What is the Flash Player auto-update behaviour for users without admin credentials on OSX and Windows?

[RustyJoe]

Hi

Does Flash Player auto-update have the ability to update systems when a user does not have administrator access on their device?

What will the results be if we enable Flash Player auto-update on OSX and Windows systems where:

1.  Users are log in with accounts that DO NOT have administrator access; and

2.  Internet access is granted via a proxy server, but only when a user with NO administrator credentials is logged in.

Thanks in advance.

[RustyJoe]

Further to this, looking at the admin guide, http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/en/devnet/flashplayer/pdfs/flash_player_1... I see:

"The update task runs as the SYSTEM user, not as the current user. The check runs regardless of who is logged on, and runs even if no one is logged on. The only requirement is that the system has an internet connection."

So that answers my first question about auto-updates occurring when the logged on user does not having admin access.  However, regarding internet access for the system account, I'm curious if the SYSTEM account will use the logged on user's credentials to download the software through the proxy server.

[chris.campbell]

My advice would be to give it a try.  I'd also look through StackOverflow to see how you can set the proxy settings for a system account.  Here's a post that might help with Windows - http://serverfault.com/questions/34940/how-do-i-configure-proxy-settings-for-local-system‌.

I'll also touch base with our installer team to see if they tested this scenario.

Baring that, you might need to look into other deployment options (SCCM, Munki, etc).

[RustyJoe]

Agreed, I've just set up a test PC with auto-update enabled and a non-admin logged in, and we'll see what happens when the next flash update is released.  Will post the results.

[_maria_]

Hi,

Regarding:

"The update task runs as the SYSTEM user, not as the current user. The check runs regardless of who is logged on, and runs even if no one is logged on. The only requirement is that the system has an internet connection."

This refers to the Background Update process. It does not refer to the Notification Update process.  For Notification Updates non-admin users will need to provide admin credentials to install the software.

--

Maria

[RustyJoe]

Hi Maria

Just to clarify, when you say Notification Update process, do you mean selecting the "Notify me to install updates" option?  And by Background Update process, do you mean the "Allow Adobe to install updates (recommended)" option?

[_maria_]

Hi,

Yes.  However, the 'Allow Adobe to install updates' (Background Updates) doesn't completely disable Notification updates.  When selecting this option updates may happen either via the Background Update process or via Notification Update process.

Since you have non-Admin users you may want to disable updates all together and deploy Flash Player via managed software deployment services (e.g. SCCM, Casper, etc), or host the Background Update resources locally.  When hosting Background Update resources locally, updates will only occur via the locally hosted Background Updates, and not from Adobe servers (either via Notification or Background).

Information on hosting Background Update resources locally is in the "Background updates from an internal server' section of the Admin Guide (currently page 20).

--

Maria

[RustyJoe]

Maria

So there's no way to completely turn off user notification AND allow background updates unless you use a locally hosted update server?  That's too bad.

Reading page 26 of the manual, I see there's an mms.cfg file that you can configure, with an option SilentAutoUpdateEnable, which is described on page 32:

SilentAutoUpdateEnable

SilentAutoUpdateEnable = [ 0, 1 ] (0 = false, 1 = true)

Availability: Flash Player 11.2 for Microsoft Windows, and Flash Player 11.3 for Macintosh

Enables a Flash Player update to install silently in the background with no user interaction. Installs both the ActiveX and plug-in players when appropriate. This type of update is called a Flash Player background update.

Standard users cannot disable background updates if they are enabled by an administrator.

Depending on the type of browser, if the user has a browser open at the time of an update, the browser might not use the updated player immediately. For more information, see "Performing a background update" on page 19.

The default value is 0 to disable background updates.

So you're saying that even if we enable this option (but don't configure a local server), users may still be prompted some or all of the time?

[_maria_]

Hi,

Correct.  The only way to turn off user notification and allow background updates is to use a local server.

The Admin Guide section you quote should be clarified to indicate that enabling silent auto updates doesn't disable notification updates and users may receive updates via notification.  I actually thought this section had been updated to clarify this, and I've made this edit on the Admin Guide to be posted with our next release.  Enabling this option in the mms.cfg file is the equivalent of selecting 'Allow Adobe to install updates (recommended)' in the control panel or when installing Flash Player.

--

Maria

[RustyJoe]

Thank you very much for the clarification.  I appreciate it.

[_maria_]

you're welcome.

--

Maria

[RustyJoe]

Hi Maria

A quick update, 17.0.0.169 was recently released and I see that my Flash is still at 17.0.0.134 so the auto-upgrade doesn't appear to be working :-(.  Two questions:

1.  Is there any way to enable logging on auto-upgrade to see where it's failing?

2.  Do you happen to know the location on the internet (I assume somewhere on the Adobe site) that the SYSTEM account attempts to access Flash updates.  I want to see if we can put an explicit allow to this website in our proxy.

Thanks in advance.

[_maria_]

Hi RustyJoe,

For the first question, you can enable verbose logging for Background Updates by adding SilentAutoUpdateVerboseLogging=1 to the mms.cfg file.  This is only for Background Updates, not for any other type of updates which already have a fair amount of logging.

For the second question, the paths used are listed on page 21 of the Flash Player Admin Guide.  In the example given, replace your.server.com with fpdownload.macromedia.com.  As for the path to the installer files, OS X uses the URL with '11' in the path and for Windows systems replace '14' with '17'.

--

Maria