Vista to allow ActiveX installation

Microsoft is to give Windows Vista an option for users to install ActiveX controls without the need for administrator approval, the company has revealed.

The move is in response to beta tests, which found that administrators had a hard time keeping up with updates to ActiveX controls, Microsoft said.

User Account Control (UAC), a feature to be introduced in Vista, places strict limits on standard users, including barring them from installing ActiveX controls without authorization from an administrator.

The feature's constant prompts for authentication have been heavily criticized by industry observers.

Chris Corio, a UAC program manager, said specifically that companies involved in the Technical Adoption Program (TAP) testing Vista had problems with numerous ActiveX controls used in day-to-day business.

Because users couldn't install the control updates themselves, administrators were being overloaded, he said.

"These ActiveX controls were being updated regularly, and the corporations couldn't package and deploy them to their users quickly enough," Corio said in a document describing the upcoming feature, on Microsoft's MSDN developer Web site.

The solution Microsoft is proposing is called the ActiveX Installer Service, consisting of a Windows service, a Group Policy administrative template, and a few changes in IE, according to Corio. The aim is to allow administrators to define group policies establishing URLs from which standard users can install ActiveX controls.

The feature will be an optional component with the Ultimate, Business and Enterprise versions of Vista, Microsoft said, and will only be enabled on clients where it is installed.

If the feature is enabled, and IE encounters a needed ActiveX control or update, the browser asks the service to carry out installation. The service checks to see if the control's host URL is defined, allowed and listed in group policy.

If it is, the service creates an installer object. If group policy doesn't specify that the control is allowed, Vista reverts to its default behavior, which is to ask for authentication, according to Corio.

So far, the service works with controls packaged as .cab, .dll or .ocx files, but Microsoft plans to enable MSI (Microsoft Installation) packages as well.

Microsoft demonstrated the service at last week's TechEd developer conference, and Ben Fathi demonstrated it as part of his security keynote there, the company said.

The feature will be included in Vista's the next public release, Release Candidate 1, according to Microsoft.

Not all administrators are thrilled with the idea of allowing constant updates of ActiveX controls. One administrator, writing on a MSDN discussion board, said developers shouldn't feel free to release buggy software and then release often disruptive fixes on a regular basis.

"Isn't this just a new excuse for the designers of said ActiveX controls to keep on releasing patches without thought of testing them before the fact?" he wrote. "The last thing I want to learn is that someone's falsified WebEx's certificate and is pushing malware under my nose. Or that WebEx released an update with a bug that results in privilege escalation."

Another admin commented that the feature is probably "a necessary evil."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Matthew Broersma
Show Comments


James Cook University - Master of Data Science Online Course

Learn more >


Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >

Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?