copied from

I have documented the steps to package and deploy the latest (currently) version of Java JRE (Java Runtime Environment) with an MSI via Group Policy. Its a relatively easy task to do but due to information being scattered around the internet when I was doing it I thought I would do a write-up.

Downloading JRE

Ok, you may wonder why i included this. Well it was always a battle to find the correct version to download off the SUN website, but now that Oracle have stepped in they have actually simplified this process. The most important thing to remember is that you want to download java from (which redirect to oracle) rather than They are actually packaged differently and not suitable for mass deployment.

The URL to download JAVA SE (Standard Edition) currently is:
From here you click on JRE (in small writing) underneath the Java (download) icon in the middle pane. This will direct you to the latest version of JRE which right now is JRE 1.6.0_26. I am only distributing Windows x86 Offline, but I’m sure the Windows x64 will be the same process.

I am working with this file from here-on in:

Extracting the MSI

Now Oracle/Sun/Java down actually tell you how to extract the MSI file from the exe you just downloaded. There is a command to extract it that I cant find right now, so ill show you a simple alternative. Double click on the EXE file and leave the installation window open. It should look like this:

Now while that window is still open open up Windows Explorer and go to the below location and you will see the CAB and MSI files that are needed to deploy via GPO.

1 C:\Users\%username%\AppData\LocalLow\Sun\Java\jre1.6.0_26

Note: You need to keep the setup window open for 64bit version because it removes the temp files when you cancel the install process. 32 bit doesn’t but its good practice.

Copy these files to your distribution location (or your staging area where you can modify the file using ORCA)

Modifying the MSI to suit enterprise deployment

So now we need to make some changes to the Java MSI so that it installs correctly, and does not try to auto update seeing as most admins don’t give their users local admin rights. The tool that I use is ORCA, and is available from download the Microsoft website. Refer to the below article to assist you with this:
How to use the Orca database editor to edit Windows Installer files

So what should you modify? well it all depends on what you want to configure. Ill give you the options I have changes, and you can use the ones you want:

Table Property Original Value Proposed Value Description
Property JAVAUPDATE 1 0 All three need to be changed to completely disable Java automatic updates
Property JU 1 0
Property IEXPLORER 0 1 Activates Internet Explorer plugin
Property MOZILLA 0 1 Activates Mozilla plugin
Property SYSTRAY 1 0 Disables system tray icon when Java applets are active
Property RebootYesNo Yes No Suppresses the need to reboot – not affected by GPO that I’m aware of   but does when installed manually.
Property EULA 0 1 I leave this setting to 0, however if you are installing it via the   msiexec through cmd prompt you may need to set this to 1 to install without   interuptions.

And this is what it looks like when you edit it in ORCA:

Once you have made the changes you are happy with you can simply save the changes. You can save it directly to the MSI file you have opened, or to a new MSI file with your modifications.

NOTE: if you wanted to use a transforms file, you need to create a transforms in ORCA first by clicking Transform -> New Transform, and then when you are finished you need to go to Transform -> Generate Transform.

Deploying via Group Policy (GPO)

Now you are ready to deploy the package via Group Policies. The general process is to do the following:

  1. Create new GPO (or use existing GPO for same software title)
  2. copy install files to DFS share
  3. Add package with specific options
  4. Change secuirty to your Testing Stakeholders before deploying to all users
  5. Change security to apply to Authenticated Users (or a specific group depending of how you manage deployment) so that everyone else gets the tested deployment.

Refer to this blog that going into detail on how to deploy via GPO:

Important Links

Here are resources i used to get the info I needed: