for the license, you will receive two follow up emails. The first email will confirm your newly created Adobe Distribution account. The second email will include download instructions for the fully packaged MSI. This second email can take several hours to arrive if your Adobe Distribution license is new.
Sharing the Package
Copy the MSI (and any other included files) to your software distribution share. Personally, I like to organize my share like this:
- Vendor (Adobe)
- Application (Flash)
- Version (11)
- Application (Flash)
- Vendor (Adobe)
When you organize by vendor, your software share will have a more vertical structure and you won’t seem so cluttered all of the time. As an example, take a look at all of the Adobe Products we deploy in our environment:
Regardless of how your setup your share, be sure that EVERYONE (or an equivalent) has Full Control to the share and that Authenticated Users has Read/Execute on the folder permissions. This will ensure that your objects (either computers or users) have the appropriate permissions needed to access the installation source.
If you have previously deployed Adobe Flash Player, read this guide to updating software through Group Policy Software Installation before continuing.
Creating the GPO
For any application that you deploy, create a specific GPO named after the product and pick a prefix to identify the type of GPO it is. I prefer to name my GPOs APP_Application Name. For example, APP_Adobe Flash Player.
There is no need to add the version to the GPO name. You will likely store updates inside this same GPO and will only have to rename the policy later. Save yourself some time and omit the application version.
Be sure to create your new GPO under the Group Policy Objects container. Many of times, I have accidentally deployed an application or setting by right clicking on an OU and creating the GPO there. Until your GPO is fully tested, it should not be in a live environment (or linked to production machines).
Edit the GPO
Edit your newly created Adobe Flash Player Group Policy Object. Because all users tend to use Adobe Flash Player, you will likely deploy it to the computer. Expand your GPO to Computer Configuration/Policies/Software Settings/Software Installation. Right click and select New Package.
Browse to your package and add it to your GPO. Be sure that you browsed to the UNC (share path or \\SERVER\SHARE\) and not a local path (D:\Software\). Select Assigned and Ok.
Disabling Adobe Flash Player Auto Update
The Auto Update settings for Adobe Flash Player can be configured by creating/editing the MMS.CFG file. MMS.CFG can be found here: C:\Windows\System32\Macromed\Flash. This file might not exist on your computers. Don’t worry, we will create it.
Open notepad and enter: AutoUpdateDisable=1
Save this file in the same location as your Adobe Flash Player MSI.
In your Adobe Flash Player Group Policy Object, create a new computer side File Preference. Configure the preference to copy the MMS.CFG file from your network share to C:\Windows\System32\Macromed\Flash\.
If you want to ensure that your MMS.cfg is always on the machine with Adobe Flash Player installs, consider embedding it within the MSI.
You are now ready to deploy Adobe Flash Player with Group Policy! Simply link your new GPO to a Test OU and reboot. Adobe Flash Player should update through Group Policy. After testing, you might want to scope your GPO down to a specific security group instead of Authenticated Users.
If you are having issues deploying Adobe Flash Player, check the top Group Policy Software Installation misconfigurations. If it doesn’t address your issue, just leave me a comment below and I will try to help you find an answer.
Once a week, I hope to highlight a particular application and the methods you can use to deploy it. If you have a particular application that you would like to see in this series, leave me a comment (or send me an email by using the button in the top right of this site).
I’m trying to add “install_flash_player_18_active_x.msi” and “install_flash_player_18_plugin.msi” to my policies, and I’m getting an error saying:
“No package in the software installation data in the Active Directory meets this criteria.”
Is this a new GPO or are you adding it as an upgrade to an old GPO?
Adding it to my previous GPO that had the v. 17 flash MSI. I had one of each for ActiveX and Plugin.
Add it a new a GPO and mark it as an upgrade for the old one under advanced options.
OK, I’ll try that, but I removed the v. 17 MSI’s from the policy. Do I have to add them again?
Yes but make sure that adding them back doesn’t cause them to reinstall. It shouldn’t (flash is smart enough) but test anyways.
Thanks, that did the trick! Now I got both plugins installed immediately. Thanks for help.
Great site! Placed it immediately in my favorites!
Installation doesn’t work for Flash in Firefox… Any ideas?
Thank you Luk! This guide covers the ActivX deployment of Flash. For Firefox, you will just need to follow the same procedures but download the Plug-in based MSI from Adobe. Let me know if you have any more questions.
Do I make a second GPO or add it to the GPO i deployed for Flash for IE.
If you use firefox everywhere, you can add it to the Flash for IE GPO.
Hi. If I put activex plugin and firefox plugin into the same gpo, only activex plugin is installed on destination computers. I need them both installed. How to do it?
I would put them in separate GPOs.
Hi, thanks, it is working now. But only on Windows 7 workstations. They get both flash plugins installed after reboot, which is what I want. However, Windows 8.1 workstations doesnt get any flash installed. System flash is built in in Windows 8.1, so I dont care about this, but plugin for other browsers doesnt get installed, however gpresult shows that policy is being applied. Any ideas?
If you look in the Application node under Event Viewer, do you see that the MSI was successfully installed? If you run the MSI silently (msiexec /I MSIname.msi /qb) on the Windows 8.1 machine, does it work?
In eventlog there were some timeout warnings and thus policies not applied. Everything is fixed now. Problem was solved, when I applied Computer Configuration \Administrative Templates\System\Logon – Always wait for the network at computer startup and logon and also Computer Configuration\Administrative Templates\System\Group Policy\Startup Policy Processing Wait Time – 30 s. I know it should be default value but setting it for 30s fixed the problem.
I had to enable that same setting on some Windows 7 machines a few years ago… very odd that you had the same problem on Windows 8. Thanks for sharing your solution!