Uninstall Adobe Flash Player

What the Adobe Flash Player removal Worklet does

This Automox Worklet™ removes Adobe Flash Player from Windows endpoints and cleans up the artifacts the standard uninstaller leaves behind. The Worklet first checks the Uninstall registry keys to confirm Flash is present, then downloads Adobe's official uninstall_flash_player.exe utility and runs it silently with -uninstall -force flags. After the uninstaller exits, the Worklet removes Macromed Flash directories and any remaining Flashutil binaries before reporting compliance.

The script checks both the native 64-bit Uninstall hive and the Wow6432Node 32-bit path to detect ActiveX, NPAPI, and PPAPI variants. On 64-bit systems it opens both registry views explicitly so no variant is missed. After the uninstaller runs, the Worklet executes a script block in the correct 64-bit context to remove Macromed Flash directories from both System32 and SysWOW64 and to run any remaining Flashutil*ActiveX.exe, Flashutil*Plugin.exe, or Flashutil*pepper.exe binaries with -uninstall -force before deleting the directories entirely.

After the uninstaller phase, the Worklet invokes a Shell helper that runs in the correct 64-bit PowerShell context on 32-bit agent processes. The helper checks for Flashutil binaries matching the ActiveX.exe, Plugin.exe, and pepper.exe suffixes in both Macromed Flash directories, runs each with -uninstall -force to let the binary clean up its own registration, then calls System.IO.Directory::Delete on both C:\Windows\System32\Macromed\Flash and C:\Windows\SysWOW64\Macromed\Flash to remove the directories entirely.

Why remove Adobe Flash Player from every endpoint

Adobe ended support for Flash Player on December 31, 2020, and shipped a runtime kill switch on January 12, 2021 that blocks Flash content from executing. The product receives no further security updates from Adobe. Any Flash binary still on a Windows endpoint is unpatched code with a long CVE history, including arbitrary remote code execution flaws like CVE-2018-15982 and CVE-2020-9633 that attackers continued to weaponize after end of life. CISA, the NSA, and the CIS Microsoft Windows Benchmarks all call for full removal from production endpoints.

Manual uninstalls reliably miss something. End users skip prompts. GPO removal scripts run once and never re-check. Imaged endpoints from 2019 still carry Flashutil binaries in System32 that the Programs and Features uninstaller never touches. The result is a long tail of endpoints that look clean in the asset inventory but still expose Flash artifacts to anything scanning for them.

This Worklet runs the documented removal procedure end to end: download Adobe's signed uninstall_flash_player.exe, run it with the force flags, fall back to msiexec /x for MSI builds, then sweep the Macromed directories, FlashUtil binaries, and Uninstall registry entries the installer leaves behind. Every evaluation cycle re-checks the result against the same five artifacts, so a re-imaged endpoint, a restored backup, or a forgotten 2019 image cannot quietly reintroduce the unpatched runtime. Endpoints already clean exit at evaluation without touching the network.

How Adobe Flash Player removal works

1. Evaluation phase: The Worklet enumerates HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and its Wow6432Node counterpart, looking for any DisplayName matching Adobe Flash Player (ActiveX, NPAPI, or PPAPI variants). It also checks HKLM:\SOFTWARE\Macromedia\FlashPlayer for legacy installs and inspects C:\Windows\System32\Macromed\Flash and C:\Windows\SysWOW64\Macromed\Flash for stray Flashutil binaries. If any of these indicators are present, the endpoint is flagged non-compliant and remediation is scheduled.

2. Remediation phase: The Worklet downloads uninstall_flash_player.exe from Adobe's fpdownload.macromedia.com host into a working directory under %TEMP% and runs it with /uninstall and force arguments so no interactive prompt blocks the policy. For MSI-deployed builds, the script falls back to msiexec /x against the cached product code. After the uninstaller exits, the script removes the Macromed Flash directories from both System32 and SysWOW64, deletes any remaining FlashUtil*.exe files, clears the Uninstall registry entries, and removes HKLM:\SOFTWARE\Macromedia\FlashPlayer. A final evaluation confirms zero artifacts and exits 0 on success.

Adobe Flash Player removal requirements

• Windows 10, Windows 11, or Windows Server 2016 and later (workstation and server SKUs)

• Local administrator rights for the Automox agent so the script can write to HKLM, delete files from System32, and invoke msiexec

• Outbound HTTPS connectivity from the endpoint to https://fpdownload.macromedia.com to fetch uninstall_flash_player.exe; pre-stage the file with a companion Worklet if the network blocks Adobe domains

• PowerShell 5.1 or later on the endpoint (default on every supported Windows build)

• A timeout window of 300 seconds for the uninstaller process; tune the $timeout variable upward if endpoints on slower disks consistently exceed it

• For Flash Player bundled into Microsoft Edge or Internet Explorer, follow Microsoft KB4577586 from the Update Catalog; this Worklet does not modify Edge or IE components

Expected state after Flash Player removal

After a successful remediation, no Adobe Flash Player entries appear under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall or its Wow6432Node mirror, the HKLM:\SOFTWARE\Macromedia\FlashPlayer key is gone, and neither C:\Windows\System32\Macromed\Flash nor C:\Windows\SysWOW64\Macromed\Flash exists on disk. Get-ChildItem against either path returns nothing, and Get-ItemProperty against the Uninstall keys returns no Flash DisplayName matches. The Automox activity log reports exit code 0.

On the next scheduled evaluation, the Worklet finds no Flash artifacts and reports the endpoint as compliant without re-running the uninstaller. Schedule the policy on a recurring cadence so any re-imaged endpoint, restored backup, or rogue installation is caught and cleaned automatically. For audit evidence, export the Worklet's compliant-endpoint list alongside CIS Benchmark control 18.9 (Disallow legacy plug-ins) or the relevant PCI-DSS 6.2 patch management section.