Java on Terminal Server 2008 not working
I am struggling with Java on a Windows 2008 Terminal Services farm. I have downloaded and installed Java like any other application on a terminal server. However Java will not work for non-privileged users. However if I make the user a local administrator and the log in as that user and goto a webpage that requires Java a prompt comes up asking me if it is OK to install and then it works. I can then log the user back out, remove their administrative privileges and log back in and it works. The problem is I would have to do this for every user on every server to get this resolved. Something tells me I have installed it wrong or I have a GPO blocking it. Has anyone had any experience with this ?
I believe you have it not installed correctly. Did you have the TS in Install Mode when you installed Java?
If you are not sure then more than likly you were not. Uninstall Java and follow the steps below.
Install Mode can be activated via DOS with the following command:
C:\>Change User /install
-- Now install Java by running the EXE
C:\>Change User /execute
-- It is now ready for users.
Doing this will create registry entries that will be applied to each user's HKCU key when they logon, plus any other files that may be needed.
Give this a go and let use know if it worked.
If you are not sure then more than likly you were not. Uninstall Java and follow the steps below.
Install Mode can be activated via DOS with the following command:
C:\>Change User /install
-- Now install Java by running the EXE
C:\>Change User /execute
-- It is now ready for users.
Doing this will create registry entries that will be applied to each user's HKCU key when they logon, plus any other files that may be needed.
Give this a go and let use know if it worked.
ASKER
I have actually installed it serveral time and each time I have put the terminal server install mode.
Please verify the permission settings on HKCU and corresponding class-id's
I would not recommand doing the Registry adjustments first. BTW, if you remove the Admin right and they are still OK does not point to a Registry Permission issue. It is more likely that the user is not allowed to execute the Installer.
ASKER
PlugThatInWhere, interesting prospect. Two things, I have scrolled through all GPOs that afffect these users and I don't see anything that I have set (although the default maybe to exclude access to the installer) and all of these users are members of the PowerUsers group although I know this is deprecated. Any ideas how I would go about checking the installer theory?
Power Users can install, but like you said still limited. I would do this to track it down: Use ProcMon to watch what the user Cannot access. You will need to be the only user on the server, and I am not sure if Procmon.exe will run as a Power User (If not then you will run it under your Admin account while you try the failed steps on a user account).
You can find Procmon.exe at sysinternals.com (now owned by MS). If you have never used this then you will be in for a shock when you see how much your system does in the background.
You will need to start the program, stop it from recording, clear the current captured events (now you are ready to capture what you want). Now get the user to the point Just before the failure (one click away). Then start recording then as quick as you can make the last click on the user session to get the failure, then as quick as you can stop the recording after the failure.
With the recording in hand you can start working from the bottom up. Look for any Access Denied messages to Files or Registry entries that make any refference to Java. You will see many such entries for various other things, most of them are normal as it is the system/software looking for options that may / may not have been defined, as well as it looking in various paths to "find" something (i.e. the DOS Search Path variable will search each folder until it says No Way).
I am fairly used to this program and can tell what is normal and not. If you can't make heads or tails of what you are seeing then maybe you can send me the PML (saved capture) for me to review.
You can find Procmon.exe at sysinternals.com (now owned by MS). If you have never used this then you will be in for a shock when you see how much your system does in the background.
You will need to start the program, stop it from recording, clear the current captured events (now you are ready to capture what you want). Now get the user to the point Just before the failure (one click away). Then start recording then as quick as you can make the last click on the user session to get the failure, then as quick as you can stop the recording after the failure.
With the recording in hand you can start working from the bottom up. Look for any Access Denied messages to Files or Registry entries that make any refference to Java. You will see many such entries for various other things, most of them are normal as it is the system/software looking for options that may / may not have been defined, as well as it looking in various paths to "find" something (i.e. the DOS Search Path variable will search each folder until it says No Way).
I am fairly used to this program and can tell what is normal and not. If you can't make heads or tails of what you are seeing then maybe you can send me the PML (saved capture) for me to review.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
I currently have a call open with MS, after the perfornance team bounced it around for some time they decided to dump me on the IE team. Around and around I go...
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
The solution to this problem was to install JAVA using a local administrator account and not a domain admin account. According to MS, 2008 uses new security and installs software on a TS differently as local admin than as domain admin.
ASKER
Resolved by installing with local administrator
installing java as a local admin didnt help me...unless you meant that you made the user having the problem a local admin, then did the install...
(from the link in the end)
Unlocking registry settings
By default, Windows Terminal Services clients do not have write access to the registry on the Windows Terminal Services computer, except to the registry hive under HKEY_CURRENT_USER.
To run some features, you might need to give users write access to some keys and subkeys
--
start > run > regedit
HKEY_CLASSES_ROOT\JavaPlug
Right click permissions
Allow users in Terminal Services OU
Repeat the same thing for other java plugin versions.
You may have to restart the server for registry changes to take effect.
http://technet.microsoft.com/en-us/library/cc179161(office.12).aspx