How can we prohibit clients to  install ActiveX in general, but not for certain Internet sites controled by Windows 2003 AD group policies

Posted on 2007-10-03
Last Modified: 2013-12-08
Generally we want to prohibit the installation of ActiveX application for all clients, but for certain (Intranet & Internet) sites we want to allow it.
How can we set these rules in our general Windows 2003 AD group policy ?

Thanks for your help,
Question by:it-maintenance
    LVL 30

    Accepted Solution

    Assuming your clients are running XP Service Pack 2, this can be controlled by specifying the GUID of the ActiveX controls that you want to allow/disallow.

    Mark Minasi's October 2004 newsletter steps you through the process - you need to register on his site to view his newsletter archives but it's worth it (he doesn't sell his email rosters to SPAMmers, no really, I promise you, he doesn't) -

    Author Comment

    Hi Laura

    Thanks for your solution. I have found some news and solutions, but it's not exactly they way, we wanna go.
    Yes, our clients have XP Service Pack 2.

    Is there a solution, where we can accept ActiveX installations (add-ons) for Internet sites and control the whole with group policies ? In VISTA I have seen, that they support this feature.
    LVL 30

    Expert Comment

    I'm afraid I don't understand your question.  The link listed above describes the available mechanism to control ActiveX installation in Windows XP.  Vista is a more advanced operating system that has many GPO options available that are not supported by Windows XP - the setting you're describing is likely one of them.

    Author Comment

    The problem with the group policy setting (Computer Configuration>Administrator templates>Windows components>Internet Explorer>Security Features>Add-on Management) we block as well browser extensions, Browser helper objects, ActiveX....
    We can enable (Add-on list) some IE add-on types (with CLSID), but these are to many.

    Just we want to block ActiveX, but even enable it for some specific sites. Probably I haven't found the correct solution.
    Thanks for your help and answer !

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Suggested Solutions

    As a Mac user and former AppleCare AHA & Senior Advisor, I'm constantly bombarded with questions about Macs and if they need Antivirus. This short article is my response to those questions.
    SSL stands for “Secure Sockets Layer” and an SSL certificate is a critical component to keeping your website safe, secured, and compliant. Any ecommerce website must have an SSL certificate to ensure the safe handling of sensitive information like…
    Google currently has a new report that is in beta and coming soon to Webmaster Tool accounts. This Micro Tutorial will highlight new features for Google Webmaster Tools.
    How to create a custom search shortcut to site-search Experts Exchange using Google in the Firefox browser. This eliminates the need to type out whenever you want to search the site. Launch your Bookmark Menu: Press 'Ctrl +…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now