Oracle Java, ruleset.xml and signing deploymentruleset.jar

Since Java 7 Update 51 Oracle has tighten the Java security. From now on only predefined sites are allowed to run, otherwise users will get all kind of warnings.
Fortunately the most warnings can be suppressed. In this article I will describe what admins can do.

Fortunately Oracle has described what can be done:

  1. Introducing Deployment Rule Sets
  2. Deployment Rule Set

The following steps need to be performed:

  1. Create a ruleset.xml
  2. Create a DeploymentRuleSet.jar from the ruleset.xml
  3. Sign the DeploymentRuleSet.jar with a self created certificate
  4. Copy the signed DeploymentRuleSet.jar, deployment.properties and deployment.config files to %windir%\sun\java\deployment.

The steps in detail:

In this example I will use Java 8 Update 151. That was the most recent version at the time of writing this article.

  1. Download Java JRE 8 Update 151 (offline installer) from Java Downloads for All Operating Systems.

    jre-8u151-windows-i586.exe

  2. Download Java JDK as the same version as the Java Runtime Engine from Java SE Development Kit 8 Downloads.

    jdk-8u151-windows-i586.exe

  3. Use 7Zip to extract the content of the file jdk-8u151-windows-i586.exe. You will get a ‘tools.zip’ folder.
  4. Extract the following files from the tools.zip file and copy them to a new folder:
    Folder PATH listing for volume Windows
    Volume serial number is 00000072 D689:C60A
    << Folder does not matter >>
    +---bin
    |       jar.exe
    |       jarsigner.exe
    |       jli.dll
    |       keytool.exe
    |       msvcr100.dll
    |       ruleset.xml
    |       
    \---lib
            tools.jar
    
  5. Create the ruleset.xml in the ‘bin’ folder (this one is an example grabbed from the Oracle Website):
    
    
    
        
        
          
        
        
      
    
      
        
        
      
    
      
        
        
      
    
      
        
        
      
    
      
        
        
          Blocked by corporate. Contact J. Smith, smith@host.example.com, if you need to run this app.
        
      
    
     
    
  6. Install Java 8 Update 151
  7. Run the following commands in the bin folder:
    cd "%~dp0\bin"
    keytool -keystore "C:\Program Files (x86)\Java\jre1.8.0_151\lib\security\cacerts" -storepass changeit -delete -alias DummyCompany
    jar.exe -cvf DeploymentRuleSet.jar ruleset.xml
    keytool -genkeypair -dname "cn=cnDummyCompany, ou=ouDummyCompany, o=oDummyCompany, c=EU" -alias DummyCompany -keypass Th!sH3lpsM3AL0t -keystore CA.jks -storepass Th!sH3lpsM3AL0t -validity 99999
    keytool -exportcert -keystore CA.jks -alias DummyCompany -file CA.cer -storepass Th!sH3lpsM3AL0t
    REN CA.cer CA.pem
    keytool -importcert -keystore "C:\Program Files (x86)\Java\jre1.8.0_151\lib\security\cacerts" -storepass changeit -file CA.pem -alias DummyCompany -noprompt
    jarsigner -verbose -keystore CA.jks -sigalg SHA256withDSA -signedjar DeploymentRuleSet.jar DeploymentRuleSet.jar DummyCompany -storepass Th!sH3lpsM3AL0t -tsa http://timestamp.digicert.com
    jarsigner -verify DeploymentRuleSet.jar
    copy DeploymentRuleSet.jar "C:\Windows\sun\java\deployment" /Y
    
  8. Create the following 2 files in C:\Windows\sun\java\deployment
    deployment.properties

    deployment.javaws.autodownload.locked= 
    deployment.javaws.autodownload=NEVER
    deployment.expiration.check.enabled=false
    deployment.expiration.decision.suppression=true
    deployment.expiration.decision=NEVER
    deployment.insecure.jres=ALWAYS
    deployment.security.level.locked
    deployment.security.level=HIGH
    deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sites
    deployment.user.security.exception.sites.locked
    deployment.security.mixcode.locked
    deployment.security.mixcode=HIDE_RUN
    deployment.webjava.enabled.locked
    deployment.webjava.enabled=true
    

    deployment.config

    deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
    deployment.system.config.mandatory=false
    
  9. Open Java Console and check the installation:

    Valid DeploymentRuleset


    Certificate details

The vb-script

The vbscript checks if there is a working network connection. That is needed as the certificate needs to be validated. See my blog article Check if there is a working internet connection when a firewall blocks ping requests for more information.

