Add Admin Control for ArcGIS Pro Software Updates

[JosephMcGehan]

Add Admin Control to ArcGIS Online (AGOL) to permit or block ArcGIS Pro Software Updates. 

ArcGIS Pro has a check for software update function, that allows users to download updates if they are connected to AGOL. This application setting is controlled by registry setting. Users can modify the registry and download software. This has created issues like; project compatibility issues between team members, functionality issues with add-ins, support issue where users want to know things about tools our GIS Managers have not tested yet, performance issues because our configuration XML was not designed for the new variables in the software. We have hundreds of users, and we like to test software with a strategical approach. 

We have a corporate AGOL. As an admin I would like a variable that controls access to ArcGIS Pro software updates. 

[RichardDaniels]

This ability is already available in the ArcGIS Pro installation within the command line during install or as a registry setting found with in the MSI install package. If you are doing managed deployments, you should set the 'do not check for updates' option.

Command line:

msiexec /i ArcGISPro.msi ALLUSERS=1 ESRI_LICENSE_HOST=my_license_server  SOFTWARE_CLASS=Viewer LOCK_AUTH_SETTING=False AUTHORIZATION_TYPE=CONCURRENT_USE CHECKFORUPDATESATSTARTUP=0 ACCEPTEULA=YES

Install Editor (Orca.exe)

Find the Property table within your MSI and set the CHECKFORUPDATESATSTARTUP setting, set to 0. Of note, most command line parameters can be set in this table as well.

[JosephMcGehan]

@RichardDaniels That registry key keeps getting hacked by users. That's why want an additional control on the AGOL side. We were using a GPO to set that registry key, but our IT now require a software package, which we also set that key. - It's all fun and war games. 

[RichardDaniels]

Most users should not have Admin permissions on their computers.  We enforce install as allusers=true to prevent this -otherwise different users can install ArcGIS Pro with different versions on the same machine. Allowing individual installs makes it near impossible to do managed deployments.

Just me, but since I have IT support with Software Center and Intune Company Portal available, I never would enable or use ESRI's or AGOLs software auto-download/update function for ArcGIS Pro. 

[JosephMcGehan]

@RichardDaniels "should" is not the same as reality. The fact on the ground is they can, and they have a strong business case for it. I would love to lock it down, but that's not going to happen. A single control in AGOL would be effective. 

[JenniferBorlick]

"Thank you for your inquiry. It is my understanding that you hacked your Registry and downloaded a version of ArcGIS Pro that has not been tested nor approved. As a result this no longer works. You have violated IT protocol and, as such, we will need to reimage your computer. Please ensure all crucial documents are backed up and  re-package your projects to an earlier version so you will be able to open them after the reimaging. Please let me know when you have completed these tasks and I will begin reimaging. I will let you know when the process is complete. With my given workload, that should be about 2 days.

In the future, please do not install unauthorized versions of software so we can maintain a smooth transition for everyone."

(Wouldn't it be nice to send that email? LOL)

[JosephMcGehan]

@JenniferBorlick We have a more politically correct version of that as a policy. But it's ineffective. 

[CalvinHarmin]

This is kind of getting into the IT weeds here, but if your users share an Active Directory domain, you may be able to impose a Group Policy that restricts ability to edit the registry.

[JosephMcGehan]

@CalvinHarmin AD groups are great. We are put our users in one to deploy our software packages to company portal. Our IT lock the admin settings for all 70k users, then give our users (600 odd) a tool to unlock the settings. We did use a GPO and it was good at applying registry settings, it was not so great at folders and files in the volumes we had. 

[JenniferBorlick]

@JosephMcGehan I figured. I was just being spicy. 🙂