Share via

ActiveX GPO is configured to allow regular users install ActiveX Controls but fails with Access is denied when file access auditing is enabled

  • Article

Can't get Axis to work and very little clues as to why the activex is not installing? Perhaps, you are hitting this scenario.

Assume, you have configured the Axis GPO on your environment to manage Windows 7 client machines. These machines could be running IE8, IE9, IE10 or even IE11. You logon using the regular user account and open the internal web page, where is hosting the activeX control. You noticed that the activeX control is not loaded and failed to installed. When you review the  IE Temporary Files, there is a CodeDownloadErrorLog entry:

Error messages are generated in 'C:\Users\<<current_user>>\AppData\Local\Microsoft\Windows\Temporary Internet Files' as ?CodeDownloadErrorLog!name={<<class_id>>} files which contain the error: "Code Download Error: (hr = 80070005) Access is denied."

Process Monitor captures shows a few Access Denied messages but not cleared indication as to what is the problem.

You decided to then look at the Security Event log and find a few entries with attempts to access an object. Example:

 Log Name:      SecuritySource:        Microsoft-Windows-Security-AuditingDate:          4/28/2010 11:14:40 AMEvent ID:      4663Task Category: File SystemLevel:         InformationKeywords:      Audit SuccessUser:          N/AComputer:      COMPUTERNAMEDescription:An attempt was made to access an object.Subject: Security ID:  DOMAIN\acct Account Name:  acct Account Domain:  DOMAIN Logon ID:  0x644b9Object: Object Server: Security Object Type: File Object Name: C:\Windows\AxInstSV\AXS00001\cabfilename.cab Handle ID: 0x1a4Process Information: Process ID: 0xc24 Process Name: C:\Program Files (x86)\Internet Explorer\ieinstal.exeAccess Request Information: Accesses: READ_CONTROL     Access Mask: 0x20000

 

The scenario outlined in this blog, is known to occur when security auditing has been enabled for file system objects in the Windows directory.

To fix this issue, you should Remove the auditing entries from the Advanced Security Settings for the Windows directory.

 

RELATED BLOGS:

 

 This blog has been provided to you by The IE Support Team.