The vbscripts.

' ================================================================================================
' Installs Java certificates and installs deploymentruleset.jar
' Created by Willem-Jan Vroom
' Version history:
'
' 0.0.1
'  - Initial version
'
' 1.0.0
'  - Final version
'
' 1.0.1
'  - Checks if the folder %ProgramFiles%\Java\jre7 or %ProgramFiles(x86)%\Java\jre exits.
'    If not then quit.
'  - The file 'cacerts' will not be copied to the 'files_for_gpo' folder.
'
' 1.0.2
'  - Checks if run with elevated rights or admin rights
'  - Displays warnings on the screen (can be suppressed)
'  - Script cannot be run from a network share.
'
' 1.0.3
'  - Gets the installdir from the registry
'
' 1.0.4
'  - Output from the various commands to the log file. Useful for troubleshooting.
'
' Usuage:
'  - Create_and_install_Java_Certificates_v100.vbs
'    Creates the needed files in the default locations. Sufficient for a local installation
'
'  - Create_and_install_Java_Certificates_v100.vbs /remove
'    Removes the %windir%\Sun\java\development folder.
'
'  - Create_and_install_Java_Certificates_v100.vbs /gpo
'    Creates the files in the folder 'files_for_gpo'. These files can be copied to the users'
'    workstation.
'      
' ================================================================================================

' ------------------------------------------------------------------------------------------------
' Declare the most variables. 
' ------------------------------------------------------------------------------------------------

  Option Explicit

  Dim objShell                   : set objShell               = WScript.CreateObject("WScript.Shell")
  Dim objLogFileFSO              : Set objLogFileFSO          = CreateObject("Scripting.FileSystemObject")
  Dim objFSO                     : Set objFSO                 = CreateObject("Scripting.FileSystemObject")
  Dim objProcessEnv              : Set objProcessEnv          = objShell.Environment("PROCESS")
  Dim objWMIService              : Set objWMIService          = GetObject("winmgmts:\\.\root\cimv2")
  Dim fn_objWMIService           : Set fn_objWMIService       = GetObject("winmgmts:\\.\root\cimv2")
  Dim objReg                     : Set objReg                 = GetObject("winmgmts:\\.\root\default:StdRegProv")
  Dim objLogFile
  Dim CurrentDir                 : CurrentDir                 = Left(Wscript.ScriptFullname, InstrRev(Wscript.ScriptFullname, "\"))
                                   CurrentDir                 = Left(CurrentDir,len(CurrentDir)-1)
  Dim strcomputerName            : strcomputerName            = objProcessEnv("COMPUTERNAME")
  Dim strLogLocation             : strLogLocation             = "C:\WINDOWS\system32\Logfiles"
  Dim strOutputFile              : strOutputFile              = strLogLocation & "\" & strcomputerName & "_Installation_JavaCertificates_" & Replace(FormatDateTime(Now(), 2),"/","-") & ".log"
  Dim strArchitecture            : strArchitecture            = ""
  Dim strOS                      : strOS                      = ""
  Dim strCommand                 : strCommand                 = ""
  Dim strLine                    : strLine                    = ""
  Dim strQuery                   : strQuery                   = ""
  Dim strProgramFilesFolder      : strProgramFilesFolder      = ""
  Dim strExceptionSite           : strExceptionSite           = "" 
  Dim strErrorText               : strErrorText               = ""
  Dim strDeploymentRuleSetFolder : strDeploymentRuleSetFolder = objShell.ExpandEnvironmentStrings("%windir%") & "\sun\java\deployment"
  Dim strMemberOfGroups          : Set strMemberOfGroups      = objshell.Exec("whoami /groups")
  Dim MemberOfGroupsOutput       : Set MemberOfGroupsOutput   = strMemberOfGroups.StdOut
  Dim strMemberOfGroupsOutput    : strMemberOfGroupsOutput    = MemberOfGroupsOutput.ReadAll
  Dim bolPreReqPassed            : bolPreReqPassed            = True
  Dim strJavaExeFileVersion
  Dim strJarsignerExeFileVersion
  Dim strWebsite                 : strWebsite                 = "http://www.google.com"

