locked
ActiveX Group Policy on Server 2003 Domain RRS feed

  • Question

  • Hi.  I'm looking for a way to allow certain approved activex controls for non-admin users running Windows 7 Prof.  Want to do this via group policy on a Server 2003 domain.  I found the steps required for a 2008 domain which unfortunately we don't have.

    If this isn't possible through group policy on the domain, how about through the registry?

    Thanks in advance.

    Wednesday, November 10, 2010 11:54 AM

Answers

  • Hi,

    Running IE8 in Windows Vista or later system, a standard user may install ActiveX controls in their own user profile without requiring administrative privileges. This improvement makes it easier for an organization to realize the full benefit of User Account Control by enabling standard users to install ActiveX controls used in their day-to-day browsing.

    If a user happens to install a malicious ActiveX control, the overall system will be unaffected, as the control was installed only under the user’s account. Since installations can be restricted to a user profile, the risk and cost of compromise (and, in turn, the total cost of administering users on a machine) will be lowered significantly.

    Per-User ActiveX was designed with compatibility in mind—most existing ActiveX controls will not have to be rewritten to benefit from this feature; the only change will be repackaging. As in Internet Explorer 7, when a webpage attempts to install a control, an Information Bar is displayed to the user.

    For more information, please refer to:

    Non-Admin ActiveX Controls
    http://msdn.microsoft.com/en-us/library/dd433049(VS.85).aspx

    Thanks.


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Mervyn Zhang Tuesday, November 23, 2010 7:58 AM
    Tuesday, November 16, 2010 8:49 AM

All replies

  • This is domain agnostic... just edit the Group Policy from a Windows 7 computer.... You need to... 1. Turn on the ActiveX installer service 2. Specify the URL in the "Approved Installation Sites for ActiveX Controls" GPO under "Computer Configuration\Administrative Templates\Windows Components\ActiveX Installer Service\" Hope it helps
    Alan Burchill (MVP)
    http://www.grouppolicy.biz
    • Proposed as answer by Alan Burchill Thursday, November 11, 2010 4:18 AM
    Thursday, November 11, 2010 4:18 AM
  • Hi Alan.

    THanks for the reply.  We don't want to have to set this individually on all of the machines in the environment which it seems like your solution would require.  (I'm a project manager, not much experience with group policies).

    So is there a way to accomplish the same thing using group policy over the domain (Server 2003)?

    Thanks.

    Monday, November 15, 2010 5:39 PM
  • Hi,

    Running IE8 in Windows Vista or later system, a standard user may install ActiveX controls in their own user profile without requiring administrative privileges. This improvement makes it easier for an organization to realize the full benefit of User Account Control by enabling standard users to install ActiveX controls used in their day-to-day browsing.

    If a user happens to install a malicious ActiveX control, the overall system will be unaffected, as the control was installed only under the user’s account. Since installations can be restricted to a user profile, the risk and cost of compromise (and, in turn, the total cost of administering users on a machine) will be lowered significantly.

    Per-User ActiveX was designed with compatibility in mind—most existing ActiveX controls will not have to be rewritten to benefit from this feature; the only change will be repackaging. As in Internet Explorer 7, when a webpage attempts to install a control, an Information Bar is displayed to the user.

    For more information, please refer to:

    Non-Admin ActiveX Controls
    http://msdn.microsoft.com/en-us/library/dd433049(VS.85).aspx

    Thanks.


    This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by Mervyn Zhang Tuesday, November 23, 2010 7:58 AM
    Tuesday, November 16, 2010 8:49 AM