Java whitelisting
1 min read Gpo, Java

Java whitelisting

Not sure about you, but I often get a lot of questions about handling Java + updates in the corp environment.  I just saw a very cool podcast from PaulDotCom ( detailing two methods for controlling it a bit more with Java whitelisting.  The skinny:

Method 1: Reg hack (IE only)

If running old versions of Java, you can allow it only to run for sites in the Trusted Zones list via:


According to the podcast, a company with 15,000 endpoints that deployed this strategy went from 1.5 Java-based infections per DAY to about 1-2 per month.

Method 2: built-in Java whitelisting (multiple browsers)

For Java 1.7U40 and above, you can create an XML file with approved files/sites to allow and push that out through GPO. 

BTW I’m way shortening this explanation…see the show notes at for full details.