SP3 installed, vs. SP3 slipstreamed, difference in default security settings?

A Lotus Notes installation, Domino 7x, which ends up trying to start a IBM SameTime 7.5.1 chat client, fails on some machines.

Specifically, it fails on Windows XP machines that have SP3 slipstreamed, whereas Windows XP machines which have had SP3 installed afterwards, work fine.

The problem can be worked around temporarily by adjusting the advanced settings in Internet Explorer, related to Active Content:

[x] Allow active content to run in files on My Computer

Setting that [x] there makes the whole thing work, removing it (which is the default setting), makes it not work. But as I said, this setting is disabled on the machines that had SP3 installed afterwards, and it works there.

This isn't an acceptable solution, so we need to figure out the root cause of this.

The chat/meeting client initialization process works like this:

• A small html page is downloaded from the SameTime server web application. This html page is just a small dummy HTML page (actually contains the text Dummy as well), as well as a javascript piece that uses window.open to open a new browser window with the actual meeting client software, which is part java application.
• This HTML file is saved locally, in the Temp directory beneath the users home directory
• A new IEXPLORE.EXE process is spawned, with a hidden main window, to load this html file
• The javascript runs, and a few seconds later, when the rest of the meeting client is loading, the IEXPLORE.EXE process that was originally spawned, is instructed to exit, which it does

What we observe is that when the IEXPLORE.EXE process is spawned, Lotus Notes loses focus, until the process dies, at which point Lotus Notes regains focus. Obviously the process started, and this is verified by the fact that we see it in Task Manager.

I can also go and open the html page from the temp directory, extract the URL from the window.open call, and paste it into the address bar in Lotus Notes, at which point the meeting client pops up in all its glory, as it should.

If I open the HTML file in Internet Explorer, an information bar drops down informing us that it has blocked execution of active content. We can ask it to enable it from the dropdown menu of the bar, at which point the meeting client pops up as it should.

We believe that the problem is the javascript, and that IE for some reason disallows execution of this script in this context.

The strange part is that a machine that has SP3 installed, instead of slipstreamed, that is, the machine originally had XP

So we have this:

• Slipstreamed: Shows information bar if manual execution, does not work from Lotus Notes
• Patched: Shows information bar if manual execution, works from Lotus Notes

So, the questions are:

• Does anyone know of any specific security differences between installing SP3, and slipstreaming SP3, that could impact this?
• Does anyone have any other ideas for what specifically we can try to adjust on the machine in order to get this working?
• Is there a list of the hotfixes that the slipstreamed edition has? This is a download from Microsoft's web pages, basically a new image with SP3 integrated.

IBM, which makes SameTime, the meeting client in question, has asked the client to just enable active content, but this solution is unacceptable, and since all the patched machines don't need that setting enabled to work, we believe it is unnecessary.

Anything that anyone could tell us that would shed some light on this would be most welcome.