Java 8 Update 25 Install Via GPO Not Working

Question

I am trying to set up our Active Directory DC to automatically install Java 8 Update 25 (jre1.8.0_25.msi) using Group Policy. When attempting to add the jre1.8.0_25.msi package in the GPO at Computer Configuration > Policies > Software Settings I receive the error:

Add operation failed. Unable to extract deployment information from the package.
Run validation on the package to ensure that the package is correct.

How can I install Java 8_25 silently across the domain?

Thanks!

UPDATE

Using information from these pages:

• https://www.java.com/en/download/help/msi_install.xml
• https://stackoverflow.com/questions/13084768/software-installation-startup-script-via-gpo

and the command line from this page:

• http://www.edugeek.net/forums/enterprise-software/143767-java-8-update-25-silent-install-via-sccm.html

I came up with this script:

:CheckOS
if exist %systemdrive%\"Program Files (x86)" 
(
    set bit=x64
)
else 
(
    set bit=i586
)

:CheckInstall
IF EXISTS %ProgramFiles%\Java\jre1.8.0_25\bin\java.exe GOTO END

msiexec /i {[NETWORKFOLDER]}\Repo\Java\jre1.8.0_25-%bit%.msi AUTO_UPDATE=0 EULA=0 NOSTARTMENU=1 SPONSORS=0 WEB_ANALYTICS=0 WEB_JAVA=1 WEB_JAVA_SECURITY_LEVEL=H /qb


:END

UPDATE (2) 11/13/2014

I thought I should provide an update in here for anyone who comes along behind to reference this. The script I provided works, but there are other problems with the JVM and JRE that you should be aware of in advance:

After exploring and testing different solutions, there seems to be a problem with 64 bit installations. Using my script, 64 bit Java 8 was installed on all of our 64 bit systems. However, none of the browsers recognized Java as being installed. The only solution that worked as to install Java 8 32 bit in addition to 64 bit. (32 bit would likely work on its own, but I haven't bothered to uninstall 64 bit)

Solution

First off, don't use the Software Installation GPOs. They suck.

Second off, make sure you have the proper "offline" Java installer.

Then, create a startup script, and put it a GPO at \Computer configuration\Policies\Windows Settings\Scripts\Startup to install it.

• Must be a startup script, not a logon script, since startup scripts run under SYSTEM context, and logon scripts run in user context.
• To view how to do a silent/Unattended installs of Java, see the page on java.com dedicated to the topic.
• You will want to do some simple checking in your script to make sure Java 8u25 isn't already installed, otherwise it will reinstall every time a domain-connected computer boots.

Comments

[Jonathon Anderson]

I'm not familiar with scripting. How can I check whether software is already installed?

[Spence]

@Hopelessn00b: While I certainly do install a lot of software via Startup Scripts, I do think that Group Policy Software Installation policy does work reasonably well. It has quirks, but it has served me well over the years. I'm in stark disagreement with the AD team blog on this, but 13 years of experience using this functionality has served me rather well.

[HopelessN00b]

@NonSecwitter There's probably a bunch of other ways to do it, but off the top of my head, I'd use the java -version command. Pretty sure that with 8u25 installed, the first line of output will show as java version "1.8.0_25", but I'd have to check that to be sure. That provide you with what you need, or do you need more help in punching up the script? (Like, just how "not familiar with scripting" are you?)

[Jonathon Anderson]

@HopelessN00b I'm unfamiliar with the specifics of scripting for Windows shell environment or making batch files. I can program in C++ and Java, so I get the basics. I'm looking around for sample scripts. I'll post if I find anything, unless someone comes up wiht something here first.

[HopelessN00b]

@NonSecwitter Well, I'll get to it later tonight and provide an example tailored to java 8u25, but you should have no problem if you can code.

[Jonathon Anderson]

Thanks. I posted an updated with a script I think might work. I'm going to give it a try and see how it goes.

[HopelessN00b]

@NonSecwitter That certainly looks like it will work - the only thing I'd say you need to be careful of is the permissions on the network share folder... and on the local machines, if you've customized those. It's the computer accounts (through NETWORK SERVICE account) that will be accessing that share, rather than the users' accounts.

[Jonathon Anderson]

HEHEHE... Turns out saving in Unicode really jacks things up :P