GPO – Deploying Java 8 Update 25

Update 09/09/2015: If you are deploying Java 8 Update 60 please see my updated post GPO – Deploying Java 8 Update 60 as Oracle have made some changes to the MSI that means the instructions below no longer work.

Extracting the MSI

To extract the MSI, run the “jre-8u25-windows-i586.exe” or  “jre-8u25-windows-x64.exe” EXE do not proceed with the installation. Open the folder “%LOCALAPPDATA%Low\Sun\Java”, depending if you ran the i586 or x64 version you will see one of the following folders.

  • jre1.8.0_25
  • jre1.8.0_25_x64

Open up the correct folder, and within the folder you will see the MSI file “jre1.8.0_25.msi”. Copy this MSI to another location then cancel the installation.

Silent Install Error

Now that you have the MSI file you have probably tried to install it from the command line using “msiexec /qb /i jre1.8.0_25.msi”. If you used a command prompt that isn’t elevated you get the following error in the event viewer, even though you elevate the MSI installation.

“Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor.”

MSI Fixes

The reason for the error above is that the MSI executes an installer that is embedded into the MSI, but when it runs this installer it doesn’t run it with administrative privileges instead it runs it in the logged on users security context. To fix this you need to modify the MSI DB with an MSI DB editor such as Orca (My personal preference is InstED http://www.instedit.com/). Open the MSI in your editor of choice and open up the table “CustomAction” and select the row “installexe” and change the value of the field “Type” to decimal 3074 or hexadecimal 0x0C02. This will set the msidbCustomActionTypeNoImpersonate bit so that it runs the embedded installer with administrative privileges.

Once the change above has been made the installer will now fail with the following error.

“Unable to install Java. Unable to open file C:\ProgramData\Oracle\Java\java.settings.cfg. Check that the configuration file exists and that the path to the file is correct.”

To fix this error an empty configuration file “java.settings.cfg” needs to be added to the “%ALLUSERSPROFILE%\Oracle\Java” folder by the installer. To do this we need to add 6 new entries to various tables in the MSI DB.

Once again open the MSI in your editor of choice and perform the following:

  1. Insert a new row into the table “Directory”
    • Directory Field = OracleDir
    • Directory_Parent Field = CommonAppDataFolder
    • DefaultDir Field = Oracle
  2. Insert a new row into the table “Directory”
    • Directory Field = JavaDir
    • Directory_Parent Field = OracleDir
    • DefaultDir Field = Java
  3. Insert a new row into the table “Component”
    • Component Field = emptycfgComponent
    • ComponentId Field = <Insert GUID>
    • Directory_  Field = JavaDir
    • Attributes Field = Decimal 0 or Hexadecimal 0x0000
    • Condition Field = <null>
    • KeyPath Field = <null>
  4. Insert a new row into the table “FeatureComponent”
    • Feature_ Field = jrecore
    • Component_ Field = emptycfgComponent
  5. Insert a new row into the table “File”
    • File Field = java.settings.cfg
    • Component_ Field = emptycfgComponent
    • FileName Field = java~1.cfg|java.settings.cfg
    • FileSize Field = 0
    • Version Field = <null>
    • Language Field = <null>
    • Attributes Field = Decimal 8192 or Hexidecimal 0x2000
    • Sequence Field = 1
  6. Insert a new row into the table “Media”
    • DiskId Field = 2
    • LastSequence Field = 1
    • DiskPrompt Field = <null>
    • Cabinet Field = <null>
    • VolumeLabel Field = <null>
    • Source Field = <null>

This adds a reference to the file in the installer DB, now you need to create an empty “java.settings.cfg” file. To do this open the folder where the MSI is located and create the folder structure “CommonAppData\Oracle\Java” and then within the “Java” folder create an empty file called “java.settings.cfg”.

The last thing to be done is to set the embedded installer so that it installs silently when the UI level is set to “Basic UI” (/qb switch) , the current configuration is that it only installs silently if the UI level is set to “No UI” (/qn switch). To change this open the MSI in your editor and open the table “InstallExecuteSequence”, within that table locate the action “SetSilentInstall” and change the condition from “UILevel=2” to “UILevel<=3”.

With the changes above you will find that the MSI installer should work as expected.

Customisations

There are many articles out on the web on how to customise the installation of Java 7 by changing/adding properties to the “Properties” table in the MSI, the same properties still apply. Here are the ones that I’ve chosen to set in our deployment.

Disable Java Auto Update

  • AUTO_UPDATE=0
  • AUTOUPDATECHECK=0
  • JU=0
  • JAVAUPDATE=0

Disable the EULA

  • EULA=0

Disable the installation Java with sponsored software

  • SPONSORS=0

Lower the web Java security level (Note: High is the lowest setting in Java 8)

  • WEB_JAVA_SECURITY_LEVEL=H

Disable the sending of  installation-related statistics to Oracle

  • WEB_ANALYTICS=0

Transform File (MST)

Once I’ve amended the MSI file I create a transform file, with InstED this is an easy process of comparing your modified MSI with an unmodified file. I then use this for both the X86 and X64 versions of the Java MSI and it’ll hopefully it’ll be compatible with the next version that comes out, which saves time and effort of doing this again :-).

Deployment

I’ve only tested the deployment through the command line with both elevated and un-elevated command prompts. My plan is to deploy Java 8 using GPO, but I’ve not managed to test this yet, I will update this post once I have . If you do manage to test deploying via GPO before I do, please let me know and I’ll update this post accordingly.

 

Advertisements

40 responses to “GPO – Deploying Java 8 Update 25

  1. Thanks for the documentation

    For the emtpty File you hve to make a little change in Point 5:

    FileName Field = java~1.cfg|java.settings.cfg

    Like

  2. You’re my Man!!!
    Worked like a charm.

    Allow me a small Suggestion:
    I am used to work with ORCA.
    ORCA does NOT use the string “” for NO ENTRY

    So, for all ORCA-Users, let me mention:
    whenever in the Post there is No Entry OR , there is NO ENTRY in ORCA needed (or even allowed)…
    NEVER write the String when using ORCA!!!

    (in your description – for example for the table “Media” – you are mixing up “” with No Entry)
    Maybe, you could delete in the Post
    (or write down where it’s missing – and let People know, that means NO ENTRY) ,
    I think, that this would make it a little clearer for upcoming Readers…

    Thanks again a lot for that great Post – saved me hours!!!

    Edi

    Like

      • I’m a little confused…for example, when adding the row for “Media”, should the lines have the words or NO ENTRY or should they be completely blank?

        Also, when adding the row in Components, should the ComponentID line include the words or should I actually type the GUID? In case I am supposed to type it there, where does the GUID originate?

        Thanks for the informative write up. If I can get passed “Error 2715” I’ll be able to deploy via GPO. Thanks again.

        ——Mark

        Like

      • The means that the field should not have a value in it.

        For the GUID in InstEd, when you add a new row and you go to enter a value in the “ComponentID” field you will see a “*” on the right hand side click on this and it will generate a GUID for you.

        Like

  3. Thanks for this informative post. I have tried to follow the process but I’m getting an error “The specified account already exists” if I run the MSI directly, while if I do it through GPO I get an error code 2725.

    Any ideas where I’ve gone wrong?

    Like

  4. Pingback: Upgrade von Java 7 auf Java 8 - scriptbasiertes Deployment per MSI | IT | IMA - Informationen Mal Anders

  5. Thanks for this information, it’s been a great help.

    I’ve also expanded my transform to remove the Start Menu shortcuts at the end of the install (the NOSTARTMENU property is available only in the paid for Enterprise version of the Java 8 MSI).

    Just add a new row in the CustomAction table;

    Action: RemoveJavaShortcuts
    Type: Dec 98 or Hex 0x0062
    Source: SystemFolder
    Target: cmd.exe /C rmdir “%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Java” /S /Q

    And a new row in the InstallExecuteSequence table

    Action: RemoveJavaShortcuts
    Condition: NOT Installed
    Sequence: 4000 (can be any number as long as it’s the highest for the table)

    Hope this helps.

    Like

  6. I’m also now using the java.settings.cfg file to specify the values that would have previously been passed as MSI properties.

    My config file is simply;

    AUTO_UPDATE=0
    SPONSORS=0
    EULA=0
    WEB_JAVA_SECURITY_LEVEL=H
    WEB_ANALYTICS=0
    REBOOT=0

    Java doesn’t officially list SPONSERS as being a valid property in the config file but it still works for now (one to keep an eye on when the next update version appears).

