Silent install Java 8 Update 71 and 72 with SCCM

In my last post about silent / unattended installation of Java 8 Update 66, we followed the new guidelines for how to install Java 8 silently by Oracle. The problem with that method is that it works when you try to run your script locally with administrator privileges it will work fine, but when you run the same script through SCCM / Configuration Manager, it will fail. And just to confuse you even more, it will only fail for the 32-bit version of java, not the 64-bit, even though you use the exact same method. This problem have been reported in some bug reports, here, here and here.

So what’s the solution?

First, you have to revert to the “old” solution of extracting the MSI package from the Java installer. Find the newest version of Java offline installer from here. Remember that you properly need a 32-bit version, since Java 64-bit can only run in a 64-bit browser, and very few have that. Open the exe file, and just let it stay on the splash screen, then navigate to the following folder where the MSI file are placed:
C:\Users\[username]\AppData\LocalLow\Oracle\Java

Then select the folder for the version you’re installing, i.e. jre1.8.0_72:
C:\Users\[username]\AppData\LocalLow\Oracle\Java\jre1.8.0_72

Now we can install by adding a few flags to the commandline of the MSI file, like this:

start /wait msiexec.exe /i “jre1.8.0_72.msi” /qn JU=0 JAVAUPDATE=0 AUTOUPDATECHECK=0 RebootYesNo=No

Remember to configure your new application in SCCM to supersede the old version of java, so they will get uninstalled first.

Now, Java is a bit special, as you might have figured out from the exe file unpacking a MSI file. But it doesn’t stop there, the MSI file actually unpacks a new exe file, and that’s causing problem with the detection method in SCCM. Because if you run the script only with the above line, the process will be over in a few seconds, and then SCCM will start to check with your preferred detection method, and it will find nothing to be installed and give an error about installation have failed. And then when you check on the target computer in “Programs and Features” you’ll see a Java 8 Update 72 to be installed. So how do we solve that? We put in a slight delay so SCCM still thinks the installation is running, by having this line:

ping 127.0.0.1 -n 120 > nul

The above command pings the localhost for 120 seconds, and don’t write anything to the screen. You can make it wait longer if the client is slow. Below is the full script:

start /wait msiexec.exe /i “jre1.8.0_72.msi” /qn JU=0 JAVAUPDATE=0 AUTOUPDATECHECK=0 RebootYesNo=No 
ping 127.0.0.1 -n 120 > nul

About the Author:

Casper Lillegård Madsen

18 Comments

  1. Paul McGrath January 27, 2016 at 22:00 - Reply

    This is mental. I use WPKG and the only way I can get 8u71 x86/x64 to install successfully is to use the x86 MSI with your PROPERTIES above and then the x64 .EXE and the Oracle recommended CFG file.
    I can’t get the x86 EXE or the x64 MSI to install silently at all. They’ve really screwed up this version.

    • Casper Lillegård Madsen
      Casper Lillegård Madsen January 30, 2016 at 9:32 - Reply

      Yep, this version was really special to get to work. I actually didn’t try the MSI method for the 64-bit version because I got that working with the EXE method, I would lie if I said I was suprise that the 64-bit version needed another method to be installed 🙂 Happy to hear that you got it working with the properties in this post 🙂

  2. Rob January 29, 2016 at 20:27 - Reply

    God I hate the Java client. Appreciate the suggested solution of putting in a pause.. been reading other fixes and they are all different for different versions. Found the exact issue I have reported on the Oracle bugs site but no solution offered.

    I have the whole thing wrapped (ultimately the msiexec command line you have there) but in a vb script – which does various other things before and after the install… using the .vbs equivalent of start /wait.. it does work but is flaky as hell via SCCM, works on one test machine but not another etc – so I’m going to give the delay a go, thanks.

    Problem with the delay is as you said not all machines are the same spec and we have a right spread of hardware across around 20k clients so would prefer to wait for a process to finish (or start) which signifies the end of the install process. Will have to fire up procmon to see what I can find. It’s regular as clockwork until I put the job into SCCM / system context installation when it starts to falls over. Good job SCCM isn’t used that widely eh Oracle….!

