Group Policy + Add-ons/Active-X + Non-Admin Users

[Frapple]

Good afternoon,

Before I got out back and take a shotgun to my temple, I thought I'd post here.

To summarise, we've recently added a document management system that operates mainly through Internet Explorer but requires a few IE Add-ons/ActiveX Controls to be installed for the extra functionality (document viewing through IE, 'WebFolders/WebDav', document edit control for MS Office Applications) to be available.

I've changed every possible setting that I know of in GP to allow any activex control on any intranet site to install but I still only get the add-on when using an administrator account (If I remove a user from the administrators group, they can no longer user the add-on) Security settings are set to low.

All the CLSIDs I can find (Ctrl+F'd the life out of the registry) have been added the 'Add-on Allow List' (\Policies\Admin Template Policy\Windows Components\Internet Explorer\Security Features\Add-on Management) in both User & Computer Configuration

Is there something I'm missing? I've even tried setting all Active-X options to 'Prompt' instead on 'Enable' but still having no luck.

 

[ZeroC007]

Add the URL as a trusted site and set the security level for the zone to low? Does the website definately display as a Local intranet site within the browser and isn't being detected as a Internet site?

 

[Frapple]

Yeah, definitely detected as an Intranet site, there are no other sites loading according the privacy report.

 

[DiscoDave]

I've not had much experience with active x and GPO's but can we assume from your first post you have configured a Approved Installation Site for ActiveX Controls via the GPO?

 

[IAmATeaf]

Have you tried running regmon and filemon to see what the add-on is trying to do when the account is a non-admin account? It could be related to file/registry permissions if the add-on has definitely been installed.