Managing Java

[Michael]

Hello all,

 

I'm being told or 'recommended' by Birmingham LA to install Policy Central 6, which requires Java to be installed.

 

So how are you guys managing/controlling/deploying Java in a network environment? How are you stopping Update Prompts going to end users? I know deploying via an MSI is an option, but what about deploying updates? Surely there's got to be a better way other than deploying a huge Java update every month?

 

All comments welcome!

[bossman]

@Michael

 

I use PDQ deploy which costs approx £250 per year for the license and just does what it says on the tin for deployment of all our runtime engines and little fiddly stuff which requires constant updates.

 

Select your runtime app point at the workstations which are automatically brought in by linking the program to your AD and then make sure all your workstations are on and deploy on mass, 10 mins later bingo! latest runtime engine installed.

 

The company update all the runtime engines for free immediately on release and put other meaningful apps in the database. I would definitely recommend very highly.

 

You can trial it before buying and it is so easy to use.

 

Deploy Software with PDQ Deploy

 

Give it a whirl

[FN-GM]

Can you import it as a software update into SCCM like you can with Flash?

[markwilfan]

We use sccm retiring older packages as they get released. Install switch turns off nagging updates and sccm package deploys site exceptions to the clients to get around unsigned java. This auto deploys once a day

[harriuk]

We use sccm retiring older packages as they get released. Install switch turns off nagging updates and sccm package deploys site exceptions to the clients to get around unsigned java. This auto deploys once a day

 

Err... tell me how!! You kept that quiet with all the trouble we had with Java..

[markwilfan]

Will post how I do it when I'm on a PC

[AliG]

We also use PDQ Deploy, we used to spend hours every few months creating packages, sometimes screwing it up! Now with PDQ Deploy/Inventory just set it and forget it! Even better now it as autodeployment options

[markwilfan]

@harriuk this one is for you but may help others too

 

Make java SCCM Application as normal using the msi extracted to %USERPROFILE%\AppData\LocalLow\Sun\Java when you run the offline installer.

 

Use this in the Installation program box in the SCCM application

 

msiexec /i name_of_msi.msi JU=0 JAVAUPDATE=0 SPONSORS=0 AUTOUPDATECHECK=0 RebootYesNo=No WEB_JAVA=1 /q

 

Totes obvs change the filename to something relevant to the same of your file you deploy

 

more switches here if you want them Installing With a Configuration File

 

I retire the old versions then and tell new application to supersede the old ones too.

 

As of Java 8 only high and very high security modes are available. So to get around sites that use code that is unsigned and "MUST" be used we use a central site.exceptions file deployed via the following method.

 

The following files are stored in a share; deployment.properties, deployment.config, & exception.sites . Add any sites you want to bypass the java security on. Wildcards do not work though.

 

Make an SCCM package that runs a .bat file with the following in

 

rem @echo on
rem copy files used for Java settings

rem ***************delete Java settings**************************
del /s /q /f "C:\Windows\sun\java\deployment\*"


rem ***************Java settings copy **************************
xcopy /C/Q/Y/R/E "\\servername\sharename\Java\*.*" "C:\Windows\sun\java\deployment"

 

Totes obvs change the share to something relevant to your network

 

Then deploy the package to a collection of your choice making the deployment rerun on a schedule. All you have to do is add sites into the site.exception file in the share then either wait for the schedule to run or manually rerun it.

 

We only do this for student devices at the moment as if you use the above method to centrally manage the site exceptions users cannot add their own. I am considering just deploying to all to make things more secure but remember kids; security and convenience are directly opposed = potentially more support tickets.

 

Hope this helps somebody

java deployment files.zip

[SHimmer45]

using the deployment config files and properties for java seems to keep it under reasonable control (and allows management of a centralized allow list etc).

still a pain sometimes

[Michael]

Thanks for all the replies - ideally I'm looking for something free, as some of the sites I support are comparatively small. The PDQ offering and indeed SCCM are good solutions, but of course they come at a price.

 

I'm just somewhat stunned that there are no official Java management tools or a console, just to see what's installed on client workstations.

 

I already deploy Java exception websites using a GPP I created, so on-going it costs schools I manage nothing. Other than deploying an MSI every time a new Java version is released, I still have no way of monitoring what's installed on the client device. Older versions of Java seem to 'stick' for whatever reason.

 

Maybe Microsoft will integrate Java and updates into Windows 10 as they have done Flash. Clutching at straws here....

[SHimmer45]

for a bit more work i remove the old version on Java before rolling out the new package by remotely running the uninstaller. using psexec and then rolling out the package using AD.

[Michael]

Positive update: Installing PDQ Inventory, then select the Free license, I can select all Computer Objects from Active Directory, perform a scan, then select individual Properties of each computer. This reveals what applications are installed which is pretty good.

