Large Scale Deployment of Active X controls

Active X controls cause us loads of pain in large scale deployment scenarios. The primary reason is that it we cannot lock down the enterprise PC's and still have users activate the Active X controls in their browsers, even if the Active X component is signed.

We can easily make a site a "trusted site" (group policy), but this does not ensure that users have the access they need to make the registry entries in HKLM or put files in C:\WINDOWS\DOWNLOADED PROGRAM FILES. We could try to hack this by opening write access to HKLM/Classes and to the downloaded program files folder, but this is not good.

Is there a reliable way of doing this? A way where I can perhaps sign the controls I approve and have active directory install it in system context on all domain computers? This must be a problem that several corporations are dealing with.

Hi Glytzhkof,

I've never really addressed the problem, but these controls don't seem much different to any other Active-X. They look different through the explorer, but you can see them clearly using a DIR command from a CMD window.

If you have the ".inf" file and the ".cab" file(s), surely you can just install it like any other piece of software? The ".inf" file is in the "Download Program Files" folder, and you can see the location of the ".cab" from the "codebase" entry under the control's properties. You can see what happens when one is installed using the Setupapi.log file under windows.

"C:\WINDOWS\System32\rundll32.exe" setupapi,InstallHinfSection DefaultInstall 132 XYZ.INF

Besides, you can see from the ".inf" file which files go where, and which need to be registered, etc.

Am I missing something?

Glytzhkof

mandy