Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With the known Java threat on the loose, I've pushed a GPO to disable Java within IE. However, I'd like to disable Java across all browsers. Java provides documentation on how to do this via their new control panel: How do I disable Java in my web browser?

I'd like to push out this setting via Group Policy. I imagine this should be able to be done by identifying the registry setting that is modified by the Java Control Panel.

Has anyone identified the registry settings needed to disable Java across all browsers?

share|improve this question
    
FYI - Microsoft has published an article on this. I'm not sure when it was published, but the there is a date in the source markup of 22-Jan-2013. support.microsoft.com/kb/2751647 –  Greg Askew Jan 23 '13 at 0:03

5 Answers 5

up vote 4 down vote accepted

Update: Microsoft has published KB 2751647 which describes the necessary settings:

http://support.microsoft.com/kb/2751647


For these scenarios, I usually just take a before/after snapshot using reg.

REG EXPORT HKLM HKLM-Before.txt  
REG EXPORT HKCU HKCU-Before.txt  

Make the configuration setting changes...

REG EXPORT HKLM HKLM-After.txt  
REG EXPORT HKCU HKCU-After.txt  

Then using a decent text editor like Notepad++ with the Compare add-in to identify the differences in each before/after file set.

If you have both x86 and x64 platforms, you will most likely need two different sets of registry values and GPO's, as almost everyone uses 32-bit java even if the platform is x64.

share|improve this answer
    
Vote++. If you identify the relevant registry values, you can either create your own ADMX file and use GPOs, or use the (newer) Group Policy Preferences option to make the change. –  Simon Catlin Jan 13 '13 at 18:30
    
This is what I was planning on doing so +1, however, I was hoping someone had identified the keys :). I'll report back with the relevant keys once I do. –  Cheekaleak Jan 13 '13 at 19:49
    
I did run this, however it reported a lot of keys in HKLM were deleted. Like 6,000 lines. Not sure if all of those are needed, or it is feasible to use that many in a GPO. You may want to check this previous answer to see if that may help: serverfault.com/a/360314/20701 –  Greg Askew Jan 13 '13 at 20:44

I found a change under:

HKEY_CURRENT_USER\Software\AppDataLow\Software\JavaSoft\DeploymentProperties\

A key was added:

deployment.webjava.enabled - REG_SZ - false
share|improve this answer

After testing, it looks like there are way too many registry keys that would need to be modified to have this be a viable option. Additionally, it would only work for java 7 update 10 and above. Given that information, and the release of Java 7 update 11, I've simply pushed out the latest release via GPO.

share|improve this answer

Firefox can find the Java plugin with two methods, both must be disabled:

  • Set the preference plugin.scan.sunJRE in Firefox to a number higher than the current versison number, for example 9.9 (Java 7.11 has version number 1.7.11, so 9 is a lot higher).
  • Remove the registry keys HKLM\SOFTWARE\MozillaPlugins\@java.com*
share|improve this answer

The tool RegFromApp is probably better to find registry changes. It doesn't do snapshots, it watches while the changes are made, and it can be told to watch only to changes made by a certain process. This gives you a much smaller, cleaner registry file, with less clutter. Unfortunately I once noticed that even this tool sometimes lists changes that must have been coming from somewhere else.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.