Case of the Office XP Web Component ActiveX

There was a website used for reporting, but when users went onto Windows 7 for some users the reports did not show up, only on some user machines.

For this type of issues I typically like to get two logs:

The Fiddler trace to check HTTP traffic and what is downloaded, and ProcMon to check IE settings and loading of ActiveX controls.

First I checked in Fiddler trace if ActiveX control was being used:

In this case I searched Fiddler trace for <object id= to find ActiveX controls. Fiddler highlighted the relevant page:


Then searching the page we found the class ID for the control:


Searching ProcMon log for the CLSID with the following filter:

Path Contains 0002E552-0000-0000-C000-000000000046


This had AlternateCLSID so I checked the details view and from the Data field got the value I wanted:


Using this GUID as a Path filter in ProcMon I found the DLL we were looking for, in this case C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL


So I then set filter to Path Contains OWC10.dll. The  file existed, but there was no Image Load.

On a broken machine:


On a working machine, we saw the Load Image that occurs when an ActiveX control is actually loaded:


With this line selected, I added “Thread ID” column, reset filter, then right clicked and chose to Include this Thread ID. This allows me to look at only what the thread that loaded the ActiveX control was doing, and filters out a lot of garbage.


I then added to filter:

  • Operation is RegQueryValue
  • Path Contains Internet Settings
  • Result is SUCCESS


From this filter we only have a few settings to check:


With the Zones\1\ settings being most likely, as it is the Zones keys where most IE security settings are stored.

The number after Zones is the zone the site is in, these are described in detail here

The number refers to:

0 My Computer
1 Local Intranet Zone
2 Trusted sites Zone
3 Internet Zone
4 Restricted Sites Zone

Checking the article Internet Explorer security zones registry entries for advanced users at

We can see the value that was set to “1” (enabled) for setting 1406 is the setting for “Miscellaneous: Access data sources across domains”

(For additional registry settings in IE10 refer to )

Configuring this setting for users fixed the issue, and we were able to deploy setting via Group Policy.


You can also use IEZoneAnalyzer from here

To compare settings across multiple machines, compare against a baseline, or check what Zone a particular site falls into and what settings it receives.

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Fiddler, Internet Explorer, ProcMon and tagged . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s