Turn off blocking of outdated ActiveX controls - Windows Server 2012, NOT R2 - How?

[link470]

Hi everyone,

 

I'm running into an issue with the new ActiveX blocking that Microsoft implemented. This particular network has a Windows Server 2012 [non R2] domain controller, and Windows 7 clients running IE 11. The problem is that even though the clients and server are fully up to date, I can't see the new ADMX templates for "Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains" and other new entries added due to the new ActiveX blocking. I would assume this is because Windows Server 2012 uses IE 10, not 11 [which I still think is insane that it needs to upgrade to R2 just to get a new free browser...but anyway].

 

Our Windows 7 clients use Java 6 Update 45, as the developer of the application they use only supports Java 6. I'm trying to enable the "Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains" GPO and push it down to allow those clients to access this site. But I can't see those settings in the GPO. I've tried downloading the ADMX files [KB2841134] and adding the template to the GPO I want to add the setting to by opening the GPO and right clicking Admiistrative Templates and choosing Add/Remove templates. This doesn't do squat. If I do that and then check Administrative Templates>Windows Components>Internet Explorer>Security Features>Add-on Management, I see no new settings.

 

Has anyone had to bypass blocking for older versions of Java on Server 2012 [non R2] and actually had it work? Any advice would be greatly appreciated.

[computer_expert]

There are some registry values mentioned here that you could use in the registry bit of group policy preferences.

[Arthur]

The problem is that even though the clients and server are fully up to date, I can't see the new ADMX templates for "Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains"

That's because you need to download the group policy templates from KB2841134 and put them in your Central Store which is located at the path below (I assume you already have one?):

 

\\[color="#FF0000"]YourDomain[/color]\sysvol\[color="#FF0000"]YourDomain[/color]\Policies\PolicyDefinitions

 

After you have extracted KB2841134.zip to folder on your HDD, delete inetres.adm and all of the language subfolders you don't need.

 

Then copy the remaining files to the root of the PolicyDefinitions folder, overwriting what's already in there. i.e.

 

\\[color="#FF0000"]YourDomain[/color]\sysvol\[color="#FF0000"]YourDomain[/color]\Policies\PolicyDefinitions\inetres.admx
\\[color="#FF0000"]YourDomain[/color]\sysvol\[color="#FF0000"]YourDomain[/color]\Policies\PolicyDefinitions\en-US\inetres.adml

 

You will then be able to see the new IE settings when you modify an existing or create a new GPO.

[link470]

There are some registry values mentioned here that you could use in the registry bit of group policy preferences.

Thanks, I saw those earlier today and was going to use that as a last resort if I couldn't get the actual GPO options to work.

 

That's because you need to download the group policy templates from KB2841134 and put them in your Central Store which is located at the path below (I assume you already have one?):

Ah...no, I actually don't. Is it really just as easy as creating a PolicyDefinitions folder in the sysvol policies folder [where the ID'd folders are for existing GPO's] and then copy all files from C:\Windows\PolicyDefinitions to there, and add the new ones [minus unneeded language files] from the downloaded zip to there and overwrite existing inetres files? Or do I only copy the new files from the zip and leave the remaining C:\Windows\PolicyDefinition files where they are and not copy those?

Edited September 20, 2014 by link470

[Arthur]

Is it really just as easy as creating a PolicyDefinitions folder in the sysvol policies folder [where the ID'd folders are for existing GPO's] and then copy all files from C:\Windows\PolicyDefinitions to there, and add the new ones [minus unneeded language files] from the downloaded zip to there and overwrite existing inetres files?

Yeah. That's all there is too it.

 

It's probably worth mentioning that the PolicyDefinitions in C:\Windows doesn't contain all of the group policy templates you would need to manage both client OSs and server OSs so you would be better off getting the latest templates from Microsoft's website:

 

Administrative Templates (.admx) for Windows 8.1 Update and Windows Server 2012 R2 Update

 

Download and run the MSI from the link above, copy the files from:

 

%ProgramFiles(x86)%\Microsoft Group Policy\Windows8.1-Update\PolicyDefinitions

 

to:

 

\\[color="#FF0000"]YourDomain[/color]\sysvol\[color="#FF0000"]YourDomain[/color]\Policies\PolicyDefinitions

 

Then copy over the IE ADMX/ADML from KB2841134.