Microsoft Internet Component Download is a technology, used by some Microsoft software to install or update components for them via Internet. It is mostly known by automatic installing and updating of ActiveX plug-ins when opening particular web sites via MS Internet Explorer (from 3.0 to 11.0). Also it is using by MS Windows Media Player (from 6.0 to 12.0) for automatic codec installation and for player automatic update feature.

MSDN article: https://web.archive.org/web/20000420214227/http://msdn.microsoft.com/workshop/delivery/download/overview/entry.asp

When an application is trying to load an ActiveX object (control element) or other Internet Component, first Windows is looking for it in system registry, then (if the object is not found or if it's need to check for an updated version) Windows is looking for it in Internet and is installing it to the PC. Then the object is running from local instance.

Downloaded components are saving in C:\WINDOWS\Downloaded Program Files\ folder (C:\WINNT\Downloaded Program Files\ on Windows NT 4.0 & 2000; C:\WINDOWS\occache or C:\WINNT\occache if MSIE 3.0 is used). It's possible to launch their uninstallation via this folder (there is an BHO to manipulate ActiveX components when this folder is open in Windows Explorer, available when MSIE is installed).

Note that components which are installed manually (not via ICD) are not listed in Downloaded Program Files folder. The are still exists in registry, are still working, but are not visible in Downloaded Program Files and probably will not update by ICD.

MSICD can download the components objects (their codebases) from pre-defined locations, or lookup them in Microsoft object servers.

As of April, 2025 some of object servers are partially continues working, but with many broken links in search results. It is unknown when the servers will completely shut down. But this sometimes will be: the MSIE and the classic Windows Media Player applications are already marked as deprecated, so probably all online services for them also may be shut down in near future.

ActiveX controls are loading from HTML pages via such HTML code:

<OBJECT ID="AgentControl" width=0 height=0
CLASSID="CLSID:D45FD31B-5C6E-11D1-9EC1-00C04FD7081F"
CODEBASE="http://activex.microsoft.com/activex/controls/agent2/MSagent.exe#VERSION=2,0,0,0">
</OBJECT>

The OBJECT tag contains CLASSID (identifier of the ActiveX control) and CODEBASE (where it can be downloaded). The Class Identifier is required parameter, and Code Base is optional. Object Class ID always have GUID format. Object Code Base can contain URL and, optionally, minimum component version information.

In case when the specified ActiveX control is installed, MSIE checks its version and runs it. Otherwise MS ICD is attempting to install the object from Internet. In example above, MSIE will install Microsoft Agent from specified link. Also the online installation will be started in case if the object is already installed, but its version older than 2.0.0.0. So the ICD also can act as automatic update service.

By the design, CODEBASE parameter also may be omitted at all. This means that the object should be searched in public online database, maintained by Microsoft.

Note: sometimes, CODE parameter can be used as equivalent for CODEBASE, but it is used only in early days of ActiveX.

Main article: https://graphcomp.com/info/specs/ms/codewld.htm

All components, distributable via ICD, can be distributed in these formats: .ocx, .exe, .dll (application/x-pe-win32-x86), .inf (application/x-setupscript) or .cab archive (application/x-cabinet-win32-x86) with some such content. If .cab format is used, it should contain an .inf installation script and the binary files. Also XML (Open Software Distribution) format can be used in some cases. The MIME content type can also have different OS and architecture (such as win32-alpha or mac-ppc).

Syntax of the Internet Component Setup Script is enough documented by Microsoft.

The installation files may contain a digital signature to verify their integrity and to prevent accidental installing of fake applications.

ICD is used to fetch compressed media decoders by Windows Media Player 5.2 and newer. When user is opening a ASF or WMV/WMA media file and some codec used in it is not installed on the machine, WMP is looking to the search engine for codebase of codec.

Many well-known codecs have own CLSIDs. At this moment known that at least MPEG4, WMV7, WMV8 and WMA decoders are distributed online in such way.

Codecs installed in such way in some cases are appearing in C:\WINDOWS\Downloaded Program Files\ folder as ActiveX controls.

