Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

To control which ActiveX components users are allowed to install, I was considering setting up a machine as an Object Store, and then setting up the Internet Search Path to divert requests for ActiveX installs from the web to the Object Store under my control.

I was wondering, do you know anybody who's set this up successfully, and is there any kind of guide on how to setup a machine as an Object Store?

Thanks.

Internet Search Path is described here:

http://msdn.microsoft.com/en-us/library/aa741211(v=vs.85).aspx#Internet_Search_Path

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The functionality goes back to 1996, but I've never seen an implementation of the "object store" part of the system by anybody. I'm not aware of Microsoft releasing a reference implementation, either.

It wouldn't be a tremendously hard thing to write. It just needs to receive POST requests and return a redirection to the "best" object URL (based on the requested MIME type, CLSID, and taking into account the language and MIME types the client says it's expecting).

I'm not sure I see the advantage to using this functionality, though. What are you looking for?

  • Addt'l integrity assurance? You should only be allowing signed controls to install anyway, so it's not like having your own repository is going to allow you some addt'l measure of integrity assurance.

  • Decreased bandwidth utilization by clients? Downloads of controls are done over HTTP, so a caching HTTP proxy would minimize the bandwidth used in code downloads as effectively as redirecting clients to a central object store.

Using a central object store doesn't really do anything with client user rights, which is what I see as the major problem associated with control installation.

Presumably your users don't have "Administrator" rights so they can't install arbitrary code (machine-wide) anyway. If you have "modern" versions of Windows you can use the ActiveX Installer Service to "whitelist" ActiveX component installs for non-Administrator user. You can do this w/o a central object store.

IE 8 does allow non-admin ActiveX control installations (installing to HKEY_CURRENT_USER instead of HKEY_CLASSES_ROOT) but the user will only be able to mess up their own environment with these installations (provided, of course, that they don't have "Administrator" rights). This functionality can be disabled by Group Policy, as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.