2   Feature lockdown

Optional

Acrobat 11.0 introduces lock feature settings for Macintosh. Like Windows, feature lockdown allows IT to create settings that cannot be changed by end users. Since the Wizard modifies the installer, the embedded feature lockdown file will be installed on all end user machines at install time. For features that have a user interface (UI), the UI is either removed from the product or greyed out thereby indicating it is disabled.

Note

The feature lockdown file is a system-level plist file in for a root account. These files do not exist by default.

To lock preferences:

  1. Create a plist file named com.adobe.Acrobat.Pro.plist or com.adobe.Reader.plist.
  2. Check Enable Feature Lockdown.
  3. Browse to the plist file you created.
  4. Choose OK.

Note: the Wizard places the file in /Library/Preferences/. If a plist already exists at that location, the existing 11 hive content is replaced by the new content generated by the wizard. All other hives within that plist remain untouched.

2.1   Lockdown file construction

The file format is an xml plist and many of its details parallel the way feature lockdown is implemented for Windows. While full details reside in the Administration Guide and the Preference Reference at http://www.adobe.com/go/acrobatetk, these ideas are key:

  • Preferences always reside under the appropriate version hive (e.g. 10, 11).

  • Not all preferences can be locked, but what can be locked is identical for Windows and Macintosh.

  • The preference is prepended by the data type (version and section nodes do not have a data type). The following is supported:

    • b: boolean
    • t: string
    • c: dictionary
  • The syntax varies by plist parser type. However, structure/hierarchy mirrors the Windows registry path. For example:

    • Windows: [HKLM root\<version>\FeatureLockDown]bUpdater
    • Mac:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>11</key>
  <dict>
    <key>FeatureLockdown</key>
      <dict>
       <key>bUpdater</key>
       <false/>
  </dict>
</dict>
</dict>

In the example above, the Updater preference is represented as a single boolean plist key named bUpdater and the initial letter ‘b’ signifies the type of preference. This value disables the Updater. It also removes UI items, including Help > Update Acrobat XI Pro and the Updater settings under Preferences.

The following example is not in XML format, but is constructed similarly:

>> ] /Services [ /c << /EnableEchoSignDetection [ /b false] >> ] >>

2.2   Lockdown example

The example below selectively blacklists the Javascript API app.alert for all PDFs.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>11</key>
    <dict>
      <key>FeatureLockdown</key>
        <dict>
        <key>cJavaScriptPerms</key>
          <dict>
            <key>tBlackList</key>
            <string>App.alert</string>
          </dict>
        </dict>
     </dict>
</dict>
</plist>