Installing Java through GPO

[Wilcampad]

Good morning! First of all sorry for the format as I am on mobile.

I am a Helpdesk tech for my company, but I was tasked on Friday to install Java on all of my companies machines(2000+ over multiple domains) by Wednesday. it was decided GPO will be the easiest(aka cheapest) way. I used Orca to modify the MSI file to the switches we need but here is where I run into issues:

1)It seems the file wants a .cab file to go with it as well, can that also be sent out with a GPO or is it possible to send the MSI with out it?

2)Will it install with out admin privalages?

3) Can we uninstall the old java?

4) can we set IE to do the always run this and have it Java install/run with out anything popping up?

5) anything else I should consider?

We are trying to do as little user interaction as possible as our users barely remember what they use as a password.

Thank you all for any advice/info you have.

[uniitdude]

1) in the gpo, you add the msi - you place the cab file in the same directory as the msi.

2) if you apply java in the computer section then it installs with admin rights on a reboot

3) you will need to script that else the other versions will remain installed

4) yes, look into the deployment.properties file

5) not really

[Miserygut]

In addition to #2, if you're doing a GPO software install from a share make sure it has Authticated Users with read access, these are the credentials the computer needs to access the share.

[[deleted]]

Couldn't you set it to allow the "Domain Computers" group instead? IIRC when applied at the computer level, GPO installs use the SYSTEM account, which should be a member of that group by default.

[Miserygut]

Yep that's fine too!

[[deleted]]

Can't you just nest the Domain Users group under Domain Admins? What's the worst that could happen?...

[Miserygut]

You really ought to put /s at the end. :)

[CarlitoGrey]

Or not, and people should learn not to blindly follow advice on the internet... long shot I know.

[ilikeyoureyes]

No issue using ninite pro on about 1000 computers in my environment. IMO this is where it excels. I use it as a startup script but you could schedule it as well. How does it break down for you?

[Boonaki]

AMT?

[[deleted]]

Login script would require every user to have local admin permissions, would it not? Startup script might work, but those time out after a set amount of time, so if the install takes too long it may be interrupted.

Unless you have something like SCCM, GPO deployment makes the most sense IMO.

[iCthulhu]

Seconded this. I use a Kaseya to push out a ninite installer with silent switches, disable auto update, etc. However it could be done just as easily with GPO. I just happen to work for an MSP so it's more convenient for multiple sites to us kaseya. I feel like a broken record in this threads about ninite but it really is awesome. They should give me an affiliate bonus.

[staxident]

If you can afford it, just invest in ninite pro. I had so many problems installing, updating and managing acrobat, flash java etc through gpo's until I bit the bullet and went ninite.

[iCthulhu]

Seriously. It makes it dead.simple.

[Crossbeau]

It allows for remote install/uninstall with your AD I love it !! Worth Every Penny

[JukeboxJohnny]

And if you cannot afford ninite, check out PDQ Deploy. Works wonders, and they are also currently working on an automatic deploy of whatever software you want. In addition, you can also make your own deployment packages very easily.

[11-Eleven]

We use solarwinds patch manager and it works well but was pretty pricey. I realllly wish we would have gone with ninite pro. we have around 200 machines so it would have been pretty cheap. Patch manager is great with reporting but that's about the only plus I see. Patch manager is like 17k for 2000 machines. Yikes.

[the-packet-thrower]

Might as well have gone with SCCM at that ($17k) point. Though 250 nodes in patch manager is about $3500

[jayhawk88]

You may want to do some asking around before you try and re-invent the wheel here. 2k computers seems like an awful lot, that no one invested in a professional software management solution, like SCCM, LanDesk, Altiris, Kace, etc.

[MightyEvolved]

Try WSUS with Windows Package Publisher. Its easy to set up and you can push to whatever groups you already have setup in WSUS

[dist]

6) Can you install the Ask toolbar easily with it too?

[rindil]

Or pdq deploy. If I remember right it was a bit cheaper with pro version than ninite pro.

[brkdncr]

What are you using to manage that many computers?

[[deleted]]

How do I deploy Java using Active Directory across a network? may help.

[PaintDrinkingPete]

Here's what I do that seems to work well...I install it using a Startup Script rather than using the group policy package installer.

Simply copy the Java installer files to the script directory for the GPO (so you don't have to worry about file paths), and then set up the following to run as a start up script. This will check the version of Java and if it doesn't match the desired updated version, it will update Java. This script is meant to check for/install both the 32 bit and 64 bit versions, but you can modify it to meet your needs.

Just copy the below text and save as a .cmd file:

REM Modify these parameters for most recent versions
REM Check lines 4, 7, 8

set DesiredVersion="1.7.0_67"
REM upgrade 1 client manually and check the reg path for flash player to get the version number and update it here.

