Solved

Java on Terminal Server 2008 not working

Posted on 2010-09-10
14
6,815 Views
Last Modified: 2015-04-14
I am struggling with Java on a Windows 2008 Terminal Services farm. I have downloaded and installed Java like any other application on a terminal server. However Java will not work for non-privileged users. However if I make the user a local administrator and the log in as that user and goto a webpage that requires Java a prompt comes up asking me if it is OK to install and then it works. I can then log the user back out, remove their administrative privileges and log back in and it works. The problem is I would have to do this for every user on every server to get this resolved. Something tells me I have installed it wrong or I have a GPO blocking it. Has anyone had any experience with this ?

0
Comment
Question by:ConcentricsInc
  • 6
  • 4
  • 3
  • +1
14 Comments
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33648006
This is worth a shot

(from the link in the end)
Unlocking registry settings

By default, Windows Terminal Services clients do not have write access to the registry on the Windows Terminal Services computer, except to the registry hive under HKEY_CURRENT_USER.

To run some features, you might need to give users write access to some keys and subkeys
--
start > run > regedit
 
HKEY_CLASSES_ROOT\JavaPlugin\
Right click permissions
Allow users in Terminal Services OU

Repeat the same thing for other java plugin versions.
You may have to restart the server for registry changes to take effect.

http://technet.microsoft.com/en-us/library/cc179161(office.12).aspx
0
 
LVL 3

Expert Comment

by:PlugThatInWhere
ID: 33648040
I believe you have it not installed correctly.  Did you have the TS in Install Mode when you installed Java?
If you are not sure then more than likly you were not.  Uninstall Java and follow the steps below.

Install Mode can be activated via DOS with the following command:
C:\>Change User /install
-- Now install Java by running the EXE
C:\>Change User /execute
-- It is now ready for users.

Doing this will create registry entries that will be applied to each user's HKCU key when they logon, plus any other files that may be needed.

Give this a go and let use know if it worked.
0
 

Author Comment

by:ConcentricsInc
ID: 33648052
I have actually installed it serveral time and each time I have put the terminal server install mode.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33648060
Please verify the permission settings on HKCU and corresponding class-id's
0
 
LVL 3

Expert Comment

by:PlugThatInWhere
ID: 33648069
I would not recommand doing the Registry adjustments first.  BTW, if you remove the Admin right and they are still OK does not point to a Registry Permission issue.  It is more likely that the user is not allowed to execute the Installer.
0
 

Author Comment

by:ConcentricsInc
ID: 33648171
PlugThatInWhere, interesting prospect. Two things, I have scrolled through all GPOs that afffect these users and I don't see anything that I have set (although the default maybe to exclude access to the installer) and all of these users are members of the PowerUsers group although I know this is deprecated. Any ideas how I would go about checking the installer theory?
0
 
LVL 3

Expert Comment

by:PlugThatInWhere
ID: 33648557
Power Users can install, but like you said still limited.  I would do this to track it down:  Use ProcMon to watch what the user Cannot access.  You will need to be the only user on the server, and I am not sure if Procmon.exe will run as a Power User (If not then you will run it under your Admin account while you try the failed steps on a user account).

You can find Procmon.exe at sysinternals.com (now owned by MS).  If you have never used this then you will be in for a shock when you see how much your system does in the background.  

You will need to start the program, stop it from recording, clear the current captured events (now you are ready to capture what you want).  Now get the user to the point Just before the failure (one click away).  Then start recording then as quick as you can make the last click on the user session to get the failure, then as quick as you can stop the recording after the failure.

With the recording in hand you can start working from the bottom up.  Look for any Access Denied messages to Files or Registry entries that make any refference to Java.  You will see many such entries for various other things, most of them are normal as it is the system/software looking for options that may / may not have been defined, as well as it looking in various paths to "find" something (i.e. the DOS Search Path variable will search each folder until it says No Way).

I am fairly used to this program and can tell what is normal and not.  If you can't make heads or tails of what you are seeing then maybe you can send me the PML (saved capture) for me to review.
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 
LVL 3

Assisted Solution

by:PlugThatInWhere
PlugThatInWhere earned 500 total points
ID: 33648567
Don't you just Love 2008 and all of the "Security Improvments" it has made, argh.
0
 

Author Comment

by:ConcentricsInc
ID: 33649420
I currently have a call open with MS, after the perfornance team bounced it around for some time they decided to dump me on the IE team. Around and around I go...
0
 

Accepted Solution

by:
ConcentricsInc earned 0 total points
ID: 33654122
Has anyone had any experience with installing as domain admin versus installing as a local admin for these types of plug-ins on a terminal server. MS is telling me that by installing these as a local admin they are written the regitry differently.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 33671926
did you try out my post ?
http:#33648006

0
 

Author Comment

by:ConcentricsInc
ID: 33782113
The solution to this problem was to install JAVA using a local administrator account and not a domain admin account. According to MS, 2008 uses new security and installs software on a TS differently as local admin than as domain admin.
0
 

Author Comment

by:ConcentricsInc
ID: 33782137
Resolved by installing with local administrator
0
 

Expert Comment

by:RVFB IT
ID: 40723868
installing java as a local admin didnt help me...unless you meant that you made the user having the problem a local admin, then did the install...
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Utilizing an array to gracefully append to a list of EmailAddresses
Scam emails are a huge burden for many businesses. Spotting one is not always easy. Follow our tips to identify if an email you receive is a scam.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now