 

The cool bit is then you can select all Computer Objects > Run Report > Application Counts and it'll tell me how many computers have Java 8 Update 45 installed for example, as well as older versions where applicable. I can't work out (if it's at all possible), how I can add a custom Java column to see what version is installed without having to look at the Properties of each computer. Any pointers would be welcome!

 

I think we're nearly there, as I'm happy to continue deploying Java via an MSI if I can properly monitor the number of successful deployments.

[Trojan]

I too am wrestling with this right now. I can deploy and update Java through group policy and MSI no problem. It's uninstalling the older non-gpo managed versions I'm having problems with. Any Ideas?

[SHimmer45]

for rooms which i know what is installed i just call msiexec /x "installID" using psexec which is part of PStools

[markwilfan]

Have a look at this https://psappdeploytoolkit.codeplex.com/

 

Specifically this section of the ps script which allows you to pop in applications to be uninstalled first

 

 

#*===============================================
#* PRE-INSTALLATION
If ($deploymentType -ne "uninstall") { $installPhase = "Pre-Installation"
#*===============================================

# Show Welcome Message, close Internet Explorer if required, allow up to 3 deferrals, verify there is enough disk space to complete the install and persist the prompt
Show-InstallationWelcome -CloseApps "iexplore" -AllowDefer -DeferTimes 3 -CheckDiskSpace -PersistPrompt

 

This is an excerpt of my old java deployment ps using psappdeploy

 

#*===============================================
#* PRE-INSTALLATION
If ($deploymentType -ne "uninstall") { $installPhase = "Pre-Installation"
#*===============================================

# Show Welcome Message, close Internet Explorer if required, allow up to 3 deferrals, verify there is enough disk space to complete the install and persist the prompt
Show-InstallationWelcome -CloseApps "iexplore" -AllowDefer -DeferTimes 3 -CheckDiskSpace -PersistPrompt

#remove old versions of JAVA
#check to see if latest version of java is installed if it is bomb out
$JavaVer = Get-InstalledApplication -Name "Java 7 Update 67"
If ($JavaVer -ne $null) {
Exit-Script -ExitCode "06" # I use a custom error code here for tracking.
}

Remove-MSIApplications "Java 6 Update 2"
Remove-MSIApplications "Java 6 Update 20"
Remove-MSIApplications "Java 6 Update 21"
Remove-MSIApplications "Java 6 Update 22"
Remove-MSIApplications "Java 6 Update 23"
Remove-MSIApplications "Java 6 Update 24"
Remove-MSIApplications "Java 7 Update 5"
Remove-MSIApplications "Java 7 Update 25"
#Remove-MSIApplications "Java 7 Update 45"
Remove-MSIApplications "Java 7 Update 51"
Remove-MSIApplications "Java 7 Update 55"
Remove-MSIApplications "Java 7 Update 60"
Remove-MSIApplications "Java 7 Update 65"
Remove-MSIApplications "Java 7 Update 67" 

 

This is how we used to push out Java.

[Michael]

I've noticed the latest Java 8 Update 45 is comparatively smaller than previous updates - the MSI is 35MB, whereas Java 8 Update 31 is 74MB. I also believe the newest Java build comes with its own uninstaller (as I found) when I manually updated Java on my own notebook.

[Michael]

I've managed to sort it!

 

Simply copy the code I've adapted from some code I found online:

 

Long version, all 8 versions and different Java 8 versions (separated) 32/64Bit:

 

Save as Super Java 8.xml, then select File > Import within PDQ Inventory.

 

 

Short version, all 8 versions 32/64Bit:

 

Save as Java 8.xml, then select File > Import within PDQ Inventory.

 

 

End result is something like this:

 

 

Hope this helps someone else!

[Michael]

I've created versions for Java 6 and 7 also:

 

Save as Java 6.xml, then select File > Import within PDQ Inventory:

 

 

Save as Java 7.xml, then select File > Import within PDQ Inventory:

 

 

End result is something like this:

 

[mbedford]

I am probably going to get burned at the steak for saying this. But have you considered not deploying Java. We stopped doing so on our machines (2500 machines across three sites) two years ago and honestly haven't looked back. We have had a couple (less than 20) machines where specific software installs have dictated that we need Java but that't it.

 

It used to be so widely used that you had to push it out a few years back, but i think Java's best days are behind it now

Chrome to Drop Support for NPAPI Plugins Including Java, Silverlight, and Unity

[markwilfan]

Burnt at the steak. Yum. Medium rare please @mbedford

[mbedford]

Burnt at the steak. Yum. Medium rare please @mbedford

 

I re-read "steak" before I posted and said to myself, "yeah, that right!" DUH!!

[bashy]

Agree to pdq deploy. Have moved all quick deploys to them. Splashed out on the enterprise versions to have all the prebuilt packages.

[Trojan]

@mbedford I would love to not deploy java but policy central v6 requires it.

[Michael]

Indeed as above, Policy Central 6 requires Java.

[Trojan]

Although I wish it didn't as I'm having a real mare getting the pce client to deploy !