Adobe Flash through Policy

[s_oconnor]

I know this has been discussed in regards to auto updating via a script. (https://www.jamf.com/jamf-nation/discussions/18495/best-way-to-set-flash-player-to-auto-update-your-thoughts)

However, I have not found anything recent for updating flash through a policy. I'm fairly new in JSS (really new and fumble my way through), I have Chrome and FF updating with the newest package I've made. With the configurations I've made, Flash of course does not install, when I try to push as an update, it sits at root and does not install.

I was wondering if someone could point in the right direction for updating Flash (and Java) as well as getting it to install during imaging (without dropping it at root).

We discussed the above script but want to have a bit of hands on, so we can test and make sure it does not affect. The patch reporting was nice for Chrome & FF, since I could use "less than" and go from there, of course that is not available.

Ideas? Thoughts?

Thanks all! :)

[Mhomar]

@sabrina.oconnor are you dropping the Flash.dmg file in Casper Admin then deploying the .dmg via a policy? You should be using this file (Download DMG Installer (for System Administrators)) this is a link that contains the .pkg. Put the Flash.pkg file into Casper Admin then use that file in the deployment Policy payload. PS... in order to get this file (that contains the .pkg) from Adobe, you must apply for and be accepted for Flash distribution. this is the link for you application if you do not already have it. [http://www.adobe.com/products/players/flash-player-distribution.html](link URL)

[rqomsiya]

Why not use AutoPKG/AutoPkgr? It makes the packaging portion of the flash player a breeze. Simply drop the .pkg file in Casper Admin and deploy.

Here is a great link from @rtrouton: https://derflounder.wordpress.com/2014/07/15/autopkgr-a-gui-for-autopkg/

[Chris_Hafner]

I've got to second @Mhomar That's the way we do it and it's super easy! You do have to dig into the java installer to get a proper .pkg but it's always been something that I was able to simply drag and drop into Casper Admin, and set to install in a policy scoped to a smart group. You could use AutoPKG of course. I never went that route because it was quite a bit of work that left me trusting in lists maintained by other non-commercial entities (i.e. people who I couldn't hold responsible for screw-ups).

Here's what I do:

•) Sign up for the adobe distribution license via the link •) Download the PPAPI and NPAPI flash.dmg for "Systems Administrators"
•) Open the .dmg and drag the .pkg somewhere. Your desktop or a folder
•) Rename the package so that the new version number is part of the name (otherwise you're going to have trouble tracking which flash .plg is which) In my case "Install Adobe Flash Player.pkg" becomes "Adobe-Flash-Player-25.0.0.127.pkg" and "Adobe-Pepper-Flash-Player-25.0.0.127.pkg" respectively.
•) Drag those two .pkg's into Casper Admin
•) At a minimum, assign them to a category and give them an install priority
•) Save, and replicate from Casper Admin

POLICY
•) Create a policy that installs both flash player .pkg's •) Scope that policy to the computers you wish to get the update. I use a SMART Group that includes everyone that doesn't have the version of Flash Player. I have an Extension Attribute that reports on the Flash player version. I can help you on that too if you need it.

[s_oconnor · Accepted solution]

Hey All - Thanks for all the suggestions. It pointed me in the right direction. We actually already had one of our accounts signed up for the Adobe distribution. Grabbed the dmg (or co-worker did for me). It didn't show a pkg. I put that into composer and pkged it. Uploaded it to JSS, tied it to a policy pushed it out to a few test computers. Dropped into root but didn't install.

Next I went to the auto packager. Grabbed it from github, uploaded the pkg to jss, tied that into a policy and this time it at least installed, still dropped it at root though.

Added in a clean up script:

rm -rf Install Adobe Flash Player.app/

Then it was happy. Installed, no left over installer sitting on the computer. Finally good.