Windows Media Player from 5.2 Beta to 6.4 is using ICD to find newer versions of the player. They are using ICD object search server defined at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\PlayerUpgrade\UpgradeServer or specified in NetShow multimedia content if it is version-locked (by default - http://codecs.microsoft.com/isapi/mpupgrade.dll). The WMP own component ID is {3253344D-9980-0010-8000-00AA00389B71}. It were used in early 2000s to promote WMP 7 to computers with WMP 6. As of April, 2025, the server always returning either 403 or 404.

Currently it is not fully found how that server worked. Seems that if upgrade is not need, the server responses 404. And if update is actually needs, then responds with something other.

Since WMP 7, another update algorithm is used.

Active Channels with OSD data inside CDF files are working as Software Update Channels if MSIE 4/5/6 is installed. They're utilizing ICD to track and install updates.

When exact codebase location is unknown or unspecified, MSIE (or other software that uses ICD) is calling to Microsoft's special search engines. They also known as "URL-to-object index server", "object store" or "Internet Explorer Component Gallery". Path to the search servers and access order are specified via HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CodeBaseSearchPath registry key. Its default value is CODEBASE;<http://activex.microsoft.com/objects/ocget.dll>;<http://codecs.microsoft.com/isapi/ocget.dll>, meaning first try CODEBASE path specified by creator, and only in case of lack of success look via registry-specified search engines in sequential order. There also http://codecs.microsoft.com:80/isapi/mpupgrade.dll server, doing similar thing, but only for Windows Media Player 6.x (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MediaPlayer\PlayerUpgrade\UpgradeServer).

WebOne since v0.17.5 can emulate the codebase search engine. Information about the emulation will update during WebOne development.

An request to codebase search engine looks as a POST HTTP request with GUID or mimetype parameter, and sometimes version parameter.

CLSID={class id}
Version=a,b,c,d
MIMETYPE=mimetype

If the requested component is found, the server returns the downloadable code cabinet file (.cab), setup script (.inf), or portable executable (.exe, .dll, .ocx) file, or makes a 302 redirect to it. If search is unsuccessful, server returns a 404 error. The mimetype parameter is used instead of GUID in case when it is need to view a file in MSIE.

If version is specified, the search engine should reply 404 in case when the specified version is equal than known latest version or newer than it. This is used to automatic update outdated components in case when they became old.

Backend part of the URL-to-object index server (Microsoft Internet Component Download ISAPI Dll) has been leaked in 2001. Sadly, without its database. However, it can help with reconstruction of its algorithms. Interesting that it probably does not see into Accept (MIME type) and Accept-Language headers of HTTP request, however MSDN recommends to do this.

As of April, 2025, the real http://activex.microsoft.com/objects/ocget.dll server is replying 403 in most of cases, but sometimes replying with correct 302 redirects (sometimes to dead addresses).

WebOne proxy server can catch requests to Microsoft object index server, and return right URLs of components. This is configured using WebOne configuration file(s), section [ActiveXGallery].

Use this option to enable or disable at all the Internet Explorer Component Gallery service emulation. If ActiveXGalleryEmulation=disable, WebOne will not catch requests and all will be directed to real server.

The default webone.conf contains default URLs of the components search engines: Internet Explorer Component Gallery (ActiveX Controls), WMP Codecs, WMP 6.4 Update. If you know extra URLs, it's possible to add them here.

Add components' GUIDs and their codebase URLs into [ActiveXGallery] section to provide ability to install these components on demand.

Example:

[ActiveXGallery]
{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}=http://activex.microsoft.com/activex/controls/agent2/MSagent.exe
{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F},EN=http://activex.microsoft.com/activex/controls/agent2/MSagent.exe
{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F},latest=2.0.0.0

Default URL is required. To provide multi-language support, you can specify extra language versions. For unlisted languages the default version will be used.

To enable correct functionality of auto-update service, it is a good idea to specify the latest version of the control. If client sends an "check for update" request and the installed version is equal to the specified or is later than it, WebOne will reply with a 404 code meaning "no update is need".