The notes for 2018 update 2 state that this needs to be done manually if you have the auto-lock down applied:
I downloaded the update and followed suggestions from Charlie Arehart here:
I stopped the main CF service and tried to run the update using the CF2018 JRE (java version "10.0.1" 2018-04-17)
from directory: [coldfustion root]\jre\bin:
command: java - jar [coldfusion root]\cfusion\hf-updates\hotfix-002-313961.jar
I got this:
Error: To use 'StartFlightRecording', first unlock using -XX:+UnlockCommercialFeatures.
Error: The unlock option must precede 'StartFlightRecording'.
Error: Could not create the Java Virtual Machine.
Error: A fatal exception has occurred. Program will exit.
What the hell is that? Now what?
It is a JVM argument -- what do you have specified in the JVM arguments in the Java And JVM settings of ColdFusion Administrator?
You will probably want to remove this: -XX:StartFlightRecording
This is a profiling feature in the JVM, you probably don't want that enabled on your production server. More info: How to Produce a Flight Recording
I figured some it out and now it's really a mess.
I had a space "- jar" between the "-" and "jar".
Running: java -jar [coldfusion root]\cfusion\hf-updates\hotfix-002-313961.jar
Error: Unable to access jarfile F:\ColdFusion2018\cfusion\hf-updates\hotfix-002-313961.jar
The jar file was in the right place, but the owner was the CFuserAccount used to lock CF down. I took ownership of the file and then granted my administrator full permissions to it and then ran the command again. It seemed to go OK and didn't log any errors. However the CF service wouldn't start.
Rebooted, CF service shows "Starting". Never started. Tried "Restart Service". Worked but site shows this error:
"Could not find the ColdFusion component or interface E:/www/Application.cfc.".
Reboot again. Now get "License Error." and can't open CF administrator page "
Tried to unistall the damn thing (gave myself full permission to hf folder).
F:\ColdFusion2018\jre\bin>java -jar F:\ColdFusion2018\uninstall\uninstaller.jar
no main manifest attribute, in F:\ColdFusion2018\uninstall\uninstaller.jar
I gave up and replaced the contents of my CF installation with a backup from yesterday.
Update#3 just released as I was going through all this. It doesn't mention any installation issues related to the auto-lockdown configuration in the release notes. Has this been fixed?
Don't rely on the fact that the latest update does not mention any installation issues like the previous update did. I have noticed that Adobe is no longer copying forward any specific instructions from previous updates. Instead they are posting a note on the new update to refer back to the previous update(s) to see if there were any specific instructions. So they are leaving it up to us to dig through all the updates and see what we need to do. i don't like it.
here is the note I am referring to: