Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network.

I have my system wide deployment config and properties files set up:

  • %windir%\Sun\Java\Deployment\deployment.config (points to below file)
  • %windir%\Sun\Java\Deployment\deployment.properties

For purposes of this discussion the contents of deployment.properties is:

  • deployment.webjava.enabled=false
  • # deployment.webjava.enabled.locked (commented out)

My goal is to disable webjava by default and force the end-users to enable it if needed. Then upon restart or next load I would expect that the system would default back to the disabled state. However, I have found that once the user enables this, unless that deployment properties file is modified again, the setting won't be read again regardless of restart, etc.

I realize I could un-comment this # deployment.webjava.enabled.locked (commented out) and it would be fine but the end user could not then modify if needed.

Question: Has any one else had any success with configuring webjava in their deployment settings as I am attempting or have any other feedback with hardening the jre for end-users?

References:


UPDATE: Brandon - thanks for your input. Yes, you are right this is a work around. We could set that so that upon next gpupate (e.g. login) the setting would go back to disabled. Java control panel has a weird behavior that if this registry setting is set outside of the control panel, then next time the control panel is opened the setting will be read from somewhere else (? default settings somewhere I am not aware of) and thus it will appear as those the setting is still 'enabled'. In fact the registry gets updated to 'enabled' (by virtue of deleting the registry entry we have made) simply by opening the control panel and not even clicking apply or OK. A strange behavior indeed, but I guess it still gets us to the desired goal. It will just take a little more training with the end users due to the confusing display of the setting in the control panel. But then again, anything I was about to do would have required some end-user education.

share|improve this question
add comment

1 Answer

I am a little surprised by the behavior you're seeing, but do have a suggested workaround. In particular, the registry key HKCU\Software\AppDataLow\Software\JavaSoft\DeploymentProperties\deployment.webjava.enabled is responsible for controlling your configuration setting. GPO can trivially set this value and the permissions on it to ensure that your end users have rights to enable the feature. See this technet post on custom registry changes through GPO.

By going this route, you ensure that the feature is disabled during the application of GPO while logging on.

share|improve this answer
    
Yes, you are right this is a work around. –  guest Apr 9 '13 at 18:22
    
Added further comments in the body of the message above. –  guest Apr 9 '13 at 18:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.