See also: java8.msi and What is different in Version 8
Oracle does not offer an MSI-file for download, but the EXE installer is internally based on an MSI file, so it is available.
The MSI-file cannot be extracted from the setup program with an archiving tool like 7zip, but you can get it with a trick, see below.
Use the offline installer, instead of the normal installer. This has the added benefit that it doesn't include the Ask-toolbar.
The easiest method is to use these direct download links.
If that page does not yet list the latest version, go to java.com, but ignore the big download buttons. Instead click in the header on download, and on the next page on 'all java downloads'. The english version of that page is here, the german one here. However Oracle is hiding the download link for the 64-bit version if you access this page with a 32-bit operating system.
To find the 64bit version, go to this page instead, and ignore that the title of this page says SE instead of JRE. Note that this page works only with Javascript and Cookies enabled. Scroll down and almost at the bottom of the page there's the link to the 64bit version. It's not called 'offline version' here, but it is. Beware to not download the source instead of the binary. The filename of the correct file ends with 'windows-x64.exe'.
Run the downloaded installer, and wait until it displays the first dialog. Only answer questions from Windows when it wants confirmation to run the installer, but don't click on any button that the installer shows once it's running. Instead look into this directory
(Source: http://www.java.com/en/download/help/msi_install.xml)
Here you find a directory with the version number of the Java installer that you have started. In that directory there is not just one MSI-file, but one or several more files. Create an empty directory somewhere and copy all files from this directory there. Then abort the installer program.
Update: Version 1.8.20 does provide just one single large MSI file, everything is included in that, no need to copy any other files.
The properties ALLUSERS and ARPNOMODIFY are already all set to 1, there's no need to do that yourself.
ARPNOREPAIR is also set to 1. This is unfortunate, but one should probably not change it.
But you should change these properties in the MSI file, for example with Orca:
The three java-specific changes regarding the updaters can also be made with this script:
Java_DisableAllUpdates.vbs.
Save this script, then drag and drop the file jre1.7.0_x.msi onto it.
For more info see Java Deployment Guide.
The browser plugin of Java version 1.7.51 (January 2014) and later will only run applets, that are signed with a digital certificate. This can be changed by creating a Deployment Rule Set, a whitelist ("Exception List"), or by changing the security level from high to medium. More details here.
The security level can be set by individual users in the Java Control Panel, or be deployed to all users with the install option WEB_JAVA_SECURITY_LEVEL=M. This option can either be specified on the command line, or as entry in the properties table of the msi-file (name "WEB_JAVA_SECURITY_LEVEL", value "M").
For security reasons many people recommend to not use Java any more at all, or only when absolutely necessary. If you need Java only to run local apps, then you should disable the web browser plugin. This prevents that security vulnerabilities can be exploited by planting malware on web pages.
Starting with Java version 1.7.10, the installation of the plugin can be disabled by specifying WEB_JAVA=0 either as command line argument for the installer (found in this technote), or as property in the MSI-file. Oracle does not tell that this also works as property in the MSI-file, thanks Miles for this great find and for telling me.
If you ever want to switch back to a version with plugins, it is not enough to just uninstall the MSI with WEB_JAVA=0, and then install one without this property. Instead you must either install one with WEB_JAVA=1, or remove the registry key HKLM\SOFTWARE\Oracle\JavaDeploy that remains in the registry after the uninstall, especially the values WebDeployJava and deployment.webjava.enabled inside this key.
Remove these registry keys:
Firefox can find the Java plugin with two methods, both must be disabled:
There's no easy way to compress all files that you got from the extraction into one self-contained MSI-file. Copy the whole directory to your server and tell the server to deploy the MSI-file. Windows installer will find and use the other files during the installation, if they are in the same directory.
If you have done the extraction on a machine with a language variant of Windows other than english, then probably one of the files that you got is an MST-File. For example jre1031.MST if your Windows is configured for Germany. This file contains the language-specific modifications. When you enter the MSI-file in a group policy, you should add there this MST-file in the 'Modification'-Tab. Otherwise you will end up with the english version being installed.
To disable the quickstarter, run
"%PROGRAMFILES%\Java\jre7\bin\jqs.exe" -unregister
(thanks, Ralph!)
You should check all computers for old versions, because in the past the installers for Java did not automatically remove them. Oracle warns that leaving them on the computer 'presents a serious security risk'. The Washington Post explains that this is because a 'web site set up by a bad guy could be made to pick and choose which version of Java should be used.'
Version 1.7.51: Java refuses to run unsigned applets
("Application blocked by security settings").
The start menu entry "Configure Java" (introduced in the previous version) is now required
to set the security level, or create the exclusion list.
Version 1.7.40: Java now inserts several entries into the Start Menu.
Oracle releases regular updates on the Tuesday that is closest to the 17th day of January, April, July and October. This can be on the same day as the patchday from Microsoft, but it can also be a week later. The next dates can be found on www.oracle.com/technetwork/topics/security/alerts-086861.html.
tested with versions 1.6.26 to 1.6.32, and 1.7.4 to 1.7.65
modifications: