I am trying to set up some hardened deployment settings for Java for the end-users' machines on my network.
I have my system wide deployment config and properties files set up:
- %windir%\Sun\Java\Deployment\deployment.config (points to below file)
For purposes of this discussion the contents of deployment.properties is:
# deployment.webjava.enabled.locked (commented out)
My goal is to disable webjava by default and force the end-users to enable it if needed. Then upon restart or next load I would expect that the system would default back to the disabled state. However, I have found that once the user enables this, unless that deployment properties file is modified again, the setting won't be read again regardless of restart, etc.
I realize I could un-comment this
# deployment.webjava.enabled.locked (commented out) and it would be fine but the end user could not then modify if needed.
Question: Has any one else had any success with configuring webjava in their deployment settings as I am attempting or have any other feedback with hardening the jre for end-users?
UPDATE: Brandon - thanks for your input. Yes, you are right this is a work around. We could set that so that upon next gpupate (e.g. login) the setting would go back to disabled. Java control panel has a weird behavior that if this registry setting is set outside of the control panel, then next time the control panel is opened the setting will be read from somewhere else (? default settings somewhere I am not aware of) and thus it will appear as those the setting is still 'enabled'. In fact the registry gets updated to 'enabled' (by virtue of deleting the registry entry we have made) simply by opening the control panel and not even clicking apply or OK. A strange behavior indeed, but I guess it still gets us to the desired goal. It will just take a little more training with the end users due to the confusing display of the setting in the control panel. But then again, anything I was about to do would have required some end-user education.