How to install SWING Integrator ActiveX controls using the Active Directory (MSI package)

Using SWING Integrator in Domino Web application requires installing and running the ActiveX controls. By design in Windows 2000, XP and 2003 members of the Users group cannot install ActiveX controls from the Internet without modifying the rights of the group. However, it is possible to allow the Users group to install some ActiveX controls. This article describes how to publish SWING Integrator ActiveX controls in the Active Directory to facilitate this functionality.

Preparing the Control

The ActiveX control must be packaged as an Installer Package (.msi) file instead of as a standard Internet Explorer cabinet (.cab) file. This file is provided to you by SWING Software (Integrator4.msi)

Publishing the Control

Once you have the MSI package, the Active Directory must be made aware of the control. The control must be added as a published control in the user portion of a policy for the appropriate Organizational Unit (OU). After the control has been published properly, you should see it in Add/Remove programs for any of the users in the OU.

After you have prepared the control and confirmed that the control can be seen in Add/Remove programs, you need to set up a registry entry in Windows 2000 that causes Internet Explorer to check the Active Directory for an installation package for the control. This entry is HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseCoInstall. Note that this can be any type of value and can contain any or no data. Here is the detailed instruction on creating and setting up the group policy:

Create a Distribution Point

1. Log on to the server computer as an administrator.

2. Create a shared network folder in which to place the MSI package (for example, \\server\share).

3. Set permissions on the share to allow access to the distribution package.

4. Copy the Integrator4.msi installation package to the distribution point.

Create a Group Policy

To create a Group Policy object (GPO) with which to distribute the software package:

1. Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.

2. In the console tree, right-click your domain or Organizational Unit, and then click Properties.

3. Click the Group Policy tab, and then click New.

4. Type the name that you want to call this policy (for example, SWING Integrator 4 ActiveX), and then press ENTER.

5. Click Properties, and then click the Security tab.

6. Click to clear the Apply Group Policy check box for the security groups that you want to prevent from having this policy applied. Click to select the Apply Group Policy check box for the groups to which you want to apply this policy. When you are finished, click OK. Note that you can also add other individual users or groups.

Publish a Package

To publish a package to computer users and make it available for installation from the Add or Remove Programs tool in Control Panel:

1. Start the Active Directory Users and Computers snap-in. To do this, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.

2. In the console tree, right-click your domain or organizational unit, and then click Properties.

3. Click the Group Policy tab, click the newly created group policy object (SWING Integrator 4 ActiveX), and then click Edit.

4. Under User Configuration, expand Software Settings.

5. (Windows XP and Windows 2003 only) Right-click the Software installation node and then click Properties.

6. (Windows XP and Windows 2003 only) In the Software installation Properties dialog box, click the Deployment tab.

7. (Windows XP and Windows 2003 only) Click Advanced, and then click to select the Include OLE Class and Product Information check box.

8. (Windows XP and Windows 2003 only) Click Apply and close the Software Installation properties window.

9. Right-click Software installation, point to New, and then click Package.

10. In the Open dialog box, type the full UNC path of the shared installer package that you want (for example, \\server\share\Integrator4.msi). Important: Do not use the Browse button to access the location. Make sure that you use the UNC path to the shared installer package.

11. Click Open.

12. Click Publish, and then click OK.

13. The package is listed in the right pane of the Group Policy window.

14. In the right pane of the Group Policy window, select the newly created package, right click it and select Properties.

15. Set name to SWING Integrator4 ActiveX Controls.

16. Switch to the Deployment tab. In the Deployment options section, uncheck the "Do not display this package in the Add/Remove Programs control panel" check box.

17. Click Advanced… and check option "Ignore language when deploying this package".

18. Click Apply and close the Properties dialog.

Add the Administrative Template that will modify the Registry

It is necessary to add the administrative template which will instruct the Group Policy object to add a Registry key to the machine where the Group Policy is applied.

1. In the left pane of the Group Policy window, in the Computer Configuration section, select the Administrative Templates node.

2. This step differs slightly for Windows 200 and Windows 2003 servers. Windows 2000 only: Right click, and go to View menu item. In the View submenu, uncheck both "Show Policies Only" and "Show Configured Policies Only" options. Windows 2003 only: Right click, and go to View -> Filtering... . In the Filtering dialog, uncheck the "Filter by Requirements information", "Only show configured policy settings" and "Only show policy settings that can be fully managed" options. Click OK to close Filtering dialog.

3. Right click on the Administrative Templates node in the Computer Configuration section and click Add/Remove templates…

4. In the Add/Remove templates window, click Add… and select the usecoinstall.adm file in the file dialog. Click Open.

5. On the Add/Remove Templates window click Close.

6. Now expand the Administrative Templates node in the Computer Configuration section. You should see Registry Settings section there. Select it.

7. In the right panel of the Group Policy window, you should see the "Enable Admin Approved ActiveX Installation via AD" setting. Set its value to Enabled.

8. Close the Group Policy window.

9. Close the Properties window and the Active Directory Users and Computers snap-in.

End-user experience

If everything is set-up correctly, once the end-user logs-in to this machine, the SWING Integrator ActiveX Group Policy should be applied to the machine. When a Windows 2000, XP or 2003 client visits a Domino Web application that contains the SWING Integrator ActiveX control that has not yet been downloaded, the registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\UseCoInstall is checked. If this value exists (and it should, following the Group Policy above), Active Directory is checked to determine whether the ActiveX control has been published. If the control is available (and it should be, following the Group Policy above), it is downloaded and installed with Windows Installer. If the control has not been published, Internet Explorer determines whether or not the current user has adequate permissions to download and run the control. The control is downloaded and run if the user's permissions are sufficient. If they are not sufficient, a red X is displayed on the Web page where the control should appear.

The scenario described above covers the installation of SWING Integrator ActiveX controls in the locked-down environments.