Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

With the known Java threat on the loose, I've pushed a GPO to disable Java within IE. However, I'd like to disable Java across all browsers. Java provides documentation on how to do this via their new control panel: How do I disable Java in my web browser?

I'd like to push out this setting via Group Policy. I imagine this should be able to be done by identifying the registry setting that is modified by the Java Control Panel.

Has anyone identified the registry settings needed to disable Java across all browsers?

share|improve this question
up vote 5 down vote accepted

Update: Microsoft has published KB 2751647 which describes the necessary settings:

For these scenarios, I usually just take a before/after snapshot using reg.


Make the configuration setting changes...


Then using a decent text editor like Notepad++ with the Compare add-in to identify the differences in each before/after file set.

If you have both x86 and x64 platforms, you will most likely need two different sets of registry values and GPO's, as almost everyone uses 32-bit java even if the platform is x64.

share|improve this answer
Vote++. If you identify the relevant registry values, you can either create your own ADMX file and use GPOs, or use the (newer) Group Policy Preferences option to make the change. – Simon Catlin Jan 13 '13 at 18:30
This is what I was planning on doing so +1, however, I was hoping someone had identified the keys :). I'll report back with the relevant keys once I do. – HostBits Jan 13 '13 at 19:49
I did run this, however it reported a lot of keys in HKLM were deleted. Like 6,000 lines. Not sure if all of those are needed, or it is feasible to use that many in a GPO. You may want to check this previous answer to see if that may help: – Greg Askew Jan 13 '13 at 20:44

I found a change under:


A key was added:

deployment.webjava.enabled - REG_SZ - false
share|improve this answer

After testing, it looks like there are way too many registry keys that would need to be modified to have this be a viable option. Additionally, it would only work for java 7 update 10 and above. Given that information, and the release of Java 7 update 11, I've simply pushed out the latest release via GPO.

share|improve this answer

Firefox can find the Java plugin with two methods, both must be disabled:

  • Set the preference plugin.scan.sunJRE in Firefox to a number higher than the current versison number, for example 9.9 (Java 7.11 has version number 1.7.11, so 9 is a lot higher).
  • Remove the registry keys HKLM\SOFTWARE\MozillaPlugins\*
share|improve this answer

The tool RegFromApp is probably better to find registry changes. It doesn't do snapshots, it watches while the changes are made, and it can be told to watch only to changes made by a certain process. This gives you a much smaller, cleaner registry file, with less clutter. Unfortunately I once noticed that even this tool sometimes lists changes that must have been coming from somewhere else.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.