Chapter 1: Overview
In a settlement agreement reached in January 2001 to resolve a dispute over Microsoft’s distribution of its Java implementation, Sun and Microsoft agreed to limit the duration of Microsoft's use of Sun's source code and compatibility test suites to support the Microsoft® Java Virtual Machine (MSJVM). However, as part of the April 2004 settlement, Sun and Microsoft agreed to extend Microsoft's license to use Sun's Java source code and compatibility test suites. This extension allows Microsoft to support the MSJVM and address potential security issues until December 31, 2007.
Consistent with the agreements made with Sun, Microsoft has been phasing out the MSJVM in its products. Going forward, the MSJVM will not be included in any future Microsoft products. The MSJVM is obsolete code and will no longer be enhanced or developed. Microsoft will only continue to provide security fixes to help keep customer machines secure.
Sites and applications that currently depend upon the MSJVM will not function correctly when accessed by systems that do not have the MSJVM installed. Users with updated Microsoft products without the MSJVM may experience problems with Internet or Intranet sites requiring the MSJVM.
.gif)
On This Page
.gif){kind=icon}
Intended Audience
How to Use This Solution Guide
Why a Transition Is Needed
Are You Affected?
IT Professionals Take Action
Assessing Your Situation
Security Considerations after December 31, 2007
Microsoft Product Support Services
Example Process
Intended Audience
This is a technical guide intended for IT professionals responsible for identifying sites and applications that require the MSJVM or contain Java-language code, and planning a transition to alternate solutions.
IT professionals will find this guide useful in identifying dependencies on the MSJVM. IT business decision makers or those charged with establishing a technology strategy will find useful information for defining a strategy to transition away from any dependencies. Technical decision makers will find guidance on the implementation of that strategy.
The Microsoft Java Virtual Machine Migration Guide for Developers is available for those tasked with defining the types of changes that need to be made, determining the appropriate approach to the work, and implementing these changes.
How to Use This Solution Guide
This document provides specific guidance for MSJVM transition projects. The guide begins with the information you need to assess your situation, a description of your planning options, and details about each option.
The following is a list of content for this guide's chapters:
Chapter 1—Overview. This chapter outlines the guide and describes why support is being discontinued for the MSJVM, how this may impact users and businesses, and a recommended plan of action for IT professionals.
Chapter 2—The Diagnostic Tool for the Microsoft VM. This chapter describes the tool available for automatically assessing all dependencies to the MSJVM, how to interpret diagnostic reports, and how to process the resulting data.
Chapter 3—Available Transition Options. This chapter describes possible transition options and outlines factors in planning a transition from the MSJVM.
Chapter 4—Lock Down Security. This chapter describes a methodology for maintaining use of the MSJVM on legacy systems.
Chapter 5—The MSJVM Removal Tool. This chapter describes the tool available for removing the MSJVM.
Chapter 6—Switch to Another JRE. This chapter discusses general topics involved in selecting, installing, and deploying an alternate JRE.
Why a Transition Is Needed
The future of the MSJVM is clearly defined by the January 2001 settlement with Sun Microsystems, which contemplates a phase out of the MSJVM. Microsoft and Sun have entered into an April 2004 settlement, which permits Microsoft to continue support of the MSJVM until December 31, 2007. After December 31, 2007, Microsoft will be unable to update the MSJVM, even to repair critical security vulnerabilities and customer defects. Although Microsoft will continue to support customers, the ability to do so will be extremely limited. In light of these restrictions, new Microsoft products will not include the MSJVM.
After the deadline, the MSJVM could be vulnerable to security issues that will be impossible for Microsoft to remediate. Businesses depending on the MSJVM that failed to migrate to alternate solutions may be in a position wherein they are required to disable the MSJVM completely with limited notice. As a result, mission-critical applets and J++ applications may cease to function properly, potentially impacting business operations and customers.
Are You Affected?
Many IT Professionals are unaware of dependencies they may have on the MSJVM, of the deadline for end of support, and the potential security risks that may occur once Microsoft loses the ability to support the MSJVM. Microsoft stresses the importance of each customer making an effort to understand the current situation with the MSJVM and the impact it may have on their day-to-day activities.
A basic assessment to understand whether this change affects you can be as simple as answering these questions:
Do you use any Microsoft applications with known MSJVM dependencies?
Do you use any third-party applications with known MSJVM dependencies?
Have you created any custom applications with MSJVM dependencies?
If you answer “No” to all three of the above, then your solution is to remove the MSJVM from your environment using the MSJVM Removal Tool. However, if you answer “Yes” or are unsure of an answer to any of these questions, it is necessary to initiate a discovery process for MSJVM dependencies in your environment.
