Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to make use of the Windows ActiveX Installer Service Group Policy to allow users to install the WebEx client without the need for security elevation from an administrator. I realize that I could add the entire domain to the Trusted Site zone in IE and this would allow them to do so, but I don't want to necessarily lock down all of their IE zones (which that policy would effectively do). The Windows ActiveX Installer Service group policy, specifically Approved Installation Sites for ActiveX Controls requires that I specify the exact URL that the control will be downloaded from, as well as the specific version number. They don't allow wildcards in this particular piece of policy unfortunately. I love the granular control, but the problem is I can't find any documentation from WebEx as to what URL this control will be made available in the future. I realize I could use Fiddler to figure out where I download the control from initially, but who knows if it will come from the exact same location in the future. The control in question is ieatgpc.dll and the current version is Does anyone know how I can go about making this work?

share|improve this question
up vote 1 down vote accepted

The administrative template for tweaking the IE zones isn't the only way to do what you want. When the policy is not enforced, those settings are stored in the registry within HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains.

My suggestion would be to add whatever settings are necessary on a test machine, export the associated registry keys, and then apply them using Group Policy Preferences. It gives you the best of both worlds. Users have the site trusted by default, but they're still free to tweak the settings.

Technically, I think you could also use the built-in "Internet Settings" portion of GPP as well. But it's a little heavy handed for my taste (and has broken things for me in the past unrelated to the settings I was trying to apply).

share|improve this answer
I'll take a look at the GPP options. I'm a little bummed out I can't use the specific ActiveX Control policy, but not entirely surprised. Thanks. – pk. Apr 29 '11 at 13:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.