Over the past several weeks, there has been great concern over some new Java bugs that compromise computers. I had been doing Java updates manually, per machine, up until now as (a) we have a slower network and (b) I wanted to roll out new installers via Group Policy after running extensive tests to make sure nothing broke.
So, given the increased rate of Java updates, I decided it was time to begin rolling out Java updates via GP.
1. Download and extract msi installers.
a. Download the offline Java 32- and 64-bit installers and extracted the 'jre_1.7.0" and "jre_1.7.0_x64" folders from ~\AppData\LocalLow\Sun\Java and copied them to my Desktop.
NOTE: This how-to makes reference to Java 7 update 11, but it can apply to any new version of Java.
2. Edit the properties of the msi installers.
Right-click on each msi installer and open it with Microsoft's Orca or Pantaray's SuperOrca. Make the following PROPERTY edits:
AUTOUPDATECHECK = 0 / EULA = 0 / IEXPLORER = 1 / JAVAUPDATE = 0 / JU = 0 / MOZILLA = 1
See this web page at Oracle for additional information and adjust to meet YOUR needs: http://www.oracle.com/technetwork/java/javase/silent-136552.html
3. Upload msi installers to your server and create Group Policies.
Upload the msi installer folders ("jre_1.7.0" and "jre_1.7.0_x64") to your server. I could create just one group policy encompassing both, but I prefer two separate policies so I can differentiate which ones get loaded for WinXP vs Win7 machines. For my needs, I use the 32-bit policy for WinXP machines and both 32/64-bit policies for Win7 machines.
1. Create a new Group Policy Object called: Java 7 update 11 x32
2. Create a new Group Policy Object called: Java 7 update 11 x64
FOR EACH POLICY:
a. Open: Computer Configuration > Policies > Software Settings > Software installation.
b. In the right pane, right-click and select New > Package.
c. Navigate to the folder where your msi installers are installed and select the msi installer.
d. Choose Advanced.
e. Click the Deployment tab. Place a checkmark ON "Uninstall this application when it falls out of the scope of management". This will ensure that when I delete the policy from an assign AD OU that the corresponding app will automatically be uninstalled before new versions are installed.
f. Click the Security tab. Assign security permissions as needed. Often times the defaults are fine. I have tended to give full permissions to all of the default "users" listed and do NOT add any additional users.
g. Click the OK button.
h. Close the Group Policy Management Editor.
4. Create a batch file to uninstall earlier versions of Java.
Since this is the first time that I'm deploying Java via Group Policy, I need to ensure that all older versions of Java are uninstalled before the newest Java is installed.
a. Using a text editor, create a batch file called: java_uninstall.bat
b. REM uninstall all current instances of java 7
c. REM 20130114.0930 by david allie
d. REM
e. @echo off
f. REM next line checks to see if c:\java_uninstalls.txt exists.
g. REM if it does, the rest of the script does not process.
h. REM this is a simple way to use a run-once script.
i. if exist "c:\java_uninstalls.txt" goto end
j. REM
k. wmic product where "name like 'Java(TM) 6%%'" call uninstall /nointeractive
l. wmic product where "name like 'Java(TM) 7%%'" call uninstall /nointeractive
m. REM create the c:\java_uninstalls.txt file to ensure above-command
n. REM does not run again.
o. echo 20130114_0930 older java 6-7 uninstalled. > c:\java_uninstalls.txt
p. echo Do NOT delete this file as it will cause Java to uninstall on next 'gpupdate'. >> c:\java_uninstalls.txt
q. attrib +h c:\java_uninstalls.txt
r. :end
s. exit
5. Copy the batch file to your server and create a Group Policy.
a. Copy the batch file to your server.
b. Create a new Group Policy called: Java uninstall all
c. Edit the new policy.
d. Open Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown)
e. Double-click on Startup.
f. Click the Add button and add your newly created batch file.
g. Click the OK button.
h. Close the Group Policy Management Editor.
6. Add the new policies to an Active Directory OU.
a. Add the new policies to an Active Directory OU.
b. Sort the new policies so the "Java uninstall all" policy executes BEFORE the x32 and x64 Java policies.
c. I use an Active Directory OU named "Tech TESTING" to test policies before widespread deployment and below is a pic of how it currently looks on my system:
d. Group_policy_management_01_big
7. Test and deploy.
Using the computer in my "Tech TESTING" OU, I run 'gpupdate /force /boot'. Once the computers restart, log in, open the Control Panel, and verify that the Group Policies are working as desired.
Conclusion
This setup worked well for me. On my test computers, I had either Java 7u9 or 7u10 already manually installed. Upon running 'gpupdate' and rebooting, the startup script ran once to clear out the older versions of Java and then installed the newest update.
The small text file (c:\java_uninstalls.txt) is hidden and small, so I don't mind leaving it on the computers. Once all my computers have gpupdated to Java 7 Update 11... and when the next 7u12 update is available, I can delete the Group Policy containing the batch file.
Thanks David Allie!
)
) that would like to see my updates….so the question is….”How can update both FB from Google+. (my props to Josh for coming up with the method…not bad for a Liberal! 
… no big deal, it’s free (yes another account to keep track of)…
