3

With the known Java threat on the loose, I've pushed a GPO to disable Java within IE. However, I'd like to disable Java across all browsers. Java provides documentation on how to do this via their new control panel: How do I disable Java in my web browser?

I'd like to push out this setting via Group Policy. I imagine this should be able to be done by identifying the registry setting that is modified by the Java Control Panel.

Has anyone identified the registry settings needed to disable Java across all browsers?

Improve this question
0

5 Answers 5

Reset to default
5

Update: Microsoft has published KB 2751647 which describes the necessary settings:

http://support.microsoft.com/kb/2751647

For these scenarios, I usually just take a before/after snapshot using reg. 

REG EXPORT HKLM HKLM-Before.txt  
REG EXPORT HKCU HKCU-Before.txt

Make the configuration setting changes... 

REG EXPORT HKLM HKLM-After.txt  
REG EXPORT HKCU HKCU-After.txt

Then using a decent text editor like Notepad++ with the Compare add-in to identify the differences in each before/after file set.

If you have both x86 and x64 platforms, you will most likely need two different sets of registry values and GPO's, as almost everyone uses 32-bit java even if the platform is x64.

Improve this answer
3
  • Vote++. If you identify the relevant registry values, you can either create your own ADMX file and use GPOs, or use the (newer) Group Policy Preferences option to make the change.
    – Simon Catlin
    Jan 13, 2013 at 18:30
  • This is what I was planning on doing so +1, however, I was hoping someone had identified the keys :). I'll report back with the relevant keys once I do.
    – HostBits
    Jan 13, 2013 at 19:49
  • 1
    I did run this, however it reported a lot of keys in HKLM were deleted. Like 6,000 lines. Not sure if all of those are needed, or it is feasible to use that many in a GPO. You may want to check this previous answer to see if that may help: serverfault.com/a/360314/20701
    – Greg Askew
    Jan 13, 2013 at 20:44
1

I found a change under:

HKEY_CURRENT_USER\Software\AppDataLow\Software\JavaSoft\DeploymentProperties\

A key was added:

deployment.webjava.enabled - REG_SZ - false
Improve this answer
0

After testing, it looks like there are way too many registry keys that would need to be modified to have this be a viable option. Additionally, it would only work for java 7 update 10 and above. Given that information, and the release of Java 7 update 11, I've simply pushed out the latest release via GPO.

Improve this answer
0

Firefox can find the Java plugin with two methods, both must be disabled:

  • Set the preference plugin.scan.sunJRE in Firefox to a number higher than the current versison number, for example 9.9 (Java 7.11 has version number 1.7.11, so 9 is a lot higher).
  • Remove the registry keys HKLM\SOFTWARE\MozillaPlugins\@java.com*
Improve this answer
0

The tool RegFromApp is probably better to find registry changes. It doesn't do snapshots, it watches while the changes are made, and it can be told to watch only to changes made by a certain process. This gives you a much smaller, cleaner registry file, with less clutter. Unfortunately I once noticed that even this tool sometimes lists changes that must have been coming from somewhere else.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .