Use Group Policy to Distribute JRE With Its Automatic Update Feature Disabled

Sun Microsystems' Java is a widely used programming language, and as a result, there are many programs and websites that require Sun's Java Runtime Environment (JRE). Many administrators have discovered that, after installing JRE, users with sufficient permissions might see a balloon prompt in the system tray to install an update when Sun releases a new version. This happens because the JRE automatic update feature is enabled by default.

The JRE automatic update feature periodically checks Sun's servers for an updated version. It can also download and install the latest version. This can cause problems on a corporate network because the new JRE version is installed alongside the old versions, taking up unnecessary disk space and cluttering the Add/Remove Programs applet with multiple entries. This also makes standardizing a particular JRE version more difficult. In recent JRE versions, users with sufficient permissions can go to the Update tab in the Java Control Panel applet and disable the automatic update feature, but this setting is a per-user rather than a per-machine setting. If a different user logs on to the computer, the automatic update feature is active for that user unless he or she disables it.

The JRE automatic update feature is controlled by Jusched.exe. When JRE is installed, a value for Jusched.exe is added to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run registry subkey. This means that Jusched.exe starts and runs in the background for any user that logs on to the machine. When Jusched.exe is running, it reads the automatic update settings from the registry and prompts the user when an update is available. I'll show you how to install JRE without creating this registry value. If Jusched.exe never runs, no automatic update prompts will appear.

However, simply preventing Jusched.exe from running at logon can create a confusing user experience because the Update tab in the Java Control Panel might still be visible to some users, depending on permissions. This means that a user could set an update schedule that will never occur. To prevent such confusion, I'll also show you how to create a Group Policy Object (GPO) registry setting to hide the Update tab for all users.

The solution to distribute JRE with its automatic update feature disabled and hide the Update tab is fairly simple. You just need to follow five steps.

To disable JRE's automatic update feature, you need Orca, a GUI database editor for creating and editing Windows Installer (.msi) packages. Orca is part of the Windows Installer SDK, which is a part of the Microsoft Windows Server 2003 Platform SDK. If you don't already have the Windows Installer SDK installed, the easiest way to obtain Orca is to download it from Microsoft developer Aaron Stebner's blog. Alternatively, you can obtain Orca by following the directions and links on the Orca.exe web page. After you have a copy of Orca.msi on your computer, double-click it from Windows Explorer to install it.

To obtain JRE, go to the Java website and click the Free Java Download link. The next page will prompt you to perform an online install. However, you need to download the offline installation program, so choose the Not the right operating system? See all Java downloads here link. This will take you to a page that lists the JRE downloads for all OSs. Choose the Windows XP/Vista/2000/2003 Offline link for the Windows offline installation and save the download to a directory on your local computer. (As I write this article, the current version's download is named jre-6u6-windows-i586-p-s.exe.) Create a directory called named C:\JavaDeployment and save the download to this directory.

Next, run the installer program you just downloaded (jre-6u6-windows-i586-p-s.exe in this example) to install JRE on your computer. After the installation finishes, use Windows Explorer to go to the Application Data\Sun\Java\version directory (where version is the JRE version you just installed) inside your user profile to find the JRE .msi file. On my computer, this file was in C:\Documents and Settings\Bill\jre1.6.0_06. Copy the JRE .msi file (jre1.6.0_06.msi in this example) to the C:\JavaDeployment directory. If you can't find the .msi file, search for it in Windows Explorer.

The next step is to use Orca to create a transform (.mst) file. First, make a backup copy of the JRE .msi file in case of mistakes. Next, right-click the JRE .msi file in Windows Explorer and choose Edit with Orca. Orca displays the JRE database in two panes. The left pane lists the tables in the database, and the right pane lists the rows in the selected table. Select Transform, then New Transform from the Orca menu to create a transform file. This will add the text (transformed by Untitled) to Orca's title bar to indicate you're creating a new transform file.

In Orca's left pane, click the Property table to select it. The right pane will display the Property table's contents, as shown here:

Select the IEXPLORER property and change it from 0 to 1. If your users operate a Mozilla-based browser (e.g., Firefox), change the MOZILLA property from 0 to 1 as well. Enabling these properties ensures that JRE becomes the default runtime environment for users' browsers.