The IE blog has an interesting post up regarding IE 8 and improvements to the ActiveX model for IE8. Looks like we will be getting a per-user install of ActiveX, SWEET. This will be a big plus for companies and should reduce the number of UAC prompts most users would see.
Per-User (Non-Admin) ActiveX
Running IE8 in Windows Vista, a standard user may install ActiveX controls in their own user profile without requiring administrative privileges. This improvement makes it easier for an organization to realize the full benefit of User Account Control by enabling standard users to install ActiveX controls used in their day-to-day browsing.
If a user happens to install a malicious ActiveX control, the overall system will be unaffected, as the control was installed only under the user’s account. Since installations can be restricted to a user profile, the risk and cost of compromise (and, in turn, the total cost of administering users on a machine) will be lowered significantly.
It appears this will be the default behavior and if you really want to continue to lock down ActiveX controls you can do so via Group Policy.
More details on ActiveX changes coming in IE8 in the IE Blog post.