    If I get anywhere I’ll post back here again… will try and raise a support call with Oracle too – for someone to swear at as much as anything else 😀 They really have had long enough to nail this – seemed reasonably reliable for v7 but v8 is beyond the joke. I don’t know who designs and builds their installation routines but they want sacking. The only uninstaller tool they provide appears to run from the web only – which is also ridiculous.

    This app is a security nightmare, the least you’d thing the vendor would do would to put together some decent deployments…

    /rant

    • Casper Lillegård Madsen
      Casper Lillegård Madsen January 30, 2016 at 9:44 - Reply

      It’s really frustrating finding your exact bug description, and seeing that no solution have been offered, I was out helping a client with this exact package, and there was a lot of swearing from my site because we got it wokring with a local script running on the client, but through SCCM we had these extra issues, with the 32-bit not being installed and the 64-bit working like a charm.

      When I look back at the code, I maybe should have given it a bit more sleep time, like 5 minutes, just to be sure, I sometime forget that might Hyper-V test enviroment have some fairly clean machines 🙂

      I found a effective method of uninstalling, I can’t remember where I got it from, but this line installs the previous version of java, since the upgrade method with STATIC=0 haven’t been working for at least 20 updates. But this line uninstalls previous versions of java, I used it only in the my hyperv test enviroment, so have that in mind:
      start /wait wmic product where “name like ‘Java 7%%’ or name like ‘Java 8%%'” call uninstall

      If you haven’t seen it yet, it seems like that we might soon have a lot less to struggle with java-wise: https://blogs.oracle.com/java-platform-group/entry/moving_to_a_plugin_free

      • Rob January 30, 2016 at 10:33 - Reply

        Thanks Casper – yeah WMI calls are what I’m using to search for and uninstall any previous versions in my vbscript.. works fine generally but would rather have a proper tool from the vendor.

        Java with no plugin? Sounds too good to be true 😀 Just summoning up the energy to have another go at this…

  3. Rob January 30, 2016 at 13:55 - Reply

    OK so the delay didn’t work.. The vendor setup was genuinely bombing out with custom action failure error 1722 in the verbose windows installer log: “customaction installexe returned actual error code (61016)” but I’m cautiously optimistic that I’ve now got this working (dare I say reliably) via SCCM… So, to sum it all up for v8u71 deployment using SCCM;

    With this version I initially reverted to the vendor EXE for deployment (in line with Oracle’s very own deployment guidelines!) and was all working fine from an elevated command prompt but hit a snag when using SCCM as documented here: https://bugs.openjdk.java.net/browse/JDK-8140474 – so in line with the ‘customer submitted workaround’ I reverted to using the extracted MSI (no transform, but using the same command line public properties I was passing on the original EXE command line – e.g. AUTO_UPDATE=0)

    I then hit this issue: https://bugs.openjdk.java.net/browse/JDK-8145729 – again working fine from an elevated command prompt but not in SCCM. This worked on one test machine but not another.. Worth noting that the test machines had been used and abused previously – much like the client machines across the estate. I’m sure I’d have had much more consistent results if both test machines were a clean build but of course that’s not reflective of clients that have been in production for years.

    Next I started exploring changing the installexe MSI custom action from 1024 to 3090 as documented on other forum postings (https://www.reddit.com/r/SCCM/comments/3iq6tq/installing_java_8u60_during_bc_task_sequence/) and thought this nailed it but not in my case for this version at least so I reverted that change again.

    Eventually it came down to having to check for / creating the “C:ProgramDataOracleJava” folder and then pre-coping my java.settings.cfg into that folder before starting the installation routine (again this is suggested on various forums). I noticed that this folder / file already existed on the machine it was working on but not on the failing one. Now that I’ve included the logic in my wrapper script it’s working reliably from both machines / different configurations.