Microsoft applications that were identified to have dependencies on the MSJVM will either be retired or re-released without the dependency. If you use a third party application with MSJVM dependencies, contact the vendor for information on how they plan to address the issue.
To review the list of known Microsoft and third-party applications with MSJVM dependencies refer to: https://www.microsoft.com/java.
Note The lists of applications provided at the link above are intended to provide you with a starting point for MSJVM dependency discovery. If a particular application is not listed, it does not necessarily mean that it does not have a MSJVM dependency. Evaluations on MSJVM dependencies are ongoing.
IT Professionals Take Action
Because you may have dependencies in a variety of websites and applications, Microsoft strongly recommends that IT professionals determine the extent of their dependencies on the MSJVM. Keep in mind that any solution chosen to address discovered dependencies may require extensive testing and an understanding of the range of systems affected.
It is important to identify all applets and Java-dependent applications and components:
Applets are identified by the <APPLET>, <OBJECT>, or <EMBED> tags, either directly or through DLLs or ActiveX controls.
Java-dependent applications and application components are applications that make use of the MSJVM, either directly or through DLLs or ActiveX controls, including the J++ source files and the binary files. Possible binary file extensions include .exe, .ocx, and .dll.
Some technologies may appear as though they have MSJVM dependencies, but this is not the case. For example the following are not affected, except when they use one of the affected technologies mentioned above:
JavaScript, Microsoft JScript®, Visual J#, or ECMAScript usage on any site.
Websites that use server-side Java technologies, such as Java Server Pages (JSP) or Servlets.
Assessing Your Situation
The Diagnostic Tool for the Microsoft VM scans systems and produces a report on the resources that have dependencies on the MSJVM or Java-language code. By analyzing the diagnostic report you can identify if the MSJVM is installed, what types of dependencies exist, and what applications and websites are affected.
Once you identify dependencies on the MSJVM, Microsoft recommends that you take one or more of the following actions, as appropriate:
Remove the MSJVM.
Lock down security and restrict access to applets or applications.
Migrate to another solution as discussed in the Microsoft Java Virtual Machine Migration Guide for Developers:
Visual J# .NET or J# Browser Controls.
C# on .NET, using the Java Language Conversion Assistant.
Other rendering technologies, such as DHTML or a 3rd party display technology such as Flash or Shockwave.
An alternate JRE.
Note Results of the discovery process may indicate that you have Java dependencies, but do not have MSJVM dependencies. It is important to understand this distinction. Organizations with Java dependent applications and applets that do not use MSJVM-specific features may want to consider switching to an alternate JRE.
Security Considerations after December 31, 2007
Although a possible option for organizations after December 31, 2007 is to do nothing to resolve MSJVM dependencies, this is not recommended by Microsoft. The MSJVM will become unsupported software on December 31, 2007, and as a result, there are serious security implications of not transitioning MSJVM dependencies before this date.
Running the MSJVM as unsupported software exposes your system to the possibility of security vulnerabilities. If a security issue is identified following the deadline, Microsoft will be unable to make security or functionality patches to the MSJVM available to users.
Prior to the deadline, every effort should be made to remove or transition away from the MSJVM. At a minimum, if you are unable to successfully transition or decide to not transition away from the MSJVM, locking down security for the MSJVM to trusted sites is recommended.
The MSJVM Removal Tool is available to remove the MSJVM from client systems after transitioning. Removing the MSJVM is one way to help ensure you will not be vulnerable to any security risks related to the MSJVM.
Microsoft Product Support Services
Microsoft is committed to helping customers through this transition and offers migration support at no charge for the Diagnostic Tool for the Microsoft VM, the MSJVM Removal Tool, and the Java Language Conversion Assistant.
Additionally, Microsoft Product Support Services (PSS) is available to help assist migrating existing applications and functionality to any Microsoft technology, including the .NET environment. This enables developers to migrate existing applications with current feature sets. Technical assistance on adding additional functionality is not included and will continue to be fee-based. MSJVM migration support is now available worldwide. Please contact PSS at 800-936-5800 in the US or your local subsidiary.
Note Microsoft will continue support of existing products that have MSJVM dependencies according to existing support policies, but cannot support MSJVM related issues after December 31, 2007. For more information on International Support, refer to: https://support.microsoft.com/common/international.aspx.
Example Process
The following graphic (Figure 1.1) is an example of how to initiate the process of dependency discovery on the MSJVM and what options are available to address those dependencies. Each step in the example process is described in more detail throughout this manual.
Note This graphic is intended to provide a starting point from which you can plan your own assessment and solutions based on your business needs and environment, and does not include steps such as re-running the Diagnostic Tool, testing migration options, etc.
.gif)