IE11 Migration Guide: Create Internet Explorer 11 batch deployment package

Apr 15, 2015

It’s time to fight back against Oracle and their crappy ways of supporting Java. This two punch script will uninstall any version in your org.. Even if multiple versions exist on a machine. Use it today and Screw oracle like you mean it 🙂

—- java-uninstall.bat —–
REM <start>
@echo off
if not exist c:\temp\. mkdir c:\temp
REM Export the Uninstall registry keys
start /wait “” REGEDIT /E c:\temp\registry.tmp HKEY_LOCAL_MACHINE\SOFTWARE\microsoft\windows\currentversion\uninstall
REM Filter only the {} keys that Java might be in
type c:\temp\registry.tmp | find /i “{” | find /i “}]” > c:\temp\uninstall.tmp
type c:\temp\registry.tmp | find /i “JRE 1” >> c:\temp\uninstall.tmp

REM Run the Vbscript that uses this file to find Java Sun entries to uninstall
cscript “java-uninstaller.vbs”
REM <end>
—- java-uninstall.bat —–

—- java-uninstaller.vbs —–
On Error Resume Next
Set WshShell = WScript.CreateObject(“WScript.Shell”)
Dim fso, MyFile
Set fso = CreateObject(“Scripting.FileSystemObject”)
Const ForReading = 1, ForWriting = 2
TempDir = “c:\temp”
TempISS = “c:\temp\iss”
LogFile = “uninst.log”
UnString = ” -s -a /s /f1″
Set MyFile = fso.OpenTextFile(TempDir & “\uninstall.tmp”, ForReading)
Set ts = fso.CreateTextFile(LogFile)
Set f = fso.CreateFolder(TempISS)

Do While MyFile.AtEndOfStream <> True
ReadLineTextFile = MyFile.ReadLine
Uninstall = ReadLineTextFile
CLSID = Mid(Uninstall, 73, 38)
search5 = Instr(Uninstall, “JRE 1”)
search6 = Instr(Uninstall, “]”)
If search5 > 0 AND search6 > 0 Then
JRE1 = Replace(Mid(Uninstall, search5, search6),”]”,””)
End If

‘DisplayName
DisplayName=WshShell.RegRead(“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” & CLSID & “\DisplayName”)
‘Publisher
Publisher=WshShell.RegRead(“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” & CLSID & “\Publisher”)

‘UninstallString
UninstallString=WshShell.RegRead(“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” & CLSID & “\UninstallString”)

‘JREUninstallString
JREUninstallString=WshShell.RegRead(“HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” & JRE1 & “\UninstallString”)

If JREUninstallString <> “” Then
JREUN = Replace(JREUninstallString,” -f”,” -s -a /s /f”)
ts.writeline JREUN
Return = WshShell.Run(JREUN , 1, TRUE)
End If

‘Search for presence of Java and Sun in DisplayName and Publisher
search1 = Instr(1, DisplayName, “Java”, 1)
search2 = Instr(1, Publisher, “Sun”, 1)
search3 = Instr(1, DisplayName, “J2SE”, 1)
search4 = Instr(1, UninstallString, “setup.exe”, 1)
‘Execute removal if there is a match
Uninstaller=”MsiExec.exe /X”&CLSID+” /QN”
if search1 > 0 or search3 > 0 and search2 > 0  Then
ts.writeline Uninstaller

Set iss = fso.CreateTextFile(TempISS & “\” & CLSID & “.iss”)

‘Create Response file for any Java Version
iss.writeline “[InstallShield Silent]”
iss.writeline “Version=v6.00.000”
iss.writeline “File=Response File”
iss.writeline “[File Transfer]”
iss.writeline “OverwrittenReadOnly=NoToAll”
iss.writeline “[” & CLSID & “-DlgOrder]”
iss.writeline “Dlg0=” & CLSID & “-SprintfBox-0”
iss.writeline “Count=2”
iss.writeline “Dlg1=” & CLSID & “-File Transfer”
iss.writeline “[” & CLSID & “-SprintfBox-0]”
iss.writeline “Result=1”
iss.writeline “[Application]”
iss.writeline “Name=Java 2 Runtime Environment, SE v1.4.0_01”
iss.writeline “Version=1.4.0_01”
iss.writeline “Company=JavaSoft”
iss.writeline “Lang=0009”
iss.writeline “[” & CLSID & “-File Transfer]”
iss.writeline “SharedFile=YesToAll”

If search4 > 0 Then
ss = Left(UninstallString,search4 + 9)
setupuninstal =  ss & UnString & Chr(34) & TempISS & “\” & CLSID & “.iss” & Chr(34)
ts.writeline setupuninstal
Return = WshShell.Run(setupuninstal , 1, TRUE)
End If
Return = WshShell.Run(Uninstaller , 1, TRUE)
End If
Loop
MyFile.Close
fso.DeleteFolder(TempDir)
—- java-uninstaller.vbs —–

Anyone can go to the control panel on their windows OS and shut down Java running in their browser. But how the hell are you going to do it for over 10,000K + non it people.

First a shopping list of sorts.

