Java Update no longer blocked

[meanoldman]

Can't quite put my finger on it, but all of the sudden a handful of the laptops in my org are getting the prompt that a Java update is available. PP CSE 3.8.557 is installed and other Policy Pak GPOs seem to be working. When I look at the Java cpl object the update tab is also present now.

Affected machine all have Java version 7 update 40 (build 1.7.0_40-b43). The curious thing is that my desktop also has that version installed yet the PP rules are being applied as expected, for instance, no update nag and no update tab.

Machine with versions of Java earlier than V7u40 don't appear to be affected either.

Other consideration, I suspected it might be McAfee Deep Defender, but I don't have that deployed consistantly across my systems yet, so some of the machine affect have DD and some don't while some machine that aren't affect do have DD.

Java policy pak is deployed at the computer level. Windows 7 64bit. 32bit Java.

Thoughts?

[jeremym]

1. This is going to require some level of investigation. We'll try to reproduce it in house first. Standby.

2. In the meantime, if you wanted to:
1. Look at what happened in the JAVA CONFIG file .. see if what's expected is really THERE and/or
2. Look inside the c:\USERS\All Users\PolicyPak\ppComputer.log (that's where SWITCHED mode logs go...) You can see what PP "thinks" its doing.

See if they match.

If they DO.. then PP is DELIVERING A-OK.. (which I suspect it is..)

But that version of Java is not "understanding it"... and we need to update the Pak to specify whatever new thing it "wants" to see...

LMK if this makes sense, and why it could be a little while before resolution.

[jeremym]

It seemed to work for me a-ok using the exact same setup.

Here's my video: http://screencast.com/t/iRoYhTlA

Let me know what you find afterward.

[meanoldman]

JM to the rescue again! Thanks Jeremy

Here's what I found, but let's review first:

Some of my systems still appeared to have the settings applied that were configured in the policy, some did not. And looking at the logs on the various computers it did not look like any of them should still have had the settings in question applied. Hmm?

So, I looked at the properties for the Java policy and while some settings I had configured before where still there, no tray icon for instance, the ones for downloading update and the update tab were cleared out.

Begs the question - why did some of the systems seem to hold onto the configured settings even though they were not actually set in the policy anymore?

As to how the setting were cleared out, I may have inadvertantly done that when I was trying to sort out that Adobe Reader issue a while back, but that doesn't explain why some of the settings were still in place and others were not.

[jeremym]

I'm not sure I'm PRECISELY following the question.

But PP should have re-applied those settings:

1. In the background.
and
2. At logon time.
and.
3. When you launch the Java Applet.

Are you saying that PP didn't re-apply expected settings?

Is it POSSIBLE that some computers (oops) didnt get the GPO and are maybe just now getting them?

[meanoldman]

I'm not sure I'm PRECISELY following the question.

But PP should have re-applied those settings:

1. In the background.
and
2. At logon time.
and.
3. When you launch the Java Applet.

Are you saying that PP didn't re-apply expected settings?

Is it POSSIBLE that some computers (oops) didnt get the GPO and are maybe just now getting them?

Sorry I wasn't clear - when I looked at the logs as you mentioned I noticed that they did not show any of the expected settings where being applied on any of my systems. PP was still applying setting, just not the ones for Java that I thought were still configured in the policy in question. As I had stated originally some computers were still behaving as though the policy was configure and applying as expected while others where not. Based on the logs, none of them should have been behaving as expected.

So, based on that I went back in and looked at the specific policy and while it still had some of the settings I had applied in the past, the ones in question (auto update and update tab) were blown away. I don't think I have touched the Java policy in months, so why all of the sudden would this issue manifest itself as it has? And why would some of the machines have behaved as though the policy was still configured properly while others did not.

[jeremym]

Sunspots?
Gremlins?

Honestly.. I'm sorry to say I just dont know.

Its good that you got to the bottom of it, and hopefully the troubleshooting steps outlined here will help future astronauts.

If you need additional help, we're here. LMK ! Thanks !

[meanoldman]

Gremlins are my thing apparently. I still can't get that (not PP related) Adobe Reader issue cleared up that I posted about.

Looks like it's sorted now. Just wanted to check my other PP policies to make sure they were still OK to rule out any system wide issue.

[Sponsored content]