ActiveX won't install when IE7 is run with full admin token

[fltcpt]

My process requires admin privilege to modify system stuff. So on
Vista, it is elevated (with the request admin manifest). And it spawns
IE. I realize it would be spawning IE with the full token (since
elevation is a one way street) but to be good citizen it spawns IE
with medium integrity (the MS recommended way: dup token, change IL to
medium, then do CreateProcessAsUser with the new token). It works fine
until IE browses to a site requiring ActiveX. IE complains security
setting does not allow ActiveX install. What?? Do I really have to
have a helper process (with the splitted token) and have it spawn IE?
No otherway? The way I see it, if I choose to run IE with full token I
should still be able to install ActiveX, I don't understand the reason
of it. Could this be an IE bug?

I am starting to appreciate the hatred people have towards Vista. It's
almost like it requires every process that needs admin privilege to
have a helper and a pipe between the two. That's alot more work and
alot less reliable than before, and there are alot of applications out
there that require admin privileges - not every app is a dumb word
processor.

Anyway, any help appreciated.

 

[Jesper]

Check the security settings on the IE instance that you open. Specifically,
check what zone your page that attempts to install the ActiveX control is in,
and what the value of the "Download [signed|unsigned] ActiveX controls" is.

Would I be correct in assuming that your page is either in the Local
Computer Zone or that the control is not signed, or both? Either would cause
a failure to install the control.