execScript (JavaScript) throws Access Denied Error in VBA

[ions]

I didn't get any responses from the JavaScript forum. However, someone suggested to me that:

"disabling VB and Java scripts is something that IT departments set in group policy to help secure computers. For this situation, I referred the user to their IT people."


I quickly read about Group Policy and opened gpedit.msc. Any ideas which field has to be modified to enable JavaScript? I don't have much faith in IT Departments and would prefer to tell them exactly what to modify.

Thanks

 

[vbaInet]

There must be someone in your IT department who knows what s/he's doing.

At the moment I'm using a simple laptop running Win 8 home edition and that doesn't come with Group Policy but had a look on the spreadsheet containing the group policies and Internet Explorer Processes and Process List are the only two related to Javascript and it's to do with protection from zone elevation so ask them for that.

They'll probably ask you if you want it for the entire machine or just the user.

 

[ions]

vbaInet.

Thank you for that helpful post.

I am just curious. I already played with almost every IE security setting and wasn't able to resolve the issue. Do Group Policies Supersede the settings the user can set in IE options?

Also I am a consultant and I am installing my Access software product... I generally don't know anyone well in IT at most of my clients' sites. The product is a single user reporting tool and if the user has admin rights they can install it on their own using the .exe I provide packaged with runtime etc...

I don't expect IT to be very helpful. Most of the time they don't even respond to my emails.

Thanks vbaInet.

 

[vbaInet]

Yep. IE first checks it's own settings then proceeds to checking group policies before going any further. I don't know why I didn't even think Group Policy. I just haven't been doing any of this stuff in a while.

Well because you're installing it yourself IT doesn't support "Third Party tools", at least that's what they'll tell you. So you can understand why they're not willing to help.

They don't like Consultants much because they think Consultants can be demanding haha!

Look into those policies before approaching them with a solid case.

 

[ions]

Thanks vbaInet.

Look into those policies before approaching them with a solid case.

Agreed.

Thanks

 

[vbaInet]

No problem. As usual, keep us posted!

 

[ions]

vbaInet,

I just sent out an email to one IT Department inquiring if they believe the JavaScript "Access is Denied" error could be the result of Internet Explorer Processes and Process List in Group Policies.

I'll let you know what their response is.

Thank you again for pointing me to these two entries.

 

[ions]

vbaInet,

The IT Department figured out the cause.

MSACCESS.exe is added to the LOCAL MACHINE ZONE LOCKDOWN feature of Internet Explorer through the installation of Microsoft Access 2010 or higher. The machines that generated the error had Access 2010 without my knowledge. This error does not occur with Access 2007 or lower. My software is deployed with Access 2007 runtime.

SOLUTION
- Add the "Mark of the Web" to the html containing the JavaScript Code, this puts the page into the Internet Zone where execScript is allowed.

REFERENCES

Mark Of The Web
http://msdn.microsoft.com/en-ca/library/ms537628(v=vs.85).aspx

Internet Explorer Local Machine Zone Lockdown
http://technet.microsoft.com/en-us/library/cc782928.aspx

Microsoft Access in Local Machine Lockdown since XPSP2 (by design)
http://support.microsoft.com/kb/883866/en-us?spid=2509&sid=402

Advice against simply removing MSACCESS from "Local Machine Zone Lockdown"
http://technet.microsoft.com/en-us/library/cc749149(v=ws.10).aspx

ADDITIONAL NOTES

As of IE11, execScript method is going away.

http://msdn.microsoft.com/en-us/library/ie/ms536420(v=vs.85).aspx

 

[vbaInet]

Interesting! Anytime I hear of "Mark Of The Web" it sounds like something related to Spiderman

I'm sure now your faith in your IT department has gone up a bit.

 

[ions]

vbaInet.

This customer had an outsourced IT Department. I paid a decent sum for this answer.

 

[vbaInet]

It came out of your pocket?

 

[ions]

Yes. This is an off the shelf Access software product I own.

 

[vbaInet]

I see.

 

[ions]

vbaInet,

Thank you again for directing me to the Group Policies. That got the conversation going with the IT department and didn't make me sound like a complete amateur.

I am happy this is resolved and yes "Mark of the Web" sounds ridiculously funny.

The solution according to the IT department is remarkably simple. (Note I have yet to try it since I don't have VM software yet on my new machine)

Add this HTML comment at the top of the HTML file containing the JavaScript.

<!-- saved from url=(0014)about:internet -->

 

[vbaInet]

No problem!

I suppose the proof of the pudding is in the eating.

 

[ions]

vbaInet,

Adding <!-- saved from url=(0014)about:internet --> resolved the issue on one problematic machine according to the IT Department and based on their detailed response I am fairly confident it will work on the rest.

If not, I will follow up here again.

Thank you again.

 

[vbaInet]

As always, we'll wait for feedback.

 

[ions]

vbaInet,

Adding <!-- saved from url=(0014)about:internet --> "Mark of the Web" to the top of the HTML file resolved the issue on another user's machine in a completely different organization as well. I confirmed this user had Access 2010 installed on their machine.

It appears the cause and resolution have been correctly identified by the outsourced IT department. I am happy another issue has been successfully diagnosed and resolved.

Once again thanks for your interest and input in this topic vbaInet.

 

[vbaInet]

Good job!

I shall remember this if I ever need to run a JavaScript script from within Access.