none
Turn on ActiveX control logging in IE RRS feed

  • Question

  • I have enabled the GPO policy "Turn on ActiveX control logging in IE" on IE11 and Windows 7 x64 using GPEDIT locally for testing purposes.  But I cannot get an actual log file from the policy.  My goal is to enable this so we can create an inventory of ActiveX and then whitelist what is needed and block everything else.  Has anyone used this GPO setting to successfully get a log file?

    https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking

    Tuesday, May 2, 2017 9:25 PM

All replies

  • Hi,

    where are you looking for the VersionAuditLog.csv file on the computer that you have enabled logging on?

    %LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv

    Have you run the powershell scripts and instructions in the 'Before you begin' section of the instructions web page.

    Before you begin

    Before you can use WMI to inventory your ActiveX controls, you need to download the configuration package (.zip file), which includes:+

      • ConfigureWMILogging.ps1. A Windows PowerShell script.

      • ActiveXWMILogging.mof. A managed object file.

      +

    Before running the PowerShell script, you must copy both the .ps1 and .mof file to the same directory location, on the client computer....... ETC.....

    Make sure also

    1. Tools>ActiveX filitering is turned off... (should not matter for intranet sites).

    2. Use the Addons Manager

    a. The ActiveX control your testing(Java JRT, Flash for is installed and enabled.

    b. Double click the item in the Addons Manager listing to display its properties page which will show you the version number, vendor and a list of allowed sites. For testing purposes you should clear the allowed sites list.

    You may like to use a testpage which contains some <object> and <applet> tags to confirm that logging has been deployed properly.

    Regards.


    Rob^_^

    Tuesday, May 2, 2017 11:19 PM
  • No, I am not trying to use WMI to create an inventory (cannot do this if I wanted since we don't speak Windows 10).  I am just trying to use the GPO setting that I believe should create the file on every client, beginning with a test local policy first as I always do.

    File Location:  %LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode\VersionAuditLog.csv -- I have also scoured the hard drive looking for the file.

    Wednesday, May 3, 2017 4:05 PM
  • I just enabled the same control under the User Configuration and the AuditMode folder was created and the VersionAuditLog.csv was created as soon as I fired up an ActiveX control.  Not sure why setting the control under the Computer Configuration did not work as it should have worked and take precedence to any user control.
    Wednesday, May 3, 2017 4:19 PM
  • Hi Eddie78701,

    Have you tried to run "gpupdate /force" to update the gpo or restart the machine to make it take effect when we configured the gpo in Computer Configuration?

    Best regards

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, May 4, 2017 6:09 AM
    Moderator