blog

When Acrobat quietly installs Adobe Express Photos

Adobe Express Photos appeared on a managed PC through an Acrobat update. I tracked down how it got there and stopped it returning with Intune.

microsoft-intune endpoint-management powershell it-operations

Four step walkthrough: Adobe Express Photos appeared via Acrobat, finding the Photoshop Express package name in PowerShell, removing it with Intune Remediations, and the registry opt out

Last week I turned on my work computer and noticed something odd: Adobe Express Photos had just appeared on the machine.

That should not happen without a deliberate install. The apps at work are managed through Microsoft Intune, so I wanted to find out how it got there.

Digging into how it arrived

I found that Adobe’s Acrobat update process could install Adobe Express Photos under certain conditions. Adobe documents this behaviour for administrators, including when the app may install itself with Acrobat updates and how to opt out.

My first thought was to use the Microsoft Store app package and configure an uninstall through Intune.

No luck.

After investigating further, I found that the app was actually listed as Photoshop Express on the system, apparently its previous name. In PowerShell the package showed up as AdobeSystemsIncorporated.AdobePhotoshopExpress (display name Adobe Photoshop Express), which is why a simple “Adobe Express Photos” Store uninstall path did not line up cleanly.

Remediating with Intune

In the end, I used a PowerShell script deployed through Intune Remediations to remove it. A sanitised, illustrative version looks like this:

# Check if Adobe Photoshop Express is installed
$package = Get-AppxPackage -Name "AdobeSystemsIncorporated.AdobePhotoshopExpress"

if ($package) {
    Write-Host "Removing Adobe Express Photos / Photoshop Express..."
    $package | Remove-AppxPackage
} else {
    Write-Host "App not found."
}

I also found that Adobe provides a registry setting to disable the related installation feature:

Registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown
Value: bDisableHarmonyInstallationFeature
Type: REG_DWORD
Data: 1

(That path matches Adobe’s administrator FAQ. On LinkedIn I had a missing backslash in the typed path. The value name above is the important part.)

After removing the app, I applied the registry policy via Intune so Acrobat would not quietly put it back on the next update.

I was not the only one

While looking into this, I also came across another user reporting a similar issue, including problems with screen capture. See this Adobe Community thread. Adobe’s own guidance for admins is in the Adobe Express Photos FAQs for administrators.

Apparently I am not the only one who was surprised by this.

Takeaway

I learned that managing apps also means watching how they update, and whether they add anything after deployment.

Intune does not prevent every app surprise. When one turns up, I need to work out what caused it and how to fix it.

Now, if only applications would ask before inviting their friends onto my computer.

Originally shared on LinkedIn.

From the lab: more Intune practice notes in the planned Intune home lab entry (placeholder).

← All posts