Hi,

ClickOnce is still a candidate for your application I think. You have two options:

- let your users click on a popup to allow the clickonce application to perform certain actions that require elevated privileges (this is triggered automatically, but the user is warned of a security risk and has to click 'OK')
- make your application a 'trusted' one and make sure every pc on which it is deployed knows that it is trusted

See this article for more info: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechart/html/ClickOnceSec.asp

Another possibility is to create an msi package for your app(either with VS setup project, WiX or a commercial product like installshield) and deploy that package to your pc's using AD group policy or a more robust tool like Microsoft SMS.

cheers,
Stephane

Am I correct in saying though that ClickOnce does not support Registry Entries?

I need my app to write some registry entries, as well as install a 3rd party database as well.

Does the distribution through AD Group Policy only apply to ClickOnce, or can I use Installshield for this as well.

Hi,

<edit> I wasn't exactly clear in the previous post, I see now. A typical scenario I would use would be:

- deploy the app with clickonce
- sign the app with a strong name
- create a certificate that allows all code signed with your key to at least write to the registry
- distribute the certificate through SMS or AD group policy

<edit>

generally speaking, clickonce apps do not have enough rights to write to registry. You can either sign your app and distribute a certificate like described above to give all code with that signature the rights you need, or you could declare that your clickonce app needs those rights in your vs project (there's a wizard that can do this for you), but then the user would get a pop-up asking for confirmation that the app gets these rights. In the latter case, if your user clicks 'no', you won't be able to write to the registry. Your user will get this pop-up everytime, I think.

So, clickonce CAN write to the registry, but only if you allow it to. And that needs to be done either at the enterprise level (distributing the cert) or at the user level (allowing the untrusted application to do this, which I wouldn't advise).

Stephane