ActiveX Installer Service in Windows 7 Technical Reference

Applies To: Windows 7

This technical reference provides IT professionals with detailed information about the ActiveX Installer Service.

Many users install ActiveX controls on their computers to ensure that programs that they use on a daily basis work properly. However, most ActiveX controls must be installed by a member of the Administrators group and many organizations have configured or want to configure their users to run as standard users, which are non-administrative users that are members of the Users group. As a result, organizations have to repackage and deploy the ActiveX controls to the users. In addition, many of these ActiveX controls must be regularly updated. Many organizations find this to be a difficult and costly process to manage for standard users.

What is the ActiveX Installer Service?

The ActiveX Installer Service is a standard service that is enabled by default on Windows 7. The ActiveX Installer Service helps IT professionals deploy ActiveX controls by using Group Policy. ActiveX controls are self-registering COM objects that are used to provide a more interactive user experience when using Internet Explorer. ActiveX controls are often distributed in .cab files. By default, standard user accounts do not have permission to install ActiveX controls.

With ActiveX Installer Service, you can use Group Policy to configure the Trusted sites zone to identify Web sites or define a list of explicitly approved host URLs that can install ActiveX controls on computers in your organization.

With Windows 7, the ActiveX Installer Service is also used when a user is logged in as a member of the Administrators group. This helps ensure that all users are aware of requests to install ActiveX controls when they visit a Web site that is not part of the Trusted sites zone.

How the ActiveX Installer Service works

When you use your Web browser to visit a site that requires installation of an ActiveX control, the ActiveX Installer Service checks the local Group Policy settings to determine whether the URL requesting the ActiveX control installation is approved either by an explicit policy setting or as a member of a domain identified as a trusted site. If the installation of ActiveX controls from the specified URL is approved, the service installs the ActiveX control for the user, and the user does not have to provide administrator credentials or administrative approval. If the URL is not approved, the default Windows 7 ActiveX control setting is used and the user is required to provide administrator credentials or administrative approval.

The ActiveX Installer Service only installs ActiveX controls with a .cab, .dll, or .ocx file name extension.

Auditing the ActiveX Installer Service

The ActiveX Installer Service records analytic and debug events in the Applications and Services event log.

Analytic and debug events are not displayed by Event Viewer by default. To review these events in Event Viewer, from the View menu, click Show Analytic and Debug Log, and then in the Action pane, click Refresh. The AxInstallService is listed in the console tree under Applications and Services\Microsoft\Windows.

ActiveX Installer Service events

The following ActiveX Installer Service events are defined logically in the order they would result during the installation of an ActiveX control.

• Event 4097 (Attempt to install ActiveX control not in Group Policy)

  This event occurs when the ActiveX Installer Service is prompted to download a control from a host URL that is not within the list of allowed installation hosts. This event is very important because you can use the enumerated host information in the event to create your policy for the ActiveX Installer Service.

• Event 4098 (ActiveX control passed all Group Policy checks)

  This event occurs when the ActiveX Installer Service is first queried to install an ActiveX control from a host that is listed in the list of allowed installation hosts. The next step that ActiveX Installer Service will complete is to download the ActiveX control from the host.

• Event 4099 (ActiveX control blocked by Group Policy)

  This event occurs when the ActiveX Installer Service attempts to download an ActiveX control that does not meet the required signing setting in Group Policy. If the ActiveX control is unsigned and Group Policy requires that all ActiveX controls are signed, then this error would occur.

• Event 4100 (Failed to download ActiveX control)

  This event occurs when the ActiveX Installer Service attempts to download an ActiveX control from a host that does not meet the criteria that you have specified in Group Policy. If an HTTPS site has an expired or invalid certificate and this certificate was required by Group Policy, then this error would occur.