Consider the following scenario:

  • You disable the DNS Client service on a Windows 8-based computer.

  • The ActiveX Installer Service feature is enabled on the computer.

  • You use Internet Explorer to browse to a site that requires you to install an ActiveX control.

In this scenario, you are prompted to enter administrator credentials or administrative approval unexpectedly.

Note The behavior is different in Windows 7. The ActiveX Installer Service works correctly if the DNS Client service is disabled in Windows 7.


This behavior is by design. A new firewall rule introduced in Windows 8 prevents the ActiveX Installer Service from making DNS queries directly when the ActiveX Installer Service cannot rely on the DNS Client service to do the query on its behalf.


Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

To work around this issue, set the following registry subkey. This registry subkey exempts DNS datagrams from the ActiveX Installer Service firewall policy.
"AxInstSV-4"="V2.0|Action=Allow|Dir=Out|RPort=53|Protocol=17|app=%windir%\\System32\\svchost.exe|Svc=AxInstSV|Name=AxInstSV DNS outbound allow|Desc=Allow outbound DNS UDP traffic from AxInstSV|"

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Thank you for your feedback!