Attempting to set Compatibility Flags for Active X Control

Usage and Config Security
1

(imported topic written by mpainter)

I am attempting to set the Compatibility Flag for various Active X controls. My relevance appears to be correct, but my action is not working. I have tried the action with the “” and without them. No luck. Any help would be greatly appreciated.

not exists 1 whose (((conjunction of (if exists key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer \ActiveX Compatibility{40F23EB7-B397-4285-8F3C-AACE4FA40309}” of it then (if exists values “Compatibility Flags” of it then ((it as integer) of (it as string) of it = (it as integer) of “1024”) of values “Compatibility Flags” of it else false) of key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility{40F23EB7- B397-4285-8F3C-AACE4FA40309}” of it else false) of (if x64 of operating system then (x32 registry; x64 registry) else x32 registry) or not exist values “Compatibility Flags” of keys “SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility{40F23EB7-B397-4285-8F3C-AACE4FA40309}” of keys “HKEY_LOCAL_MACHINE” of (if x64 of operating system then (x32 registry; x64 registry) else x32 registry)) and (exist values “Compatibility Flags” of keys “SOFTWARE \Microsoft\Internet Explorer\ActiveX Compatibility{40F23EB7-B397-4285-8F3C-AACE4FA40309}” of keys “HKEY_LOCAL_MACHINE” of (if x64 of operating system then (x32 registry; x64 registry) else x32 registry) and (exist values “Compatibility Flags” whose (type of it = “REG_DWORD”) of keys “SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility{40F23EB7-B397-4285-8F3C-AACE4FA40309}” of keys “HKEY_LOCAL_MACHINE” of (if x64 of operating system then (x32 registry; x64 registry) else x32 registry) or not exist values “Compatibility Flags” of keys “SOFTWARE \Microsoft\Internet Explorer\ActiveX Compatibility{40F23EB7-B397-4285-8F3C-AACE4FA40309}” of keys “HKEY_LOCAL_MACHINE” of (if x64 of operating system then (x32 registry; x64 registry) else x32 registry)))))

waithidden “{pathname of system folder}\reg.exe” add “” /v “Compatibility Flags” /t REG_DWORD /d 1024 /f

if {x64 of operating system}

waithidden “{pathname of system folder}\reg.exe” add “” /v “Compatibility Flags” /t REG_DWORD /d 1024 /f /reg:64

endif

2

(imported comment written by mpainter)

Hmm. It stripped out my registry key. I have attached a text file with the Action detail.

1 Like
3

(imported comment written by Eric Walker)

Hi Marcus,

I’m having trouble finding this check – is it one you’re creating by hand? Just curious.

Four details that would be good to mention:

  • I think you need a slash after “ActiveX Compatibility”
  • The remediation action shouldn’t have “” in the string for the registry key. See reg.add /h for more information on the syntax.
  • For actionscript, text surrounded by “{” and “}” is interpreted as relevance and needs to be escaped if it appears in a registry key. One way to escape it is to use two opening braces: “{{”.
  • It doesn’t look like the second reg.exe statement is needed in this case.

Here is a remediation that seems to be working for me:

waithidden “{pathname of system folder}\reg.exe” add “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility{{40F23EB7-B397-4285-8F3C-AACE4FA40309}” /v “Compatibility Flags” /t REG_DWORD /d 1024 /f

Eric

4

(imported comment written by Eric Walker)

It looks like the wiki is interpreting away some characters. I suspect you had a slash, and it just got dropped. Also, the “” in my previous message contained a square bracket ([).

Eric