Update to block out-of-date ActiveX controls in Internet Explorer

About this update

This update introduces the out-of-date ActiveX control blocking security feature. This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls. By using the out-of-date ActiveX control blocking security feature, Internet Explorer lets you do the following:

• Know when Internet Explorer prevents a webpage from loading common but out-of-date ActiveX controls.

• Interact with parts of a webpage that are unaffected by out-of-date ActiveX controls.

• Update out-of-date ActiveX controls so that they are up to date and safer to use.

• Inventory the ActiveX controls that your organization is using.

Important notes

• This feature was first introduced in the August cumulative security update for Internet Explorer (MS14-051) on Windows 7 SP1 and later versions. Support for Internet Explorer 9 was later added for Windows Vista SP2 and Windows Server 2008 SP2 as part of the November cumulative security update for Internet Explorer (MS14-065).

• Although the August cumulative security update for Internet Explorer (MS14-051) enabled this capability, out-of-date ActiveX controls began to be blocked on September 9, 2014, to provide organizations time to identify and resolve dependencies. For more information, see the More information section.
  
  
   

• The Internet Explorer administrative templates were updated with four new Group Policy settings to support out-of-date ActiveX control blocking. You can download the updated Internet Explorer administrative templates here. A fifth manageability setting was later exposed through the registry. You can learn more about this setting here.

• It can take up to twelve hours from the time that you configure the feature for it to be fully functional in Internet Explorer.

The out-of-date ActiveX control blocking feature works in the following environments:

• Internet Explorer versions 8 through 11 on Windows 7 SP1 and later versions

• Internet Explorer versions 8 through 11 on Windows Server 2008 R2 SP1 and later versions

• Internet Explorer 9 on Windows Server 2008 SP2 and Windows Vista SP2

• All security zones except the Local Intranet Zone and the Trusted Sites Zone

For more information about blocking out-of-date ActiveX controls, go to the following websites:
 

Out-of-date ActiveX control blocking

List of blocked ActiveX controls

Internet Explorer begins blocking out-of-date ActiveX controls

Updated Group Policy Settings

More Information

Enterprise administrators are encouraged to review the Out-of-date ActiveX control blocking article on Microsoft TechNet for more information about this feature and the new Group Policy options which can be employed to manage it.