Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

Updating Java through Managed Software Delivery Policy (Updated article)

Created: 22 Jan 2014 | 9 comments
Language Translations
Sally5432's picture
+3 3 Votes
Login to vote

I previously wrote up my updating Java process as an article for 7 update 45, but when 7 update 51 came out our users were still presented with an update Java prompt.  In order to try to simplify the process for myself going forward, I decided to post another article, hopefully making it simpler and correcting my prior mistakes.  There’s some great feedback in the comments on the prior post that might be valuable if you haven’t checked it out yet, it’s here.

Here's my process now for updating Java via Managed Software Delivery Policy

1)      Download the latest offline .exe installer from or

2)      Extract the MSI

a.      Download and launch in GUI mode the Windows Offline Installation executable (.exe) file. 
b.      When Welcome to Java window appears do not click Install button and navigate to LocalAppData folder (the user Application Data folder). The location of the LocalAppData folder differs for each Windows platform. 
Note: You can also navigate directly to APPData folder by typing : %APPDATA% in Windows Explorer Address Bar or Run. 

i.     Windows Vista and Windows 7 - C:\Users\<user>\AppData\LocalLow\Sun\Java\jre<version_number>                            ii.     Windows XP - C:\Documents and Settings\<user>\Local Settings\ApplicationData\Sun\Java\jre<version_number>          iii.     Windows 2000 - C:\Documents and Settings\<user>\ApplicationData\Sun\Java\jre<version_number>

         More info here:

3)      Copy .cab and .msi to folder to desktop

4)      Create (or copy existing) deployment.config and file to same folder where .cab, & .msi, these are plain text files. 

a.      Our deployment.config file following 2 lines


b.      Our file is following (some prior keys mentioned in other thread are outdated now).  We have to set security level to 'medium' for one of our apps to run, which is probably not advised if you can get away on 'high'

You can add more options to properties file based on what’s available in current release. See

The folder on the desktop should now have 4 files,, deployment.config,, & .msi file.

5)      Open CMS and navigate to Manage – Software Catalog - Import

6)      Click plus button and navigate to folder where all 4 java related files exist, select all files and then select open

7)      Make sure .msi file is bolded, if not highlight it and select “Set Installation File”

8)      Select Next, files upload to CMS.  Edit name, etc as desired. Leave checkbox checked for edit software resource… Select OK.

9)      On package tab, delete Install, install no IU and install for all users leaving just Install for all users with no UI/Repair/Uninstall options (not necessary).  Our “Install for all users with no UI” command line looks like

a.      Ex msiexec.exe /i "jre1.7.0_51.msi" AUTOUPDATECHECK=0 IEXPLORER=1 JAVAUPDATE=0 JU=0 MOZILLA=1 /qn ALLUSERS=2

10)   Detection rule is auto created.  For Applicability, enter as needed (I leave mine at default).  Click OK to save.

11)   Navigate to your CMS sharepoint \\cms\SoftwareLibrary and find the UUID of the folder uploaded (latest time /date stamp).  This is the same UUID folder name that gets copied locally to workstation when rolling out.

12)   Create command script task to copy deployment files to right location.  My script also includes lines to delete javaUpdate registry file if it exists because some people had this from previous versions and the Java 7 51 installer wasn’t clearing it and leaving the update tab in the control panel app.    Here’s example script – replace 9f283b6e-34b5-4e23-a171-82d3axxxxxxx with the UUID from step 11.

xcopy "C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delivery\{9f283b6e-34b5-4e23-a171-82d3axxxxxxx}\cache\deployment.config" C:\Windows\sun\java\deployment\ /y
xcopy "C:\Program Files\Altiris\Altiris Agent\Agents\SoftwareManagement\Software Delivery\{9f283b6e-34b5-4e23-a171-82d3axxxxxxx }\cache\" C:\Windows\sun\java\deployment\ /y
reg add "HKLM\Software\JavaSoft\Java Update\Test"
reg delete "HKLM\Software\JavaSoft\Java Update" /f

13)   Create vbscript to remove previous versions of Java if needed.  I got my script from “serverkudsk” comment in this thread .  I changed the line strCurrentVersion to be Java(TM) Update 51, this script removes all versions of java on machine below 1.7.51.

14)   Create Managed software delivery Policy with 2 scripts and add software task.  If you’re not 7.5, consider adding a task to delete software cache (this regenerates the software listed in inventory, there was a bug in 7.1 where old software doesn’t get removed unless you clear cache), and then run a software inventory scan.  7.5 fixes this bug and Delete SoftwareCache is no longer needed.  Set applied to and schedule.

This is what my policy looks like


Installing java with the browser opened seems to continue to cause issues.  I saw some machines in add/remove programs saying the app was installed, but it didn’t work in the browser and there was no control panel icon.  So, I set the policy to only run if no user logged in under schedule – advanced options


I also set the advanced settings for the software install to only run “only when no user is logged on.”  This is probably not necessary, but I thought it was a failsafe.


Our users typically leave machines in locked or powered off states, so my plan is to leave these ‘install at logout’ precautions in place for a week or 2 and then eventually set it to run whenever for all users not yet updated and deal with the corrupted installs that happen manually.  I’m happy so far in first few days of policy being on about half of users have been updated.  At some point I need to better troubleshoot Wake On Lan as that obviously would help in this scenario.

In case it helps anyone else out there, to maintain Java, I have some filters set up. 

1)      Static filter for “Needs Latest Java” that is maintained at our helpdesk level so if someone calls in needing java, they get added to the static filter.

2)      Dynamic filter for “Has Java 7 Update 51” that just checks for latest version of Java.  This is built easily in software section of CMS by right clicking on your software resource selecting action, create installed software filter.

3)      Dynamic filter for “Waiting for Latest Java Install” that includes all machines in “Needs Latest Java” except those also in “Has Java 7 Update 51”.  This is the filter the managed software delivery policy gets scoped to.

4)      Static filter for “Needs Outdated Java” for 2-3 users that require an old version of Java for a specific app also maintained by helpdesk

5)      Dynamic filter for “Has Java Installed” that is based on SQL query below that some nice person on Connect probably helped me figure out

SELECT sw._ResourceGuid [Guid]

FROM [vSoftwareComponent] sc

inner join [Inv_InstalledSoftware] sw

on sw.[_SoftwareComponentGuid] = sc.[Guid]

where sc.[Name] LIKE '%JAVA%'

and sw.[InstallFlag]=1

6)      Finally, a dynamic filter “Remove Java” that is based on ‘Has Java Installed’ but excludes ‘Needs Outdated Java’ and also excludes ‘Needs Latest Java’.  This I scope a policy with script to remove Java for everyone who isn’t approved to have it.  This policy runs with update software inventory as well so users fall out of the dynamic group after uninstall is successful.

Comments 9 CommentsJump to latest comment

dcuoq's picture

Good Article ! wink

But do you know that you can have one package of java 7 update 51 that clean all of java 7 under 7.51 (except java 6).

Some tools exist to do that make the job easy and save times for you !

[Addon] Java Runtime Environment 6.0 / 7.0 x86/x64

Java Multi Maker [Addon & SFX - x86 & x64]


Cordialement | Best Regards
Coordinateur Technique Micro-Informatique

Login to vote
lakeith.collins's picture

How are you ensuring it runs at logout?

Login to vote
Sally5432's picture

Sorry maybe it's not the best term. It happens WHILE logged out.

For users reporting they need Java, I ask them to logout for 5 minutes and they get it.  They haven't complained yet... figure everyone can use the time for water cooler run, lunch, or whatever.  

Most have gotten it without calling, though & it's nice to not have to worry about the corruption I used to see when Java would run with browsers opened (without force closing browsers on users).

Don't forget to mark answers to your questions as solutions :)

Login to vote
lakeith.collins's picture

I started down the path of using managed software policies, and got swept away completly. I came up with something that's probably more confusing that what you've posted, but still gets the same result.

I created two batch files, and imported them as software resources.

One creates a scheduled task that runs with elevated rights (system account) to handle the silent install of java. It uses a trigger of "at system startup". Poof, no more user interference to deal with. I can also just ask users to reboot and java will be installed for them. It includes all switches and various sorcerey. 

The second just removes the scheduled task from the computer, assuming the first policy was successful.

I manage it via Installed software filters and static file detection rules (yay random text files!)

I was pushed this way as to limit user interuption. I'd much rather use the patch engine and edit that batch file to include a command to kill the browsers, but Im gonna roll with this for now.

Login to vote
SK's picture

Very nice artocle Sally.

@lakeith.collins, you can use PMS still as you can create a custom install file, place it into the Java update folder, and then configured the Java update package to use that custom command line.

Connect Etiquette: "Mark as Solution" those posts which resolve your problem, and give a thumbs up to useful comments, articles and downloads.

Login to vote
Rick D's picture

Very nice Sally, thank you for taking the time.

I have Patch Solution to handle the Java 7 updates but still have clients on Java 6 that will need to patch which I'll now have to create manually after 6u45, now its on 6u71.


Login to vote
chrismcevoy72's picture

Thanks for this extremely useful article.  We've just started using software management and we've now got Java working via managed software delivery in our test environment, thanks to this.

Has anyone done something similar with Quick Delivery, for example during a computer re-image?  I'd be interested in knowing how people have tackled the deployment of the java deployment files (included in the dependant task for the policy) for a quick delivery task.  Can't see anyway of linking a dependent task to a quick delivery, apart from doing it manually before the quick delivery task runs....

Login to vote
Sally5432's picture

Glad some found it useful.  During a reimage, the computers in our 'needs java' list would get it as part of the managed software policy pretty quickly post image.

You could do it via tasks in an imaging job (one copy file task, one install software task), but you'd have to copy those files differently... a copy file task I think would work and lets you put credentials in the job itself.

Don't forget to mark answers to your questions as solutions :)

Login to vote
Sally5432's picture

This seems to be the latest link for deployment file properties info.

Don't forget to mark answers to your questions as solutions :)

Login to vote