In This Topic
Deployment / Deployment from a network location addendum

Deployment from a network location addendum

In This Topic

If you want to deploy from a network location, you need to know, that you cannot load .NET assemblies from network shares without first changing the system security policy.

As it is a major security policy change that can be a potential security breach, we strongly advise that you contact the local system and network administrator to make sure it complies with the company security policy before going further.

It is strongly recommended to carefully read and understand the Microsoft .NET Framework Code Access Security Policy tool documentation as a prerequisite.

Network shares get "LocalIntranet" permission by default so you need to use the Code Access Security Policy tool (Caspol.exe) that comes within the .NET Framework to grant full trust on network shares and/or assemblies.

To grant trust to a network location, you must have administrator privileges and change the security policy at the Machine level.

To trust everything on the share \\server\share, the command is : CasPol.exe -machine -polchgprompt off -addgroup 1.2 -url file://///server/share/* FullTrust

And it reads the following:

  • -machine : modify the machine level of the policy
  • -polchgprompt off : turns the confirmation prompt off (might be useful in an automated deployment process)
  • -addgroup 1.2 : add a code group under group 1.2. In the default policy, group 1.2 is the "LocalIntranet" group, so the new code group that we're creating will only be checked if the file comes from the intranet
  • -url file://///server/share/* : The URL must include a protocol and a wildcard character (*) can be used to specify multiple assemblies from a particular URL, if you use a mapped network drive, let's say Z:, then simply replace file://///server/share/* with file:///Z:/*
  • FullTrust : the permission set to grant assemblies that match the code group
Of course this example should not be used as is since it grants full access to every assembly in a shared folder (which is a bad practice) and needs to be adapted to your own situation.

In addition, if you are running a 64-bit operating system, make sure to run caspol.exe on both the 32-bit version and the 64-bit version of the framework.