    So seems to be a combination of issues / resolutions to make this work in my environment. I can’t say for sure whether this is the solution for the next person as the appropriate resolutions seem to be based on a combination of things.. deployment type (EXE or MSI), installation context (elevated user / system context), deployment tool (SCCM in my case), and probably which way the wind is blowing when Oracle spit out their offline enterprise installer…!

    Monday is looking a lot less daunting now, hopefully the upgrade pilot will work well and we can start to get it deployed across the client estate on schedulle.. If it turns out I still have problems and find further fixes I’ll post back here again.

    Thanks for the blog post – I hope my additional information helps someone else out 🙂 Can’t wait for the next version 😀

    • Casper Lillegård Madsen
      Casper Lillegård Madsen January 31, 2016 at 10:49 - Reply

      That’s quite a journey you been on to *hopefully* get it working. I actually also tried with creating the cfg file, but no luck with that method. Maybe every offline installer download comes with a random factor on how to get it working 😉

      Thanks for the many tips Rob and additional info, I’m glad my post helped you on some of the way 🙂

  4. Troy February 5, 2016 at 21:48 - Reply

    I feel your pain as I know how difficult it can be to install java or to update it. I have a method that has been working for two or more years and my success rate is 99% or higher. What I do is copy the msi into a folder on my sccm server along with a batch file and a vbs file. My batch file contains removal of all of the previous versions and the install line and it looks something like this:

    **************
    REM *** This will uninstall ALL JAVA ***

    taskkill /F /IM iexplorer.exe
    taskkill /F /IM iexplore.exe
    taskkill /F /IM firefox.exe
    taskkill /F /IM chrome.exe
    taskkill /F /IM javaw.exe
    taskkill /F /IM jqs.exe
    taskkill /F /IM jusched.exe

    MsiExec.exe /X {26A24AE4-039D-4CA4-87B4-2F83218060F0} /qn /norestart
    REM Uninstall Java(TM) 8 update 65 32 bit
    MsiExec.exe /X {26A24AE4-039D-4CA4-87B4-2F83218065F0} /qn /norestart
    REM Uninstall Java(TM) 8 update 66 32 bit
    MsiExec.exe /X {26A24AE4-039D-4CA4-87B4-2F83218066F0} /qn /norestart

    TIMEOUT 5
    REM INSTALL JAVA 1.8.0_73
    msiexec.exe /i %~dp0jre1.8.0_73.msi /passive /norestart
    exit /B %EXIT_CODE%
    ************

    I do have all of the older versions listed as well, but to save space I only included a few for demonstration purposes. In my vbs file I have it copying my config files over that also include my security exception list. I moved the cache to a common folder so every user doesn’t have their own copy. I found using a common folder makes everything easier and whenever I have a new site that needs to added to the exception list I just edit the ‘exception.sites’ adding the new site.

    I create a new Package in SCCM and within this package I create two programs; one with my batch file and another one with my vbs file. I deploy the vbs file, but on the Advanced tab I have checked the “run another program first” and I chose the batch file. That way my vbs config file doesn’t run until after the removal and install of java on the client.

    So when there is a new update to Java I just copy the msi into a new folder and copy the batch file and vbs file over from the previous version, edit the line for the version I’m installing and I create a new package and I’m ready to deploy. To its really simple and it works great. I hope this helps.

    • Mike_KC February 10, 2016 at 18:20 - Reply

      Troy,
      Would you be willing to share your vbs script as well?

      It would be most appreciated.

      Thanks,
      Mike

    • Shanna April 26, 2017 at 5:32 - Reply

      Thank you for some other invaimotrfe website. The place else may just I get that kind of info written in such a perfect method? I have a mission that I am simply now running on, and I have been at the glance out for such info.

