How do I test the new out-of-date ActiveX controls feature?

On the previous blog “How to manage the new “blocking out-of-date ActiveX controls”  feature in IE?” we showed you the location and settings for the new out-of-date ActiveX controls feature and on this one, we are outlining the step by step instructions covered in article KB2991000 | Update to block out-of-date ActiveX controls in Internet Explorer under the section “Testing the out-of-date ActiveX controls feature” to get your testing started and better prepare you for the upcoming changes.

Testing Guidance 



PLEASE FOLLOW THE STEPS OUTLINED IN THE ARTCILE: under, Testing the out-of-date ActiveX controls feature

TIP: Make a backup of the original file, so you can restore it after you are done with testing!

 Turn on AuditMode 

  • Enabled the “Turn on ActiveX logging in Internet Explorer” GPO

Registry Location:


Restart Internet Explorer. You should see that websites that attempt to load out-of-date Java ActiveX controls will now display the out-of-date ActiveX control blocking notification.



To see the Audit Log, open the %LOCALAPPDATA%\Microsoft\Internet Explorer\AuditMode folder and review the VersionAuditLog.CSV file. You should see the Audit items listed.

If your organization needs more time to mitigate dependencies on out-of-date Java controls, you have the following two options:

  • Turn off the feature completely: Use the Turn off blocking of outdated ActiveX controls for Internet Explorer Group Policy setting (or corresponding registry key)
     Note  This is the less secure option.
  • Turn off the feature for a specific domain: Use the Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains Group Policy setting (or corresponding registry key). This setting allows you to turn off the feature on the specific domains on which your enterprise has an out-of-date Java dependency.


This blog has been provided to you by the IE Support team!


Comments (13)

  1. Glenn says:

    How soon after a Java update is released will Microsoft update VersionList.xml?  

    Java may be set to check updates only weekly, or monthly, and it does take organizations time to test and roll out these updates. My concern with this is that we don't (yet) have the visibility as to how long we have got, so our thinking is to just turn this functionality off.

    Java (in particular is a pain in the #ss), because you really need IE to not be running as you do the update, which makes it harder to find windows where you can update laptops.

  2. John Carnex says:

    After applying the MS update 2976627, I'm still not seeing the directory %LOCALAPPDATA%MicrosoftInternet ExplorerVersionManager.  Do we have to manually create this, or should it get placed during the update?

  3. AxelRMSFT says:

    @John Carnex    

    Please make sure you enable the GPO below:

    GPO NAME: Turn on ActiveX control logging in Internet Explorer

    REGISTRY LOCATION: SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExt

    VALUE: "AuditModeEnabled"=dword:00000001

    Check the clients registry and make sure it is present.

  4. _Emin_ says:


    The audit log isn't in %LOCALAPPDATA%MicrosoftInternet ExplorerVersionManagerAuditMode as mentioned in your post.

    It's actually in "%localappdata%microsoftInternet ExplorerAuditMode"

    Other ref:…/dn761713.aspx

  5. AxelRMSFT says:


    you are correct!

    Fix it!

    The correct path for the VersionAuditLog.CSV is: %LOCALAPPDATA%MicrosoftInternet ExplorerAuditMode

  6. Eric says:

    I have (in the registry) enabled AuditModeEnabled per the instructions above and I am unable to locate the Audit log.

  7. Glenn Turner says:

    Can I please get an answer re: how long we have to roll out a new version before the versionlist.xml will be updated?

  8. AxelRMSFT says:


    Is the registry: SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExt

    VALUE: "AuditModeEnabled"=dword:00000001  present ?

    Where did you defined it?

    Machine or User?

    Make sure it exist.

    Once you do so, run the GPUPDATE /FORCE on the client

    visit a website with the java component and then check to see if exist under: %LOCALAPPDATA%MicrosoftInternet ExplorerAuditMode

  9. 127 says:


    Try to create the Folder "AuditMode" in %LOCALAPPDATA%MicrosoftInternet Explorer  manually

  10. AxelRMSFT says:


    You don't need to create that folder.

    You should wait until the versionlist.xml is created. The AuditMode can only be created if the versionlist.xml exist and you may have to wait 12 hours to see it.  

  11. 127 says:


    i have the Version list since weeks.

    But nothing happened when activate the AuditMode.

    Even afer i created the Folder i got the log.

    2nd issue, the log only shows (granted) Flash, but not Java (no granted if latest Java and no block if very old Java) also no block msg shown on IE itself when use old Java e.g 6#45

  12. AxelRMSFT says:


    I would suggest considering opening a ticket with Microsoft support to help you further look into this issue.  

  13. Steven says:

    The audit log will not create an entry for non-routable server IP (192.168..). Additionally, I have defined a specific non-routable IP in my local intranet and in PoliciesextDomain and still out of date Java is being blocked in IE 10: "Your security settings have blocked an application from running with an out-of-date or expired version of Java."