Conditions

The following conditions must be met for this to work successfully:

• The control must be packaged in a Microsoft Installer package (.msi file).
• The Microsoft Installer package must be published to Active Directory.
• The following value must be added to the registry on computers that are permitted to download the control: 

HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseCoInstall

Please note that this can be any type of value and can contain any or no data.

Terminal Services Client 6.0 (KB925876)

In this scenario we will use the ActiveX component from Terminal Services Client 6.0 that includes the ActiveX components we need for install on demand when a user visits a web page. The web page in this case will be the Remote Desktop Web Connection (TSWEB) which is included with Windows 2003 R2 or can be downloaded for earlier versions.

Windows Installer Wrapper+

The Terminal Services Client 6.0 is a hotfix, this means we cannot repackage it into a Microsoft Installer package (.msi file). Instead of repackaging, we can create a wrapper+ for the hotfix. All the wrapper does is execute the hotfix. The + part is what makes the difference from a "normal" wrapper. This wrapper will also contains COM Class ID (CLSID) information and Program ID (ProgID) information. The CLSID information is essential in making the install on-demand work.

Before We Begin

First we need to set the UseCoInstall registry entry mentioned earlier on all target computers. You can do this by using an administrative template. An article on how to do this can be found here. If you're already familiar with administrative templates, just grab it from the downloads section.

Next you need the Windows Installer wrapper named WindowsXP-KB925876-x86.msi. It can be found in the downloads section.

Finally we need the Terminal Services Client 6.0 itself. This can be obtained from Microsoft here. The Terminal Services Client 6.0 comes in the following format: WindowsXP-KB925876-x86-XYZ.exe. Where XYZ is the language.

Important: Rename the file to WindowsXP-KB925876-x86.exe (without the anguage specific part).

Save the Windows Installer file (WindowsXP-KB925876-x86.msi) and the Terminal Services Client file (WindowsXP-KB925876-x86.exe) on a network share or DFS share. Make sure it's accessible for your users.

Publish the ActiveX Warapper+

Now we can publish the wrapper+ ActiveX in the Active Directory. Create a group policy object (or use an existing one) and make sure the policy will apply on your users.

Navigate to the share you saved the .msi file and the .exe file and open the WindowsXP-KB925876-x86.msi.

Make sure you select the Advanced Deploy Software option.

Click the Deployment tab and...

Make sure that the Deployment type is set to Published. Important: Click the Advanced button and make sure to check the Include OLE class and product information checkbox.

Note: The wrapper+ was created for English operating systems. If you're deploying another language than english, it might be useful to check the Ignore language when deploying this package checkbox.

And we're finished publishing the ActiveX control in the Active Directory. Now all you have to do is reboot the workstation so the UseCoInstall registry entry is applied. Then log on as a restricted user and navigate to your terminal server web (TSWEB). As soon as the ActiveX code is encountered on the page, the computer will look if the same CLSID is published in the Active Directory and begin to install the Windows Installer file containing the ActiveX control.

Troubleshooting

When you've published the control, it should be visible for the user in Add/Remove Programs.

Select the Add New Programs button for a list of all published applications.

The WindowsXP-KB925876-x86.msi file has the ARPSYSTEMCOMPONENT property set. Meaning the msi will not show up in the Add/Remove Programs list. The hotfix itself however does show up in the programs list if you click the Show Updates checkbox.

Above is an example on how the ActiveDirectory published control stores the CLSID information. If you've not checked Include OLE class and product information checkbox, the CLSID information will not be available in the Active Directory and Windows Installer will not install the ActiveX control.

If you're running Internet Explorer 7, your browser may suddenly quit when you navigate to a page containing a ActiveX control. This is due to a bug in IE7. Call Microsoft Product Support and ask for hotfix 935544. It's free of charge.

More information

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
241163 How to Publish ActiveX Controls in Windows 2000 Using IntelliMirror
280579 How To Install ActiveX Controls in Internet Explorer Using the Active Directory
894571 When you try to install an ActiveX control by using Active Directory in Windows XP or in Windows Server 2003, the operation is not successful
925876 A Remote Desktop Connection 6.0 client update is available
935544 FIX: Windows Internet Explorer 7 may crash when you use it to visit a Web site

Let me know how it worked out for you and add a comment!