Unable to Install ClickOnce Application due to Security Settings (Windows 10)

Question

When attempting to install a Microsoft-signed ClickOnce application, an error appears stating "Your administrator has blocked this application because it potentially poses a security risk to your computer" and "Your security settings do not allow this application to be installed on your computer".

As the administrator who would have set said policies, I cannot for the life of me figure out why this is being blocked for just one user and not other users whose PCs are based off the same image and why it works for other users who should be enjoying the same privileges as the user who is receiving the following message. Note that the exact same domain group policies are applied to this user that is experiencing the error and to users who are not receiving the error.

Even attempting to run the application "as an administrator" does not solve the issue. The event logs show no errors, and I cannot otherwise find any logs to help diagnose the issue.

What local policies or settings would allow or deny this application?

Answer 1

This is caused by the "ClickOnce Trust Prompt Behavior": https://msdn.microsoft.com/en-us/library/ee308453.aspx

To adjust this, simply change the values in the Registry and you should be able to install the application.

To enable the ClickOnce trust prompt by using the registry editor Open the registry editor:

Click Start, and then click Run.

In the Open box, type regedit, and then click OK.

Find the following registry key:

\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel

If the key does not exist, create it.

Add the following subkeys as String Value, if they do not already exist, with the associated values shown in the following table.

On my computer, the values were set to "Disabled" and I have no clue which application did that. I changed the values to default and now everything works again like it should.

Or you can just delete the key "TrustManager" itself and everything is working as well.

---

Answer 2

Here is a powershell script that will update the values:

Set-Itemproperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'Internet' -value 'Enabled'
Set-Itemproperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'LocalIntranet' -value 'Enabled'
Set-Itemproperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'MyComputer' -value 'Enabled'
Set-Itemproperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'TrustedSites' -value 'Enabled'
Set-Itemproperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'UntrustedSites' -value 'Enabled'

It's enough just to copy/paste above code, at "elevated" powershell, (right click run as administrator).

And if you get some errors, it's probably because path does not exist, then run this commands

New-Item "HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel" -force | Out-Null
New-ItemProperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'Internet' -value 'Enabled'
New-ItemProperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'LocalIntranet' -value 'Enabled'
New-ItemProperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'MyComputer' -value 'Enabled'
New-ItemProperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'TrustedSites' -value 'Enabled'
New-ItemProperty -path 'HKLM:\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel' -Name 'UntrustedSites' -value 'Enabled'