tl;dr (summary) for version 11.0.12:

  1. Find AdbeRdr11000*.exe for your language
  2. Save it in an empty directory.
  3. Run AdbeRdr-Extract.bat in the same directory.
  4. Save this in C:\AdobeReaderFiles\AIP.
  5. Run ApplyMSP2.bat there.
  6. Remove the bat and the msp files.
  7. Keep the directory AIP, remove everything else.
  8. Goto section "Configure" below.

tl;dr (summary) for version DC.2015.008:

  1. Find AcroRdrDC1500820082*.exe for your language
  2. Save if in an empty directory.
  3. Run AcroRdr-Extract.bat in the same directory.
  4. Run ApplyMSP2.bat in C:\AdobeReaderFiles\AIP
  5. Remove the bat and the msp files.
  6. Keep the directory AIP, remove everything else.
  7. Goto section "Configure" below.

Adobe offers some MSI-files on their ftp-server, but usually only for the versions which have a zero as third part of their version number, for example 9.5.0, 10.0.0, 11.0.0. For the other versions they offer MSP-files.

It is possible to extract an MSI file to an AIP, and then slipstream the latest MSP into that. The result is an AIP which can be GPO-deployed like an MSI, and will install the latest version. This web-page helps you to do that.

The easiest way to get the required files (MSI-file, plus MSP-files if applicable) is to extract them from the EXE installer AdbeRdr*.exe.
The latest EXE always contains the same MSI as the first EXE of the same series (the one with zero as third part of the version mumber), plus an MSP which can patch that to bring the version number to the current one. For example the EXE for version 11.0.10 contains the MSI of 11.0.0, plus an MSP to patch that to 11.0.10. The ftp-server also has an incremental MSP to upgrade 11.0.9 to 11.0.10.

However Adobe updates the EXE-installers only for the latest series, which currently is 12 alias Document Cloud (DC). In series 11.x they offered EXE-installers for up to version 11.0.10, because after that they started running series 12.x ("DC") in parallel. Thus for later versions the MSP can only be downloaded from their ftp-server.

This description was written for series 10 and 11. A quick test showed the same principle applies to series 12 ("Document Cloud"). The major differences of version 12 seem to be that the filename of the EXE installer starts with Acro instead of Adbe, the version number contains year and month, and it refuses to install in Windows-XP.
Updates checkout these notes about RdrCEF.exe and this mst.


First you should register with Adobe, because otherwise you are not allowed to distribute Adobe Reader. Registration is free and takes only a few minutes. In return they will send you an URL where you can download the enterprise version (which does not try to talk you into using McAffee).

extract from installer

Download the installer from the link that Adobe sent you after your registration, or from their ftp-server, because if you download from Adobe wants to include McAffee.

You might be tempted to do the extraction with 7zip, but you shouldn't. 7zip cannot see the included MSP-files, so you'll end up in most cases with an outdated MSI-file, and the MSP-file(s) required to do the update is/are missing.

The extraction must be done with a command like
AdbeRdr11002_en_US.exe -nos_oC:\AdobeReaderFiles -nos_ne
If you do not like typing complicated commands, you can instead copy the installer.exe to an empty directory, dowload my script AcroRdr-Extract.bat and copy it into the same directory, then double-click the script. It will detect the filename of the installer.exe in the same directory, and then issue the above command with the correct filename.

The extracted files will be saved in the newly created directory C:\AdobeReaderFiles. It will contain one MSI-file, one file named, plus in most cases one or more MSP-files, plus some other files like setup.exe that are not needed for deployment with GPO.

If there are MSP-files, then the included MSI-file and are outdated, and you must apply the patches from the MSP-files to get the latest version. If you want to deploy using GPO, you must slipstream them, see below. In the example from above (version 11.0.2) you get two MSP-files: AdbeRdrUpd11001.msp and AdbeRdrSecUpd11002.msp. They must be applied one after the other, in the correct order, according to the version numbers in the filenames.

or try to find the right downloads

Alternatively the available MSI-files can be downloaded from Adobes ftp-server, and for the MSP-files go to the web-page Downloads and scroll down to Updates, or look on the ftp-server in the directory that has the name 'misc' instead of the language code. If the FTP-server offers several MSP-files for the version that you want, each one is for a different group of languages. They are using codes in the filenames like TIER and MUI to specify that. That's described for older versions here. The TIERs for Adobe Reader 10 are described here (redirects to here). For more info about their language codes they refer to their 'Enterprise Administration Guide', see below.

