HOW TO: Deploy Java 7 Update 45 (32-bit) & (64-bit) with UAC on or off in the client environment.

Topics: Publishing Issue
Oct 16, 2013 at 8:49 PM
Java 7 Update 45 Install Notes:
First install the standard Java x86 & x64 packages from Sun.

Obtain Cab and MSI from Vista/7 Directory: C:\Users\<yourusername>\AppData\LocalLow\Sun\Java (XP: C:\Documents and Settings\username\Local Settings\Application Data\Sun\Java)

The jre folders therein contain the uncompressed installers; your results may be undesirable if you attempt to uncompress the jre executable installer with 7zip or winRAR and then try to use those installers to create a package; just something I ran into a while back, FYI.

I use the .cab / .msi because of various errors and problems I’ve encountered using the EXEs; Sun recommends using the MSI and cab like I do. Save yourself the headache and skip the EXEs; I encounter new issues with each release.

Next, get the install strings for the java release you're deploying; I have listed them for convenience, but you can see how I found them below.

7u45 string:

7u45x64 string:

7u45 updater string: (Unchanged since 7u21)

You can find these by using the WSUS Package Publisher and going to tools > MSI Reader, loading the MSI, and going to the property table. The install string is labeled "ProductCode".

Now to create the package!
I used the guide as a template, ( so you may need to read that to fill in some gaps, but in summary here's how I built my x86 update:
A. Start Custom Update from WPP
  1. Define variable “Return Code” as an integer as in guide
  2. Stop Service JavaQuickStarterService
  3. Allow to execute a file with following strings:
    Path to file:
    /i jre1.7.0_45.msi /quiet /norestart AUTOUPDATECHECK=0 IEXPLORER=1 JAVAUPDATE=0 JU=0
    Kill process after 15 minutes, link to "Return Code"
    Add Exit code, link to "Return Code."
  4. You are now done with custom update XML generator, continue on.
    B. Add .CAB and .MSI files to the package; Mark it as an update - Critical update.
    I mostly followed the guide from this point on, except for my install rules; for “already installed”, I used the guide, but for “installable”, I set the x86 java package to install on x86 & x64 machines (since most browsers are 32-bit.) I used the not equal to Itanium CPU type rule to allow for x86 and x64 installation.
    On the 64-bit package, for “installable” values, I set the x64 architecture type and the <not><MSI> value.
    Also, the x64 installer doesn't have an updater package anymore; for more information in what command line options java's MSI accepts, see the slightly outdated article from Sun:
To test, approve for WSUS test group. If retrying a package, or flushing a deleted test package on a test machine, you can stop the Windows Update service, delete “datastore” and “download” folder contents from local cache in C:\Windows\SoftwareDistribution, then check for Windows Updates. (Leave the folders, just delete the contents.)
I hope you find these tips helpful; your mileage may vary. Credit: The people at WSUS Package Publisher who wrote that excellent documentation. I never would have gotten this package working right without the Documentation section.
Marked as answer by DParks256 on 10/16/2013 at 1:49 PM
Nov 19, 2013 at 1:20 PM
This process works fine on Release v1.3.1309.28 but on v1.3.1311.02 it allways getting error code "FFFC"
Nov 19, 2013 at 3:48 PM
I'm getting the error code as well. I posted a discussion regarding the error that I get, with a sample from the update log.
Nov 19, 2013 at 6:13 PM
Please select the update in WPP, and click on the link beside the 'Id' label. This will open a window, open the folder and open the .xml file. Copy the content of the file and paste it here.
Nov 19, 2013 at 6:57 PM
@ cmaraslian : With 9993009fmmmdkk22 we have identified a bug in the release that prevent installation of custom updates if there is an ExecutableElement with System Variable (like %WinDir%) in the Path to executable.

Please send me an email at, I will reply with a fixed release.
Nov 27, 2013 at 9:37 AM

The above mentioned procedure seemed to work fine for me with release 1.3.1311.24 but i noticed that everytime Windows 7 checks for updates it finds the Java update even though it completes the installation without errors. I also noticed that Java isn't registered in IE or Mozilla.

Does anybody have an idea what i'm doing wrong?
Nov 27, 2013 at 11:34 AM

anyone knows, if the above description is able to kill any Java and/or IE instance running at the time of install?

Nov 27, 2013 at 2:28 PM
Hey all, some notes with my deploy experiece; I'm going to change the update status to "requires reboot" next time so I don't have to worry about java instances being killed, this seemed to cause a bit of a problem, application wouldn't register properly if Java was running. Also to answer NorbertFE: Check out this link from Sun for command line switches to register Java with Mozilla (Our organization is IE only due to government applications.)

Any one else have any tips? Thanks DCourtel for the update about WPP, I'm still on the old release and hadn't noticed that bug.
Nov 27, 2013 at 6:46 PM
@ DCourtel : Thanks for your reply, I tested on new Release v1.3.1311.24 and is working like a charm!

Carlos A. Maraslian
Nov 27, 2013 at 8:12 PM
Edited Mar 21, 2014 at 11:49 AM
DParks256 wrote:
Thanks DCourtel for the update about WPP, I'm still on the old release and hadn't noticed that bug.
The bug only occure in V1.3.1311.02. When WPP start to display Package Level Rules.
Mar 3, 2015 at 2:32 PM

DParks256 wrote:
To test, approve for WSUS test group.
How do I manage to test one update with a certain test group? I would like to configure eg. Java Updates. JRE 7 for the staff, JDK 7 for the developers, JDK 8 for a special test group. Corresponding groups are configured on the WSUS Server.
Can this be done?

Thanks in advance.
Best regards