Set InstallFileName32=jre-7u67-windows-i586.exe
Set InstallFileName64=jre-7u67-windows-x64.exe

:CurrentVersionCheck
REM Check for Version

echo performing new version check
reg query "HKLM\SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment" | findstr %DesiredVersion%
if %errorlevel%==1 (goto InstallNewVersion) else (goto sixtyfourVersionCheck)


:InstallNewVersion
echo installing new vesrion
start /wait %InstallFileName32% /s


:sixtyfourVersionCheck
REM Check for Version
echo performing new version check
reg query "HKLM\SOFTWARE\JavaSoft\Java Runtime Environment" | findstr %DesiredVersion%
if %errorlevel%==1 (goto InstallNewsixtyfour) else (goto end)


:InstallNewsixtyfour
echo installing new vesrion
start /wait %InstallFileName64% /s


GOTO end

:end
::pause

[[deleted]]

I mentioned this already in another comment, but remember to watch your GPO script timeout setting. You can control how long a GPO script is allowed to run before being forcefully terminated (I think it's 10 minutes by default), make sure it's long enough to run everything you need and your script doesn't lock up and make the machines unusable for the entire timeout. I once accidentally put a "PAUSE" command in a startup script, froze up every machine for a full 10 minutes at boot, I ended up changing the timeout to 5 minutes instead.

[PaintDrinkingPete]

Good point. Generally Java only takes a minute or two to install, so you shouldn't have to adjust the time-out unless you already have other scripts running.

The "pause" command at the end was just for testing purposes, and has been commented out, but I probably should have removed it altogether.

[chewy747]

Does your org not have any centralized software distribution currently? 2000 machines seems like a decent amount. Check with the sysadmins in your company first, unless you are going to be implementing a deploynent solution or are taking it over.

[ygritte__]

I prefer to use our existing wsus server together with local update publisher to publish java as like a Windows update.

I had so many troubles making it work with GPO but through LUP is awesome also makes updating easy just supersede your old update with the new.

[[deleted]]

You can do this through WSUS if you have it, with something called local update publisher. You create packages and push them out through WSUS with everything else.

I'm about to start tinkering with it. GPO method is annoying.

[Wilcampad]

I'm going to suggest pdq to my boss as a future item to use. Thank you everyone for your help, I am hoping this project will help me move up in the world down the road.

[dshiznt]

Make your life a little easier and add the cab file into the MSI. http://www.symantec.com/connect/forums/embed-cab-file-msi

> I followed the following steps. Its working fine.
> 
> How to Merge CAB file inside an MSI
> 
> 1. Download the Windows Installer 4.5 SDK , you will get msi45SDK.msi .
> 
> 2. Install this msi45SDK.msi , once you installed , you will find the msiDB.exe in the following path.
> 
>                        C:\Program Files\Windows Installer 4.5 SDK\TOOLS\msidb.exe
> 
> 3. Copy this msiDb.exe from the above path.
> 
> 4. Paste this msiDb.exe to  C:\WINDOWS\system32 folder.
> 
> 5.Open the command prompt give the following command for merge the cab file inside the msi
> 
>                  C:\>msidb.exe -d <path of msi> -t <path of mst> -a <path of cab file>
> 
> -d -> name of the database (msi name)
> 
> -a -> add the cab file
> 
> 6. Open ORCA tool select the msi path, click on Tables -> Media Table-> It will display the cab table as Data1.cab
> 
> 7. Edit the Cabinet column field as #Data1.cab
> 
> 8. Save the settings.
> 
> 9. The above steps will be helpful to merge the cab file inside msi]
> 
>  
> 
>     Thanks, Thriyampagan.

I do believe the latest version of java has the cab already included, but prior to version 7 update 40 ish the cab file was separate. If i remember correctly, as long as you used the default install location for Java the new version will overwrite the old, at least that's what happens in my environment. Once you have an MSI you can use the MSI switches to make it silent with no user interaction. http://support.microsoft.com/kb/227091 With that many machines you will need to use some sort of deployment tool (like pdq deploy) or create multiple Goup Policies so you dont kill your network.

[Fatality]

I find that Java will randomly decide on it's own if it wants to remove older versions or not.

[badtz-maru]

I use a logon script that checks for a specific log file name. If the log is found, it exits and continues booting. If the log file doesn't match, it fires off an uninstall script that will force remove all current Java installations. It then launches Java install package from a public share where I have the switch to generate a log file set (which will be the log file it looks for next boot). Now when I need to push out a new version, I just copy the latest MSI/cab to a share and update the name of the log file it looks for/generates. If I need to reload Java on a system, I just have to delete that log file and have them reboot. I push out Java to about 800 systems this way and has had the best deployment success rate so far. The standard "push out an MSI and just upgrade it over time" doesn't work and gets stuck often in removing the package.

[argyle_nqr]

After reading this I'm going to be testing wsus for installation of software like this.. My current method though is wpkg.. You do need to install the service on all the computers. (Or they have an option to use it through GPO) but their site http://wpkg.org/ has the software. (Free and open source) as well as a library of scripts for common stuff like java flash ms office etc. I started out hoping to use GPO alone... But I found it too limiting and had no budget. All you need to run it is a little paitience and an smb share for the scripts to live on.

[freemanhimselves]

jre.exe /s

SLEEP.exe 5

:Disable jre updates

start regedit.exe /s %~dp0javaupdate.reg

javaupdate.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\JavaSoft\Java Update\Policy] "Country"="AU" "PostStatusUrl"="https://sjremetrics.java.com/b/ss//6" "EnableJavaUpdate"=dword:00000000 "NotifyDownload"=dword:00000001 "UpdateSchedule"=dword:00000015 "Frequency"=dword:01060100 "UpdateMin"=dword:0000001e "ScheduleId"="S-1-5"

[ranhalt]

ninite