If you support clients who have vendor apps (Kronos) that use a specific version of Java you'll want to read this to automate the install of the client on all workstation and prevent the version from being updated. I have found this very useful!
Use Group Policy to Distribute JRE With Its Automatic Update Feature Disabled
