.NET security for enterprise

[techsmith]

We are trying to implement full trust for all assemblies created with a specific strongname for any user on any machine on the network.

We have successfully created a code group using our strong name and this seems to work for any user on the client that we have added the code group to.

Is there a way to add this code group once to all users/client machines as user/machine/enterprise levels imply that we can?

If not, is there a quick way to roll out the setting using a batch or xcopy approach?

Also, if anyone fancies writing a good FAQ for .NET security settings I'm sure there would be a lot of thankful people out there...

 

[chrissie1]

I think this has been covered before and I thinkk they suggested group policies. But I'm not sure. So we wait for chiph or Rick or some other smart person.

Christiaan Baes
Belgium

I just like this --> [Wiggle] [Wiggle]

 

[techsmith]

I don't know the first thing about group policy, so I'm hoping someone can walk me through the solution.

Thanks for your input Chrissie

 

[techsmith]

Still need HELP!

I have got as far as creating a code group for all code using a specific strong name. I have also ticked the 2 boxes that make this 'LevelFinal' and 'Exclusive' (required if you want the evaluation of permissions to ignore anything at the same level or below this code group).

Then there is a handy feature in mscorcfg.msc when you right click on the 'runtime security policy' node - Create Deployment Package. This builds a .msi file that can be used to recreate a specific runtime security policy level on another machine, e.g. Enterprise level. Unfortunately, it overwrites any settings on the target machine, so I'm going to investigate coding my own when I get time.

My current problems are that users need admin rights for the .msi to work (so I'm thinking give it to my network admin to sort out under Group Policy).

The main problem though is that it needs to be run twice The first time the .msi file is run, nothing changes. The second time it runs the new code group is created.

Has anyone come across this before? Any ideas?