it's true... i've already tried it... we can't pass through user's local machine security checks.
actually there's another way to run executable files in your client's local machine, but this can't pass through your client's security checks either. i suggest that you use the asp.net <object> tag to attach your browser with a downloadable winform, while in your winform's on load events you write down this code :
System.Reflection.Assembly.LoadFrom(YOUR WINFORM DLL's URL);
and after that you can just create new instance of your winform class and told your form to show() or anything else

, but remember you should use the :
System.Reflection.Activator.CreateInstance(typeof(winformclass));
to create new instance of your winform class cause you get the assembly at runtime, not design time

.
but anyway, you must told your client to trust your assembly, and told him to enable activeX, if not there will be a messagebox appearing telling you that you don't have permissions blablabla
anyway, i've just tried this downloadable winform once, so if you guys have a better way, please tell me i'll be very grateful
