One of the problems associated with least privileged user accounts in Windows XP is that when users browse to a Web site that requires them to download an ActiveX control to display the Web page contents, they don't have the authority to install the control. An ActiveX control from a rogue Web site can be used for malicious purposes. Therefore, ActiveX controls should always be installed with caution from trusted sources only, preferably by an administrator who understands the risks. In practice, this means that users with limited privileges must wait until a support technician with administrative privileges has time to install controls for them. Hardly an ideal situation, but preferable to running Microsoft Internet Explorer (IE) with administrative privileges, in most cases.
This is where Windows Vista’s ActiveX Installer Service comes in. This service—in Vista Ultimate, Business, and Enterprise editions only—can be used in conjunction with Group Policy to determine whether a least privileged user is allowed to install an ActiveX control package (i.e., an .ocx, .dll, or .cab file) from a particular URL. If ActiveX Installer Service finds the URL on the allowed list in Group Policy, the service will install the control on the user’s behalf. Although Installer Service has some limitations (which I discuss below), it does give users and their administrators some control over ActiveX objects, so I believe it's worth using. Let's look at how to set up Installer Service to install Adobe Flash Player for users who request it. . . .
