blog

When Acrobat quietly installs Adobe Express Photos

Adobe Express Photos appeared on a managed PC via Acrobat’s update path. How I investigated it in Intune and blocked it going forward.

microsoft-intune endpoint-management powershell it-operations

Four-step walkthrough: Adobe Express Photos appeared via Acrobat, finding the Photoshop Express package name in PowerShell, removing it with Intune Remediations, and the registry opt-out

Last week, I turned on my work computer and noticed something unexpected: Adobe Express Photos had appeared on the machine.

That should not happen without a deliberate install. Our company apps are managed through Microsoft Intune, so naturally I wanted to find out how it got there.

Digging into how it arrived

After doing some digging, I found that Adobe’s Acrobat update process could install Adobe Express Photos under certain conditions. Adobe documents this behaviour for administrators, including when the app may auto-install with Acrobat updates and how to opt out.

My first thought was to use the Microsoft Store app package and configure an uninstall through Intune.

No luck.

After investigating further, I found that the app was actually listed as Photoshop Express on the system — apparently its previous name. In PowerShell the package showed up as AdobeSystemsIncorporated.AdobePhotoshopExpress (display name Adobe Photoshop Express), which is why a simple “Adobe Express Photos” Store uninstall path did not line up cleanly.

Remediating with Intune

In the end, I used a PowerShell script deployed through Intune Remediations to remove it. A sanitised, illustrative version looks like this:

# Check if Adobe Photoshop Express is installed
$package = Get-AppxPackage -Name "AdobeSystemsIncorporated.AdobePhotoshopExpress"

if ($package) {
    Write-Host "Removing Adobe Express Photos / Photoshop Express..."
    $package | Remove-AppxPackage
} else {
    Write-Host "App not found."
}

I also found that Adobe provides a registry setting to disable the related installation feature:

Registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown
Value: bDisableHarmonyInstallationFeature
Type: REG_DWORD
Data: 1

(That path matches Adobe’s administrator FAQ. On LinkedIn I had a missing backslash in the typed path; the value name above is the important part.)

After removing the app, I applied the registry policy via Intune so Acrobat would not quietly put it back on the next update.

I was not the only one

While looking into this, I also came across another user reporting a similar issue, including problems with screen capture — see this Adobe Community thread. Adobe’s own guidance for admins is in the Adobe Express Photos FAQs for administrators.

Apparently I am not the only one who was surprised by this.

Takeaway

This was a good reminder that managing applications is not just about controlling what gets installed deliberately. We also need to understand how existing applications update, bundle additional components, and behave after deployment.

Even with Intune managing devices, unexpected application behaviour can still happen. Knowing how to investigate the cause and deploy a remediation is just as important as having the management policies in place.

Now, if only applications would ask before inviting their friends onto my computer.

Originally shared on LinkedIn.

← All posts