Download the offline installer
Use the offline installer, instead of the normal installer. This has the added benefit that it doesn't include the Ask-toolbar.
The easiest method is to use these direct download links.
If that page does not yet list the latest version, go to java.com, but ignore the big download buttons. Instead click in the header on download, and on the next page on 'all java downloads'. The english version of that page is here, the german one here. However Oracle is hiding the download link for the 64-bit version if you access this page with a 32-bit operating system.
To find the 64bit version, go to this page instead, and ignore that the title of this page says SE instead of JRE. Note that this page works only with Javascript and Cookies enabled. Scroll down and almost at the bottom of the page there's the link to the 64bit version. It's not called 'offline version' here, but it is. Beware to not download the source instead of the binary. The filename of the correct file ends with 'windows-x64.exe'.
Extract the MSI-file
Run the downloaded installer, and wait until it displays the first dialog. Only answer questions from Windows when it wants confirmation to run the installer, but don't click on any button that the installer shows once it's running. Instead look into this directory
- %APPDATA%\Sun\Java (Windows-XP)
- %LOCALAPPDATA%Low\Sun\Java (Windows 7)
(Source: http://www.java.com/en/download/help/msi_install.xml)
Here you find a directory with the version number of the Java installer that you have started. In that directory there is not just one MSI-file, but one or several more files. Create an empty directory somewhere and copy all files from this directory there. Then abort the installer program.
Update: Version 1.8.20 does provide just one single large MSI file, everything is included in that, no need to copy any other files.
Configure
The properties ALLUSERS and ARPNOMODIFY are already all set to 1, there's no need to do that yourself.
ARPNOREPAIR is also set to 1. This is unfortunate, but one should probably not change it.
But you should change these properties in the MSI file, for example with Orca:
- set ARPNOREMOVE to 1. This disables uninstall in 'Add/Remove Programs'.
- change AUTOUPDATECHECK from 1 to 0. This disables update check during installation.
- change JAVAUPDATE from 1 to 0. This disables automatic updates.
- change JU from 1 to 0. Don't allow users to re-enable updater (is this documented anywhere?).
The three java-specific changes regarding the updaters can also be made with this script:
Java_DisableAllUpdates.vbs.
Save this script, then drag and drop the file jre1.7.0_x.msi onto it.
For more info see Java Deployment Guide.
Change Security Settings (optional)
The browser plugin of Java version 1.7.51 (January 2014) and later will only run applets, that are signed with a digital certificate. This can be changed by creating a Deployment Rule Set, a whitelist ("Exception List"), or by changing the security level from high to medium. More details here.
The security level can be set by individual users in the Java Control Panel, or be deployed to all users with the install option WEB_JAVA_SECURITY_LEVEL=M. This option can either be specified on the command line, or as entry in the properties table of the msi-file (name "WEB_JAVA_SECURITY_LEVEL", value "M").