We have multiple image builds of Windows XP Pro SP2, and have encountered an issue where on a particular build if the user goes to a website that wishes to install an ActiveX control, the control does not install and they do not see the prompt.
This is not an issue with IE settings, as the problem occurs if the user is just a member of Users group, but if I grant them admin rights without changing anything else then visiting the same URL results in the ActiveX prompt appearing and the user is able to install it.
I have checked the solutions in the EE articles:
http://www.experts-exchang
and
http://www.experts-exchang
but they do not help in our situation.
The issue occurs with any site we've tested that tries to install ActiveX, including Microsoft Update. We've tried everything we can think of, including adding the sites to our Trusted Sites and giving full access to all settings within that zone, but to no avail.
What file, reg key, or process does a user account need to have rights to in order for IE to even display the prompt? This particular build is using IE 7.0.5730.13CO
Thanks in advance,
Gavin
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Oh, also, when you say you add the sites to trusted zones, have you just gone into the security settings (custom settings I mean) and changed the settings under "ActiveX Controls and Plugins" ?
Tools > Options > Security > Internet Icon > Custom Level
^ then Under "ActiveX Controls and Plugins"
I'm just trying to figure out what you've tried already.
Hi PJ,
Believe me, if it were up to me we'd be a Firefox shop. ;-)
To answer your question, yes we have tried messing with the settings pertaining to ActiveX controls, and also scripts. We first made the settings exactly match a non-effected build, but it didn't work. We then took those settings and made them even less "secure", and it still didn't work.
No, not yet. Implementing a third-party solution for just this one problem would likely be considered overkill by the brass, especially since it isn't free.
On top of that, all of our other builds allow users to install ActiveX. With those builds there actually used to be a process to customize the security settings by applying a CustomSecInfo.sdb. I'm sure that somewhere in this process the answer is buried, but we have discontinued the use of this security "template" as it has been discovered to have been the root of many, many problems in the environment. Does this make any sense?
As I suspected, users being unable to install ActiveX plug-ins is by design; the reason they are prompted in all of our old builds is because of a defect with the old process.
If I could just know what area of the registry or file system that users need rights to then it might be helpful. On the other hand, we don't want all users to be able to install all ActiveX plug-ins at all times, so we may be to resort to a 3rd-party solution like the one you suggested in order to have a white list of acceptable plug-ins.
If nobody else chimes in with a concrete solution then I'll award all points to pjvog for your suggestions thus far.
Gavin
This might be of some (little) help: http://support.microsoft.c
Also I have this in my notes:
To install Active X controls, users must have local administrator permission.
The best way is to add end users to local computer administrator user group
If you cannot add them to local computer administrator group due to some
limitation, there is a workaround as following to make other users group
has the ability to download and install ActiveX controls:
For example, we grate Power Users group has the permission.
- Granting Power Users the SeLoadDriverPrivilege. This can be done through
local group policy in the following setting:
Computer Configuration/Windows Settings/Security Settings/Local
Policies/User Rights Assignment/Load and Unload Device drivers
- Granting Power Users full control to the "c:\windows\downloaded program
files" folder
- Granting Power Users full control to the "HKLM\Software\Microsoft\C
Store Database" registry key
Please note that this configuration is not recommended or supported due to
the vulnerabilities that exist with downloading ActiveX controls.
Business Accounts
Answer for Membership
by: pjvogPosted on 2009-11-06 at 09:54:54ID: 25761325
I can tell you, my first reaction to this is "Well you see, here, the whole problem is that you're using IE in the first place..." but obviously I can't imagine that's what you want to hear.
In a similar situation, I've found that using Privilege manager from beyond trust can set the required access for unpriviledged users to install activeX controls. Link: http://pm.beyondtrust.com/
Otherwise, I don't know the exact setting in the registry or otherwise to set this up, I'll see if I can find anything else. (as Privilege manager isn't free)