MS Patch KB2976627 Java ActiveX version control and how it affects RDS sessions

Question

The recent patch for MS to prevent IE from using older versions of Java ActiveX seems to put a version file under %localappdata% and pull this file from the Internet.  My questions are:
1.  How does this work when you are using a mandatory profile for RDS users?
2.  We don't allow internet access to the RDS servers/sessions.  How does that affect this whole process?
I'm quite confused how this patch works with RDS overall, so any explanation is appreciated.

Answer 1

I assume you are referring to this http://support.microsoft.com/kb/2991000
"Starting September 9, 2014, out-of-date ActiveX controls will be blocked on computers that have the August Cumulative security update for Internet Explorer (MS14-051)(http://support.microsoft.com/kb/2976627/ )or a later update applied"
If you apply this update and your users do not have access to the Internet, the control will simply be blocked.
Microsoft list these options...
"If your organization has to have more time to lessen dependencies on outdated Java controls, you can take one of the following actions: •Turn off the feature completely. To do this, use the Turn off blocking of outdated ActiveX controls for Internet
Explorer Group Policy setting (or the corresponding registry key).
Note This is the less secure option. 
•Turn off the feature for a specific domain. To do this, use the Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains Group Policy setting (or the corresponding registry key). This setting lets you turn off the feature on
the specific domains on which your enterprise has an outdated Java dependency."
Since you are using mandatory profiles, I would recommend updating the ActiveX control in the mandatory profile -> http://technet.microsoft.com/en-us/library/gg241183(v=ws.10).aspx
HTH,
Jeremy