Restricted users, possible to have open ActiveX?

At a site we have all the users created with the standard mobile user
template. This works fine and dandy in that it keeps them from doing Very
Bad Things (tm).

However, one of the corporate sites uses various ActiveX controls. Normally
this means I have to login to the workstation, go to the site, download the
controls and then they can use them.

The corporation does not make these ActiveX controls available for download
other than through loading the site itself.

Please tell me there is a better way.

Thank you.

Rosewood <rosewood@nospam.gmx.nospam.de> wrote:
> At a site we have all the users created with the standard mobile user
> template. This works fine and dandy in that it keeps them from doing
> Very Bad Things (tm).
>
> However, one of the corporate sites uses various ActiveX controls.
> Normally this means I have to login to the workstation, go to the
> site, download the controls and then they can use them.
>
> The corporation does not make these ActiveX controls available for
> download other than through loading the site itself.
>
> Please tell me there is a better way.
>
> Thank you.

ActiveX itself isn't the issue - a local end user may indeed be able to run
an ActiveX control. It's what the control *does* that may be the issue - if
it's installing software that an end user doesn't have permission to
install, that clearly won't work. Make this particular install part of your
standard workstation build & then it shouldn't be a problem, I'd think....

Ok, I don't think I explained the situation fully then.

These ActiveX controls are for the corporate site and there is no way for me
to get them other than to visit the site in IE. They don't make them
available in any other fashion. Unless I run IE as an administrator, I'm
not even prompted to download these controls. If I am an administrator,
they are downloaded and installed to C:\Windows\Downloaded Program files.
Then everything is great. Someone using a normal user account can make use
of those controls. If the control is updated, again I have to login as an
administrator and go to the site and let it get updated. Then back to
normal.

Is there a user level that would allow someone to install things like these
ActiveX controls (Flash is a more mainstream example but the exact same
thing. If I go to the adobe Flash installer site, I don't even get the
yellow bar since I can't install it as a regular user). Or is there a way
for me to redistribute these things w/o getting an installer from them since
I never will.

Fake edit: While I was trying to figure this out I tried adding a user to
the Power Users group. Now I was able to install the ActiveX control no
problem... but now I can install whatever else I want too which is what I
want to avoid here. If I can't avoid that, what protection do I get from
having them as a Power User vs a full Administrator ?

Thanks

"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:%23m$mSccYIHA.4196@TK2MSFTNGP04.phx.gbl...
> Rosewood <rosewood@nospam.gmx.nospam.de> wrote:
>> At a site we have all the users created with the standard mobile user
>> template. This works fine and dandy in that it keeps them from doing
>> Very Bad Things (tm).
>>
>> However, one of the corporate sites uses various ActiveX controls.
>> Normally this means I have to login to the workstation, go to the
>> site, download the controls and then they can use them.
>>
>> The corporation does not make these ActiveX controls available for
>> download other than through loading the site itself.
>>
>> Please tell me there is a better way.
>>
>> Thank you.
>
> ActiveX itself isn't the issue - a local end user may indeed be able to
> run an ActiveX control. It's what the control *does* that may be the
> issue - if it's installing software that an end user doesn't have
> permission to install, that clearly won't work. Make this particular
> install part of your standard workstation build & then it shouldn't be a
> problem, I'd think....
>

Rosewood <rosewood@nospam.gmx.nospam.de> wrote:
> Ok, I don't think I explained the situation fully then.
>
> These ActiveX controls are for the corporate site and there is no way
> for me to get them other than to visit the site in IE. They don't
> make them available in any other fashion. Unless I run IE as an
> administrator, I'm not even prompted to download these controls. If
> I am an administrator, they are downloaded and installed to
> C:\Windows\Downloaded Program files. Then everything is great. Someone
> using a normal user account can make use of those controls. If the control
> is updated, again I have to login as an administrator
> and go to the site and let it get updated. Then back to normal.
>
> Is there a user level that would allow someone to install things like
> these ActiveX controls (Flash is a more mainstream example but the
> exact same thing. If I go to the adobe Flash installer site, I don't
> even get the yellow bar since I can't install it as a regular user). Or is
> there a way for me to redistribute these things w/o getting an
> installer from them since I never will.
>
> Fake edit: While I was trying to figure this out I tried adding a
> user to the Power Users group. Now I was able to install the ActiveX
> control no problem... but now I can install whatever else I want too
> which is what I want to avoid here. If I can't avoid that, what
> protection do I get from having them as a Power User vs a full
> Administrator ?
> Thanks

I understood you before - and again, ActiveX in general isn't a specific
*thing*. End users can install some ActiveX controls perfectly well.
However, they can't do so if the control is doing something such as
installing software, which an end user cannot do (oh, and since a Power User
is pretty much a full Administrator, I wouldn't bother with it). I don't see
a way around your problem offhand unless you can get an MSI file from your
company & use software installation policies, sorry. You might post in a
group policy group for more expert help.


