Problem Installing ActiveX Controls

gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
I am having a problem getting signed active x controls downloaded and installed on end users machines when they visit trusted website.

The trusted site has be enabled to download and install activex controls without prompting the end user. Unfortunatly the activex control does not download and install so the users cannot go anyfarther on the website. Here is some background information:

-Operating System is Windows XP
-Users all belong to "Domain Users" group (was wondering if this was root cause since activex regesters with windows)
-Power Users can download\install the active x control
-Website is trusted and downloading and installing of signed activex controls enabled
-Activex control is signed
-Viewed the source code on website and activex control is not downloaded from a different site

Any help/suggestions would be appreciated. I figure the worst case scenerio is I could push it out as a package. Thanks in advance

Comments

  • gregeegregee Member Posts: 10 ■□□□□□□□□□
    can u do a run as on internet explorer as someone with administrative rights and install the active x application
  • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
    yes, that will work as well
  • DirtySouthDirtySouth Member Posts: 314 ■□□□□□□□□□
    You're using IE, right? Not Firefox or something else?
  • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
  • jescabjescab Inactive Imported Users Posts: 1,321
    I had the same problem with IE plus it would not d/l and run the latest Flash Player......
    GO STEELERS GO - STEELERS RULE
  • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
    how did you solve your problem?
  • hanakuinhanakuin Member Posts: 144
    Is the control available as a msi? If it is then you can deploy it with group policy or SMS to your users.
  • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
    Yes it is, I found an msi today that has the controls I need. I will use it if I have to, but would really like to allow trusted sites to install active x controls without prompting reguardless of end user permissions. The main reason is to save time from creating a work around for different agencies we work with everytime they have an active x control they want us to use
  • hanakuinhanakuin Member Posts: 144
    Unless there is some third party app out there that will do it, the only way that I've seen and been able to do is to actually deploy the msi.
  • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
    Ok, thank you very much
  • sprkymrksprkymrk Member Posts: 4,884 ■■■□□□□□□□
    Have you tried setting Group Policy to allow it? Check under the following:

    User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Trusted Sites.

    Specifically try these and see if they do what you want:
      Download signed ActiveX controls
      Run ActiveX controls and plugins


      Hope that helps!
      All things are possible, only believe.
    • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
      Specifically try these and see if they do what you want:

      Download signed ActiveX controls
      Run ActiveX controls and plugins

      Yeah, I tried that as well as

      Disabling Prompting for ActiveX Controls
      Script ActiveX controls marked Safe for Scripting
    • sprkymrksprkymrk Member Posts: 4,884 ■■■□□□□□□□
      Well, it looks like hanakuin was right. See this:

      http://support.microsoft.com/default.aspx?scid=kb;en-us;Q240897

      In part:
      When you use Microsoft Internet Explorer to view a Web site that contains an ActiveX control in Windows 2000, Internet Explorer determines whether you have the appropriate permission to install and run the control before downloading it. Internet Explorer does this by attempting to write to the HKEY_LOCAL_MACHINE registry hive. If the attempt to write to the registry is unsuccessful, Internet Explorer does not download the control.

      I assume the same holds true for XP based on your findings. Weird. You would think if an administrator went to the trouble of trusting a site and allowing activeX controls to be downloaded and installed from the site that you wouldn't need admin rights to install it.
      All things are possible, only believe.
    • gojericho0gojericho0 Member Posts: 1,059 ■■■□□□□□□□
      Yeah, that makes sense since all activex controls have to regester with the operating system and user rights can't do this. Maybe Microsoft will change this in Vista to provide more granular control. I guess the trusted sites and group policy configurations are used as a security blanket for the individuals who have the elevated rights. Thanks again, learn something new everyday
    • JDMurrayJDMurray MSIT InfoSec CISSP SSCP GSOM GSEC EnCE C|EH Cloud+ CySA+ CASP+ PenTest+ Security+ Surf City, USAAdmin Posts: 12,673 Admin
      sprkymrk wrote:
      You would think if an administrator went to the trouble of trusting a site and allowing activeX controls to be downloaded and installed from the site that you wouldn't need admin rights to install it.
      This is one of the many reasons why it is very inconvenient to use Windows in a user account that does not have administrator privileges. They are fixing this need in Vista, but I'm not yet clear on how these changes will limit the ability of many legacy Windows apps to run correctly on Vista.
    • deneb829deneb829 Member Posts: 292
      sprkymrk wrote:
      Well, it looks like hanakuin was right. See this:

      http://support.microsoft.com/default.aspx?scid=kb;en-us;Q240897

      In part:
      When you use Microsoft Internet Explorer to view a Web site that contains an ActiveX control in Windows 2000, Internet Explorer determines whether you have the appropriate permission to install and run the control before downloading it. Internet Explorer does this by attempting to write to the HKEY_LOCAL_MACHINE registry hive. If the attempt to write to the registry is unsuccessful, Internet Explorer does not download the control.

      I found this one out the hard way this past summer after we imaged the math lab at the college and ended up forgetting an ActiveX plugin for one of their math apps. I want to give the students the right to install this control and only this control. After much searching, testing, and frustration, we found that it was just a better idea to redo the image instead of the possibility of giving the students too many rights.
      There are only 10 types of people in this world - People who understand binary and people who do not.
    • sprkymrksprkymrk Member Posts: 4,884 ■■■□□□□□□□
      deneb829 wrote:
      sprkymrk wrote:
      Well, it looks like hanakuin was right. See this:

      http://support.microsoft.com/default.aspx?scid=kb;en-us;Q240897

      In part:
      When you use Microsoft Internet Explorer to view a Web site that contains an ActiveX control in Windows 2000, Internet Explorer determines whether you have the appropriate permission to install and run the control before downloading it. Internet Explorer does this by attempting to write to the HKEY_LOCAL_MACHINE registry hive. If the attempt to write to the registry is unsuccessful, Internet Explorer does not download the control.

      I found this one out the hard way this past summer after we imaged the math lab at the college and ended up forgetting an ActiveX plugin for one of their math apps. I want to give the students the right to install this control and only this control. After much searching, testing, and frustration, we found that it was just a better idea to redo the image instead of the possibility of giving the students too many rights.

      Wow - talk about a double take! I had to look twice because I thought you said "meth lab"! icon_lol.gificon_lol.gif

      Sorry to get off topic though. Was reimaging easier than pushing the ActiveX as an MSI via Group Policy?
      All things are possible, only believe.
    Sign In or Register to comment.