The regular quarterly MSP-files for Adobe Reader are cumulative, i.e. you need to apply only the latest one. But emergency patches are incremental. Thus if Adobe has published emergency patches after the last regular update, you must apply the latest cumulative update, and then all emergency updates that came after it. Thus for version 10.1.6 (an emergency update) you must apply AdbeRdrSecUpd1016.msp to the AIP of version 10.1.5. Version 10.1.5 was a regular update, so you only need the MSP-file for 10.1.5 and must apply it directly to the MSI-file of 10.1.0. The versions inbetween are not required. The link on Adobes download page leads to info which version is required to apply the patch. Also Adobe spells the rule out here for version 7 to 9 and separately for version 10. The release notes tell which update was planned, and which was not.

Slipstream MSP-files

The MSP-files cannot directly be deployed via GPO to patch already existing installations. Instead the MSI-file must be extracted to an AIP-directory, and then the MSP-file must slipstreamed into that, to get an updated AIP. This new AIP-directory can then be deployed like an MSI-file.

My MSP-description offers a script that automates the slipstreaming. Please note that the extraction from the installer.exe as described above is not an AIP, so you must typein MSI when my script asks its question. If there is more than one MSP-file to slipstream, make sure to always have only one of them in the directory when you call the script. Also only the first MSP is applied to the MSI, which creates an AIP. If there is more than one MSP to be applied, all others ones must all be applied to that AIP, one at a time. To do this, copy the script into the AIP directory, and typein AIP when the script asks its question.

Slipstreaming MSP-files of Adobe Reader does not always succeed. In my experience it only works reliably on a PC on which Adobe Reader is not installed, ideally a PC where it has never been installed. Also it requires admin rights, otherwise it aborts with strange error messages.


For most configuration changes you need the customization wizard. The wizard is version specific. For any Adobe Reader version 11.x.x you need Wizard XI, for Adobe Reader 12 you need Wizard DC.

There you can disable all updates. I also set the option "Display PDF in browser" to disabled, but it still displays PDFs in Firefox. Probably this option affects only Internet Explorer.

The wizard creates a MST-file that you can deploy as modification to the MSI-file or AIP. You can either tell the wizard to write an MST-file, or just quit and it will ask to save changes to the MSI. Even in this case it will also write an MST-file, it will be in the same directory as the MSI-file.

The Wizard version 11.0.0 has a bug (fixed in version 11.0.3): Every time you change anything, the property REMOVE_PREVIOUS changes by itself from YES to NO, even if you do not touch the corresponding Install-Option "Remove all versions of reader". You can edit again, load the bad transform, and put the missing checkmark back into the box. Now it's correct. But if you later make another change, the same error will happen again. So you must always edit twice: first for your desired changes, then to re-enable this option. Another possibility is to edit the MSI plus the MST in Orca and restore REMOVE_PREVIOUS to YES there.

Note that this uninstall-option is important, because when upgrading via GPO from version 10 to 11, the default install method autodetected by the server is update, not replace. Thus if you accept the default GPO-setting, and loose the MSI-property because of this bug, then the old version will remain installed.

other options

In the MSI-file the options ARPNOREMOVE and ARPNOMODIFY are not set, ARPNOREPAIR is set to 1. I usually set ARPNOREMOVE and ARPNOMODIFY to 1. Repair can be triggered in the help menu of AdobeReader, even if it is disabled in the MSI-file and does not show up in appwiz.cpl.

GPO templates

Adobe announced that version 11 has "GPO Template for the most common enterprise settings".

Details can be found here:

more info

Adobe used to offer PDF-Documents with descriptions how to deploy Adobe Reader. The document for version 9 is still available here. The document for version 10 used to be here (and they still link to that location on the bottom of their page Reader Development Center), but this now redirects to the new web-based Enterprise Administration Guide, which is part of the Enterprise Toolkit, but this seems to be only for version 11. A pdf-file for versions 9, 10, and 11 can be found here.

A lot more info is on


  • 2015-08-16
    • link to two config tipps for version 12
  • 2015-08-08
    • Added info for version 12 alias Document Cloud (DC).
    • Updated script for extraction of EXE installer for new filename of version 12.
  • 2015-08-07
    • fix link to AdbeRdrUpd11010_incr.msp
    • mention shortcut 11.0.0 to 11.0.12
  • 2015-07-15
    • version 11.0.12 in summary-box
    • updated script ApplyMSP2.bat
  • 2014-05-14
    • version 11.0.7 and summary in "tl;dr"-box
  • 2013-04-06
    • mention GPO template for version 11
  • 2013-03-25
    • bug in Customization Wizard 11
  • 2013-03-24
    • add more details
    • add script for extraction
    • reorder & additional headlines
  • 2013-03-23
    • add extract MSI & MSPs from EXE
    • cleanup
  • 2012-11-11
    • Customization Wizard for version 11 now available
  • 2012-11-07
    • Customization Wizard for version 11 not yet available
  • 2012-01-21
    • update for version 10.1.2