A customer has provided a Windows Server 2012R2 instance to use as our server. This morning (July 25th) I reconnected to the box to change my password and was immediately prompted about a successful Java installation and to uninstall old versions of Java.
This is alarming, because our server application is Java based and currently running on an older version of Java (which is fine for our purposes) and uninstalling an older version of Java could cause our server application to fail if you removed the version it is using!
Naturally, I declined to remove the old version of Java, but my colleague and I were disturbed that I was even prompted. If someone else logged in without the awareness of our Java dependency they might remove the old version.
I checked my Java Update settings and discovered that it was set to check, but prompt before downloading. (Since I've disabled even checking.)
We investigated further and found in Event Viewer that on July 20th around noon a new version of Java (8 update 101) was installed on the box and apparently I'd done it (or it was done with my User ID). However, we know that I didn't do it, since I was on vacation in Yellowstone National Park that day without internet! My User ID is an AD account that has Admin privileges, but is named "smmccants" and does not have a shared password. I did have a session running on the server (I usually disconnect rather than logout).
I was unable to find anything interesting in the Event Viewer from my reconnect and interaction with the Java dialogs this morning (7/25/2016 a little before 10:00 AM).
We are wanting to understand what happened and prevent it in the future. Any ideas on how this could have automatically occurred and where else we should look for clues?
Below are the logs I found in EventViewer.
From Event Viewer (Source: MsiInstaller) at 7/20/2016 11:59:44 AM:
Beginning a Windows Installer transaction: C:\Users\smmccants\AppData\LocalLow\Oracle\Java\jre1.8.0_101\jre1.8.0_101full.msi Client Process Id: 87064
From MsiInstaller at 7/20/2016 12:00:29 AM:
Product: Java 8 Update 101 -- Installation completed successfully
-
Windows Installer installed product. Product Name: Java 8 Update 101. Product Version: 8.0.1010.13. Product Language: 1033 Manufacturer: Oracle Corporation. Install success or error status: 0.
-
Ending a Windows Installer transaction: C:\Users\smmccants\AppData\LocalLow\Oracle\Java\jre1.8.0_101\jre1.8.0_101full.msi. Client Process Id: 87064
-
Beginning a Windows Installer transaction: {4A03706f-666A-4037-7777-5F2748764D10}. Client Process Id: 87064
And then from RestartManager (whatever that is...):
Starting session 0 - 2016-07-20T17:00:29.904899600Z
Finally, we get a new time stamp of 7/20/16 12:00:39 and MsiInstaller reports:
Product: Java Auto Updater -- Removal completed successfully.
Who ordered the removal and how did they do it through my user account? Likely part of the install process for Java 8 Update 101.
Windows Installer removed the product. Product Name: Java Auto Updater. Product Version: 2.8.77.3 Product Language: 1033 Manufacturer: Oracle Corporation. Removal success or error status: 0.
-
Ending a Windows Installer transaction: {4A03706f-666A-4037-7777-5F2748764D10}. Client Process Id: 87064
-
Beginning a Windows Installer transaction: C:\Users\smmccants\AppData\LocalLow\Oracle\Java\jre1.8.0_101\au.msi. Client Process Id: 87064
Now at 12:00:40 PM
Product: Java Auto Updater -- Installation completed successfully.
-
Windows Installer installed the product. Product Name: Java Auto Updater. Product Version 2.8.101.13. Product Language: 1033. Manufacturer: Oracle Corporation. Installation success or error status: 0.
-
Ending a Windows Installer transaction: C:\Users\smccants\AppData\LocalLow\Oracle\Java\jre1.8.0_101\au.msi. Client Process Id: 87064.
-
Beginning a Windows Installer transaction: {26A24AE4-039D-4Ca4-87B4-2F83218077F0}. Client Process Id: 87064
Now we go backwards one second to 12:00:39 PM for one message from RestartManager:
Ending session 0 started 2016-07-20T17:00:29.904899600Z
Now RestartManager at 12:00:40 PM:
Starting session 0 - 2016-07-20T17:00:40.326806900Z
-
Ending session 0 started 2016-07-20T17:00:29.904899600Z
Now we get to the really scary MsiInstaller messages at 12:01:07 PM:
Product: Java 8 Update 77 -- Removal completed successfully.
-
Windows Installer removed the product. Product Name: Java 8 Update 77. Product Version: 8.0.770.3. Product Language: 1033. Manufacturer: Oracle Corporation. Removal success or error status: 0.
This next message is logged under the SYSTEM user, instead of me.
Ending a Windows Installer transaction: {26A24AE4-039D-4Ca4-87B4-2F83218077F0}. Client Process Id: 87064
That is all I found.
