Link to home
Start Free TrialLog in
Avatar of Jose-Valencia
Jose-ValenciaFlag for United States of America

asked on

Unable to create registry key for Allow active content to run in files on my computer* via .vbs or even .bat

Hello Experts,


Users are trying to access a page that requires them to install ActiveX Controls (for Siebel) but they are not able to do so because they belong to the Users group ( Windows XP ). As a solution we have the users run a .vbs script as Administrator ( Script Compiled into an .exe ) where it opens an Internet Explorer window that calls two .cab files.


This method works but one of the issues we are encountering here is the amount of calls we are getting because users apparently suffer from yellow blindness and can't click on the yellow prompt even with instructions provided in the same page.

I was able to replicate this procedure silently or in the background through the modification of the Administrator's HKCU prior to launching the Internet Explorer window so there are no prompts that stops the ActiveX Controls from installing. I tested my script and it runs fine on workstations where the Administrator's HKCU path that takes care of the Allow active content to run in files on my computer* already exist. In workstations where the this path ( [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN] ) does not exist, my scripts fails because the registry file is not creating the path and the key that takes care of this option.

Changing the HKLM registry works because this path already exist, but I am thinking this will require a restart in order for the path to appear in the Administrator's HKCU. I tested my method of creating any registry path and it works. Somehow creating this specific path to the Administrator's HKCU is not working unless it already exists.

This path gets created once you go to Internet Options > Advanced ( Tab ) > Security > Allow active content to run in files on My Computer*. As additional information, we are using IE7.

Please help!!!!!!!!!!!!!!!!
Avatar of Giovanni
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Also to clarify....

"but I am thinking this will require a restart in order for the path to appear in the Administrator's HKCU."

Who is logged on? If it is ANYthing but Administrator, HKCU has no effect on their profile, and will ONLY modify Administrator's HKCU (if doing a "Run As Administrator").
AND HKCU changes are instant.....
johnb6767: thanks for the assist!
Avatar of Jose-Valencia


@ johnb6767: Yes, I only want this to change the Administrator's HKCU. Maybe it doesn't like to run it from the command prompt. Do you know how to write this in .vbs ?

To clarify my previous clarification....

Users are currently logged in under Administrator? If not, and you are trying to modify User1, by doing a RunAs... Essentially there is no purpose for even running the command unless Administrator logged on......
No, users are logged in with their own account ( User Group ). We are running the script as administrator under their account.
Tha'ts what I thought... Wait... Nevermind, I see the only thing thats doing in the Admin profile is to unlock regedit (which shouldnt be needed since using reg.exe in the .bat format....)....

Sorry, I kinda wasted a bit of time chasing the wrong bird.....

So where do you stand with everything now?

"Yes, I only want this to change the Administrator's HKCU."

This isn't needed if you use the reg.exe commands to modify the "FEATURE_LOCALMACHINE_LOCKDOWN" values.....


Thank you guys for the assistance provided with this. I found the solution after looking at this from a different perspective. If you look at the .vbs that I attached I only had 5 seconds for the IE window to close until it completes its process and its visibility was set to 0 or false. Since the IE window was running in the background I was not even aware the activeX controls were actually installing and no prompts were stopping the IE from installing the ActiveX Controls. I increased the time as a way to test this and I noticed that it completed successfully and even on machines where the registry path did not exist, the registry needed was created after the script completed.

When the process of the ActiveX Controls is interrupted due to time, the registry key didn't get added even though when you look at the code, registry writing comes before the execution of the ActiveX Controls. Somehow there is a link between running the ActiveX Controls and the creation of the registry key for the Allow active content to run in files on my computer* option in IE. The registry key modification actually happened, it is that you don't see but after the script completes successfully, it happens in the background when the script is running.

As a more robust solution to allow the window to complete its process. I looped the Busy state of the IE window to allow time for it to complete the installation of the ActiveX Controls. Below are the modifications I made to my code and it seems to be working. So regardless you use reg /s file.reg or reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN" /v iexplore.exe /t REG_DWORD /d 0, it would have worked it is just that Windows XP was presenting the wrong symptoms in order to diagnose accordingly.
Dim objShell, strRegPath, strRegValue
Set objShell = CreateObject("WScript.Shell")

strRegPath = "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe"

On Error Resume Next
strRegValue = objShell.RegRead(strRegPath)

'Key doesn't exist
If Err Then 
   objShell.RegWrite strRegPath, 0, "REG_DWORD"
'Key exists, check value
	If strRegValue = 1 Then
		objShell.RegWrite strRegPath, 0, "REG_DWORD"
    End If 
End if

'Alternative Solutions to write to registry besides vbs
'SiebelRegistry = "C:\SiebelAx\AllowActiveContent.reg"
'AllowActiveContent = "regedit /s C:\SiebelAx\AllowActiveContent.reg"
'"cmd /c reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /f "_
'& "& regedit /s " & SiebelRegistry
'& "& reg add HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN /v iexplore.exe /t REG_DWORD /d 00000000 /f"
'ReturnAllowActiveContent = objShell.Run(AllowActiveContent, 0, True)

Set objIEAx = CreateObject("InternetExplorer.Application")
SiebelPage = "C:\SiebelAx\DownloadSiebelAx.htm"
objIEAx.Visible = 1
objIEAx.ToolBar = 0
objIEAx.Resizable = 0
objIEAx.AddressBar = 0
objIEAx.Width = 600
objIEAx.Height = 200
objIEAx.Top = 300
objIEAx.Left = 400
ObjIEAx.Navigate SiebelPage
'Wait for files to be copied or holds the script so it completes, this two lines were the solution.
Do While objIEAx.Busy

'Once IE changes to a ready state, the following will close the window a exit the script.

Open in new window

This registry modification will allow the installation of ActiveX Controls without getting prompted by IE. In order for the registry modification to happen via a script, time has to be given to the IE Window to complete its installation of the ActiveX Controls so the registry modification can be noticed once you access the registry. The symptoms presented when the script fails can be misleading into thinking that the registry modification never happened.