Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Prevent per-user installation of ActiveX controls

This policy prevents ActiveX controls from being installed on a per-user basis.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX\BlockNonAdminActiveXInstall
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX\BlockNonAdminActiveXInstall

This policy prevents ActiveX controls from being installed on a per-user basis. When enabled, an ActiveX control cannot be installed solely for the current user account. When disabled or not configured, per-user installation remains available.

The policy is limited to the per-user installation mechanism. It does not remove existing ActiveX controls, govern whether installed controls may run, or block computer-wide installation.

Notes

Security

Preventing per-user installation limits users' ability to introduce additional ActiveX controls into their own user context. This can reduce exposure to untrusted, tampered, or vulnerable controls.

The setting does not eliminate ActiveX-related risk. Controls that are already present or installed computer-wide can remain available. Whether a control is allowed to run is determined by separate ActiveX, add-on management, and security-zone policies.

Possible side effects

Legacy websites or line-of-business applications can lose functionality if they attempt to install a missing ActiveX control for the current user. The installation is blocked, and content or application features that depend on that control might consequently be unavailable.

Notes

The policy supports both computer and user configuration. The value under HKLM belongs to the device-wide policy scope, while the value under HKCU belongs to the policy scope of the affected user.

This setting is part of the legacy Internet Explorer policy set. Microsoft has retired the Internet Explorer 11 desktop application on certain Windows versions. ActiveX remains relevant primarily to managed legacy applications, and Microsoft Edge Internet Explorer mode continues to support ActiveX controls.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – PreventPerUserInstallationOfActiveXControls

Microsoft Learn: What is Internet Explorer mode?

See also