  Dim colItems, objItem
  Dim valOSBuildNumber,valResult
  Dim arrArguments, valCounter
  Dim strKeyPath, strValueName, strValue, strCurrentVersion, strJavaHome

  Const ForWriting               = 2
  Const ForReading               = 1
  Const ForAppending             = 8
  Const OverWriteFiles           = True
  const HKEY_CURRENT_USER        = &H80000001
  const HKEY_LOCAL_MACHINE       = &H80000002
  Const HKEY_USERS               = &H80000003
  Const blnDebug                 = True

  Const strAlias                 = "DummyCompany"
  Const strPassword              = "changeit"
  Const strCN                    = "cnDummyCompany"
  Const strOU                    = "ouDummyCompany"
  Const strO                     = "oDummyCompany"
  Const strC                     = "EU"
  
  Const bolDisplayErrorsOnScreen = True

' ------------------------------------------------------------------------------------------------
' Checks if run with admin or elevated permissions. If not, then quit.
' ------------------------------------------------------------------------------------------------

  if InStr(strMemberOfGroupsOutput, "S-1-16-12288") = 0 AND InStr(strMemberOfGroupsOutput, "S-1-5-32-544") = 0 Then
     strErrorText = "You need to run this script with administrator or with elevated rights."
     ShowErrorOnScreen(strErrorText)
     wscript.quit(3)
  End if

' ------------------------------------------------------------------------------------------------
' Create the log location (if not exists)
' Open the logfile.  
' ------------------------------------------------------------------------------------------------

  CreateFolderStructure(strLogLocation)
  OpenLogFile()
  WriteToLog "- ACTION: script started."

' ------------------------------------------------------------------------------------------------
' Detect the current OS.  
' ------------------------------------------------------------------------------------------------

  Set colItems = objWMIService.ExecQuery("Select Caption,BuildNumber from Win32_OperatingSystem")
  For Each objItem in colItems
      strOS            = objItem.Caption
      valOSBuildNumber = objItem.BuildNumber
  next

' ------------------------------------------------------------------------------------------------
' Detect the current processor architecture.  
' ------------------------------------------------------------------------------------------------

  if objFSO.FolderExists(objShell.ExpandEnvironmentStrings("%windir%") & "\SysWOW64\Config") then  
     strArchitecture = "x64"
     strProgramFilesFolder=objProcessEnv("ProgramFiles(x86)")
       else
     strArchitecture = "x86"
     strProgramFilesFolder=objProcessEnv("ProgramFiles")
  end if

  WriteToLog("########## Details regarding operating system                        ##########")
  WriteToLog("Found Operating System:       " & strOS)
  WriteToLog("Found architecture:           " & strArchitecture)
  WriteToLog("########## End details regarding operating system                    ##########")
  WriteToLog(" ")

' ------------------------------------------------------------------------------------------------
' Sets SEE_MASK_NOZONECHECKS to 1.  
' That will avoid a screen that asks for permission to run an application from
' a share or mapped drive. 
' ------------------------------------------------------------------------------------------------

  objProcessEnv("SEE_MASK_NOZONECHECKS") = 1

' ------------------------------------------------------------------------------------------------
' Checks the prereqs:
'  - No UNC path
'  - Java Runtime Engine has been installed.
' ------------------------------------------------------------------------------------------------

