[gptalk] Re: Allowing standard users to install ActiveX controls

  • From: "Nelson, Jamie" <Jamie.Nelson@xxxxxxx>
  • To: <gptalk@xxxxxxxxxxxxx>
  • Date: Thu, 30 Oct 2008 10:10:57 -0500

John,

I've been in the same boat you are many times. From experience I've
found the best approach for these pesky ActiveX controls is to:

1) If they're needed by a large percentage of your users, copy/register
them with a GPO startup script for all your machines OR run the
script/install through a configuration management product like SMS/SCCM.

2) If they're only needed by random users, I would generally publish a
self-install package through SMS so users can add it themselves through
the Control Panel and SMS will run it as NT AUTHORITY\SYSTEM. However,
if you don't have SMS/SCCM you might to just push it out to everyone
regardless of whether they need it or not using option 1 above.

3) The last and neatest option (although the most expensive) is a
product by BeyondTrust called Privilege Manager which allows you very
granular control over ActiveX installation by non-administrators.

Regards,

Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com

-----Original Message-----
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of John Everyman
Sent: Thursday, October 30, 2008 2:19 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Allowing standard users to install ActiveX controls

Is there anyway via policy to allow standard users to install ActiveX
controls via IE7? As an admin, I browse to an internal site and get the
familiar yellow bar saying I need to install the control. As a standard
user, I just get a red X and do not get prompted to install anything.
Vista
has an ActiveX control service but we are using XPSP3.



***********************
You can unsubscribe from gptalk by sending email to
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR
by logging into the freelists.org Web interface. Archives for the list
are available at http://www.freelists.org/archives/gptalk/
************************
Confidentiality Warning: This message and any attachments are intended only for 
the use of the intended recipient(s), are confidential, and may be privileged. 
If you are not the intended recipient, you are hereby notified that any review, 
retransmission, conversion to hard copy, copying, circulation or other use of 
all or any portion of this message and any attachments is strictly prohibited. 
If you are not the intended recipient, please notify the sender immediately by 
return e-mail, and delete this message and any attachments from your system. 
***********************
You can unsubscribe from gptalk by sending email to 
gptalk-request@xxxxxxxxxxxxx with 'unsubscribe' in the Subject field OR by 
logging into the freelists.org Web interface. Archives for the list are 
available at http://www.freelists.org/archives/gptalk/
************************

Other related posts: