SCCM by Davis: “Enterprise Management of ActiveX Controls using ActiveX Installer Service” plus 2 more

Enterprise Management of ActiveX Controls using ActiveX Installer Service
VHD creation for ConfigMgr 2012 R2
Logitech Turns Its Business Focus to UC

Enterprise Management of ActiveX Controls using ActiveX Installer Service

Posted: 16 Jun 2013 02:01 AM PDT

The ActiveX Installer Service (AXIS) is a Windows technology that enables the installation of ActiveX controls to a standard user in the enterprise. It consists of a Windows service, a Group Policy administrative template, and a few changes in Internet Explorer behavior.

Many organizations must install ActiveX controls on their desktops in order to ensure that a variety of programs that they must use on a daily basis will work properly. However, most ActiveX controls must be installed by a member of the Administrators group, and many organizations have configured or want to configure their users to run as standard users, which are non-administrative users that are members of the Users group. As a result, organizations often have to repackage and deploy the ActiveX controls to the users. In addition, many of these ActiveX controls must be regularly updated. Many organizations find this to be difficult and costly to manage for standard users.

With Windows 7/8 the ActiveX Installer Service is a native OS service and you can easily deploy and update ActiveX controls to your standard user environments. The ActiveX Installer Service enables you to leverage Group Policy to define and manage approved host URLs that standard users can use to install ActiveX controls in a locked-down environment. For more information about AXIS, see: http://technet.microsoft.com/en-us/library/cc721964.aspx.

Here is how ActiveX Installer Service works :

Define a list of explicitly approved host URLs
AxIS checks Group Policy Object (GPO) to see URL is approved
Internet Explorer asks AxIS to install the ActiveX
No admin credentials required for install if approved
If not approved, administrator credentials required for install
Only installs ActiveX controls with a .cab, .dll, or .ocx file extension

AxInstallerService in Windows allows the corporate administrator to manage ActiveX controls while maintaining a strong security posture, by having users run as standard user with default file system settings. AXIS provides Group Policy options to configure trusted sources of ActiveX controls and a broker process to install controls from those trusted sources on behalf of standard users. The key benefit is that you can maintain a non-administrative security posture on user workstations along with centralized administrative control. AXIS relies on the IT administrator to identify trusted sources (typically Internet or intranet URLs) of ActiveX controls.

When an object tag directs Internet Explorer to invoke a control, AXIS takes the following steps:

Checks that the control is installed. If not, it must be installed prior to use
Checks the AXIS policy setting to verify if the control is from a trusted source
The specific check matches the host name of the URL specified in the CODEBASE attribute of the object tag against the list of trusted locations specified in policy
Downloads and installs the control on the user's behalf

Some security zones settings configure the ability for computers to execute and/or download ActiveX controls. However, even if Internet Explorer allows an ActiveX control to be downloaded from the web site, the ActiveX control can only be installed from an elevated process or administrative account. One of the goals for enterprises is to only provide end users standard, non-administrative access to their operating system. This means that ActiveX controls downloaded from web sites – regardless of the web site's security zone – cannot be installed by the end users.

With Windows 7/8 and beyond, AXIS is a native Windows service that will install ActiveX controls on behalf of end-users. Enterprises can maintain a list of approved web sites, implemented via Group Policy, that will cause AXIS to install any required ActiveX controls for the end-user. Further, AXIS can be configured to install ActiveX controls from all Trusted Sites.

The advantage of using AXIS over an Software Distribution tool is that no packaging of ActiveX controls is required, which significantly reduces the amount of time needed to get an ActiveX control installed in production. Group Policy based administration enables rapid changes to the deployed computers. Leveraging AXIS involves some additional management, specifically the management of a Group Policy object to add specific sites to leverage AXIS. The control of ActiveX installation and functional state can be managed in enterprises via Active Directory Group Policy.

Policy Settings	Scope	Policy Path
Turn off ActiveX Opt-In Prompt	User, Machine	Windows Components\Internet Explorer
Only use the ActiveX Installer Service for installation of ActiveX controls	User, Machine	Windows Components\Internet Explorer
Only allow approved domains to use ActiveX without prompt	User, Machine	Windows Components\Internet Explorer\Internet Control Panel\Security\PER ZONE
Disable Per-User Installation of ActiveX Controls	User, Machine	Windows Components\Internet Explorer

Turn off ActiveX Opt-In prompt: This policy setting allows you to turn off the ActiveX Opt-in prompt. The ActiveX Opt-in prevents websites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an Information bar will appear asking the user for approval. If you enable this policy setting, the ActiveX Opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks. If you disable or do not configure this policy setting, the ActiveX Opt-In prompt will appear.

Only use the ActiveX Installer Service for installation of ActiveX controls:
This policy setting allows you to specify how ActiveX controls are installed. If you enable this policy setting, ActiveX controls will only install if the ActiveX Installer Service is present and has been configured to allow ActiveX controls to be installed. If you disable or do not configure this policy setting, ActiveX controls, including per-user controls, will be installed using the standard installation process.

Disable Per-User Installation of ActiveX Controls: This policy setting allows you to disable the per-user installation of ActiveX controls. This policy only affects ActiveX controls that can be installed on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.

Configuring the ActiveX Installer Service

The ActiveX Installer Service is enabled by default in Windows 7 /8 , you only need GPMC to configure it. You must configure the ActiveX Installer Service settings by using an administrative template in Group Policy. The administrative template consists of a list of approved installation sites, which the ActiveX Installer Service uses to determine whether an ActiveX control can be installed. We recommend Domain policies over Local policies.

To configure the ActiveX Installer Service using local GPMC (similar steps for Domain Policy)

Press Windows Key + R to open the Run command.
Type mmc, and then click OK.
In the File menu, click Add/Remove Snap-in.
In the Add/Remove Snap-ins dialog box, select Group Policy Management Console, and then click Add.
In the Select Group Policy Object dialog box, accept the default setting of the local computer or click Browse to configure a remote computer, and then click Finish.
In the Add/Remove Snap-ins dialog box, click OK.
In the console tree, expand Local Computer Policy, expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click ActiveX Installer Service.
In the details pane, click Approved Installation Sites for ActiveX Controls to edit
In the Approved Installation Sites for ActiveX Controls Properties dialog box, select Enabled, and then click Show next to Host URLs.
In the Show Contents dialog box type the name for the URL where you want to allow ActiveX controls to be installed
Type the values for the four ActiveX Installer Service host URLs settings.
Click OK
In the details pane, click Establish ActiveX installation policy for sites in Trusted zones to Edit.
Make your selection for the Trusted zones
Click OK to close

When you add a URL, you can specify comma-delimited values that detail the settings for the ActiveX Installer Service.
You can configure four values:

Installing ActiveX controls that have trusted signatures
Installing signed ActiveX controls
Installing unsigned ActiveX controls
HTTPS error exceptions

ActiveX Recommended Practices

▪ Only install ActiveX controls from reputable organizations -
We recommend that you only install ActiveX controls from publishers that you know and trust. The ActiveX Installer Service does not determine whether the host presenting the ActiveX control is connected to a secure network. Ensuring that you only install ActiveX controls from reputable publishers will help mitigate this threat.

▪ Deploy commonly used ActiveX controls -
We recommend that you deploy ActiveX controls that are commonly used in your environment by using your organization's application deployment method. Many users today use laptops to connect to multiple networks, including wireless hot spots. A malicious proxy at an insecure network could attempt to trick the ActiveX Installation Service by redirecting it to a host with malicious software that represents itself as a commonly used ActiveX control. Ensuring that you deploy commonly used ActiveX controls for your users will help mitigate this threat.

