ActiveX is a major source of security headaches in Microsoft Internet Explorer. Although IT professionals might wish to disable ActiveX altogether, that simply isn't an option for many users, so we need to know how to tweak various settings and permissions for the different security zones in IE. Fortunately, there are a variety of customization options available in IE 6 that can help an administrator improve security, especially with Service Pack 2 for Windows XP installed. However, not many administrators are educated about these options and there is minimal documentation available, so these security best practices for ActiveX and browser add-ons are not widely used.

Managing Add-ons

New in IE 6 for Windows XP SP2 is the Add-on Manager screen. Just what are add-ons? Those are the Browser Helper Objects (BHOs), ActiveX controls, toolbars, and browser extensions that enhance the way Internet Explorer displays Web sites or provides additional functionality to the browser. Some are pre-installed when the operating system is loaded; others are installed by users, or downloaded as users visit certain Web sites.

How can you manage add-ons? Administrators can enable/disable or block users from downloading new add-ons. However, by default, users can change these settings themselves unless they are prevented from doing so by Group Policy or another desktop lockdown tool.

To access add-ons, open Internet Explorer and go to Tools | Manage Add-ons to see all the active Browser Helper Objects as well as any other add-ons that IE has used previously and which are still stored on the computer.

Select any object by name and you can either Enable it if you need it or Disable it if it repeatedly causes problems. You can also update most ActiveX add-ons from this screen by clicking on the Update ActiveX button after selecting the add-on.

Some add-ons are "signed" but come from untrusted sources. The Add-on Manager will normally block those and you need to open the Add-on Manager to unblock any that you need. Beware that doing so automatically moves everything from that publisher to the trusted list. It doesn’t enable only the single add-on you specify. In XP SP2 these blocked add-ons are what show up in the Browser Information Bar to notify you that a site feature is disabled and needs to be authorized if you want to use it.

One important thing to remember is that, even though you have disabled an add-on in the Add-ons Manager, it only applies to the IE browser. Other applications may still activate and use the Add-on because it is still on the system, just disabled at the moment. You need to delete it completely if you don’t trust it and don't want any other applications to use it.

One exception to note is that any ActiveX control that is already "blocked by its compatibility flag" will be disabled in every case, without regard to any changes in the Add-on Manager settings.

ActiveX controls in IE 6

Battling with ActiveX controls is obviously not new to the XP SP2 upgrade of IE 6, but a lot of people who complain about the dangers of ActiveX code don’t seem to realize that there are options for securing ActiveX.

In addition to the changes you can make in the Add-on Manager in XP SP2, you can fine-tune how Internet Explorer treats any ActiveX controls. One of the main security concerns with ActiveX is that an ActiveX control will be compromised by an attacker and then the attacker will gain elevated privileges to do damage on the local machine. An administrator can fight against this by locking down the "Local intranet" privileges in IE. Go to the Tools | Internet Options | Security, which takes you to the Web content zones (Internet, Local intranet, Trusted sites, and Restricted sites). Click on Local intranet and then click the Sites button. Here, you can choose to enable or disable:

  • all local (intranet) sites not listed in other zones
  • all sites that bypass the proxy server
  • all network paths (UNCs)

Click on the Advanced button and you can add or remove specific sites in the Local intranet zone.

Author's note

Under XP SP2 the Local intranet zone receives additional protection intended to keep attackers from using the Local settings to elevate privileges and attack the system. On earlier systems the local file system was presumed to be secure but now the Local machine zone is further locked down by default (all three of the above options are triggered by default). Also, any apparent violation is now supposed to trigger the Browser Information Bar (in XP SP2) to ask permission to continue.

You can also highlight Internet, Trusted sites, or Restricted sites and then click on the Sites button to fine-tune which sites are affected in those zones.

For all four zones you can click on the Custom Level button to bring up the Security Settings screen that offers the same ActiveX options for all four zones:

ActiveX controls and plug-ins

  • Automatic prompting for ActiveX controls
  • Disable
  • Enable

Binary and script behaviors

  • Administrator approved
  • Disable
  • Enable

Download signed ActiveX controls

  • Disable
  • Enable
  • Prompt

Download unsigned ActiveX controls

  • Disable
  • Enable
  • Prompt

Initialize and script ActiveX controls not marked as safe

  • Disable
  • Enable
  • Prompt

Run ActiveX controls and plug-ins

  • Administrator approved
  • Disable
  • Enable
  • Prompt

Script ActiveX controls marked safe for scripting

  • Disable
  • Enable
  • Prompt

Each zone has its own default settings for these options but you can also change any individual setting to customize how ActiveX code is dealt with in each situation.

Crash detection

There is also a new browser crash detection feature in XP SP2 that attempts to show which add-on is causing problems. This feature can greatly improve troubleshooting. The crash detection tool is enabled by default in XP SP2 and you probably want to leave it enabled since it shouldn’t even be noticed unless the browser crashes. If you do set NoCrashDetection, the operating system will treat browser crashes in the pre-SP2 manner (i.e., invoke the standard Windows Error Reporting tool).

If you experience problems with this new tool and need to disable or re-enable crash detection, it is done in either the following Registry keys:

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions

For details on how to enable or disable the entire Add-on Manager and/or the new crash detection features, see this Microsoft TechNet article.

End sum

With the options that we've listed, you can fine-tune a variety of settings in order to get granular control over ActiveX and browser add-ons. This will allow you to get all your essential sites working while blocking any dangerous ActiveX controls.