Establish ActiveX installation policy for sites in Trusted zones

This policy setting controls the installation of ActiveX controls for sites in Trusted zone.

If you enable this policy setting, ActiveX controls are installed according to the settings defined by this policy setting.

If you disable or do not configure this policy setting, ActiveX controls prompt the user before installation.

If the trusted site uses the HTTPS protocol, this policy setting can also control how ActiveX Installer Service responds to certificate errors. By default all HTTPS connections must supply a server certificate that passes all validation criteria. If you are aware that a trusted site has a certificate error but you want to trust it anyway you can select the certificate errors that you want to ignore.

Note: This policy setting applies to all sites in Trusted zones.

Supported on: At least Windows Vista
Installation Policy for ActiveX control signed by trusted publisher


  1. Don't install
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallTrustedOCX
    Value TypeREG_DWORD
    Value0
  2. Prompt the user
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallTrustedOCX
    Value TypeREG_DWORD
    Value1
  3. Silently install
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallTrustedOCX
    Value TypeREG_DWORD
    Value2

Installation Policy for signed ActiveX control


  1. Don't install
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallSignedOCX
    Value TypeREG_DWORD
    Value0
  2. Prompt the user
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallSignedOCX
    Value TypeREG_DWORD
    Value1
  3. Silently install
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallSignedOCX
    Value TypeREG_DWORD
    Value2

Installation Policy for unsigned ActiveX control


  1. Don't install
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallUnSignedOCX
    Value TypeREG_DWORD
    Value0
  2. Prompt the user
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
    Value NameInstallUnSignedOCX
    Value TypeREG_DWORD
    Value1

Permit connection to trusted sites with the following server certificate errors.

Unknown certifcation authority (CA)
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
Value NameIgnoreUnknownCA
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
Invalid certificate name (CN)
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
Value NameIgnoreInvalidCN
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
Expired certificate validation date
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
Value NameIgnoreInvalidCertDate
Value TypeREG_DWORD
Default Value0
True Value1
False Value0
Wrong certificate usage
Registry HiveHKEY_LOCAL_MACHINE
Registry PathSOFTWARE\Policies\Microsoft\Windows\AxInstaller\AxISURLZonePolicies
Value NameIgnoreWrongCertUsage
Value TypeREG_DWORD
Default Value0
True Value1
False Value0

activexinstallservice.admx

Administrative Templates (Computers)

Administrative Templates (Users)