Thanks everyone for all the help and pointing me in the right direction. I greatly appreciate it :)

Now I'll follow the same steps to get Java going. :D

[duffcalifornia]

So, just as a different take, even though you've marked this solved:

I install the Distribution package on my own machine, then use Composer to create a package from preinstalled software, then remove the user folder and create a DMG.

I then create a smart group that says "Flash is less than [insert current version number], then create a policy to install the newly created DMG with a scope of the Needs Flash Updated smart group.

Wash, rinse, repeat every time Flash updates.

[Chris_Hafner]

I've got to jump back in here. Why would any of you install and then repackage a perfectly good .pkg installer? Additionally, it's perfectly fine that this installs as root. That's how policies work, they install with root privilege unless you script them otherwise.

[s_oconnor]

@Chris_Hafner it was more of not wanting the installer sitting in root, vs it installing at root. After it was installed, the installer was still sitting there. Which I believe ended up being another issue. I need to further test today to be sure.

[s_oconnor]

@Chris_Hafner it was more of not wanting the installer sitting in root, vs it installing at root. After it was installed, the installer was still sitting there. Which I believe ended up being another issue. I need to further test today to be sure.

[Chris_Hafner]

Fair enough, but why repackage the installer?

[s_oconnor]

@Chris_Hafner - Not sure why it posted so much. The one from Adobe was not working properly (not sure if it was because of the way it was handed off to me, a coworker sent it to me). That is why I tried. When I took it from autopackager (github) and it was already a pkg. I didn't have to repackage. It was done and happy. That is when I was able to load it up and push out. I've got flash & java tested and out to the environment now working. :phew:

[Chris_Hafner]

That makes a lot more sense. I must have misread as I didn't realize that you were using the AutoPkgr package!

[s_oconnor]

The first time I didn't. Tried using the dmg from Adobe's distribution file, that I put into a pkg. Since we use their distribution file for SCCM. That's when I realized it wasn't playing nice and just gave up and went to autopkgr, that of course always seems fix everything for me. Like I said still learning and struggling along. Never touched jss until a few months ago, so I fumble and learn as I go :)

[mm2270]

Hi @sabrina.oconnor When you say you tried putting the dmg into a pkg, what do you mean exactly? The dmg you get from Adobe's distribution url needs to be mounted and the pkg extracted from that. You should see the pkg installer inside the mounted disk image. You can pull that into Casper Admin to upload it and it should work.
All of the above is moot of course since you got it working through an AutoPkg download, but just wanted to make sure you weren't attempting to upload the dmg as is, or repackaging the dmg itself into a pkg installer, since either of those would not end up installing anything.

The other possibility is the dmg you received had Adobe's app installer for Flash, instead of the admin distribution package. Adobe loves putting installers into their own custom "app" installers for mom & pop end users. Apparently someone high up at Adobe thinks they won't know what to do with a package installer or something.

[s_oconnor]

@mm2270 I think it was the app installer for flash vs the admin distribution package. Like you said, since autopkg worked. I have just given up trying other things and will probably stick to autopkg. Thought I'd try something new...after spending far too much time on it, oy. Oh well, yayy for autopkger. :D

[bozemans]

@Chris_Hafner
Do you set your policy for once per computer? Do you find that there is need to have the "remove install app" script with your workflow?

[Chris_Hafner]

No and No, respectively. I use and ongoing policy

1) I use a smart group to set the scope of the policy. So I specifically have a policy whos ONLY criteria is "flash version is not XXXXXX" where XXXX is the specific version of Flash that I wish to distribute.

2) I find no need to remove the installer as the jamf cache handles that for me. I simply use Adobes Administrator installer files and there's no cruft left behind that isn't supposed to be there.

I set two policies. One optional installer in Self-Service and the other a forced policy that runs on check-in, both with a recon. This allows users to install Flash manually if they are a little too eager to wait for the automated policy to take effect. Also, since an older version of Flash will not install over a newer version, the "forced" policy will start recording failures the instant a new flash version is out, which in turn informs me that I have yet another version of flash to certify and distribute.