Java security warnings in IE11

[fleXx]

Hi all,

 

Our students are now required to take tests on an online test environment that is run by a company called "EnlightKS", which we were only told about last week..

 

When students go to start the test, some system checks are run before you can actually start the test. It tests things like whether it can open office and opening pop up windows etc.

One of the tests it does is testing whether Java is installed and whether it can run, and we are having an issue with this.

 

The test requires you to accept and run a Java security warning in order for it to actually test whether Java is installed and can run, which is fine, if we were using chrome or firefox...

In chrome and firefox, we get this pop up box, and students can click run, and the test runs and completes, and users can start the test. However, in IE11, which is what we are using, the popup box will not load up, and I cannot figure out why.

FYI we are using Java version 8 update 31.

 

I have tried entering the domain name into the Trusted site list in IE, I have entered the domain name into the security exceptions in the Java control panel, I have ensured that java scriplets, activex controls etc are enabled in IE's security settings for Trusted sites, I have enabled absolutely everything in the security settings for Trusted Sites, windows is fully up to date, I have tried using a different proxy etc and I cannot get this pop up box to show.

 

If i revert a test machine back to Java version 7 update 71, the popup box then shows, and users can click run and do the test, so at the moment as a temporary fix, that is what we have done, reverted a bunch of machines to that version of java and they are running the tests. This would be fine, however, we have other software installed that requires the lastest version of java....

 

On rare occasions, the popup box will show up using version 8 update 31, and we can click run and the test will run, but it is so inconsistent that we cannot role it out properly to all machines.

 

Has anyone got any ideas at all? I am willing to try anything at this point...

 

Thank you very much in advance

[Michael]

The security in Java 8 is far greater than in Java 7 as you've noticed. If you navigate to Control Panel > Java > Security (tab), you can specify sites in the exceptions list, so your website should then work as expected.

 

With some clever trickery, you can deploy these settings using Group Policy and scripts following my example here. I hope this helps! The same rules apply, irrelevant of the website.

 

One advantage of my method is it deploys setting on a per computer, rather than per user basis which can save you a lot of time!

Edited January 26, 2015 by Michael

[webbobfc]

We are getting the exact same issue at my School. We are using the older version of Java at the moment, as soon as I upgrade to version 8 update 31 it doesn't want to work. I have logged a call with Enlight but they haven't resolved as of yet. If you find any solutions let us know.

 

Cheers.

[fleXx]

Thanks for your reply Michael,

sorry, I obviously forgot to include that as one of the things I have tried, I have been working on this for so long now that I cant quite remember what I have and havent done, but I will read your guide anyway as I'm sure that this will come in handy in the future, thank you

 

Will do Webbobfc, and the same to you if you find a solution please

[fleXx]

For all who are having a similar issue, it turns out that Java version 8 doesn't play well with IE proxy settings, so I had to manually specify the proxy in the Java control panel, rather than telling it to look for IE for proxy settings and it seems to have fixed the issue.

I then deployed these settings via GPO using the java deployment.config and deployment.properties method.

[synaesthesia]

We are loving this currently. I've just fired off an email to these incompetent muppets asking a) why the hell are they using Java b) why it doesn't work properly even with the correct version. Their system requirements state Chrome works fine however that's just not right....

[fleXx]

Why they are only supporing chrome I do not know. You would of thought that IE would have been their main concern as this (I assume) is the most used browser when it comes to business use...?

We have repeatedly had talks in the office about using an alternative browser but no one wants to be responsible for managing it

[PaulBM]

Oh no, I've just been asked to set up Enlight for our school in June. My first question was why on earth are they using Java and it appears they don't support java 8 yet! Running a test as student user, the applets are blocked as you'd expect. The saga begins!

[mrnoisy]

I spent a week sorting out this mess in our school, enlightks support was next to useless, we ended up doing it ourselves, even then at best it's flakey. Good luck !

[PaulBM]

The .NET test was still reporting In Progress when I returneed this morning. They have sent a 21 page PDF of requirements!

 

First job, search the Chrome settings GPO to allow popups!! How very 1990s.

[SHimmer45]

we have been running enlightKS for our ECDL and is a bit of a pain for it to work correctly.

we use it with IE 10/11 and office 2010 and it works ok apart from having to keep the version of java very up todate.

java 8 needed some tweaking (adding the enlight sight to the security allow list turning off update notifications etc, all done with the deployment options within java)

deploying the deployment files for java i do by scripting rather than GPP currently as still testing a couple of options.

it should have java 8 support as anything less it moans like hell?

