Java, JRE, LocalLow, Certificates and trusted Sites

[amarsden]

OK - what's the opinions/thoughts/advice on using UEM to copy to the safe place the contents of the sun folder in <UserProfile>\LocalLow ?

On a normal PC this will store details of which sites have been "approved" as well as certificates.

I have tried to do this, but the results are unpredictable - or at least inconstant.  On a clean desktop, and a first run experience, the user is asked to approve the Java application I run.  The next time seems fine.  After switching into a brand new VPC, sometimes you get past without the nag.  Other times not so.  I'm thinking there is a time element built in here - maybe a security thing with the certificate?

Anyway, any suggestions as to best practice for using UEM to keep in a safe place the Java settings would e much appreciated.

ACM

[jordanht]

I'm not sure if there is an official method, but my configuration seems to be working consistently for now - Java changes frequently. I think that in a recent version I actually noticed some settings now going into appdata\roaming instead of the old LocalLow! I use a group policy preference to push out an exception.sites file that I maintain.

My UEM config file looks like this:

[IncludeFolderTrees]

<UserProfile>\AppData\LocalLow\Sun\Java\Deployment\security

[IncludeFiles]

<UserProfile>\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

I am using folder redirection for Roaming appdata so I don't have to worry about that, but most people probably don't do that. If you aren't, I would recommend something like...

[IncludeFolderTrees]

<UserProfile>\AppData\LocalLow\Sun\Java\Deployment\security

<AppData>\Sun\Java\Deployment\security

[IncludeFiles]

<UserProfile>\AppData\LocalLow\Sun\Java\Deployment\deployment.properties

<UserProfile>\AppData\Roaming\Sun\Java\Deployment\deployment.properties

[amarsden]

thanks - I think that is more or less what we have - I think the issue is with certificates - we've got it down to one nag screen now.

[lansti]

Hi.

How do you guys disable Java Updates with UEM?

And, how do you include java plugin for Mozilla family?

BR

Stian

[HussamRabaya]

thank you its very helpful

however i did it in another way, since all the users in my environment should have the same configuration of site exception and deployment configuration

i please these files in share and with UEM , i copied these files to locallow , or roaming duing the user login through login police in UEM and Xcopy command

this way i guarantee all the users with policy have the same settings    

[iforbes]

Hi HussamRabaya,

That is what I want to do too. I don't understand your steps. Could you be more specific? I tried to use Files and Folders in UEM User Environment section. Unfortunately, there is not a default Locallow folder. I created one but when I saved it said it didn't see any files. My thought is since Locallow is not a default folder and I created it, it didn't like that.

If you could let me know your exact steps to accomplish what you did, I'd appreciate it.

[HussamRabaya]

This is how I did it

This way we use to capture any files outside of user profile with VMware UEM

-java save the sites security exceptions in file named “exception.sites” and by default this file located under” C:\Users\%username%\AppData\LocalLow\Sun\Java\Deployment\security”

- copy this file to share location (e.g  \\fssrv\files\)

-in UEM go to “User Environment”  then to “logon tasks”

-also can be done in triggered tasks

-create task  as below :

                Name : Java security sites

                Run Once : checked

                In the command filed write :

XCOPY " \\fssrv\files\*.*" "%appdata%\LocalLow\Sun\Java\Deployment\security \" /y

save and close and donot forget to add condition

[iforbes]

Thank you so much HussamRabaya! I will give that a try today. Do you also know the best way to add a registry line to all users too? I see there is registry under UEM-Personalizations and again under UEM-User Environment. Why does it exist in both, and when would I configure registry in one location over the other?

Thanks

[iforbes]

Hmm. So, I ran into an issue. Java is delivered to my users desktop as an AppStack. I just noticed that \Sun\Java\Deployment\security path wasn't created under C:\Users\%username%\AppData\LocalLow until AFTER I launched the Java app when logging into a desktop. Therefore, my UEM Login task that copies over to that \sun\java\... path fails because the path doesn't exist when the Login task fires. Can you think of a way to ensure the full path exists before the UEM Login task launches? A condition?

[iforbes]

Figured it out. I disabled DirectFlex for the Java config file, meaning it gets imported at logon (rather than application launch) and the paths get built immediately. I have the UEM User Environment Logon Tasks execute xcopy tasks for both the Java deployment.properties and exception.sites files. It looks to have worked as expected.

I suppose I could have also created a script to copy both files over and run it as a post import task (on the Java config file in UEM).