Skip to main content
Jamf Nation, hosted by Jamf, is the largest Apple IT management community in the world. Dialog with your fellow IT professionals, gain insight about Apple device deployments, share best practices and bounce ideas off each other. Join the conversation.

Adobe Flash through Policy

I know this has been discussed in regards to auto updating via a script. (

However, I have not found anything recent for updating flash through a policy. I'm fairly new in JSS (really new and fumble my way through), I have Chrome and FF updating with the newest package I've made. With the configurations I've made, Flash of course does not install, when I try to push as an update, it sits at root and does not install.

I was wondering if someone could point in the right direction for updating Flash (and Java) as well as getting it to install during imaging (without dropping it at root).

We discussed the above script but want to have a bit of hands on, so we can test and make sure it does not affect. The patch reporting was nice for Chrome & FF, since I could use "less than" and go from there, of course that is not available.

Ideas? Thoughts?

Thanks all! :)

Like Comment
Order by:
SOLVED Posted: 3/20/17 at 4:32 PM by Mhomar

@sabrina.oconnor are you dropping the Flash.dmg file in Casper Admin then deploying the .dmg via a policy? You should be using this file (Download DMG Installer (for System Administrators)) this is a link that contains the .pkg. Put the Flash.pkg file into Casper Admin then use that file in the deployment Policy payload. PS... in order to get this file (that contains the .pkg) from Adobe, you must apply for and be accepted for Flash distribution. this is the link for you application if you do not already have it.

SOLVED Posted: 3/20/17 at 5:11 PM by rqomsiya

Why not use AutoPKG/AutoPkgr? It makes the packaging portion of the flash player a breeze. Simply drop the .pkg file in Casper Admin and deploy.

Here is a great link from @rtrouton:

SOLVED Posted: 3/21/17 at 3:01 PM by Chris_Hafner

I've got to second @Mhomar That's the way we do it and it's super easy! You do have to dig into the java installer to get a proper .pkg but it's always been something that I was able to simply drag and drop into Casper Admin, and set to install in a policy scoped to a smart group. You could use AutoPKG of course. I never went that route because it was quite a bit of work that left me trusting in lists maintained by other non-commercial entities (i.e. people who I couldn't hold responsible for screw-ups).

Here's what I do:

•) Sign up for the adobe distribution license via the link •) Download the PPAPI and NPAPI flash.dmg for "Systems Administrators"
•) Open the .dmg and drag the .pkg somewhere. Your desktop or a folder
•) Rename the package so that the new version number is part of the name (otherwise you're going to have trouble tracking which flash .plg is which) In my case "Install Adobe Flash Player.pkg" becomes "Adobe-Flash-Player-" and "Adobe-Pepper-Flash-Player-" respectively.
•) Drag those two .pkg's into Casper Admin
•) At a minimum, assign them to a category and give them an install priority
•) Save, and replicate from Casper Admin

•) Create a policy that installs both flash player .pkg's •) Scope that policy to the computers you wish to get the update. I use a SMART Group that includes everyone that doesn't have the version of Flash Player. I have an Extension Attribute that reports on the Flash player version. I can help you on that too if you need it.

SOLVED Posted: 3/21/17 at 4:11 PM by s.oconnor

Hey All - Thanks for all the suggestions. It pointed me in the right direction. We actually already had one of our accounts signed up for the Adobe distribution. Grabbed the dmg (or co-worker did for me). It didn't show a pkg. I put that into composer and pkged it. Uploaded it to JSS, tied it to a policy pushed it out to a few test computers. Dropped into root but didn't install.

Next I went to the auto packager. Grabbed it from github, uploaded the pkg to jss, tied that into a policy and this time it at least installed, still dropped it at root though.

Added in a clean up script:

rm -rf Install\ Adobe\ Flash\

Then it was happy. Installed, no left over installer sitting on the computer. Finally good.

Thanks everyone for all the help and pointing me in the right direction. I greatly appreciate it :)

Now I'll follow the same steps to get Java going. :D

SOLVED Posted: 3/21/17 at 4:26 PM by duffcalifornia

So, just as a different take, even though you've marked this solved:

I install the Distribution package on my own machine, then use Composer to create a package from preinstalled software, then remove the user folder and create a DMG.

I then create a smart group that says "Flash is less than [insert current version number], then create a policy to install the newly created DMG with a scope of the Needs Flash Updated smart group.