    Like

  7. I followed your instructions to the letter, but i am getting an error in the log stating that: “The specified File key (”) not found in the File Table.” I have double and triple checked both file tables and the entry is in both the x86 and x64 msi’s. Im on a win 8.1 x64 ENT installing to a win 7 x64 pro

    Like

  8. Thank you for the documentation.

    I am having trouble with “Customisations”. Some of the customisations I can not find under the “Property” table in the MSI editor. Do you just include them in the custom cfg file? or do I add new row in the Property table?

    Thanks in advance. B

    Like

    • For the customisations, you either modify or add rows to the property table. Someone has reported that you can also use the “java.settings.cfg” to pass the customisations to the installer.

      Like

  9. Great article!
    Any tips for Version 8 Update 40?
    Some changes been made to the installer, no more ask toolbar.

    Get this error:
    Product: Java 8 Update 40 — The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2721. The arguments are: installexe, ,

    Like

    • ok this works without tweaking the original MSI:
      msiexec /i jre1.8.0_40.msi AUTO_UPDATE=0 EULA=0 JAVAUPDATE=0 AUTOUPDATECHECK=0 NOSTARTMENU=1 SPONSORS=0 WEB_ANALYTICS=0 WEB_JAVA=1 WEB_JAVA_SECURITY_LEVEL=H /qn

      Like

      • I tried what you said but cant make it work. Getting first error msg:

        ““Error 1722. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor.”

        How did u make it work?

        Like

      • I installed the java (jre-8u40-windows-i586.exe) on a test machine and saved the MSI fromC:\Users\USERAppData\LocalLow\Sun\Java\jre1.8.0_40

        I’ve made a script (found parts of it on the web) that kills some processes and then uninstall all old versions before installing the new. But the installation-string should work just fine if you have a clean machine.

        Here’s the cmd-script I use for SCCM if you want it.

        @echo off
        CLS

        :: Close browsers and kill Java executable, to prevent open files / corrupt install.
        taskkill /F /IM iexplore.exe
        taskkill /F /IM firefox.exe
        taskkill /F /IM chrome.exe
        taskkill /F /IM javaw.exe
        taskkill /F /IM jqs.exe
        taskkill /F /IM jusched.exe

        :: Using WMI find Java in installed programs and uninstall.
        wmic product where “name like ‘Java%% %%'” call uninstall /nointeractive

        REM Make sure browsers remain closed before install.
        taskkill /F /IM iexplore.exe
        taskkill /F /IM firefox.exe
        taskkill /F /IM chrome.exe
        taskkill /F /IM javaw.exe
        taskkill /F /IM jqs.exe
        taskkill /F /IM jusched.exe

        :: Install Java 8 Update 40
        msiexec /i jre1.8.0_40.msi ALLUSER=1 AUTO_UPDATE=0 EULA=0 JAVAUPDATE=0 AUTOUPDATECHECK=0 NOSTARTMENU=1 SPONSORS=0 WEB_ANALYTICS=0 WEB_JAVA=1 WEB_JAVA_SECURITY_LEVEL=H /qn
        REM Disable automatic updates
        reg delete “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” /v SunJavaUpdateSched /f
        reg add “HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy” /v EnableJavaUpdate /t REG_DWORD /d 0 /f

        REM Return the exit code to SCCM
        exit /B %EXIT_CODE%

        Like

  10. For GPO – Deploying Java 8 Update 40, use decimal 3090 (hex 0x0C12) for the “Type” field for installexe (INSTEAD OF 3074 / 0x0C02). Here is a modified paragraph, from the original paragraph in the top of this article:
    “Open the MSI in your editor of choice and open up the table “CustomAction” and select the row “installexe” and change the value of the field “Type” to decimal 3090 or hexadecimal 0x0C12. This will set the msidbCustomActionTypeNoImpersonate bit so that it runs the embedded installer with administrative privileges.”

    Like

  11. something quite odd using this post, is that after the first install of jre, the following installs do not need the java.settings.cfg file anymore. Using only the msi works. Anyone has an explanation about that ?

    Like

  12. Tried this with Java 8 Update 73 (2) – got error 2715.

    Then tried the msi the usual way – edit Property Table: Java_Update = 0 and Autoupdatecheck = 0 . Deployed via GPO without errors for both versions.

    Like

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s