Windows 8 and 8.1 Forums

Internet Explorer blocking out-of-date ActiveX control

  1. #1

    Internet Explorer blocking out-of-date ActiveX control

    As part of our ongoing commitment to delivering a more secure browser, starting August 12th Internet Explorer will block out-of-date ActiveX controls. ActiveX controls are small apps that let Web sites provide content, like videos and games, and let you interact with content like toolbars. Unfortunately, because many ActiveX controls aren’t automatically updated, they can become outdated as new versions are released. It’s very important that you keep your ActiveX controls up-to-date because malicious or compromised Web pages can target security flaws in outdated controls to collect information, install dangerous software, or by let someone else control your computer remotely.

    For example, according to the latest Microsoft Security Intelligence Report, Java exploits represented 84.6% to 98.5% of exploit kit-related detections each month in 2013. These vulnerabilities may have been fixed in recent versions, but users may not know to upgrade. To help avoid this situation with ActiveX controls, an update to Internet Explorer on August 12, 2014 will introduce a new security feature, called out-of-date ActiveX control blocking.

    Out-of-date ActiveX control blocking lets you:

    • Know when Internet Explorer prevents a Web page from loading common, but outdated, ActiveX controls.
    • Interact with other parts of the Web page that aren’t affected by the outdated control.
    • Update the outdated control, so that it’s up-to-date and safer to use.
    • Inventory the ActiveX controls your organization is using.

    We wanted to share some guidance ahead of next week’s update, to help you understand this feature and decide the best course of action. If you are an end user and see the notification bar, we suggest updating to the latest version. If you are an IT Pro, you can decide how to implement this feature.

    Supported Configurations

    The out-of-date ActiveX control blocking feature works with:

    • On Windows 7 SP1, Internet Explorer 8 through Internet Explorer 11
    • On Windows 8 and up, Internet Explorer for the desktop
    • All Security Zones—such as the Internet Zone—but not the Local Intranet Zone and the Trusted Sites Zone

    This feature does not warn about or block ActiveX controls in the Local Intranet Zone or Trusted Sites Zone.

    What does the out-of-date ActiveX control blocking notification look like?

    It is important to note that, by default, this feature warns users, with options to update the control or override the warning. When Internet Explorer blocks an outdated ActiveX control, you will see a notification bar similar to this, depending on your version of Internet Explorer:

    Internet Explorer 9 through Internet Explorer 11

    Internet Explorer 8

    From the notification about the outdated ActiveX control, clicking “update” will take you to the control’s Web site to download its latest version. Optionally, in managed environments, IT can configure the feature to block—and not just warn—a user from running out-of-date ActiveX controls.

    Out-of-date ActiveX control blocking also gives you a security warning that tells you if a Web page tries to launch specific outdated apps, outside of Internet Explorer:

    How does Internet Explorer decide which ActiveX controls to block?

    Internet Explorer uses a Microsoft-hosted file, versionlist.xml, to determine whether an ActiveX control should be stopped from loading. This file is updated with newly-discovered out-of-date ActiveX controls, which Internet Explorer automatically downloads to your local copy of the file. We are initially flagging older versions of Java, but over time will add other outdated ActiveX controls to the list.

    As of August 12, 2014, this feature will provide users with notifications when Web pages try to load the following versions of Java ActiveX controls:

    • J2SE 1.4, everything below (but not including) update 43
    • J2SE 5.0, everything below (but not including) update 71
    • Java SE 6, everything below (but not including) update 81
    • Java SE 7, everything below (but not including) update 65
    • Java SE 8, everything below (but not including) update 11

    You can view Microsoft’s complete list of out-of-date ActiveX controls at Internet Explorer version list.

    Out-of-date ActiveX control blocking for managed environments

    Out-of-date ActiveX control blocking is turned off in the Local Intranet Zone and Trusted Sites Zone, to help ensure that intranet Web sites and trusted line-of-business apps can continue to use ActiveX controls without disruption. Some customers may want more granular control over how this feature works on managed systems. IT Pros may want to turn on ActiveX control logging, enforce blocking, allow select domains to use out-of-date ActiveX controls, or—although it is not recommended—disable the feature altogether.

    To support these scenarios, Internet Explorer includes four new Group Policy settings that you can use to manage out-of-date ActiveX control blocking.

    • Logging can tell you what ActiveX controls will be allowed or flagged for warning or blocking, and for what reason. Creating an inventory of ActiveX controls can also show which ActiveX controls are compatible with Enhanced Protected Mode, an Internet Explorer 11 security feature which provides additional protection against browser exploits—but not all ActiveX controls are compatible with EPM, so this feature can help assess your organization’s readiness for blocking out-of-date ActiveX controls and enabling EPM. This Group Policy is “Turn on ActiveX control logging in Internet Explorer,” and can be used separately or in conjunction with the other three policies.
    • Enforced blocking prevents users from overriding the warning for out-of-control ActiveX controls. Users will not see the “Run this time” button. This Group Policy is “Remove Run this time button for outdated ActiveX controls in Internet Explorer.”
    • Selected domains can be managed for which Internet Explorer will not block or warn about outdated ActiveX controls. This policy is “Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains” and includes a list of top level domains, host names, or files.
    • This feature can be turned off by using the policy “Turn off blocking of outdated ActiveX controls for Internet Explorer.” This might be used temporarily in combination with logging, to assess ActiveX controls before re-enabling the feature. This can also be enabled, like all four policies, with a registry key—in this case, a REG_DWORD “HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Ext\VersionCheckEnabled" with value of zero.

    Please see the complete technical documentation here, pending publication on August 7. Starting on August 12, you can also download updated Internet Explorer administrative templates from:

    • Windows Server 2003.*Download the complete set of (English only) Internet Explorer administrative templates, which include the new settings, from*here.
    • Windows Server 2008 and up.*Download the complete set of Internet Explorer administrative templates, which include the new settings, from here.

    Stay up-to-date with Internet Explorer

    We know that many organizations still rely on the capabilities of ActiveX controls, but out-of-date ActiveX controls are a risk today. By helping consumers stay up-to-date—and enabling IT to better manage ActiveX controls, including those that are compatible with Enhanced Protected Mode—Microsoft is helping customers stay safer online. This is another example of delivering on the promise to help get users current with a safer, more secure Internet Explorer.

    — Fred Pullen, Senior Product Manager, Internet Explorer

    — Jasika Bawa, Program Manager, Security

    Last edited by Brink; 06 Aug 2014 at 14:11.

      My System SpecsSystem Spec

Internet Explorer blocking out-of-date ActiveX control
Related Threads
On my external hard drive, I have a ton of photos from different cameras that retain the weird file-naming scheme that the camera implements so the order is weird and out of whack. I've been wanting to organize these photos and thought the best way to do it would be to sort it by date; however,...
More... See also: How to Enable or Disable Users to Turn On and Off Enterprise Mode in Internet Explorer 11 How to Turn On or Off Enterprise Mode for Sites in Internet Explorer 11
Hi all, I've noticed that Windows 8 has more processes that require internet access than Windows 7. Which ones can I safely block from internet access? Thanks
The Modified date of files in Windows Explorer is shown as Today - Yesterday - Friday ..... and if it's older than a week as a date 13/02/2013. Is there any way to always show the modified column as date and not day-of-week? thank you.
Eight Forums Android App Eight Forums IOS App Follow us on Facebook