1

Our company has an internal software application (.xbap and .application) that is launched through Internet Explorer and it's hosted on several servers. There are tens of computers that access it. Every time anyone tries to open it there is a Security warning popup.

My goal is to get rid of the warning popup and go straight to launching that application.

I've googled around and found some ways:

  • Add exception to Internet explorer security settings - it's blocked by administration and it would work for the local machine, I want to get rid of the popup for all machines.
  • Generate certificate and sign code - I've successfully signed my code, but security warning popup still appears, but there is a green shield icon instead of the red one (it still appears because the program requires Machine Access - and it always will).

Now I want some way to change group policy, so Admins will take list of servers where our application runs, add it to exception for this security warning popup. This way we won't have to change IE security settings on tens of PCs.

Is this possible? Or is there any other way?

Edit:

Picture of security warning. Let me know if it's there, I can't see it myself.

I cannot upload my screenshot (policy), but I found this one which is exactly the same:

security warning

When I signed my code, the shield turned green and publisher field was filled, but the popup remained.

Edit2: My bad, the application is not .exe but .xbap and .application

Edit3: Managed to get rid of the popup. After code signing, I've added the certificate in IE Trusted Root Certification Authorities and Trusted Publisher. Now I just need to find a way to add it for all users.

  • 1
    can you provide a screenshot of the security warning popup? – SimonS Feb 13 '17 at 12:49
  • Edited, I hope it's there. – Zikato Feb 13 '17 at 13:01
  • You will have to alter the target PCs settings either way. With the certificate, you need to add it as trusted on each station and with the exception you still need to add it in the same manner. That could be scripted or used VIA GPO if possible and should make things easier. – Overmind Feb 13 '17 at 13:10
  • The certificate already should be on all stations. It's certainly on mine, but when I compiled the app, it still showed the popup, even when I was named as the publisher. I'm hoping the exception will work better but I don't see if there is a an easy way to roll it out. – Zikato Feb 13 '17 at 13:15
2

The solution that solved my problem.

  • I've signed my application with a certificate (pfx - with private key). (In Visual studio, right click project, properties, signing ClickOnce manifest)

  • I've passed the certificate without the private key (.cer) to our admin team and they used Group policy (GPO) to add this certificate to IE - Trusted Root Certification Authorities and Trusted publishers.

As a user, I would add it through IE \ Internet options \ Content \ Certificates, correct tabs.

|improve this answer|||||
  • I suspect the signing certificate should only be added to the Trusted Publishers store and if the signing certificate is issued by your own Certificate Authority, the CA certificate should be added to the Trusted Root Certification Authorities store. I also had to uninstall the ClickOnce app and install again to get it to work. I suspect that the trust decision is made at install time and the installed files have the "Zone.Identifier" stream set accordingly. I used Unblock-File to test this before doing the re-install. – Martin Hollingsworth Jan 9 '19 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.