  5. Tommy February 11, 2016 at 8:52 - Reply

    Starting at Windows 8 and the problem with rollback when installing Java, we have completely changed the way we distribute Java.
    We use SCCM to deploy the applications, here is our solution to force java to be installed on computers.
    1) Create Java Application, we deploy x86 & x64 in the same app.
    2) Create 3 deployment types. Priority 1 depends on nr 2, and priority 2 depends on nr 3. (installation will start at priority 3 then 2, and finally 1.
    3) Priority 3 Deployment Type: Is bat script just altering registry to turn off DisableRollback.
    3) Priority 2 Deployment Type: Self made program much like this from coretech (http://blog.coretech.dk/jgs/coretech-auto-install-warning-freeware/), but we have included the possibillity to delay installation for a period of time, install and log off, install and shut down, and install now. Otherwise the program will install after countdown reach 0. USers can minimize the program, and then get a countdown i the bottom right corner of the screen.
    The reason for doing this, is that we have had a lot of problems regarding faulty Java installs due to running webbrowsers.
    4) Based on the answer in step 3, a new bat file will kick of and start the installation.
    We use this msi install string:
    REM Install JRE x86
    msiexec.exe /i “%~dp0VS8U71x86jre1.8.0_73.msi” /qn JU=0 JAVAUPDATE=0 AUTOUPDATECHECK=0 RebootYesNo=No
    REM Installing JRE x64
    msiexec.exe /i “%~dp0VS8U71x64jre1.8.0_73.msi” /qn JU=0 JAVAUPDATE=0 AUTOUPDATECHECK=0 RebootYesNo=No
    ping -n 160 127.0.0.1>nul

    Enables DisableRollback again.
    If user is logged on, we display a message on the screen that Java is finished installing, and the web-browser can be used again.

    The same day as we publish a new version of Java, we update a unistall script for java witch runs as a required application on a schedule in sccm.
    *************************
    Option Explicit

    Dim oFSO, oLog, strComputer, oWMI, colSoft, oSoft, test, test2, navn, java1, java2, intCompare, intCompare2, javasiste
    java1 = “Java 8 Update 73”
    java2 = “Java 8 Update 73 (64-bit)”

    strComputer = “.”
    Set oWMI = GetObject(“winmgmts:{impersonationLevel=impersonate}!\” & strComputer & “rootcimv2”)
    Set colSoft = oWMI.ExecQuery(“SELECT * FROM Win32_Product Where Name LIKE ‘Java%'”)

    For Each oSoft In colSoft
    navn = oSoft.Name
    intCompare = StrComp (navn, java1, vbTextCompare)
    if intCompare = 0 then
    javasiste = javasiste + 1
    elseif intCompare2 = StrComp (navn, java2, vbTextCompare) then
    javasiste = javasiste + 1
    end if
    Next

    For Each oSoft In colSoft
    navn = oSoft.Name
    test=0
    test2=0
    intCompare = StrComp (navn, java1, vbTextCompare)
    if intCompare = 0 then
    test = 1
    elseif intCompare2 = StrComp (navn, java2, vbTextCompare) then
    test2 = 1
    elseif test = 0 AND test2 = 0 AND javasiste > 0 then
    oSoft.Uninstall()
    end if
    Next
    *************************

    This will remove all old instances of java, if and only if both versions of the new Java Update 73 is installed. Be aware! if you publish this unistall script, remember that it will with this configuration remove everything that starts with Java. Do yo have applications, like Java sdk etc, please reconfigure the script, otherwise some people may be unhappy 🙂

  6. Troy February 18, 2016 at 17:41 - Reply

    Mike, here is my vbs code. You will need to replace the share path with yours.
    *****************************************
    Const HKEY_LOCAL_MACHINE = &H80000002
    strComputer = “.”
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    Set oReg=GetObject(“winmgmts:{impersonationLevel=impersonate}!\” & _
    strComputer & “rootdefault:StdRegProv”)

    strKeyPath = “SOFTWAREMicrosoftWindowsCurrentVersionRun”
    strDWORDValueName = “SunJavaUpdateSched”
    oReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strDWORDValueName

    If objFSO.FolderExists(“C:program files(x86)”) Then
    ‘Set objFolder = objFSO.GetFolder(“C:FSO”)
    strKeyPath = “SOFTWAREJavaSoftJava UpdatePolicy”
    strValueName = “EnableJavaUpdate”
    dwValue = 0
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue

