Scripting

We have the same scenario here at my place of employment. First, I need update all of our machines to an acceptible level of Java 7 security, without breaking the end users current version - Java 6.24 or 6.33. End uses are running the old Java 6 versions so they can continue to run applications requiring Oracle Forms, and other Oracle based apps.  Our Oracle Team is upgrading the backend but not quickly enough.

So I am doing the following to upgrade our client machines, so they are within some type of compliance:

Step 1:  Install an Environment Variable to all machines.  This allows the end users machine to have more than one instance of Java installed on their machine, AND when called upon by an application, the variable will know (decide) on which Java instance to use - 6.33 or 7.21

Step 2: After the Environment Variable has been pushed out to all machines, I will run a script that removes all instances of Java 6 and 7 from the end users machine. I am doing it this way so I have a fresh machine with NO previous Java installed.

Step 3: Now, I run a script to all machines that will only install the following Java versions:  Java 6.33 & Java 7.21 for 32Bit machines, AND Java 6.33, Java 6.33-x64, Java 7.21, Java 7.21-x64 for all 64Bit machines.

Below is a snapshot of my process in Scripts:

1. Install an Environment Variable to all machines

Verify

    Verify that “HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment!JAVA_TOOL_OPTIONS” exists.

Reorder | Add…
On Success

    Log “PC already HAS the Environment Variable installed! - No Update Needed.” to “output”.
    Launch “$(KACE_INSTALL)\runkbot.exe” with params “4 0 ”.

Reorder | Add…
Remediation

    Run the batch file “Add Java Option” with params “”.

Reorder | Add…
On Remediation Success

    Log “The Environment Variable has been SUCCESSFULLY installed!” to “output”.
    Launch “$(KACE_INSTALL)\runkbot.exe” with params “4 0 ”.

Reorder | Add…

2. Script to remove all instances of Java 6 and 7 from the end users machine (1ST Half of script)

3. Script to install Java 6.33 and 7.21 to all end user machines (2ND Half of script)

Verify

On Success

Remediation

On Remediation Success

On Remediation Failure

1. Create a message window named “Java Upgrade In Progress...” with title “Do Not Close This Window.”, message “COMPANY NAME is currently installing Java 6 support.” and timeout “300” seconds.
   
2. Launch “$(KACE_DEPENDENCY_DIR)\java6.33.bat” with params “”$(KACE_DEPENDENCY_DIR)\java6.33.bat“”.
   
3. Set the text in the message window named “Java Upgrade In Progress...” to “Installing Java 7 support.”.
   
4. Launch “$(KACE_DEPENDENCY_DIR)\Install-Java7.bat” with params “”$(KACE_DEPENDENCY_DIR)\Install-Java7.bat“”.
   
5. Set the text in the message window named “Java Upgrade In Progress...” to “Upgrade is complete. Click OK to close this window.”.
   
6. Launch “$(KACE_INSTALL)\runkbot.exe” with params “4 0 ”.
   
7. Log “Running Runkbot 4 0” to “status”.

I am currently running this project now.  I have just pushed out the Environment Variable this week, machines are checking into the KBOX and receiving the variable.  So far, all is going as planned.

I have tested this out already with a small test group, with the following issues:

1.  Pop-ups of Java security certificates (3 or 4) are annoying.  (Solution): I found the CERTS that were popping up on the end users screen, and I exported them.  Once exported, I added the CERTS into GPO, and pushed the CERT out to all machines in the domain via GPO.

All BUT 1 pop-up has disappeared.  This 1 pop-up is OKAY to have, because it is asking the end user one thing - "This application would like to use a version of Java (1.6.0.24) that is blocked by your security settings" - SIMPLY click the button "Run with the latest version".

Now, I did receive the same pop-up above ("This application would like to use a version of Java (1.6.0.24) that is blocked by your security settings") ONE more time.  I clicked the button "Run with the latest version" and everything launched as planned.  No more pop-ups, and no more issues with Java being out of compliance.

Install an Environment Variable

Place this in NOTEPAD and save as a .REG file

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment] 
"JAVA_TOOL_OPTIONS"="-Djava.vendor=\"Sun Microsystems Inc.\""

Script to remove all instances of Java 6 and 7

@echo OFF
cls
TITLE Currently uninstalling old versions of Java... please wait

:KillIE&JavaProcesses
echo *** This will kill Browsers and Java Processes ***
Rem ***
taskkill /F /IM iexplorer.exe
taskkill /F /IM iexplore.exe
taskkill /F /IM firefox.exe
taskkill /F /IM chrome.exe
taskkill /F /IM jusched.exe
taskkill /F /IM jp2launcher.exe
taskkill /F /IM java.exe
taskkill /F /IM javaw.exe
taskkill /F /IM jqs.exe

:UninstallingOldJREVersions
echo.************************************************************************
echo.************************************************************************
echo.              DO NOT CLOSE THIS WINDOW
echo. All the Java versions from your computer are being removed.
echo.************************************************************************
echo.************************************************************************
wmic product where "name like 'Java(TM) 6%%'" call uninstall
wmic product where "name like 'Java 7%%'" call uninstall

goto END

Script to install Java 6.33 and 7.21

Install 6.33 (32Bit) - create a batch file for the script below.

@echo OFF
cls
TITLE Updating Java 6.33... please wait

jre-6u33-windows-i586.exe /s /v"/qn AUTOUPDATECHECK=0 ADDLOCAL=ALL IEXPLORER=1 MOZILLA=1 JAVAUPDATE=0"

Install 6.33-x64 (64Bit) - create a batch file for the script below.

@echo OFF
cls
TITLE Updating Java 6.33-x64... please wait

jre-6u33-windows-x64.exe /s /v"/qn AUTOUPDATECHECK=0 ADDLOCAL=ALL IEXPLORER=1 MOZILLA=1 JAVAUPDATE=0"

Install 7.21(32Bit) - create a batch file for the script below.

@echo OFF
cls
TITLE Updating Java 7.21... please wait


jre-7u21-windows-i586.exe /s /v"/qn AUTOUPDATECHECK=0 ADDLOCAL=ALL IEXPLORER=1 MOZILLA=1 JAVAUPDATE=0"

Install 7.21-x64 (64Bit) - create a batch file for the script below.

@echo OFF
cls
TITLE Updating Java 7.21-x64... please wait

start /wait jre-7u21-windows-x64 /s /qb /v" /norestart ADDLOCAL=ALL IEXPLORER=1 MOZILLA=1 JU=0"

Basically here you are trying to downgrade your version of JRE. Can you explain why exactly you are trying to do that? 

- If any application requires JRE 6.33 in the machines which already has 7 JRE on it, you can deploy with out uninstalling the JRE 7. Both versions can exist together. 

- If I am in your place I will not uninstall version 7, I just install 6.33 in the same machine with out uninstall because they both can exist in same machine.