Admin Arsenal Blog

Wouldn't this method be considered "tattooing the registry"? Also if one types the wrong key info you can mess up things. The java package can be edited instead to make the update check disabled. So it will be deployed with it disabled already & not have to be done as a secondary step. Just don't deploy this edited package to your own pc or you won't know when java has updates. ;-)

My point here was to let admins know that even after the fact they have the ability to enable or disable Java updates. Hopefully this will raise consciousness of their ability to make other changes quickly and easily. If you can turn off update checking during the deployment then this is obviously the best way to go. Java usually has two properties for this: JAVAUPDATE=0 or AUTOUPDATECHECK=0. Please note, however, that users have noted that since JRE6u20 these properties do not disable auto update checks. I recently tried this on JRE6u30 and noticed the same behavior. 
 
As far as "tattooing the registry"... not necessarily (which is a way of saying "yes, but" ;-) ). Using the Registry Scanner feature in PDQ Inventory will help you keep track of your reg changes and, obviously, let you modify them as appropriate. Using Group Policy is the best way to enforce registry policy in your environment (as well as avoiding registry tattoos) but there are also times when a GPO is, IMO, simply overkill.