Java.msi

Oracle does not offer an MSI-file for download, but the EXE installer is internally based on an MSI file, so it is available.

The MSI-file cannot be extracted from the setup program with an archiving tool like 7zip, but you can get it with a trick, see below.

Download the offline installer

Use the offline installer, instead of the normal installer. This has the added benefit that it doesn't include the Ask-toolbar.

The easiest method is to use these direct download links.

If that page does not yet list the latest version, go to java.com, but ignore the big download buttons. Instead click in the header on download, and on the next page on 'all java downloads'. The english version of that page is here, the german one here. However Oracle is hiding the download link for the 64-bit version if you access this page with a 32-bit operating system.

To find the 64bit version, go to this page instead, and ignore that the title of this page says SE instead of JRE. Note that this page works only with Javascript and Cookies enabled. Scroll down and almost at the bottom of the page there's the link to the 64bit version. It's not called 'offline version' here, but it is. Beware to not download the source instead of the binary. The filename of the correct file ends with 'windows-x64.exe'.

Extract the MSI-file

Run the downloaded installer, and wait until it displays the first dialog. Only answer questions from Windows when it wants confirmation to run the installer, but don't click on any button that the installer shows once it's running. Instead look into this directory

  • %appdata%\Sun\Java (Windows-XP)
  • %UserProfile%\AppData\LocalLow\Sun\Java (Vista and Windows 7)

(Source: http://www.java.com/en/download/help/msi_install.xml, claims to be valid only for java version 6.0 !?!)

Here you find a directory with the version number of the Java installer that you have started, and in that directory not just one MSI-file, but one or several more files. Create an empty directory somewhere and copy all files from this directory there. Then abort the installer program.

Configure

The properties ALLUSERS and ARPNOMODIFY are already all set to 1, there's no need to do that yourself.

ARPNOREPAIR is also set to 1. This is unfortunate, but one should probably not change it.

But you should change these properties in the MSI file, for example with Orca:

  • set ARPNOREMOVE to 1. This disables uninstall in 'Add/Remove Programs'.
  • change AUTOUPDATECHECK from 1 to 0. This disables update check during installation.
  • change JAVAUPDATE from 1 to 0. This disables automatic updates.
  • change JU from 1 to 0. Don't allow users to re-enable updater (is this documented anywhere?).

The three java-specific changes regarding the updaters can also be made with this script:
Java_DisableAllUpdates.vbs.
Save this script, then drag and drop the file jre1.7.0_x.msi onto it.

For more info see Java Deployment Guide.

Change Security Settings (optional)

The browser plugin of Java version 1.7.51 (January 2014) and later will only run applets, that are signed with a digital certificate. This can be changed by creating a Deployment Rule Set, an Exception List, or by changing the security level from high to medium (more details here).

The security level can be set by individual users in the Java Control Panel, or be deployed to all users with the install option WEB_JAVA_SECURITY_LEVEL=M. This option can either be specified on the command line, or as entry in the properties table of the msi-file (name "WEB_JAVA_SECURITY_LEVEL", value "M").

Disable Browser-Plugin (optional)

For security reasons many people recommend to not use Java any more at all, or only when absolutely necessary. If you need Java only to run local apps, then you should disable the web browser plugin. This prevents that security vulnerabilities can be exploited by planting malware on web pages.

prevent installation of browser-plugin

Starting with Java version 1.7.10, the installation of the plugin can be disabled by specifying WEB_JAVA=0 either as command line argument for the installer (found in this technote), or as property in the MSI-file. Oracle does not tell that this also works as property in the MSI-file, thanks Miles for this great find and for telling me.

If you ever want to switch back to a version with plugins, it is not enough to just uninstall the MSI with WEB_JAVA=0, and then install one without this property. Instead you must either install one with WEB_JAVA=1, or remove the registry key HKLM\SOFTWARE\Oracle\JavaDeploy that remains in the registry after the uninstall, especially the values WebDeployJava and deployment.webjava.enabled inside this key.

prevent use of browser-plugin by Firefox

Firefox can find the Java plugin with two methods, both must be disabled:

  • Set the preference plugin.scan.sunJRE in Firefox to a number higher than the current versison number, for example 9.9 (Java 7.11 has version number 1.7.11, so 9 is a lot higher).
  • Remove the registry keys HKLM\SOFTWARE\MozillaPlugins\@java.com*

Deploy

There's no easy way to compress all files that you got from the extraction into one self-contained MSI-file. Copy the whole directory to your server and tell the server to deploy the MSI-file. Windows installer will find and use the other files during the installation, if they are in the same directory.

If you have done the extraction on a machine with a language variant of Windows other than english, then probably one of the files that you got is an MST-File, for example jre1031.MST if your Windows is configured for Germany. This file contains the language-specific modifications. When you enter the MSI-file in a group policy, you should add there this MST-file in the 'Modification'-Tab. Otherwise you will end up with the english version being installed.

Tips

Disable Quickstarter

To disable the quickstarter, run
"%PROGRAMFILES%\Java\jre7\bin\jqs.exe" -unregister
(thanks, Ralph!)

Remove Old Versions

You should check all computers for old versions, because in the past the installers for Java did not automatically remove them. Oracle warns that leaving them on the computer 'presents a serious security risk'. The Washington Post explains that this is because a 'web site set up by a bad guy could be made to pick and choose which version of Java should be used.'

More

News

Version 1.7.51: Java refuses to run unsigned applets ("Application blocked by security settings").
The start menu entry "Configure Java" (introduced in the previous version) is now required to set the security level, or create the exclusion list.

Version 1.7.40: Java now inserts several entries into the Start Menu.

  • There doesn't seem to be an easy way to prevent this from happening (scanned the installer for new options, found none).
  • The entries for update (and parts of configure?) don't really work for users with limited rights.
  • The texts are always english, regardless of the selected install language.

tested with versions 1.6.26 to 1.6.32, and 1.7.4 to 1.7.45

modifications:

  • 2014-Jan-15 version 1.7.51 & install option WEB_JAVA_SECURITY_LEVEL=M
  • 2013-Nov-11 added howto disable jqs and howto remove out-of-date warning
  • 2013-Sep-18 info about menu-entries created by version 1.7.40
  • 2013-Jul-11 howto update from 7.25.16 to 7.25.17
  • 2013-Jun-23 download rewritten, deploy extended and made a separate section, mention 1.6.25_b17
  • 2013-Jun-19 direct download links moved to separate page
  • 2013-Apr-10 howto disable quickstarter
  • 2013-Feb-20 added vbs-script
  • 2013-Feb-04 mention MST-file
  • 2013-Jan-16 property WEB_JAVA added
  • 2013-Jan-13 howto disable the plugin in Firefox
  • 2012-Aug-30 property JU added