HOWTO get Adobe Reader as MSI-file
The easiest way to get the required files (MSI-file plus the required MSP-files if applicable) is to extract them from the intaller file AdbeRdr*.exe.
However Adobe offers exe-installers only for the latest version. Thus in the series 10.1.x they offer it until 10.1.4, but not for 10.1.5, 10.1.6 etc. This is because at that time they started running series 11.x.x in parallel, so they stopped offering it for 10.x.x.
First you should register with Adobe, because otherwise you are not allowed to distribute Adobe Reader. Registration is free and takes only a few minutes. In return they will send you an URL where you can download the enterprise version (which does not try to talk you into using McAffee).
extract from installer
Download the installer from the link that Adobe sent you after your registration, or from their ftp-server, because if you download from http://get.adobe.com/de/reader Adobe wants to include McAffee, thus I haven't tried using that version.
You might be tempted to do the extraction with 7zip, but you shouldn't. 7zip cannot see the included MSP-files, so you'll end up in most cases with an outdated MSI-file, and the MSP-file(s) required to do the update is/are missing.
The extraction must be done with a command like
The extracted files will be save in the newly created directory C:\AdobeReaderFiles. It will contain one MSI-file, one file named data1.cab, plus in most cases one or more MSP-files, plus some other files like setup.exe that are not needed for deployment with GPO.
If there are MSP-files, then the included MSI-file and data1.cab are outdated, and you must apply the patches from the MSP-files to get the latest version. If you want to deploy using GPO, you must slipstream them, see below. In the example from above (version 11.0.2) you get two MSP-files: AdbeRdrUpd11001.msp and AdbeRdrSecUpd11002.msp. They must be applied one after the other, in the correct order, according to the version numbers in the filenames.
or try to find the right downloads
Alternatively the available MSI-files can be downloaded from Adobes ftp-server, and for the MSP-files go to the web-page Downloads and scroll down to Updates, or look on the ftp-server in the directory that has the name 'misc' instead of the language code. If the FTP-server offers several MSP-files for the version that you want, each one is for a different group of languages. They are using codes in the filenames like TIER and MUI to specify that. That's described for older versions here. The TIERs for Adobe Reader 10 are described here (redirects to here). For more info about their language codes they refer to their 'Enterprise Administration Guide', see below.
The regular planned MSP-files for Adobe Reader are cumulative, but emergency patches are incremental. Thus for version 10.1.6 (an emergency update) you must apply AdbeRdrSecUpd1016.msp to the AIP of version 10.1.5. Version 10.1.5 was a regular update, so you only need the MSP-file for 10.1.5 and must apply it directly to the MSI-file of 10.1.0. The versions inbetween are not required. The link on Adobes download page leads to info which version is required to apply the patch. Also Adobe spells the rule out here for version 7 to 9 and separately for version 10. The release notes tell which update was planned, and which was not.
The MSP-files cannot directly be deployed via GPO to patch already existing installations. Instead the MSI-file must be extracted to an AIP, and then the MSP-file must slipstreamed into that, to get an updated AIP. This new AIP can then be deployed like an MSI-file.
My MSP-description offers a script that automates the slipstreaming. Please note that the extaction from the installer.exe as described above is not an AIP, so you must type MSI when my script asks its question. If there is more than one MSP-file to slipstream, make sure to always have only one of them in the directory when you call the script. Also all except the first one must be applied to the AIP, so copy the other MSPs (one at a time) plus the script into the AIP directory, and type AIP when the script asks its question.
Slipstreaming MSP-files of Adobe Reader doesn't always succeed. In my experience it only works reliably on a PC on which Adobe Reader is not installed, ideally a PC where it has never been installed. Also it requires admin rights, otherwise it aborts with strange error messages.
For most configuration changes you need the customization wizard. The wizard is version specific. For any Adobe Reader version 10.x.x you need the Wizard 10, for versions 11.x.x you need Wizard version 11.
There you can disable all updates. I also set the option "Display PDF in browser" to disabled, but it still displays PDFs in Firefox. Maybe this option affects only Internet Explorer.
The wizard creates a MST-file that you can deploy as modification to the MSI-file or AIP. You can either tell the wizard to write an MST-file, or just quit and it will ask to save changes to the MSI. Even in this case it will also write an MST-file, it will be in the same directory as the MSI-file.
The Wizard for version 11 has a bug: Each time you change anything, the property REMOVE_PREVIOUS changes by itself from YES to NO, even if you don't touch the corresponding Install-Option "Remove all versions of reader". You can edit again, load the bad transform, and put the missing checkmark back into the box. Now it's correct. But if you later make another change, the same error will happen again. So you must always edit twice: first for your desired changes, then to re-enable this option. Another possibility is to edit the MSI plus the MST in Orca and restore REMOVE_PREVIOUS to YES there.
And starting with Adobe Reader version 11 this uninstall-option is important, because the default install via GPO is now update, not replace. Thus if you accept the new default GPO-setting, and loose this MSI-property because of the bug, then the old version will remain installed.
Adobe knows this problem and they suggest that you should place the checkmark in this box as last action before saving. Problem is: the box is already checked by default! Maybe they mean that you should start by unchecking this option, then make your desired changes, then restore the checkmark. But even if this works (haven't tested), it's ridiculous. Hey Adobe, fix this bug!
In the MSI-file the options ARPNOREMOVE and ARPNOMODIFY are not set, ARPNOREPAIR is set to 1. I usually set ARPNOREMOVE and ARPNOMODIFY to 1. Repair can be triggered in the help menu of AdobeReader, even it it's disabled in the MSI-file and doesn't show up in appwiz.cpl.
Details can be found here:
Adobe used to offer PDF-Documents with descriptions how to deploy Adobe Reader. The document for version 9 is still available here. The document for version 10 used to be here (and they still link to that location on the bottom of their page Reader Development Center), but this now redirects to the new web-based Enterprise Administration Guide, which is part of the Enterprise Toolkit, but this seems to be only for version 11. A pdf-file for versions 9, 10, and 11 can be found here.
A lot more info is on http://www.grouppolicy.biz/tag/adobe-reader/