ActiveX & IE Security Zones

Hello all,

I am non-developer doing some research on how to best lock down Internet Explorer security zones against active content threats. My question centers around how IE allows a user/administrator to select settings such as "Script ActiveX controls marked safe for scripting" and "Run ActiveX controls and plug-ins". I have read a large amount of Microsoft documentation but I am still confused on how ActiveX controls are initialized, scripted or run. If for example I enable scripting for controls marked as safe but then disable running any ActiveX controls will any controls actually run?
If you have any URLs or documents which address these kinds of questions I would greatly appreciate it!

Thanks for your help,
Rob