Configuring Windows ActiveX Installer Service for WebEx

Question

I'd like to make use of the Windows ActiveX Installer Service Group Policy to allow users to install the WebEx client without the need for security elevation from an administrator. I realize that I could add the entire webex.com domain to the Trusted Site zone in IE and this would allow them to do so, but I don't want to necessarily lock down all of their IE zones (which that policy would effectively do). The Windows ActiveX Installer Service group policy, specifically Approved Installation Sites for ActiveX Controls requires that I specify the exact URL that the control will be downloaded from, as well as the specific version number. They don't allow wildcards in this particular piece of policy unfortunately. I love the granular control, but the problem is I can't find any documentation from WebEx as to what URL this control will be made available in the future. I realize I could use Fiddler to figure out where I download the control from initially, but who knows if it will come from the exact same location in the future. The control in question is ieatgpc.dll and the current version is 2.1.0.2. Does anyone know how I can go about making this work?

Answer 1

The administrative template for tweaking the IE zones isn't the only way to do what you want. When the policy is not enforced, those settings are stored in the registry within HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains.

My suggestion would be to add whatever settings are necessary on a test machine, export the associated registry keys, and then apply them using Group Policy Preferences. It gives you the best of both worlds. Users have the site trusted by default, but they're still free to tweak the settings.

Technically, I think you could also use the built-in "Internet Settings" portion of GPP as well. But it's a little heavy handed for my taste (and has broken things for me in the past unrelated to the settings I was trying to apply).