ActiveX GPO is configured to allow regular users install ActiveX Controls but fails with Access is denied when file access auditing is enabled

Can't get Axis to work and very little clues as to why the activex is not installing? Perhaps, you are hitting this scenario.

Assume, you have configured the Axis GPO on your environment to manage Windows 7 client machines. These machines could be running IE8, IE9, IE10 or even IE11. You logon using the regular user account and open the internal web page, where is hosting the activeX control. You noticed that the activeX control is not loaded and failed to installed. When you review the  IE Temporary Files, there is a CodeDownloadErrorLog entry:

Error messages are generated in 'C:\Users\<<current_user>>\AppData\Local\Microsoft\Windows\Temporary Internet Files' as ?CodeDownloadErrorLog!name={<<class_id>>} files which contain the error: "Code Download Error: (hr = 80070005) Access is denied."

Process Monitor captures shows a few Access Denied messages but not cleared indication as to what is the problem.

You decided to then look at the Security Event log and find a few entries with attempts to access an object. Example:

Log Name:      Security
Source: Microsoft-Windows-Security-Auditing
Date: 4/28/2010 11:14:40 AM
Event ID: 4663
Task Category: File System
Level: Information
Keywords: Audit Success
User: N/A
An attempt was made to access an object.
Security ID: DOMAIN\acct
Account Name: acct
Account Domain: DOMAIN
Logon ID: 0x644b9
Object Server: Security
Object Type: File
Object Name: C:\Windows\AxInstSV\AXS00001\
Handle ID: 0x1a4
Process Information:
Process ID: 0xc24
Process Name: C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Access Request Information:

Access Mask: 0x20000


The scenario outlined in this blog, is known to occur when security auditing has been enabled for file system objects in the Windows directory.

To fix this issue, you should Remove the auditing entries from the Advanced Security Settings for the Windows directory.




 This blog has been provided to you by The IE Support Team.

Skip to main content