>
> "Lanwench [MVP - Exchange]"
> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
> message news:%23m$mSccYIHA.4196@TK2MSFTNGP04.phx.gbl...
>> Rosewood <rosewood@nospam.gmx.nospam.de> wrote:
>>> At a site we have all the users created with the standard mobile
>>> user template. This works fine and dandy in that it keeps them
>>> from doing Very Bad Things (tm).
>>>
>>> However, one of the corporate sites uses various ActiveX controls.
>>> Normally this means I have to login to the workstation, go to the
>>> site, download the controls and then they can use them.
>>>
>>> The corporation does not make these ActiveX controls available for
>>> download other than through loading the site itself.
>>>
>>> Please tell me there is a better way.
>>>
>>> Thank you.
>>
>> ActiveX itself isn't the issue - a local end user may indeed be
>> able to run an ActiveX control. It's what the control *does* that
>> may be the issue - if it's installing software that an end user
>> doesn't have permission to install, that clearly won't work. Make
>> this particular install part of your standard workstation build &
>> then it shouldn't be a problem, I'd think....

Thanks. I think we will see pigs flying before they do something like that
:)

"Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:%23rNpcfiYIHA.2000@TK2MSFTNGP05.phx.gbl...
> Rosewood <rosewood@nospam.gmx.nospam.de> wrote:
>> Ok, I don't think I explained the situation fully then.
>>
>> These ActiveX controls are for the corporate site and there is no way
>> for me to get them other than to visit the site in IE. They don't
>> make them available in any other fashion. Unless I run IE as an
>> administrator, I'm not even prompted to download these controls. If
>> I am an administrator, they are downloaded and installed to
>> C:\Windows\Downloaded Program files. Then everything is great. Someone
>> using a normal user account can make use of those controls. If the
>> control is updated, again I have to login as an administrator
>> and go to the site and let it get updated. Then back to normal.
>>
>> Is there a user level that would allow someone to install things like
>> these ActiveX controls (Flash is a more mainstream example but the
>> exact same thing. If I go to the adobe Flash installer site, I don't
>> even get the yellow bar since I can't install it as a regular user). Or
>> is there a way for me to redistribute these things w/o getting an
>> installer from them since I never will.
>>
>> Fake edit: While I was trying to figure this out I tried adding a
>> user to the Power Users group. Now I was able to install the ActiveX
>> control no problem... but now I can install whatever else I want too
>> which is what I want to avoid here. If I can't avoid that, what
>> protection do I get from having them as a Power User vs a full
>> Administrator ?
>> Thanks
>
> I understood you before - and again, ActiveX in general isn't a specific
> *thing*. End users can install some ActiveX controls perfectly well.
> However, they can't do so if the control is doing something such as
> installing software, which an end user cannot do (oh, and since a Power
> User is pretty much a full Administrator, I wouldn't bother with it). I
> don't see a way around your problem offhand unless you can get an MSI file
> from your company & use software installation policies, sorry. You might
> post in a group policy group for more expert help.
>
>
>>
>> "Lanwench [MVP - Exchange]"
>> <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in
>> message news:%23m$mSccYIHA.4196@TK2MSFTNGP04.phx.gbl...
>>> Rosewood <rosewood@nospam.gmx.nospam.de> wrote:
>>>> At a site we have all the users created with the standard mobile
>>>> user template. This works fine and dandy in that it keeps them
>>>> from doing Very Bad Things (tm).
>>>>
>>>> However, one of the corporate sites uses various ActiveX controls.
>>>> Normally this means I have to login to the workstation, go to the
>>>> site, download the controls and then they can use them.
>>>>
>>>> The corporation does not make these ActiveX controls available for
>>>> download other than through loading the site itself.
>>>>
>>>> Please tell me there is a better way.
>>>>
>>>> Thank you.
>>>
>>> ActiveX itself isn't the issue - a local end user may indeed be
>>> able to run an ActiveX control. It's what the control *does* that
>>> may be the issue - if it's installing software that an end user
>>> doesn't have permission to install, that clearly won't work. Make
>>> this particular install part of your standard workstation build &
>>> then it shouldn't be a problem, I'd think....
>
>
>