▪ Only use HTTPS host URLs -
We recommend that you only modify the value for HTTPS error exceptions to require the connection to pass all verification checks (0). If a remote users connects to an insecure wireless network, and the proxy attempts to redirect the connection, this setting will ensure that the ActiveX control installation will fail since the certificate will be invalid.

▪ Consolidate ActiveX controls to a central server -
We recommend that you consolidate the ActiveX controls you use in your organization to a central server. The location where a Web site hosts an ActiveX control is called a CODEBASE. Normally, the CODEBASE is specified in the Web page, and the installation process retrieves the ActiveX control from that location.
In managed enterprises, you can use Group Policy to override the CODEBASE that is specified within the Web page to redirect to an internal server. Using this setting allows you to easily manage which ActiveX controls users can install by consolidating the ActiveX controls onto a central server; if the server is an HTTPS server, you also satisfy the previous recommended practice, only use HTTPS host URLs.
You can configure a common Group Policy setting to redirect all ActiveX control installations to a central server in your organization. You can do this by using the CodeBaseSearchPath registry key. For more information on the CodeBaseSearchPath see Implementing Internet Component Download http://go.microsoft.com/fwlink/?LinkId=90677

AXIS Implementation Checklist

Gather ActiveX controls - You can assess which controls, if any, are appropriate to use within your organization. You may need to gather an inventory of existing ActiveX controls already in production use. The Microsoft Assessment and Planning Toolkit or Application Compatibility Manager as part of the Windows 8 ADK will help for the inventory.
Create and implement Group Policies

Most Common Controls

More Information about ActiveX can be found:

ActiveX Installer Service in Windows 7 Technical Reference
http://technet.microsoft.com/en-us/library/ee247410(v=WS.10).aspx
Administering the ActiveX Installer Service in Windows 7
http://technet.microsoft.com/en-us/library/dd631688(v=WS.10).aspx
Fixing ActiveX Installation Compatibility Issues for Standard Users
http://msdn.microsoft.com/en-us/library/windows/desktop/ff966518(v=vs.85).aspx

This post is based on the work of Steve Campbell (Architect with Microsoft Consulting Services US ) and was contributed by Lutz Seidemann, a Solution Architect with Microsoft Consulting Services – World Wide Client Center of Excellence.

The information on this site is provided "AS IS" with no warranties, confers no rights, and is not supported by the authors or Microsoft Corporation. Use of included script samples are subject to the terms specified in the Terms of Use.

VHD creation for ConfigMgr 2012 R2

Posted: 15 Jun 2013 06:39 PM PDT

Recently Microsoft has been unveiling the enhancements that will be seen in System Center 2012 Configuration Manger.

http://www.microsoft.com/en-us/server-cloud/system-center/system-center-2012-r2-configuration-manager.aspx

The goal of the VHD creation for R2 is to help you with VMM, having a unified approach to image creation. Now you can update your VHD by simply changing a task sequence. That's nice but what about the undocumented benifit.

Windows 8 has a hyper-V functionality. So what? Well generally you create your Corporate Image and then start pushing to hardware, some might even push it to a hyper-V server to load and allow people to look at. Well now you can cut testing time by creating a VHD, shoot it over to the VM farm for testing or maybe even just allow Win8 users to pull down the VHD, install it on their machine and run all the testing on their own virtual environment. While this is happening the Imaging team can also then work on the Hardware drivers and other items necessary for deployment. Then the real Hardware testing can be done while other are still testing the data portion in a VHD. Then you have a real world deployment and testing.

This could, in affect, quicken the testing and deployment of an image utilizing the Win8 and R2 system. Test Win 8.1 in this manor before sending it out. This way you don't even need to install it to your machine, you have the corporate image VHD created and apply 8.1 and test your applications.

Thank you Microsoft for allowing the IT professionals an easier way to test and deploy IT standards!!!!

Later we will show this in a Task Sequence.

Logitech Turns Its Business Focus to UC

Posted: 15 Jun 2013 08:30 AM PDT

The company sees opportunity in selling products that make unified communications easier to use.