  WriteToLog("########## Checking the pre-requirements                             ##########")

  if left(CurrentDir, 2) = "\\" Then
     strErrorText = "This script cannot run from an UNC path."
     WriteToLog (strErrorText)
     ShowErrorOnScreen(strErrorText)
     bolPreReqPassed  = false
  end if

  strKeyPath   = "SOFTWARE\JavaSoft\Java Runtime Environment"
  if strArchitecture = "x64" Then
     strKeyPath   = "SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment"
  end if
 
  strValueName = "CurrentVersion"
  objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strCurrentVersion
  if isnull(strCurrentVersion) Then
     strErrorText = "There is no Java Runtime found."
     WriteToLog (strErrorText)
     ShowErrorOnScreen(strErrorText)
     bolPreReqPassed  = False
  end if

  if bolPreReqPassed Then
     strKeyPath   = strKeyPath & "\" & strCurrentVersion
     strValueName = "JavaHome" 
     objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strJavaHome
  end if

  if bolPreReqPassed Then
     strJavaExeFileVersion      = objFSO.GetFileVersion(strJavaHome & "\bin\java.exe")
     strJarsignerExeFileVersion = objFSO.GetFileVersion(CurrentDir  & "\jarsigner.exe")
     WriteToLog("File version '" & strJavaHome & "\bin\java.exe' is: "& strJavaExeFileVersion)
     WriteToLog("File version '" & CurrentDir  & "\jarsigner.exe' is: "& strJarsignerExeFileVersion)
     if strJavaExeFileVersion = strJarsignerExeFileVersion Then
        WriteToLog("This is ok: the installation can continue.")
          else
        strErrorText = "The file versions are different. The installation is aborted now."
        WriteToLog (strErrorText)
        ShowErrorOnScreen(strErrorText)
        bolPreReqPassed  = False
     end if
  end if

  if bolPreReqPassed Then
     strCommand = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File " & chr(34) & CurrentDir & "\CheckIfWebsiteIsReachable_with_vbscript.ps1" & chr(34) & " -URL "& strWebsite
     valResult = objShell.Run(strCommand, 0, True)
     WriteToLog("The command '" & strCommand & "' returns " & valResult & ".")
     if valResult = 1 Then
        strErrorText = "The website '" & strWebsite & "' could not be reached. There is no working internet connection. The installation is aborted."
        WriteToLog (strErrorText)
        ShowErrorOnScreen(strErrorText)
        bolPreReqPassed  = False
     end if
  end if

  WriteToLog("########## End checking the pre-requirements                         ##########")   

  if NOT bolPreReqPassed Then
     CloseLogFile
     wscript.quit(2)
  end if

' ------------------------------------------------------------------------------------------------
' Sets the working directory
' ------------------------------------------------------------------------------------------------

  WriteToLog(" ")
  WriteToLog("Current working directory: " & objShell.CurrentDirectory)
  objShell.CurrentDirectory = CurrentDir
  WriteToLog("New working directory:     " & objShell.CurrentDirectory)
  WriteToLog(" ")

' ------------------------------------------------------------------------------------------------
' Checks for command line options
' ------------------------------------------------------------------------------------------------

  if wscript.arguments.count > 0 Then
     Set arrArguments = wscript.arguments
     for valCounter = 0 to wscript.arguments.count - 1
        if instr(lcase(arrArguments(valCounter)),"/remove") > 0 or instr(lcase(arrArguments(valCounter)),"/uninstall") > 0 Then
           DeleteDeploymentRuleSet
           CloseLogFile
           Wscript.quit(0)
        end if
        if instr(lcase(arrArguments(valCounter)),"/gpo") > 0 Then
           strDeploymentRuleSetFolder = CurrentDir & "\files_for_gpo"
           WriteToLog("*** The files will be generated for GPO Policy ***")
        end if
     next
  end if

' ------------------------------------------------------------------------------------------------
' Uninstall whatever version has already been installed. 
' ------------------------------------------------------------------------------------------------

  DeleteDeploymentRuleSet

' ------------------------------------------------------------------------------------------------
' Start the main application. 
' ------------------------------------------------------------------------------------------------

  WriteToLog("########## Start generating Java DeployementRuleSet.xml file.        ##########")

  DeleteFile(CurrentDir & "\CA.jks")
  DeleteFile(CurrentDir & "\CA.cer")
  DeleteFile(CurrentDir & "\CA.pem")
  DeleteFile(CurrentDir & "\DeploymentRuleSet.jar")
  fnKillProcess("javaw.exe")

  DeleteFile(strDeploymentRuleSetFolder & "\exception.sites")

