Either Creative Suite or Acrobat can be "pushed" out by NexGen, Active Directory or Managed Mac. In fact, for Creative Suite, "push" is the only option. The terms of our agreement make it clear that IT Services cannot distrbute the install media nor the serial information.
Make AD groups
The installation software resides on a Windows share, and is protected by an ACL in the form of an Active Directory group.
In order for departmental computers to gain access to the install media, this master group will contain sub groups which you, NexGen Admins, AD admins or Managed Mac admins, will create and populate.
You will populate the groups with Computer objects!
There must be no user objects in the group. This will be checked (by a CRON job running every 5 minutes) and if a user is found in a group, the group will be simply deleted and the software thereby uninstalled (automatically) at first opportunity.
So computer objects only.
Please create an AD group (following the naming rules and preferably with a meaningful name) for example,
ITS Acrobat Computers
ITS Creative Suite Computers
Then email firstname.lastname@example.org with the name of the group and intended purpose (which will of course be obvious by the name).
- There will probably be two groups created by you, one for Creative Suite, one for Acrobat.
- As per Adobe's recommendations, the "adobe_cc_2015" package does not include Acrobat Pro (you will need to assign both packages if you want both).
Link group polict objects (GPOs)
Once email@example.com has replied to say that the group(s) created above have been added to the master group, the next step is an easy one. Simply apply the Group Policy
SFU Push Adobe Acrobat
SFU Push Adobe Creative Suite
to the OUs where the computers live. This will result in a simple script running at the next restart. That script will install or remove the software, as appropriate.
Be warned though, that Creative Suite is BIG; just copying the files will take at least an hour on a fast connection at a non-busy time, and could take much longer than that. Then there's the actual install time, which is also significant. The group policy is set to time out after 3 hours, so if the software has not installed in that time, a second reboot will be required.
Note too that you will not be able to look inside this policy, but you will be able to apply it, so don't worry about the big red X.
Acrobat or Creative Suite will be installed via WPKG, using a global installer. These installers will be named "acrobatpro_2015" and "adobe_cc_2015" (no spaces).
You will still have to create the AD groups described above, and then edit your HOSTS.XML and PROFILES.XML. For example, to push Acrobat, HOSTS.XML should contain the lines
<host group="SFU Adobe Acrobat Computers" profile-id="SFU-Acrobat"/>
and PROFILES.XML should contain
For Creative Suite, the group to use in your HOSTS.XML file is
"SFU Adobe Creative Suite Computers"
and the WPKG ID is
IT Services understands that there are full-time continuing staff or faculty that are 100% owners and administrators of their own computers. Many of these users are entitled to this software on a case-by-case basis.
These users should contact firstname.lastname@example.org directly to ask about obtaining named-user licenses for Creative Suite.
In this scenario, licenses are assigned to the individual user and are _NOT_ intended for wide-scale deployments. The agreement is between the user and Adobe. IT Services plays a negligable role.
For Managed Macs, talk to your local Managed Mac admin: email@example.com
There are three scenarios that might entitle a user to Creative Suite:
- Fully managed Macs (the easiest to deploy) belonging to users that do not have administrative rights. A Mac admin simply assigns the package to these computers and the framework does the rest.
- Full-time continuing staff or faculty that are 100% owners and administrators of their own Macs. These users should contact firstname.lastname@example.org directly to ask about obtaining named-user licenses for Creative Suite. In this scenario, licenses are assigned to the individual user and are _NOT_ intended for wide-scale deployments. The agreement is between the user and Adobe. IT Services plays a negligable role.
- Macs supported by LAN-Administrators at the University. These departmental IT staff need access to the software to support their users. In this scenario IT Services will first ask you to consider putting your Macs under management. If this doesn't suit your user, refer to the previous point if they are administrators. If you still need to install the software and not manage your computers, read on...
I administer Macs at SFU. What if my Macs are entitled to the Adobe Suite, but I don't want to manage them?
This is discussed here (link permitted to SFU LAN-Administrators only).
Managed Macs get the software tended to automatically. If you don't want to manage your Macs, you need to update them yourself.
The Adobe suite installs packaged by IT Services have the Adobe Remote Update Manager configured to use an internal Adobe updates server. This is documented here: http://helpx.adobe.com/creative-cloud/packager/using-remote-update-manager.html
But to simplify matters, all that is necessary to automatically schedule updates is to run the updater binary.
Use task scheduler or a group policy to schedule the updater at:
"C:\Program Files (x86)\Common Files\Adobe\OOBE_Enterprise\RemoteUpdateManager\RemoteUpdateManager.exe" (and expect exit code 0)
Schedule a cronjob or launch daemon to run:
"/usr/local/bin/RemoteUpdateManager" (and expect exit code 0)
Remote Update Manager log file
The Remote Update Manager log file provides detailed information about the events that occur during deployment of exception payloads with Remote Update Manager.
The log file is named RemoteUpdateManager.log and is located as follows:
- In Windows, the log file is in the %temp% location (if run as part of a scheduled task, this is %windir%/temp).
- In Mac OS, the log file is in the folder ~/Library/Logs/ (if run as part of a launchd or cron job, this is /Library/Logs).
Checking for Errors
The errors that Remote Update Manager encounters are marked with the [error] tag in the log file.