    ELSE
    strKeyPath = “SOFTWAREWow6432NodeJavaSoftJava UpdatePolicy”
    strValueName = “EnableJavaUpdate”
    dwValue = 0
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue

    End If

    IF NOT objFSO.FolderExists(“C:WINDOWSSUN”) Then
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    Set objFolder = objFSO.CreateFolder(“C:WINDOWSSUN”)
    Set objFolder = objFSO.CreateFolder(“C:WINDOWSSUNJAVA”)

    END IF

    Const OverWriteFiles = TRUE

    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    objFSO.CopyFolder “\serverNamevb$java” , “c:windowssunjava” , OverWriteFiles

    Dim objShell
    Set objShell = WScript.CreateObject(“WScript.Shell”)

    Dim strFolder, strUser, strDomain

    strFolder = “c:windowssunjava”
    strUser = “users”
    strDomain = “”

    SetPermissions

    Function SetPermissions()
    Dim intRunError, objShell, objFSO

    Set objShell = CreateObject(“Wscript.Shell”)
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    If objFSO.FolderExists(strFolder) Then
    intRunError = objShell.Run(“icacls ” & strFolder & ” /grant ” & strDomain &”” & strUser & “:(OI)(CI)F “, 2, True)

    If intRunError 0 Then
    Wscript.Echo “Error assigning permissions for user ” & strUser & ” to folder ” & strFolder
    End If
    Else
    ‘ Wscript.Echo “Error: folder ” & strFolder & ” does not exist”
    End If
    End Function
    *********************

    The Java folder that it is copying has three folders; Depolyment, JavaCache, and Security. The Depolyment folder will contain the two files; deployment.config and deployment.properties. The deployment.config file will contain this line:

    deployment.system.config=file:C:/WINDOWS/Sun/Java/Deployment/deployment.properties

    The deployment.properties file I think I copied from a current install and contains these lines:
    #deployment.properties
    #Tue May 06 10:06:56 CDT 2014
    deployment.modified.timestamp=1399388816712
    deployment.version=8.0.310
    deployment.security.level=HIGH
    #Java Deployment jre’s
    #Tue May 06 10:06:56 CDT 2014
    deployment.javaws.jre.0.registered=true
    deployment.javaws.jre.0.platform=1.8
    deployment.javaws.jre.0.osname=Windows
    deployment.javaws.jre.0.path=C:\Program Files (x86)\Java\jre1.8.0_31\bin\javaw.exe
    deployment.javaws.jre.0.product=1.8.0_31
    deployment.javaws.jre.0.osarch=x86
    deployment.javaws.jre.0.location=http://java.sun.com/products/autodl/j2se
    deployment.javaws.jre.0.enabled=true
    deployment.javaws.jre.0.args=
    deployment.user.cachedir=c:\windows\sun\java\JavaCache
    deployment.user.security.exception.sites=c:\windows\sun\java\security\exception.sites
    deployment.expiration.check.enabled=false

    The JavaCache folder is blank. The Security folder will contain the file exceptions.sites which is a list of sites you want to add to the exceptions list that you see under the java applet, security tab.

    Hope this helps. Let me know if I leave something out.

    • Casper Lillegård Madsen
      Casper Lillegård Madsen February 19, 2016 at 7:31 - Reply

