Group Policy control of ActiveX installation RRS feed

  • Question

  • Our users are on Windows 8.1 and IE 11.

    We use SQL reporting services at our company. Our users run reports from the Report Manager, which uses an ActiveX control to enable printing. 

    I need to allow our normal users to install this ActiveX control. Looking at this page I added the CLSID of the control to a GPO under Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management. I linked this GPO to an OU. 

    Even after making sure the policy was applied to the the computer, this ActiveX control still required popped a UAC dialog to allow the installation of this control. 

    What do I need to do to make this work?

    Wednesday, October 29, 2014 5:12 PM


  • Hi,

    Please follow these steps:

    Step 1: Convert ActiveX exe or cab file to MSI package


    Install visual studio installer to create .msi package of ActiveX Control

     Downloaded free Visual Studio installer from

    But this requires Visual Studio 6.0 to be installed

    Step 2: Place the package in network share where all the users have access

    Step 3: Create an organizational unit (OU) in active directory

    Step 4: Add a group policy object (GPO) to the OU

    Step 5: Publish the package using this GPO


    1. Open Group Policy editor and go under User Configuration > Software Settings ->"Software Installation"

    2. Right-click, select new > package, and browse to the package (make sure it's on a network location that all of his users will be able to access, because this is going to become the distribution point)

    3. Once you choose a package, choose "Advanced" from the options list

    4. On the Deployment tab, select "Assigned", click the "Advanced" button at the bottom, and make sure that "Include OLE class and product information" is checked, and that "Make this 32bit x86 application available to Win64 machines" Also, on the "Deployment" tab, make sure that "Install this application at logon" is checked.

    After that, please be assured that we need to run gpupdate /force command on the client machines after applying the group policy on the server side.

    Now log in to client machine using the user login created in the OU to check if it can work properly.

    For more information, please refer to this article:

    How To Install ActiveX Controls in Internet Explorer Using the Active Directory

    Karen Hu
    TechNet Community Support

    Thursday, October 30, 2014 8:21 AM