Active X controls cause us loads of pain in large scale deployment scenarios. The primary reason is that it we cannot lock down the enterprise PC's and still have users activate the Active X controls in their browsers, even if the Active X component is signed.
We can easily make a site a "trusted site" (group policy), but this does not ensure that users have the access they need to make the registry entries in HKLM or put files in C:\WINDOWS\DOWNLOADED PROGRAM FILES. We could try to hack this by opening write access to HKLM/Classes and to the downloaded program files folder, but this is not good.
Is there a reliable way of doing this? A way where I can perhaps sign the controls I approve and have active directory install it in system context on all domain computers? This must be a problem that several corporations are dealing with.
