Mar 13, 2006

Posted by in Tech Tips | 1 Comment

Trusted ActiveX controls – Auto install

So the problem for today is trying to get an ActiveX control to automaticaly install itself onto the computer so that the user can run the website perfectly each and every time.

From reading arround the net it seems there are 3 things you need to do

  1. create an MSI installer for your control
  2. Publish the control to AD
  3. Make the local computer check AD for allowed controls

Below are 3 articles that help expand these steps.

Article 1:

The following article deals with the problem of creating an MSI install from a CAB file (as most ActiveX packages are dowloaded and run from by Internet Explorer)

How To Install ActiveX Controls in Internet Explorer Using the Active Directory – http://support.microsoft.com/kb/q280579/

Things to note about the article:

Visual Studio Installer 1.1 requires Visual Studio 6 to be installed on the machine which could be somewhat of a problem these days.

After you have created your MSI file it might look like the OCX has not been correctly installed to windows\downloaded program files\. Don’t take Windows word for it check in DOS chances are its there just the Downloaded Program Files folder doesn’t behave like a normal folder when viewed.

Article 2:

This one deals with how to allow Internet explorer to automaticaly download and install trusted controls from Active Directory.

How to Publish ActiveX Controls in Windows 2000 Using IntelliMirror – http://support.microsoft.com/kb/241163/

Now this is the part I haven’t got working yet. I have the application published in Active Directory but seem unable to make Internet Explorer do a lookup for the controls its allowed. Now its possible that I was just having issues due to the propagation of group policies etc.. so only time will tell in the morning I guess.

Another possbile problem is this only referes to Windows 2000 and says nothing about XP let alone XP SP2 which really tightens the security policies regarding ActiveX

Article 3:

The following really just makes the solution that much more elegant by allowing you to force the correct reg key onto the computers via group policy rather than having to script it.

http://www.mcse.ms/archive47-2004-1-253694.html

Quoted below incase the link disapears:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
CLASS MACHINE
 CATEGORY !!RegistrySettings
 KEYNAME “Software\Microsoft\Windows\CurrentVersion\Internet  Settings”
 POLICY !!EnableActiveX
 EXPLAIN !!EnableActiveX_Explain
 VALUENAME “UseCoInstall”
 VALUEON NUMERIC 1
 VALUEOFF NUMERIC 0
 END POLICY
 END CATEGORY
 
 [strings]
 EnableActiveX=“Enable Admin Approved ActiveX Installation via AD”
 EnableActiveX_Explain=“Allows users to download Admin approved ActiveX controls from Active Directory.”
 RegistrySettings=“Registry Settings”

Things to note with the Group Policy Editor – because this isn’t stricktly a ‘Policy’ it is classed as a ‘Preference’ and so doesn’t show up in the GPE unless you specificaly tell it to (click on the Administrative templates – view – filtering… – Only show configured policies). Apparently the difference between a Policy and a Preference is when the GP is removed the preference stays set where as the policy is removed.

UPDATE (20/03/06):
For now I have settled for publishing the ActiveX MSI installer in AD where the users can install it as required.

  1. Tiago Sumita says:

    Great article, thanks

Leave a Reply

Your email address will not be published. Required fields are marked *