The ActiveX Installer Service

Vista:: ActiveX installer service

[MSFT-BE] Arlindo's Blog - IT Pro Evangelist — Thu, 15 Jun 2006 01:15:28 GMT

Spotted this on the UAC blog:The ActiveX Installer Service

As many IT Pro's know the ActiveX...

Encouraging more bad design?

Gordon Fecyk — Thu, 15 Jun 2006 04:42:37 GMT

EEK! Isn't this just a new excuse for the designers of said ActiveX controls to keep on releasing patches without thought of testing them before the fact?

I have to deal with WebEx Communications multiple times a month because they keep updating one of their controls and conferences stop working when they deploy an update.

I hope there's a way to disable these new installation capabilities for limited users. The last thing I want to learn is that someone's falsified WebEx's certificate and is pushing malware under my nose. Or that WebEx released an update with a bug that results in privilege escalation.

I'd rather install tested and working code, and not have to worry about updating every single little control every single day because developers don't bother testing them before they release them.

Dee’s-Planet! » ActiveX Control Installer Service

Dee’s-Planet! » ActiveX Control Installer Service — Thu, 15 Jun 2006 15:39:26 GMT

PingBack from http://www.roks.xmgfree.com/blog/2006/06/15/activex-control-installer-service/

re: The ActiveX Installer Service

Bill D. — Thu, 15 Jun 2006 16:28:03 GMT

Control is disabled and manged via Group Policy so I would think you could manage the installer capability by on a user/OU/domain level.

Code developed internally is subject to internal controls and QA procedures, therefore IT has input into the release freqency and can directly affect code integrity. This service is a neccassary evil, in my opinion, because there are many vendors that release new controls on a frequent basis of which the IT admins have no control. This service will potentially save IT depts. where it counts; their budgets.

-Bill

Still encouraging more bad design

Gordon Fecyk — Fri, 16 Jun 2006 10:37:53 GMT

"there are many vendors that release new controls on a frequent basis of which the IT admins have no control."

No control? I've had full control over this since 2003 when my first major client decided to upgrade to Win2K. The only reason other IT admins don't have control is they don't bother to sieze it.

The only really frequent updater I've really encountered after 11 years of IT experience is WebEx Communications. Of the others, for example Macromedia, content and services are tolerant of varying versions of said controls. Every new release represents untrusted, unknown, untested code to the eyes of the IT admin, who gets blamed when the new version of "x" doesn't work exactly the same as the old version.

My solution to WebEx and other frequently updated controls is to stop using them. Callinfo and Gotomeeting come to mind as replacements. Nothing works like healthy competition to encourage better design.

ActiveX Installer サービス - Windows Installer

社本＠ワック Blog — Sat, 17 Jun 2006 00:56:53 GMT

ActiveX Installer サービス - Windows Installer

社本＠ワック Blog — Sat, 17 Jun 2006 00:57:33 GMT

ActiveX Installer サービス - Windows Installer

re: The ActiveX Installer Service

David Hopwood — Sat, 17 Jun 2006 05:38:52 GMT

Is the control only installed for the current user? It's a bad idea to allow standard users to install a control for the whole machine, even if it is supposedly from a "trusted" codebase. (Conversely, if the control is only being installed for the current user, I don't see the need for this feature.)

# Before installing the ActiveX control, the
# Installer service will check to see if the
# Host URL of the CODEBASE is defined and
# listed in Group Policy and if it is allowed.

Since when was the codebase URL a secure way to determine which controls are allowed (if it is not https)?

re: The ActiveX Installer Service

Eugene K — Tue, 20 Jun 2006 22:13:45 GMT

So if the system has malicious DNS set up, the *safe* URLs can be resolved to any malware site?

re: The ActiveX Installer Service

Aaron Margosis — Wed, 21 Jun 2006 19:05:19 GMT

Gordon Fecyk: Take a look at LiveMeeting. It *used* to use an ActiveX control, and it drove me nuts because I could never use it without MakeMeAdmin. They switched to a better model, and it works great now for the non-admin, after the LiveMeeting client has been installed. Installation of the LM client requires admin, but all further use works great for the non-admin.

Reply to Aaron re LiveMeeting

Gordon Fecyk — Thu, 22 Jun 2006 04:51:52 GMT

Thanks for the heads-up. Additional alternatives to WebEx are gladly welcome!

