How to: Configure Inclusion List Security (2007 System)

How to: Configure Inclusion List Se...

Collapse All

Language Filter

This page is specific to

Microsoft Visual Studio 2008/.NET Framework 3.5

Other versions are also available for the following:

Microsoft Visual Studio 2010/.NET Framework 4

Microsoft Visual Studio Tools for the Microsoft Office system (version 3.0)

How to: Configure Inclusion List Security (2007 System)

Applies to
The information in this topic applies only to the specified Visual Studio Tools for Office projects and versions of Microsoft Office. Project type Document-level projects Application-level projects Microsoft Office version 2007 Microsoft Office system For more information, see Features Available by Application and Project Type.

Applies to

The information in this topic applies only to the specified Visual Studio Tools for Office projects and versions of Microsoft Office.

Project type

Document-level projects
Application-level projects

Microsoft Office version

2007 Microsoft Office system

For more information, see Features Available by Application and Project Type.

If you have Administrator permissions, you can configure the ClickOnce trust prompt to control whether end users are given the option of installing Visual Studio Tools for Office solutions by saving a trust decision to the inclusion list. For information about inclusion lists, see Trusting Office Solutions by Using Inclusion Lists (2007 System).

For solutions that are in each of five zones, you can set the following options:

Enable the ClickOnce Trust Prompt Key and the inclusion list. You can allow end users to grant trust to Office solutions that are signed with any certificate.
Restrict the ClickOnce Trust Prompt Key and the inclusion list. You can allow end users to install Office solutions that are signed with a certificate that identifies the publisher, but that is not already trusted.
Disable the ClickOnce Trust Prompt Key and the inclusion list. You can prevent end users from installing any Office solution that is not signed with an explicitly trusted certificate.

Enabling the Inclusion List

Enable the inclusion list for a zone when you want end users to be presented with the option of installing and running any Visual Studio Tools for Office solution that comes from that zone.

To enable the inclusion list by using the registry editor

Open the registry editor:
1. Click Start, and then click Run.
2. In the Open box, type regedt32.exe, and then click OK.
Find the following registry key:
\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel
If the key does not exist, create it.
Add the following subkeys as String Value, if they do not already exist, with the associated values.
String Value subkey
Value
Internet
AuthenticodeRequired
UntrustedSites
Disabled
MyComputer
Enabled
LocalIntranet
Enabled
TrustedSites
Enabled
By default, Internet has the value AuthenticodeRequired and UntrustedSites has the value Disabled.

String Value subkey	Value
Internet	AuthenticodeRequired
UntrustedSites	Disabled
MyComputer	Enabled
LocalIntranet	Enabled
TrustedSites	Enabled

To enable the inclusion list programmatically

Create a Visual Basic or Visual C# console application in Visual Studio.

Open the Program.vb or Program.cs file for editing and add the following code.

Visual Basic

Dim key As Microsoft.Win32.RegistryKey
key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel")
key.SetValue("MyComputer", "Enabled")
key.SetValue("LocalIntranet", "Enabled")
key.SetValue("Internet", "AuthenticodeRequired")
key.SetValue("TrustedSites", "Enabled")
key.SetValue("UntrustedSites", "Disabled")
key.Close()

Microsoft.Win32.RegistryKey key;
key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\\MICROSOFT\\.NETFramework\\Security\\TrustManager\\PromptingLevel");
key.SetValue("MyComputer", "Enabled");
key.SetValue("LocalIntranet", "Enabled");
key.SetValue("Internet", "AuthenticodeRequired");
key.SetValue("TrustedSites", "Enabled");
key.SetValue("UntrustedSites", "Disabled");
key.Close();

Build and run the application.

Restricting the Inclusion List

Restrict the inclusion list so that solutions must be signed with Authenticode certificates that have known identity before users are prompted for a trust decision.

To restrict the inclusion list

Open the registry editor:
1. Click Start, and then click Run.
2. In the Open box, type regedt32.exe, and then click OK.
Find the following registry key:
\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel
If the key does not exist, create it.
Add the following subkeys as String Value, if they do not already exist, with the associated values.
String Value subkey
Value
UntrustedSites
Disabled
Internet
AuthenticodeRequired
MyComputer
AuthenticodeRequired
LocalIntranet
AuthenticodeRequired
TrustedSites
AuthenticodeRequired
By default, Internet has the value AuthenticodeRequired and UntrustedSites has the value Disabled.

String Value subkey	Value
UntrustedSites	Disabled
Internet	AuthenticodeRequired
MyComputer	AuthenticodeRequired
LocalIntranet	AuthenticodeRequired
TrustedSites	AuthenticodeRequired

To restrict the inclusion list programmatically

Create a Visual Basic or Visual C# console application in Visual Studio.

Open the Program.vb or Program.cs file for editing and add the following code.

Visual Basic

Dim key As Microsoft.Win32.RegistryKey
key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel")
key.SetValue("MyComputer", "AuthenticodeRequired")
key.SetValue("LocalIntranet", "AuthenticodeRequired")
key.SetValue("Internet", "AuthenticodeRequired")
key.SetValue("TrustedSites", "AuthenticodeRequired")
key.SetValue("UntrustedSites", "Disabled")
key.Close()

Microsoft.Win32.RegistryKey key;
key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\\MICROSOFT\\.NETFramework\\Security\\TrustManager\\PromptingLevel");
key.SetValue("MyComputer", "AuthenticodeRequired");
key.SetValue("LocalIntranet", "AuthenticodeRequired");
key.SetValue("Internet", "AuthenticodeRequired");
key.SetValue("TrustedSites", "AuthenticodeRequired");
key.SetValue("UntrustedSites", "Disabled");
key.Close();

Build and run the application.

Disabling the Inclusion List

You can disable the inclusion list so that end users can only install solutions that are signed with a trusted and known certificate.

To disable the inclusion list

Open the registry editor:
1. Click Start, and then click Run.
2. In the Open box, type regedt32.exe, and then click OK.
Create the following registry key if this does not already exist:
\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel
Add the following subkeys as String Value, if they do not already exist, with the associated values.
String Value subkey
Value
UntrustedSites
Disabled
Internet
Disabled
MyComputer
Disabled
LocalIntranet
Disabled
TrustedSites
Disabled

String Value subkey	Value
UntrustedSites	Disabled
Internet	Disabled
MyComputer	Disabled
LocalIntranet	Disabled
TrustedSites	Disabled

To disable the inclusion list programmatically

Create a Visual Basic or Visual C# console application in Visual Studio.

Open the Program.vb or Program.cs file for editing and add the following code.

Visual Basic

Dim key As Microsoft.Win32.RegistryKey
key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel")
key.SetValue("MyComputer", "Disabled")
key.SetValue("LocalIntranet", "Disabled")
key.SetValue("Internet", "Disabled")
key.SetValue("TrustedSites", "Disabled")
key.SetValue("UntrustedSites", "Disabled")
key.Close()

Microsoft.Win32.RegistryKey key;
key = Microsoft.Win32.Registry.LocalMachine.CreateSubKey("SOFTWARE\\MICROSOFT\\.NETFramework\\Security\\TrustManager\\PromptingLevel");
key.SetValue("MyComputer", "Disabled");
key.SetValue("LocalIntranet", "Disabled");
key.SetValue("Internet", "Disabled");
key.SetValue("TrustedSites", "Disabled");
key.SetValue("UntrustedSites", "Disabled");
key.Close();

Build and run the application.

Tasks

How to: Add or Remove Inclusion List Entries (2007 System)

Concepts

Trusting Office Solutions by Using Inclusion Lists (2007 System)

Security in Office Solutions (2007 System)