Wash, rinse, repeat every time Flash updates.

SOLVED Posted: 3/22/17 at 8:14 AM by Chris_Hafner

I've got to jump back in here. Why would any of you install and then repackage a perfectly good .pkg installer? Additionally, it's perfectly fine that this installs as root. That's how policies work, they install with root privilege unless you script them otherwise.

SOLVED Posted: 3/22/17 at 10:01 AM by s.oconnor

@Chris_Hafner it was more of not wanting the installer sitting in root, vs it installing at root. After it was installed, the installer was still sitting there. Which I believe ended up being another issue. I need to further test today to be sure.

SOLVED Posted: 3/22/17 at 10:01 AM by s.oconnor

@Chris_Hafner it was more of not wanting the installer sitting in root, vs it installing at root. After it was installed, the installer was still sitting there. Which I believe ended up being another issue. I need to further test today to be sure.

SOLVED Posted: 3/22/17 at 10:17 AM by s.oconnor
SOLVED Posted: 3/24/17 at 11:09 AM by Chris_Hafner

Fair enough, but why repackage the installer?

SOLVED Posted: 3/24/17 at 11:16 AM by s.oconnor

@Chris_Hafner - Not sure why it posted so much. The one from Adobe was not working properly (not sure if it was because of the way it was handed off to me, a coworker sent it to me). That is why I tried. When I took it from autopackager (github) and it was already a pkg. I didn't have to repackage. It was done and happy. That is when I was able to load it up and push out. I've got flash & java tested and out to the environment now working. :phew:

SOLVED Posted: 3/24/17 at 11:17 AM by Chris_Hafner

That makes a lot more sense. I must have misread as I didn't realize that you were using the AutoPkgr package!

SOLVED Posted: 3/24/17 at 11:22 AM by s.oconnor

The first time I didn't. Tried using the dmg from Adobe's distribution file, that I put into a pkg. Since we use their distribution file for SCCM. That's when I realized it wasn't playing nice and just gave up and went to autopkgr, that of course always seems fix everything for me. Like I said still learning and struggling along. Never touched jss until a few months ago, so I fumble and learn as I go :)

SOLVED Posted: 3/24/17 at 11:29 AM by mm2270

Hi @sabrina.oconnor When you say you tried putting the dmg into a pkg, what do you mean exactly? The dmg you get from Adobe's distribution url needs to be mounted and the pkg extracted from that. You should see the pkg installer inside the mounted disk image. You can pull that into Casper Admin to upload it and it should work.
All of the above is moot of course since you got it working through an AutoPkg download, but just wanted to make sure you weren't attempting to upload the dmg as is, or repackaging the dmg itself into a pkg installer, since either of those would not end up installing anything.

The other possibility is the dmg you received had Adobe's app installer for Flash, instead of the admin distribution package. Adobe loves putting installers into their own custom "app" installers for mom & pop end users. Apparently someone high up at Adobe thinks they won't know what to do with a package installer or something.

SOLVED Posted: 3/24/17 at 11:32 AM by s.oconnor

@mm2270 I think it was the app installer for flash vs the admin distribution package. Like you said, since autopkg worked. I have just given up trying other things and will probably stick to autopkg. Thought I'd try something new...after spending far too much time on it, oy. Oh well, yayy for autopkger. :D

SOLVED Posted: 10/19/17 at 11:48 AM by bozemans

Do you set your policy for once per computer? Do you find that there is need to have the "remove install app" script with your workflow?

SOLVED Posted: 10/20/17 at 6:20 AM by Chris_Hafner

No and No, respectively. I use and ongoing policy

1) I use a smart group to set the scope of the policy. So I specifically have a policy whos ONLY criteria is "flash version is not XXXXXX" where XXXX is the specific version of Flash that I wish to distribute.

2) I find no need to remove the installer as the jamf cache handles that for me. I simply use Adobes Administrator installer files and there's no cruft left behind that isn't supposed to be there.

I set two policies. One optional installer in Self-Service and the other a forced policy that runs on check-in, both with a recon. This allows users to install Flash manually if they are a little too eager to wait for the automated policy to take effect. Also, since an older version of Flash will not install over a newer version, the "forced" policy will start recording failures the instant a new flash version is out, which in turn informs me that I have yet another version of flash to certify and distribute.