Software Deployment

Clickonce should be renamed poo on a stick.
ClickOnce apps are not designed for corporate environments and are for Home users, they are not an MSI. The source is only part of the install, it will connect to the net and drag down the rest of the install. It usually installs everything into the users profile. Most Clickonce apps will also do a check online to see if there are updates required, so the app constantly changes.
Remove the Internet access or log in as another user,see the flaw in your application now ?
I

Any suggestion will be appreciated. I am bashing my forehead against the wall now.

can you tell us in more details...

does this help at all

http://www.devx.com/dotnet/Article/30177/0/page/2

Thanks for all your reply. I finally choose wise setup capture to repackage this ClickOnce application. The auto update function comes along with ClickOnce is ruined, I have to make update package afterwards.

And I collect some information in the Internet about ClickOnce, I hope this may help somebody.

ClickOnce is designed for per-user installation which means that it should be installed by the users who log into the system. The files are installed to the current logged on user's profile.

ClickOnce is not an install package. ClickOnce in an installation of the application via the web, the way microsoft designed clickonce was for software to be deployed and updated to clients quickly, and safely. It was not intended as an internal company distribution method. That being said the security implications for allowing the installation of an application via the web are neumerous. Obviously the main thought is someone developing a .net virus which they can silently install onto peoples machines automatically. This is the reason ClickOnce will not allow automated silent installs.

To avoid seeing the ClickOnce trust prompt, the certificate used to sign the manifests should be trusted at an enterprise or machine level.With Trusted Application Deployment, you can configure client computers so that your ClickOnce applications run with a higher level of trust without prompting the user.
1>: The manifests should be signed.
2>: The publisher's certificte which sign the manifest should be added into the Trusted Publisher Store on the client computer.
Please refer to Microsoft TechNet for the details.