ActiveX won't install when IE7 is run with full admin token

Posted: 01-25-2008, 07:13 AM
My process requires admin privilege to modify system stuff. So on
Vista, it is elevated (with the request admin manifest). And it spawns
IE. I realize it would be spawning IE with the full token (since
elevation is a one way street) but to be good citizen it spawns IE
with medium integrity (the MS recommended way: dup token, change IL to
medium, then do CreateProcessAsUser with the new token). It works fine
until IE browses to a site requiring ActiveX. IE complains security
setting does not allow ActiveX install. What?? Do I really have to
have a helper process (with the splitted token) and have it spawn IE?
No otherway? The way I see it, if I choose to run IE with full token I
should still be able to install ActiveX, I don't understand the reason
of it. Could this be an IE bug?

I am starting to appreciate the hatred people have towards Vista. It's
almost like it requires every process that needs admin privilege to
have a helper and a pipe between the two. That's alot more work and
alot less reliable than before, and there are alot of applications out
there that require admin privileges - not every app is a dumb word
processor.

Anyway, any help appreciated.

ActiveX won't install when IE7 is run with full admin token


Responses to "ActiveX won't install when IE7 is run with full admin token"

Jesper
Guest
Posts: n/a
 
RE: ActiveX won't install when IE7 is run with full admin token
Posted: 01-26-2008, 07:45 AM
Check the security settings on the IE instance that you open. Specifically,
check what zone your page that attempts to install the ActiveX control is in,
and what the value of the "Download [signed|unsigned] ActiveX controls" is.

Would I be correct in assuming that your page is either in the Local
Computer Zone or that the control is not signed, or both? Either would cause
a failure to install the control.
---
Your question may already be answered in Windows Vista Security:
http://www.amazon.com/gp/product/047...otectyourwi-20


"fltcpt@yahoo.com" wrote:
> My process requires admin privilege to modify system stuff. So on
> Vista, it is elevated (with the request admin manifest). And it spawns
> IE. I realize it would be spawning IE with the full token (since
> elevation is a one way street) but to be good citizen it spawns IE
> with medium integrity (the MS recommended way: dup token, change IL to
> medium, then do CreateProcessAsUser with the new token). It works fine
> until IE browses to a site requiring ActiveX. IE complains security
> setting does not allow ActiveX install. What?? Do I really have to
> have a helper process (with the splitted token) and have it spawn IE?
> No otherway? The way I see it, if I choose to run IE with full token I
> should still be able to install ActiveX, I don't understand the reason
> of it. Could this be an IE bug?
>
> I am starting to appreciate the hatred people have towards Vista. It's
> almost like it requires every process that needs admin privilege to
> have a helper and a pipe between the two. That's alot more work and
> alot less reliable than before, and there are alot of applications out
> there that require admin privileges - not every app is a dumb word
> processor.
>
> Anyway, any help appreciated.
>
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
Getting FULL Admin rights to delete folders inhisgrace007 Windows Vista Administration 2 12-07-2007 02:31 AM
How to get FULL Admin privileges toreddie Windows Vista Security 6 10-01-2007 10:56 PM
XP not recong. user has been given full admin rights Chelle Windows XP Security & Administration 0 09-25-2003 08:27 PM
Security log on system is full, only Admin can log on. T. Jordan Windows XP Security & Administration 2 09-04-2003 12:23 AM
Lost full admin rights Arlyn Windows XP Security & Administration 0 08-25-2003 03:39 PM