Make It Work

For publishing ActiveX Controls in the Active Directory to work, we need to set up a registry entry on our Windows 2000/XP machines that causes Internet Explorer to check the Active Directory for an installation package of the control.

The following value must be added to the registry on computers that are permitted to download the control:

HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseCoInstall

Please note that this can be any type of value and can contain any or no data.

Also, the ActiveX control must be packaged in a Windows Installer package (.msi file). And this package must be published to Active Directory. There is another article explaining this and includes a sample installation of Terminal Server ActiveX control.

So now when the user visits a webpage containing a Class ID (CLSID), this will make the installer mechanism install the published application and essentially changes it to an assigned application. Using this method you circumvent the permission issue related to installing ActiveX controls as a normal, permission restricted, user.

Download

The easiest way to set the UseCoInstall registry value is by using an administrative template:

CLASS MACHINE

    CATEGORY "Custom Administrative Templates"
        KEYNAME "Software\Microsoft\Windows\CurrentVersion\Internet Settings"

        POLICY "Publish ActiveX Controls in Windows"

            #if VERSION >= 3
            EXPLAIN !!MSKB241163
            #endif
            VALUENAME "UseCoInstall"
            VALUEON NUMERIC 1
            VALUEOFF DELETE

        END POLICY ; Publish ActiveX Controls in Windows

    END CATEGORY ; Custom Administrative Templates

[STRINGS]
MSKB241163 ="long description removed here"

You can download this template from the download repository.

Implement

After you’ve downloaded the administrative template, add it to your Active Directory policy, or create a new policy and link it to an OU which contains computers you wish to target with the UseCoInstall setting.

In the above example, I’ve created a new GPO named Publish ActiveX Controls and added the administrative template to the Computer Configuration. Because this policy is a tattooing policy, it will not be visible by default. So change the View settings and clear the Only show policy setting that can be fully managed checkbox.

After that, simply enable the Publish ActiveX controls in Windows setting, wait for Active Directory replication to occur and reboot the targeted workstations.

Troubleshooting

Verify if the UseCoInstall registry entry is added to the workstations' registry.

You should be able to see it in HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseCoInstall. If it's not there yet, verify the Active Directory location of your computer and make sure it's targetted by the policy. Also you can try to run the following command: "gpupdate /force" (sans quotes & for XP only) and reboot the workstation after the command completes.

Additional Information

For additional information, click the following article numbers to view the article in the Microsoft Knowledge Base:
241163 How to publish ActiveX controls in Windows 2000 using IntelliMirror
280579 How to install ActiveX controls in Internet Explorer using the Active Directory

Important information for Internet Explorer 7:

935544 FIX: Windows Internet Explorer 7 may crash when you use it to visit a Web site (Note: Calling Microsoft support services to request a hotfix is free of charge)

Let me know how it worked out for you and add a comment!