Being an ActiveX control isn't really a design problem if it works with Limited accounts. So I update Flash Player and a bunch of other controls before rolling out a new disk image for a client, no problem. Being an ActiveX control that frequently changes, on the other hand, makes me pull my hair out.

Including an installation service for lazy developers who don't test their controls just encourages more bad design.

Even if WebEx provided a working Windows Installer package I could deploy through Group Policy, that's better than logging on manually to 50+ PCs.

run ActiveX as admin under UAC

leesoft — Fri, 25 Aug 2006 00:02:49 GMT

Hi,
I was trying to perform some task requiring administrator right in my activeX control (launching from IE7), for example, communicate with a local NT service by memeory mapping file, execute a shell command, and so on. But the control will not work under UAC unless I launch IE7 using "Run as an administrator".
I searched arround and found that there should be a way to do so via CoCreateAsAdmin(), could you provide me more detail on that.

Thanks very much.

re: The ActiveX Installer Service

Gabriel Lozano-Morán — Thu, 31 Aug 2006 00:21:46 GMT

It seems like in the latest builds of Windows Vista it is possible to install the ActiveX Installer Service but configuring the administrative template in the Group Policy Object editor does nothing. Is Internet Explorer 7+ the problem? I mean does it need a newer build of IE to work?

re: The ActiveX Installer Service

windowsvistasecurity — Thu, 31 Aug 2006 01:24:06 GMT

1) You need to be a standard user (not admin) for it to work
2) confirm that the activex installer service is running

Cant upload pictures on msn

tish — Mon, 04 Sep 2006 06:37:00 GMT

I went to add pictures to my msn community and a pop up came up that said the following..

"Internet Explorer has blocked this site from using an ActiveX control in an unsafe manner. As a result this page may not display correctly.

How do I fix this problem so I can put my pictures in my album???

UAC Improvements in Release Candidate 1 (RC1) and Video

UACBlog — Wed, 06 Sep 2006 02:14:00 GMT

We’d like to thank all of the Windows Vista beta testers for using and giving us feedback on User Account...

UAC Improvements in Release Candidate 1 (RC1) and Video

UACBlog — Thu, 07 Sep 2006 17:27:38 GMT

We’d like to thank all of the Windows Vista beta testers for using and giving us feedback on User Account...

re: The ActiveX Installer Service

skyler — Fri, 08 Sep 2006 06:04:06 GMT

i cant load on my cpu and i'm upset

ActiveX Installer Service Discussion and Video

UACBlog — Wed, 13 Sep 2006 19:30:07 GMT

This is Joel Yoker, Senior Consultant, and Rob Campbell, Technical Solutions Specialist, from the Microsoft...

Internet Explorer 7: More than a browser

David Boschmans Weblog — Sat, 30 Sep 2006 15:18:42 GMT

Yesterday&nbsp;we had Cyra Richardson - Lead Program Manager on the Internet Explorer team&nbsp;- in...

How to Install ActiveX without IE7 ?

Honjo — Fri, 20 Oct 2006 03:17:10 GMT

We want to install our ActiveX without IE7 and UAC dialog on Vista basic.

re: The ActiveX Installer Service

osexp2000 — Tue, 14 Nov 2006 22:11:19 GMT

Hi, I have been experienced LUA for a long time since win2K. Of course the ActiveX in IE is a big problem. ActiveX Installer is good, thank you very much, but:

1. Why not provide a option to "install the ActiveX use non-Admin just for current user( by File/Reg virtualization)" ? I think many users need it.

Theorotically, we do not need install flash.ocx by Admin. And after UAC, downloading is taken in admin context, this is not a good choice.

2. Another option I want is that "just download activeX.cab, check signature, prompt Save or Install or Cancel?"

re: The ActiveX Installer Service

Abuwi Shakur — Wed, 06 Dec 2006 03:18:01 GMT

I am trying to activate or install ActiveX. I need activex to install symantec for additional security on my computer.

re: The ActiveX Installer Service

DIANE DANIELS — Wed, 10 Jan 2007 12:56:43 GMT

WHAT DOES THE ACTIVE-X INSTALLER HAVE TO DO WITH SETTING UP A WEB CAM?

Install Instructions » Blog Archive » … LiveMath Plug-In Installation. Authors - Update your

Fri, 19 Jan 2007 18:40:11 GMT

PingBack from http://www.elka-install-instructions.info/blog/39/livemath-plug-in-installation-authors-update-your/