  CreateDefaultExceptionSiteFile

  WriteToLog("Delete the current certificate with the alias: " & strAlias)
  strCommand = "keytool -keystore " & chr(34) & strJavaHome & "\lib\security\cacerts" & chr(34)
  strCommand = strCommand & " -storepass " & strPassword & " -delete -alias " & strAlias
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
  
  WriteToLog("Create DeploymentRuleSet.jar from the ruleset.xml")
  strCommand = "jar.exe -cvf DeploymentRuleSet.jar ruleset.xml"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)

  WriteToLog("Create CA.jks certificate")
  strCommand = "keytool -genkeypair -dname " & chr(34) & "cn=" & strCN & ", ou=" & strOU & ", o=" & strO
  strCommand = strCommand & ", c=" & strC & chr(34) & " -alias " & strAlias
  strCommand = strCommand & " -keypass " & strPassword & " -keystore CA.jks -storepass " & strPassword & " -validity 99999"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)

  WriteToLog("Create CA.cer certificate")
  strCommand = "keytool -exportcert -keystore CA.jks -alias " & strAlias & " -file CA.cer -storepass " & strPassword
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)

  WriteToLog("Rename CA.cer to CA.pem")
  objFSO.CopyFile CurrentDir & "\CA.cer", currentDir & "\CA.pem"
  DeleteFile(CurrentDir & "\CA.cer")

  WriteToLog("Import CA.pem")
  strCommand = "keytool -importcert -keystore " & chr(34) & strJavaHome & "\lib\security\cacerts" & chr(34)
  strCommand = strCommand & " -storepass " & strPassword & " -file CA.pem -alias " & strAlias & " -noprompt"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)

  WriteToLog("Sign CA.jks")
  strCommand = "jarsigner -verbose -keystore CA.jks -sigalg SHA256withDSA -signedjar "
  strCommand = strCommand & "DeploymentRuleSet.jar DeploymentRuleSet.jar " & strAlias & " -storepass " & strPassword & " -tsa http://timestamp.digicert.com"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)

  WriteToLog("Sign DeploymentRuleSet.jar")
  strCommand = "jarsigner -verify -verbose DeploymentRuleSet.jar"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)

  WriteToLog("Create the folder '" & strDeploymentRuleSetFolder & "' (if not already exists)") 
  CreateFolderStructure(strDeploymentRuleSetFolder)

  WriteToLog("Delete any existing 'DeploymentRuleSet.jar'")
  DeleteFile(strDeploymentRuleSetFolder & "\DeploymentRuleSet.jar")
  
  WriteToLog("Copy the new 'DeploymentRuleSet.jar' to '" & strDeploymentRuleSetFolder & "'.")
  objFSO.CopyFile CurrentDir & "\DeploymentRuleSet.jar", strDeploymentRuleSetFolder & "\"
  WriteToLog("########## End generating Java DeployementRuleSet.xml file.          ##########")
  WriteToLog(" ")
  WriteToLog("########## Copying deployment.config and deployment.properties.      ##########")

  objFSO.CopyFile CurrentDir & "\Main files\deployment.config"    , strDeploymentRuleSetFolder & "\" 
  objFSO.CopyFile CurrentDir & "\Main files\deployment.properties", strDeploymentRuleSetFolder & "\"
  objFSO.CopyFile CurrentDir & "\Main files\exception.sites"      , strDeploymentRuleSetFolder & "\"

  WriteToLog("########## End copying deployment.config and deployment.properties.  ##########")

  WriteToLog("########## Performing after installation checks.                     ##########")
  
  if fnAfterInstallationCheck Then
     WriteToLog("The deployment ruleset has been processed successfully.")
      else
     WriteToLog("There was an error while processing the deployment ruleset. The files where not copied to")
     WriteToLog("the folder '" & strDeploymentRuleSetFolder &"'.")
  end if

  WriteToLog("########## End performing after installation checks.                 ##########")


  CloseLogFile

Sub OpenLogFile() 

' ------------------------------------------------------------------------------------------------
' Subroutine: OpenLogFile() 
' The name of the logfile is mentinoed in the variabele strOutputFile.
' ------------------------------------------------------------------------------------------------

