Problem Installing ActiveX Controls

I am having a problem getting signed active x controls downloaded and installed on end users machines when they visit trusted website.

The trusted site has be enabled to download and install activex controls without prompting the end user. Unfortunatly the activex control does not download and install so the users cannot go anyfarther on the website. Here is some background information:

-Operating System is Windows XP
-Users all belong to "Domain Users" group (was wondering if this was root cause since activex regesters with windows)
-Power Users can download\install the active x control
-Website is trusted and downloading and installing of signed activex controls enabled
-Activex control is signed
-Viewed the source code on website and activex control is not downloaded from a different site

Any help/suggestions would be appreciated. I figure the worst case scenerio is I could push it out as a package. Thanks in advance

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

gregee

can u do a run as on internet explorer as someone with administrative rights and install the active x application

gojericho0

yes, that will work as well

DirtySouth

You're using IE, right? Not Firefox or something else?

gojericho0

yup IE 6

jescab

I had the same problem with IE plus it would not d/l and run the latest Flash Player......

gojericho0

how did you solve your problem?

hanakuin

Is the control available as a msi? If it is then you can deploy it with group policy or SMS to your users.

gojericho0

Yes it is, I found an msi today that has the controls I need. I will use it if I have to, but would really like to allow trusted sites to install active x controls without prompting reguardless of end user permissions. The main reason is to save time from creating a work around for different agencies we work with everytime they have an active x control they want us to use

hanakuin

Unless there is some third party app out there that will do it, the only way that I've seen and been able to do is to actually deploy the msi.

gojericho0

Ok, thank you very much

sprkymrk

Have you tried setting Group Policy to allow it? Check under the following:

User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Trusted Sites.

Specifically try these and see if they do what you want:

Download signed ActiveX controls
Run ActiveX controls and plugins

Hope that helps!

gojericho0

Specifically try these and see if they do what you want:

Download signed ActiveX controls
Run ActiveX controls and plugins

Yeah, I tried that as well as

Disabling Prompting for ActiveX Controls
Script ActiveX controls marked Safe for Scripting

sprkymrk

Well, it looks like hanakuin was right. See this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q240897

In part:

When you use Microsoft Internet Explorer to view a Web site that contains an ActiveX control in Windows 2000, Internet Explorer determines whether you have the appropriate permission to install and run the control before downloading it. Internet Explorer does this by attempting to write to the HKEY_LOCAL_MACHINE registry hive. If the attempt to write to the registry is unsuccessful, Internet Explorer does not download the control.

I assume the same holds true for XP based on your findings. Weird. You would think if an administrator went to the trouble of trusting a site and allowing activeX controls to be downloaded and installed from the site that you wouldn't need admin rights to install it.

gojericho0

Yeah, that makes sense since all activex controls have to regester with the operating system and user rights can't do this. Maybe Microsoft will change this in Vista to provide more granular control. I guess the trusted sites and group policy configurations are used as a security blanket for the individuals who have the elevated rights. Thanks again, learn something new everyday

JDMurray

sprkymrk wrote:

You would think if an administrator went to the trouble of trusting a site and allowing activeX controls to be downloaded and installed from the site that you wouldn't need admin rights to install it.

This is one of the many reasons why it is very inconvenient to use Windows in a user account that does not have administrator privileges. They are fixing this need in Vista, but I'm not yet clear on how these changes will limit the ability of many legacy Windows apps to run correctly on Vista.

deneb829

sprkymrk wrote:

Well, it looks like hanakuin was right. See this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q240897

In part:

When you use Microsoft Internet Explorer to view a Web site that contains an ActiveX control in Windows 2000, Internet Explorer determines whether you have the appropriate permission to install and run the control before downloading it. Internet Explorer does this by attempting to write to the HKEY_LOCAL_MACHINE registry hive. If the attempt to write to the registry is unsuccessful, Internet Explorer does not download the control.

I found this one out the hard way this past summer after we imaged the math lab at the college and ended up forgetting an ActiveX plugin for one of their math apps. I want to give the students the right to install this control and only this control. After much searching, testing, and frustration, we found that it was just a better idea to redo the image instead of the possibility of giving the students too many rights.

sprkymrk

deneb829 wrote:

sprkymrk wrote:

Well, it looks like hanakuin was right. See this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q240897

In part:

When you use Microsoft Internet Explorer to view a Web site that contains an ActiveX control in Windows 2000, Internet Explorer determines whether you have the appropriate permission to install and run the control before downloading it. Internet Explorer does this by attempting to write to the HKEY_LOCAL_MACHINE registry hive. If the attempt to write to the registry is unsuccessful, Internet Explorer does not download the control.

I found this one out the hard way this past summer after we imaged the math lab at the college and ended up forgetting an ActiveX plugin for one of their math apps. I want to give the students the right to install this control and only this control. After much searching, testing, and frustration, we found that it was just a better idea to redo the image instead of the possibility of giving the students too many rights.

Wow - talk about a double take! I had to look twice because I thought you said "meth lab"!

Sorry to get off topic though. Was reimaging easier than pushing the ActiveX as an MSI via Group Policy?