[synaesthesia]

Had a reply from Enlight yesterday suggesting I change Chrome's settings to allow npapi. Shouldn't have to, it's being disabled for a reason, but never mind. GPO'd out to enable them again for the time being. However they did confirm they were working on an update to remove the Java requirement.

Considering how long developers have been aware of this, it's a bit daft however not entirely surprising.

[PaulBM]

... deploying the deployment files for java i do by scripting rather than GPP currently as still testing a couple of options.

 

Would you mind sharing your script for Java deployment? If I can get Java security sorted I think I'll be there. Well the tests will all work, then it's looking at the Microsoft Office UI requirements!

 

I'm still amazed that the Java MSIs are only available to paying 'Enterprise' customers, especially when they can be grabbed during a regular the install anyway.

Edited April 29, 2015 by PaulBM

[SHimmer45]

Would you mind sharing your script for Java deployment? If I can get Java security sorted I think I'll be there. Well the tests will all work, then it's looking at the Microsoft Office UI requirements!

 

all i do is roll out the MSI for java via AD

then use a .bat file containing this:

 

net use b: \\**PCNAME**\C$\Windows\Sun\Java\Deployment

xcopy javadeploymentfilelocation\*.* b: /S /E /I /Y

net use b: /delete

 

the deployment files i copy to the machine are the DEPLOYMENT.CONFIG & DEPLOYMENT.PROPERTIES files with my chosen options

 

DEPLOYMENT options documentation can be found:

JAVA 8 DEPLOYMENT DOCUMENTATION

 

EDIT

my deployment.properties file

#deployment.properties

deployment.user.security.exception.sites=\\\\servername/java_exception/exception.sites

deployment.webjava.enabled=true

deployment.webjava.enabled.locked

deployment.security.level.locked

deployment.security.level=HIGH

#EXPIRATION CHECK

deployment.expiration.check.enabled=false

deployment.expiration.check.decision.suppression=true

deployment.expiration.check.decision=NEVER

#PROXY SETTINGS

deployment.proxy.type=1

deployment.proxy.same

deployment.proxy.http.host=http://proxyaddress

deployment.proxy.http.port=proxyport

#JNLP SETTINGS

deployment.javaws.associations=1

deployment.javaws.associations.locked

deployment.security.sandbox.jnlp.enhanced=true

 

will be ditching the script in favour of GPP soonish if i make a change for the java options i have to remember to recopy the files

Edited April 29, 2015 by SHimmer45

[bossman]

I've just been given this 17 page document by our head of ICT with the words "I don't have a clue what this is all about but I'm sure you will!"

 

What a pile of Cr*p!!!

 

Its so full of holes it's like a colander!

 

Why would you allow macros to run without being digitally signed is beyond me, even the Excel application tells you (Not recommended) plus allowing pop-ups in the browser plus a myriad of other such drivel!!

 

I am surprised BCS use such an incompetent company to deliver its exam module online!

 

But who am I? Just the person who has to make all this work within the next 2 weeks and without any testing so I am led to believe by the head of ICT, apparently EnlightKS don't allow you to run tests.

 

I find this very hard to swallow like a bur!

 

I have told them without testing I cannot guarantee that the exams will run smoothly if at all, we shall certainly see on the day!

 

Have fun everyone

[7UD9]

I've just been given this 17 page document by our head of ICT with the words "I don't have a clue what this is all about but I'm sure you will!"

 

What a pile of Cr*p!!!

 

Its so full of holes it's like a colander!

 

Why would you allow macros to run without being digitally signed is beyond me, even the Excel application tells you (Not recommended) plus allowing pop-ups in the browser plus a myriad of other such drivel!!

 

I am surprised BCS use such an incompetent company to deliver its exam module online!

 

But who am I? Just the person who has to make all this work within the next 2 weeks and without any testing so I am led to believe by the head of ICT, apparently EnlightKS don't allow you to run tests.

 

I find this very hard to swallow like a bur!

 

I have told them without testing I cannot guarantee that the exams will run smoothly if at all, we shall certainly see on the day!

 

Have fun everyone

 

If you call them they will provide a test account, I got one set up today.

 

Call BCS on 01793 417 530 and tell them you need a test account for ET2, they had someone call me back who set me up with an account within the hour.

 

I'm now stuck finding out why Java is disabled in the browser (IE11)

 

Good luck!

[bigjb]

Any ideas what setting can be changed to remove this message? Using java 8 u131 and tried as a site exception in java control panel/trusted site in ie11