  If objLogFileFSO.FileExists(strOutputFile) Then
     Set objLogFile = objLogFileFSO.OpenTextFile(strOutputFile, ForWriting)
         Else
     Set objLogFile = objLogFileFSO.CreateTextFile(strOutputFile)
  End If

End Sub

Sub CloseLogFile()

' ------------------------------------------------------------------------------------------------
' Subroutine: CloseLogFile()
' Close the log file.
' ------------------------------------------------------------------------------------------------

  WriteToLog "- ACTION: script ended."
  objLogFile.Close
  Set objLogfileFSO = Nothing

End Sub

Function WriteToLog(sLogMessage)

' ------------------------------------------------------------------------------------------------
' Function: WriteToLog(sLogMessage)
' Writes an entry 'sLogMessage' in the logfile.
' ------------------------------------------------------------------------------------------------

  if instr(sLogMessage, "- ACTION: ") = 0 then sLogMessage = "          " & sLogMessage
  objLogFile.WriteLine("Time: " & now & "  " & sLogMessage)

End Function

Sub CreateFolderStructure(strFolderNameToBeCreated)

' ------------------------------------------------------------------------------------------------
' Subroutine: CreateFolderStructure(strFolderNameToBeCreated)
' Creates the map as mentioned in strFolderNameToBeCreated.
' ------------------------------------------------------------------------------------------------

  Dim arrFoldersTMP : arrFoldersTMP = split (strFolderNameToBeCreated,"\")
  Dim strFolder     : strFolder     = ""
  Dim objFolderTMP
 
  For Each objFolderTMP in arrFoldersTMP
      strFolder = strFolder & objFolderTMP
      If NOT objFSO.FolderExists(strFolder) Then
             objFSO.CreateFolder(strFolder)
      end If
      strFolder = strFolder & "\"
  Next
 
End Sub

Function RunCommandPlusOutput(strCommand)

' ------------------------------------------------------------------------------------------------
' Function: RunCommandPlusOutput(strCommand)
' Runs the command strCommand and returns the outpunt in RunCommandPlusOutput
' ------------------------------------------------------------------------------------------------

  Dim strResultsOfExecCommand          : Set strResultsOfExecCommand        = objshell.Exec(strCommand)
  Dim objResultsOfExecCommandOutput    : Set objResultsOfExecCommandOutput  = strResultsOfExecCommand.StdOut
  Dim strResultsOfExecCommandOutput    : strResultsOfExecCommandOutput      = objResultsOfExecCommandOutput.ReadAll
  strResultsOfExecCommandOutput = vbCrLf & vbCrLf & "---    Result of Running Comand ---   "& vbCrLf & strResultsOfExecCommandOutput
  strResultsOfExecCommandOutput = strResultsOfExecCommandOutput & "---  End result of running command --- " & vbCrLf
  WriteToLog (strResultsOfExecCommandOutput)

End Function


Function DeleteFile(strFileName)

' ------------------------------------------------------------------------------------------------
' Function: DeleteFile(strFileName)
' Deletes the given file
' ------------------------------------------------------------------------------------------------

  if objFSO.FileExists(strFileName) Then
     objFSO.DeleteFile(strFileName)
     WriteToLog("The file '" & strFileName & "' has been deleted.")
  end if

End Function 

Function fnKillProcess(strProcessName)

' ------------------------------------------------------------------------------------------------
' Function: fnKillProcess(strProcessName)
' Terminates the given processname.
' ------------------------------------------------------------------------------------------------

  Dim colProcess
  Dim objProcess

  Set colProcess = fn_objWMIService.ExecQuery ("Select * From Win32_Process")
  For Each objProcess In colProcess
    If Instr(LCase(objProcess.Name),LCase(strProcessName)) > 0 Then
       objShell.Run "TASKKILL /F /T /IM " & objProcess.Name, 0, False
       objProcess.Terminate()
       WriteToLog("Terminating application: " & objProcess.Name)
    End If
  Next

End Function



Sub CreateDefaultExceptionSiteFile

' ------------------------------------------------------------------------------------------------
' Subroutine: CreateDefaultExceptionSiteFile
' Create the default content for the exception.site file.
' ------------------------------------------------------------------------------------------------

  strExceptionSite = ""

