Re: .NET apps not being recognized as being in the Intranet Zone

On May 21, 1:18 am, james <men...@xxxxxxxxxxxxxxxxxx> wrote:
WATYF <WAT...@xxxxxxxxx> wrote innews:eb43eb6a-afaa-4e39-ac0b-850afdb6d1e4@xxxxxxxxxxxxxxxxxxxxxxxxxxxx:





On May 18, 2:20 pm, james <men...@xxxxxxxxxxxxxxxxxx> wrote:
WATYF <WAT...@xxxxxxxxx> wrote
innews:b49180b8-f865-4aae-aa4c-6896e6d9f3c8@xxxxxxxxxxxxxxxxxxxxxxxxxx
om:

So I had a problem recently... my .NET apps would no longer run
from a particular share, nor could I open them in VS.NET. See:
[snip]
So I went into Internet Explorer's "zone" area and added the domain
that the network share is on to the "Intranet Sites" list.

But the problem still remains the same. I've got a network share
[snip]
IIRC, you need to be using caspol.exe rather than the zones set with
Internet Explorer. That's what I had to do in my very similar case,
anyway.

Good luck!

--
The email address, above, is most certainly munged. Perhaps you
might reply to the newsgroup, instead? Thanks!

How would I use caspol to do this? I tried running it from command
line, but I got an "access denied" message.

Basically, I just need to tell ".NET" that any assembly that exists on
the drive mapped like so: ( share on 'sub.corpdomain.org\shares' )
belongs to the IntRAnet zone, not the IntERnet zone. How do I do
this??

WATYF

It gets complicated. First, a reference:http://msdn.microsoft.com/en-us/library/cb6t8dtz(VS.80).aspx

You might also try a:
<dotnetframeworkpath\caspol.exe -list | more
to see what _they_ mean by the groups (some of which share names with
more familiar IE groups).

So, my .Net 2.0 program, to get to run from a network share, required
several things. First, the person setting up for remote access was a
local admin on the box. Power User might work, I'm not sure. The user
has to be able to modify local security policies, though, because that's
what caspol does. Second, they required caspol.exe, which is usually in
c:\windows\microsoft.net\framework\v<version>\CasPol.exe. Note that if
side-by-side versions of .Net are installed then you must use the one
that corresponds with the version of .Net framework your program uses.

Then I wrote this command file:
@echo off
echo y|c:\windows\microsoft.net\frameowrk\v2.0.50727\caspol.exe -m -ag
1.2 -url file://server/sharename/path/to/my/program/* FullTrust
exit

That echo y| thing is all one easy-to-read line. -ag 1.2 is AddGroup for
the Zone - Intranet: LocalIntranet, which is how intranet shares are
classified. The 1.2 is easily found in the first few lines of caspol -
list | more.

Google is your friend. Also, I should have named my entry because I seem
to be getting multiple entries, one per program update. Also, every user
must rerun the caspol command file each time your program version is
updated because that's part of the security (note that the * in my
example allows _all_ code from that location to be run, not necessarily
very secure).

I found my example using google, hopefully this is enough to get you
going.

--
The email address, above, is most certainly munged. Perhaps you
might reply to the newsgroup, instead? Thanks!


Hi there. I appreciate the response. I have, of course, been using
Google to find the answer to this, but it hasn't returned any useful
results as yet. And while your example seemed very promising at first,
unfortunately it doesn't solve my problem.

What you're doing is making a share trusted... which I had already
done, and which was already working well for quite some time. The
issue arose when my IT dept decided to change the way the share is
mapped. It is no longer mapped using the UNC path (\\server\share
\subfolder\). It is now mapped using a domain (sub.corpdomain.org\share
\subfolder). It is this method of mapping that causes the problem,
because, apparently, it doesn't see that share as a network share, but
rather as an internet URL (which is why it puts it in the Internet
zone).

My problem lies with telling .NET that all apps at that URL are
trusted.

WATYF
.

Relevant Pages

  • [Full-Disclosure] The Dangers of Cross-Site-Scripting: Rogers Hi-Speed Internet Network [Canada]
    ... Many people dismiss the dangers of cross site scripting as ... The Rogers Hi-Speed Internet Network of Canada ... Explorer security setting: 'intranet zone': ...
    (Full-Disclosure)
  • The Dangers of Cross-Site-Scripting: Rogers Hi-Speed Internet Network [Canada]
    ... Many people dismiss the dangers of cross site scripting as ... The Rogers Hi-Speed Internet Network of Canada ... Explorer security setting: 'intranet zone': ...
    (Bugtraq)
  • Re: IE 7 Einstellung: automatisch anmelden in...
    ... Benutzer-Informationen auch ins Internet uebertragen werden. ... must be set to Automatic logon only in Intranet zone or Automatic ...
    (microsoft.public.de.german.windows.server.general)
  • How to securely connect an Intranet-Samba-PDC with a LAMP in the DMZ?!
    ... I have the RED, ORANGE and GREEN zone, all combined by a Firewall/Gateway linux box. ... In the ORANGE zone I am running a LAMP server which serves data towards the public internet ... In the GREEN zone (intranet) I am running a Samba-Server as fileserver and PDC for my intranet client machines. ... I want to be sitting on one of my Windows clients in the green network and be able to transfer files from the orange LAMP server to the green File-Server and vice verca comfortably via network shares. ...
    (comp.os.linux.networking)
  • Re: Unknown zone
    ... Tools> Internet Options> Advanced ... If it is the Internet zone use the Default Level button. ... How to make a good newsgroup post: ... it is connected to my local network. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)