Windows SDK – http://www.microsoft.com/en-us/download/details.aspx?id=3138

Manual Java Download link – http://www.java.com/en/download/manual.jsp

I will show how to manipulate the MSI based installed of Java so that you can build a custom transform with the settings you feel is appropriate to deploy. First steps is to download the Windows 7 SDK. You do not need to install the full SDK. Follow my second link on how to install ORCA. The second article tells you which options you will need to install.

So what is ORCA? ORCA is a Microsoft based utility that allows you to see property database tables of MSI installers. This will be an important thing to do so we can build a custom transform of Java.

Download Java from the manual download link. So you will start to think. Hey wait a minute. This only has executable versions of Java. That’s ok. I suggest installing it in a Windows 7 VM.

Install Java 7 update 10 in a Windows 7 VM. Once you are finished navigate to the following folder.

C:\Users\{username}\AppData\LocalLow\Sun\Java\jre1.7.0_10 (for Win 7)

You will see two files:

Pull those and make two separate copies in two separate places. I suggest making some copies of it in case you end up messing something up. Next you will need to run ORCA and do a file Open on the jre1.7.0_10.msi file.

When orca pulls up the MSI you will see a lot of property table files. The first thing you need to do. Generate a new transform before you start editing.

Once you have selected new Transform on the right you will see a listing of tables. Scroll down until you see a Table called “Property”.

There are a few properties to take note of.

(AUTOUPDATECHECK=0 JAVAUPDATE=0, MOZILLA=1, IEXPLORER=1 and REBOOT=No)

In their current order. This will prevent Java from Auto updating and performing update checks. Why do this? In your org it is wise to test application compatibility related to java applications before you choose to upgrade. It’s all about quality control.

The other settings enable java in Mozilla Firefox and IE. Reboot’s are suppressed with the setting “No”. This is done for obvious reasons. If you only run IE in your org. Mozilla can be set to = 0

Some new settings to take note of which are not in the “Property” Table

WEB_JAVA=0/1

WEB_JAVA_SECURITY_LEVEL=VH/H/M/L

These are two settings you can add as a property row in the table “Property” all you need to do is right click on the right hand side of the window pane and click on “add row”

WEB_JAVA=0

This will disable java content inside the browser. IF you do this. Setting WEB_JAVA_SECURITY_LEVEL will not be needed.

WEB_JAVA=1

This will enable Java inside the browser. Setting WEB_JAVA_SECURITY_LEVEL will be needed. Assign your security level as you see fit.

Once you are done with adding in the settings. Go to Transform toolbar and select “Generate Transform”. This will make a mst of your customized JAVA settings for you org.

Rollout Time

Uninstall previous version of Java. Refer to my script located here to do that. This will uninstall any version of Java. Even if multiple versions exist on the machine.

Next rollout customized version of Java.

Here is what your customized rollout deployment would look like from a command line

msiexec /i c:\temp\jre1.7.0_10.msi TRANSFORMS=”c:\temp\untitled.mst” /passive

This will automatically install Java only showing a progress bar to the machine.

Roll the uninstall script and this command line into your org’s deployment tool. MSI’s can also be accomplished as a GPO software based policy install.

Adding a little Extra security sauce to your landscape

Only do this if you enabled web_java setting

If you have well documented apps in your org then you should start whitelisting sites in the trust sites zone.

Do this to the registry first:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Set the value data from 10000 to 0

This effectively removes java from being ran in the “internet zone”

I normally do reg add modifications as batch scripts and then I deploy.

Next set up your trusted sites by group policy. This will eliminate a lot of risk if you absolutely have to run Java in your internet browser. Be aware of XSS exploits though

First a shopping list of sorts.

Windows SDK – http://www.microsoft.com/en-us/download/details.aspx?id=3138

Manual Java Download link – http://www.java.com/en/download/manual.jsp

Required:

1. Download and install the Sonicwall 64-bit VPN client from HERE (as of this writing).

2. Install the Cisco VPN client.  Edit:  If you get an error that it cannot run on this operating system then just extract the .exe file and run the .msi file.  Problem solved.

The first two steps worked for me without the need for registry edit.  I checked and the settings were already spelled correctly on my machine.  Full disclosure my systems are clean Windows 10 installs without being upgrades.

Without installing the Sonicwall client first you will get Error 433 after trying to connect.  Checking the logs shows that it cannot download the key to complete the secure connection.

What happens is that the Sonicwall client adds the DNE Lightweight filter network client on the machine.  I tried getting it directly from Citrix and installing it that way but was unsuccessful.

Using this method you can now get some more use out of the Cisco VPN client.  If you prefer you can uninstall the Sonicwall client afterwards.  I’ve been told by several people that the DNE software remains even after the Sonicwall client is removed.

BUILD 1511 EDIT:

I’m getting a lot of feedback about networking being broken after 1511.  I would highly advise you remove the Cisco VPN client and Sonic Global client software prior to installing build 1511.

I have now upgraded three different systems to 1511.  By removing both the Sonicwall and Cisco VPN software first, I had zero issues with it working properly afterwards.

However if the upgrade went through already, here’s what you can do to help mitigate these issues.  There’s no guarantee this is going to work but I have had two instances where the Cisco VPN software was removed by the 1511 upgrade and this worked after following the steps above.

You will need to reset all networking on Windows 10.  Luckily this is pretty easy to do.

– Open an administrator command prompt
– Run “netcfg -d”
– Reboot and reconfigure your networking as needed.