      Hey Troy,
      Thanks for sharing your script with us 🙂

      Best Regards,
      Casper

  7. Scott March 22, 2016 at 22:02 - Reply

    What line is the Share Path that need to be replaced?
    *****************************************
    Const HKEY_LOCAL_MACHINE = &H80000002
    strComputer = “.”
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    Set oReg=GetObject(“winmgmts:{impersonationLevel=impersonate}!\” & _
    strComputer & “rootdefault:StdRegProv”)
    strKeyPath = “SOFTWAREMicrosoftWindowsCurrentVersionRun”
    strDWORDValueName = “SunJavaUpdateSched”
    oReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strDWORDValueName
    If objFSO.FolderExists(“C:program files(x86)”) Then
    ‘Set objFolder = objFSO.GetFolder(“C:FSO”)
    strKeyPath = “SOFTWAREJavaSoftJava UpdatePolicy”
    strValueName = “EnableJavaUpdate”
    dwValue = 0
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
    ELSE
    strKeyPath = “SOFTWAREWow6432NodeJavaSoftJava UpdatePolicy”
    strValueName = “EnableJavaUpdate”
    dwValue = 0
    oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
    End If
    IF NOT objFSO.FolderExists(“C:WINDOWSSUN”) Then
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    Set objFolder = objFSO.CreateFolder(“C:WINDOWSSUN”)
    Set objFolder = objFSO.CreateFolder(“C:WINDOWSSUNJAVA”)
    END IF
    Const OverWriteFiles = TRUE
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    objFSO.CopyFolder “\serverNamevb$java” , “c:windowssunjava” , OverWriteFiles
    Dim objShell
    Set objShell = WScript.CreateObject(“WScript.Shell”)
    Dim strFolder, strUser, strDomain
    strFolder = “c:windowssunjava”
    strUser = “users”
    strDomain = “”
    SetPermissions
    Function SetPermissions()
    Dim intRunError, objShell, objFSO
    Set objShell = CreateObject(“Wscript.Shell”)
    Set objFSO = CreateObject(“Scripting.FileSystemObject”)
    If objFSO.FolderExists(strFolder) Then
    intRunError = objShell.Run(“icacls ” & strFolder & ” /grant ” & strDomain &”” & strUser & “:(OI)(CI)F “, 2, True)
    If intRunError 0 Then
    Wscript.Echo “Error assigning permissions for user ” & strUser & ” to folder ” & strFolder
    End If
    Else
    ‘ Wscript.Echo “Error: folder ” & strFolder & ” does not exist”
    End If
    End Function
    *********************

    • Troy April 21, 2016 at 16:20 - Reply

      the line
      objFSO.CopyFolder “\serverNamevb$java” , “c:windowssunjava” , OverWriteFiles

      change \serverNamevb$java to whatever is the path of the source.

  8. Peteski May 20, 2016 at 0:07 - Reply

    Be careful when using WMI. If you query a list of installed software such as win32_product, I found out the hard way that “select x,y,z from win32_product” results in the windows (7) OS literally running the MSI for EVERY piece of installed software to check for stuff. If you look in the application log I believe, you’ll see it reference each MSI being called for all programs in win32_product.

    On developer PCs or anyone with a large amount of software installed, this can take 5 or more minutes on physical PCs, longer on VDIs. So generally speaking, I do not query win32_product if I can help it.

    For my Java updates I use Landesk and a Powershell script. The script looks at what is installed, removes older JDK/JREs, notes which ones were installed and determines if it needs to install the latest JDK/JRE.

    It works reasonably well using the exe and only ‘/s’ silent switch as the other switches have proven to sometimes work and sometimes not, which is rather disheartening.

    The only thing bugging me at the moment is the AUTO_UPDATE=0 as it seems to cause problems. I’m either going to handle it by controlling the reg entry for it via GPO or perhaps try the MSI installation method but I have my doubts it will be more reliable over all future releases.

    WTF is Oracle doing with Java. It’s such a PITA and huge security hole they should be doing a much better job of making it very easy to update. Probably because it’s a free product it gets zero love/$ so we get the shaft. Yay.

    Good luck all.

  9. Matt August 10, 2017 at 21:57 - Reply

    thanks for this post, i had this same problem deploying java 8 update 66 using SCCM- the batch file worked fine locally on the test computer, but for some reason SCCM would not execute the java install- but had no issues with every other command in the batch file.

    can you point me to a description for the switches you have in your msi command line examples? i did some googling but to no avail, i can only find a list of the exe switches.

  10. check this site out September 11, 2017 at 17:11 - Reply

    … [Trackback]

    […] Read More on|Read More|Find More Infos here|Here you can find 38106 more Infos|Infos to that Topic: blog.ctglobalservices.com/configuration-manager-sccm/clm/silent-install-java-8-update-71-and-72-with-sccm/ […]

Leave A Comment