ActiveX Install From Limited Account on XP SP2?

[TR]

Hi,

When logged in as a "limited account" user
on XP SP2, I cannot install ActiveX controls.
Nothing seems to happen, or just a red x appears
where the control should be. I do not get an Information
Bar prompt.

When logged in on the same system as an administrator,
I can install those ActiveX controls just fine.

Once I have installed the component as an admin,
then the limited account can run the control just fine.

This is a clean install with no policy management in place.

I've tried adding the site(s) to the trusted zone,
completely opened up every possible security
setting for the zone, and also completely made IE
as insecure as possible in the Advanced internet
settings. The code is in a cab file which is signed
with a valid cert.

Does anyone know any trick to get ActiveX controls
to install from a limited account? Is it just supposed
to be impossible for limited accounts to install ActiveX
components no matter what?

Thanks.

 

[TR]

Pardon me for answering my own question.

The short answer is "permissions".

The limited account does not have
permission to write in the
C:\Windows\Downloaded Program Files directory.
Also, it is likely that registry modifications
needed to install are also denied. If you must,
permissions can be modified on the registry,
and the Downloaded Program Files directory (use cacls),
to permit the limited user to install ActiveX controls.
But, that defeats the purpose of the limited account.
Perhaps make the user a "Power User" instead.

See:
http://support.microsoft.com/default.aspx?scid=KB;EN-US;240897
Also:
http://groups.google.com/groups?hl=...100&hl=en&lr=&ie=UTF-8&sa=N&as_qdr=all&tab=wg