Java 7 U51 Exlusion List via Policy Pak

[llara@acssyr.com]

Hi,

We are testing the new Java 7 U 51 PAK with CSE 605. We would like to add a list of internal sites to the Java 7 U 51 Policy PAK GPO to be excluded by Java. Can you please explain how should how can we get this accomplished?

Thank you.

[jeremym]

Working it thru and making a video. Standby.. gonna be a little bit as we test it end to end.

Working on it though. Standby.

[jeremym]

Here's a video to explain what's possible TODAY.

We have some ideas for an enhancement to this; but this is as-is today.

http://www.policypak.com/videos/policypak-manage-java-site-exceptions-using-policypak

Post your questions about it here if you have them. Thanks.

[llara@acssyr.com]

Hi Jeremy,

Thanks for your answer. Unfortunately we can't deploy this solution because users won't be able to manage their own exception since the file will be overwritten by the original one when the GPP is applied. Any way to control that?

[jeremym]

I'm confused about what you're asking.

I think what you / most people want is:

1. Centralized deployment (I showed that using GPPrefs.)
2. Centralized management on how to POINT to the file (I showed that using PPAM.)
3. Users UN-able to change what you put down (I didn't show that.)

If you want #3, today: You can manually set file ACLs such that the file is read only.

This is possible using Group Policy's security node ... though not super intuitive.

In the future, we hope that PPAM can do 1,2 and 3 all at the same time.

If I'm misunderstanding what you DO want, can you re-clarify? Thanks !

[llara@acssyr.com]

I might be missing something let's say we configure GPP to copy the exception.sites which contains site1 and site2 the file is successfully copied to C:\dest on workstationA

Policy Pak for Java 7 U51 is changed to read the file from C:\dest

now WorkstationA's Java is getting an exception for site1 and site2

That being said, user1 goes to the Java applet and manually adds site3 for workstationA. Now the exception.sites allows site1,site2 and site3 when the user logs off and logs back in to workstationA doesn't the GPP overwrite the exception.sites file with the orginal one which contains just site1 and site2?

[jeremym]

If you set the GPPreferences type to CREATE it will deliver once and not re-apply again.

However, that being said, in my video, I'm specifying that all users use the SAME file.

And that might not be what you want.

Based on what I'm hearing you want, you could:

1. Copy the "starter" file using GPpreferences and place in the users' local Appdata. Use Action type CREATE. Something like this: http://screencast.com/t/rSlp2XUxiueZ

2. Then use PPAM, on the *USER* side to point to that same location. PP should accept the variable named %Local AppData% (different that what GPPrefs uses, I'm afraid.) But it should point to the same place.

Result:

1. User logs on: Gets the "starter file" and it's unique to each user who logs on.
2. User gets the file "pointed to".
3. User can change the file AFTER its put down.
4. CREATE action from GPPrefs means its delivered once and not again.

LMK if this feels right to you.

Warning: I haven't tested the environment variables part end to end. So if you're going to do this, start out with c:\DEST\ like I did in the video. Get it?

[llara@acssyr.com]

I will be testing with C:\dest and then using the variables. I get back with the results.

[Sponsored content]