End Sub

Sub DeleteDeploymentRuleSet

' ------------------------------------------------------------------------------------------------
' Subroutine: DeleteDeploymentRuleSet
' Deletes the folder %Windir%\sun\java\deployment
' ------------------------------------------------------------------------------------------------

  WriteToLog("########## Delete deploymentruleset from the system.                 ##########")

  if objFSO.FolderExists(strDeploymentRuleSetFolder) Then
     objFSO.DeleteFolder(strDeploymentRuleSetFolder)
     WriteToLog("The folder '" & strDeploymentRuleSetFolder & "' has been deleted successfully.")
  end if

  WriteToLog("Delete the current certificate with the alias: " & strAlias)
  strCommand = "keytool -keystore " & chr(34) & strJavaHome & "\lib\security\cacerts" & chr(34)
  strCommand = strCommand & " -storepass " & strPassword & " -delete -alias " & strAlias
  WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  RunCommandPlusOutput(strCommand)

  WriteToLog("########## End deleting deploymentruleset from the system.           ##########")

End Sub

Sub ShowErrorOnScreen(strErrorTextToShow)

' ------------------------------------------------------------------------------------------------
' Subroutine: ShowErrorOnScreen
' Shows an error message on the screen if allowd
' ------------------------------------------------------------------------------------------------

  if bolDisplayErrorsOnScreen Then
     msgbox strErrorTextToShow,16,"Error while creating and installing Java Certificate."
  end if

End Sub

Function fnAfterInstallationCheck

' ------------------------------------------------------------------------------------------------
' function: fnAfterInstallationCheck
' Checks if all files are in C:\Windows\Sun\Java\Deployment
' ------------------------------------------------------------------------------------------------

  fnAfterInstallationCheck = True
  
  if NOT objFSO.FileExists(strDeploymentRuleSetFolder & "\DeploymentRuleSet.jar") Then 
     writeToLog("### FATAL ERROR: The file '" & strDeploymentRuleSetFolder & "\DeploymentRuleSet.jar' does not exists!")
     fnAfterInstallationCheck = False
  End if

  if NOT objFSO.FileExists(strDeploymentRuleSetFolder & "\deployment.config") Then 
     writeToLog("### FATAL ERROR: The file '" & strDeploymentRuleSetFolder & "\deployment.config' does not exists!")
     fnAfterInstallationCheck = False
  End if

  if NOT objFSO.FileExists(strDeploymentRuleSetFolder & "\deployment.properties") Then 
     writeToLog("### FATAL ERROR: The file '" & strDeploymentRuleSetFolder & "\deployment.properties' does not exists!")
     fnAfterInstallationCheck = False
  End if

End Function

Group policy

If you run this script with the parameter /gpo then there will be a new folder created ‘files_for_gpo’. With a GPO setting, the files in that folder can be copied to %windir%\sun\java\deployment.
More information can be found in this article: Centralized Management of Java SE Environment Using GPO (Redux).

The screen prints below are created while following the guidelines in the above mentioned post.

Start Group Policy Management Console

Start Group Policy Management Console

Create new WMI query

Create new WMI query

Define the name

Define the name

Enter the query: Select * From win32_Directory where (name="c:\\Program Files\\Java\\jre7" or name="c:\\Program Files (x86)\\Java\\jre7")

Enter the query: Select * From win32_Directory where (name=”c:Program FilesJavajre7″ or name=”c:Program Files (x86)Javajre7″)

Click Save to save the query

Click Save to save the query

Specify the folder to be created

Specify the folder to be created

Specify the source and destination file

Specify the source and destination file

  • The source file will be:
    \\demoforest\sysvol\demoforest.local\JavaScripts\deployment.config
  • The destination file will be:
    %windir%\sun\java\deployment\deployment.config

Do the same for the other 3 files.

The same for all other files

The same for all other files

Apply the WMI filter to the GPO.

Apply the WMI filter to the GPO.

The files at the correct location on the client.

The files at the correct location on the client.

And the policy is also applied on the client.

And the policy is also applied on the client.

The whole package (excluding jre1.8.0_151.msi) can be downloaded here.