Important

Starting with the .NET Framework version 4, the common language runtime (CLR) is moving away from providing security policy for computers. We recommend that you use Windows Software Restriction Policies (SRP) or AppLocker as a replacement for CLR security policy. The information in this topic applies to the .NET Framework version 3.5 and earlier; it does not apply to the .NET Framework 4 and later. For more information about this and other changes, see Security Changes in the .NET Framework 4.

The highest level of security policy is enterprise-wide. Successive lower levels of hierarchy represent further policy restrictions, but can never grant more permissions than allowed by higher levels. The following policy levels are implemented:

1. Enterprise: Security policy for all managed code in an enterprise.

2. Machine: Security policy for all managed code run on the computer.

3. User: Security policy for all managed code run by the user.

4. Application domain: Security policy for all managed code in an application.

A policy level consists of a set of code groups organized into a single rooted tree (see CodeGroup), a set of named permission sets that are referenced by the code groups to specify permissions to be granted to code belonging to the code group, and a list of fully-trusted assemblies.

Use SecurityManager.PolicyHierarchy to enumerate the policy levels.

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows XP SP2 x64 Edition, Windows Server 2008 (Server Core Role not supported), Windows Server 2008 R2 (Server Core Role not supported), Windows Server 2003 SP2

.NET Framework

.NET Framework Client Profile

Reference