This project has moved. For the latest updates, please go here.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\DC\Installer]
;Disable Repair Button


[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Adobe ARM\Legacy\Reader\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}]
;0= Do not download or install updates automatically.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\DC\AdobeViewer]
;Accept EULA

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown]
;Disables both updates to the product's web-plugin components as well as all services.
;Specifies whether to enable the First Time Experience (FTE) feature.
;Disables and locks a PDF's ability to display commercial ads.
;Specifies whether Flash content should be rendered in a PDF.
; Disables the Help > Purchase Acrobat menu item in Adobe Reader. 
;Specifies whether to show the menu item that opens the online Actions file library.
;Specifies whether to show the menu item that opens the online Acrobat Tool Set Exchange.
;Specifies whether a document's certification status should appear in the Protected View's DMB
;If false, the string "On behalf of" does not append the author's name in the comment when another person opens the document in a shared-review workflow.
;Disables messages which encourage the user to upgrade the product.
;Enables enhanced security for the standalone application.
;Enables enhanced security when the application is running in the browser.
;Disables trusted folders AND files and prevents users from specifying a privileged location for directories.
;Disables and locks the ability to specify host-based privileged locations.
;Specifies whether to disable WebMail.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cServices]
;Disables all service access except those features controlled by the other preferences.
;Disables Adobe Send for Signature (formerly EchoSign).
;Disables preferences synchronization.
;Disables 3rd party connectors.
;Toggles the Adobe Send and Track plugin for Outlook

MSI Product-Code for Detection:


Disable Update Task

Detection PS:
if(Get-Process armsvc -ea SilentlyContinue) { $true } else { $false } 

Remediation PS:
Get-Process armsvc -ea SilentlyContinue | Stop-Process -Force;
Get-Process adobeARM -ea SilentlyContinue | Stop-Process -Force;
Remove-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Adobe ARM'  -ea SilentlyContinue
Get-ScheduledTask "Adobe Acrobat Update Task" | Disable-ScheduledTask
Set-Service AdobeARMService -StartupType Disabled

Last edited Feb 17, 2016 at 8:56 PM by rzander, version 5