Java updates on domain machines

Uhtred · 7 Oct 2009 at 15:59

Hi there,

I have 200 odd machines with no admin rights (vista/xp). Every day i get asked by 2-3 people about the ****ing java auto update popup. Because they have no admin rights the autoupdate option is greyed out.

WHat's the best way to disable this on 200 odd machines?

ruffneck · 7 Oct 2009 at 16:05

These keys via GP should work

[HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy]
"EnableJavaUpdate"=dword:00000000
"EnableAutoUpdateCheck"=dword:00000000

Ev0 · 8 Oct 2009 at 00:01

My installer disables the autoupdate during install, the reg keys above should work as a remedial solution

In future for installs/when upgrading to newer version create an MST for the MSI installer that disables it.

Uhtred · 9 Oct 2009 at 11:22

Thanks guys. I've tested this and I'm about to roll it out on Monday.

THe second key doesn't seem to be present in the newer versions of java but the first key just removes the whole tab so that will do!

Ev0 · 9 Oct 2009 at 18:31

I've been off all week but will check Monday exactly what I change

Muffin` · 11 Oct 2009 at 14:51

\\xxxx\Deployed\Java6.13\jre-6u13-windows-i586-p-s.exe /s /v"/qn ADDLOCAL=ALL IEXPLORER=1 REBOOT=Suppress JAVAUPDATE=0 /L c:\swsetup\jre6u3.txt

: Disable Update
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableJavaUpdate /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v EnableAutoUpdateCheck /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v NotifyDownload /t REG_DWORD /d 0 /f
REG ADD "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v NotifyInstall /t REG_DWORD /d 0 /f
REG DELETE "HKLM\SOFTWARE\JavaSoft\Java Update\Policy" /v PromptAutoUpdateCheck /f

I had to be sure......

Uhtred · 12 Oct 2009 at 11:37

THanks for all your help guys. So far it seems to be working great but I've noticed 64bit machines have the key in a different place ie

HKLM\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy

All our 64bit machines are in the same GPO as 32bit but am I right in thinking that there will be no impact to 32bit machines if i add this key to my script as well?

I'm guessing windows would just ignore the Wow6432Node branch. I'm going to do some testing...

Ev0 · 12 Oct 2009 at 12:45

Just looked at my install, I set the following to 0 on install using a trasform (MST file):

AUTOUPDATECHECK
JAVAUPDATE
JU

These are all public properties so can also be set on the install command line, i.e. AUTOUDATECHECK=0, they just change the corresponding reg keys as discussed above.

My install then also sets a value of 0 for the following reg keys:

HKLM\SOFTWARE\JavaSoft\Java Update\Policy\EnableJavaUpdate
HKLM\SOFTWARE\JavaSoft\Java Update\Policy\NotifiyDownload

You could also set these reg keys in the MST file too.

Same for your 64bit issue, could always create a transform for those values, using something like Orca.