Can a .NET Word 2003 add-in be installed outside of the GAC?

Question

I've created a Word add-in component, and a visual studio setup project to install the component.

On a clean machine with Office 2003 installed, it does not seem to be possible to get the add-in component to load in Word.

Googling the issue suggests that this is because the assembly is not trusted. I gave the assembly full trust using the command line tool:

caspol -af AssemblyName.dll

This makes no difference and the compenent is still not loaded in Word. caspol prints out a message "Because all GAC assemblies always get full trust, the full trust list is no longer meaningful. You should install any assemblies that are used in security policy in the GAC to ensure they are trusted"

Changing the installer to put the assembly in the GAC allows it to correctly load in Word. But the component may have to use common assemblies in the future, shared between our other .NET applications, and adding these libraries to the GAC would be undesirable.

Does anyone know how to set the security to allow the component to be loaded when installed outside the GAC?

Answer 1

I don't think putting the add-in assembly in GAC is compulsory. I think you're just missing a step in your deployment.

The office applications such as MS Word load their add-ins by reading certain registry entries. You are most likely not creating these entries during deployment.

To learn the details of all this registry business, see this article. Also to read about deploying office add-ins in general, see this article

Answer 2

You definitely do not have to install your assembies to the GAC, neither is it necessary to define any security policy on your add-in assembly.

Are you using .NET 2.0 with Office 2003? Office 2003 and Office XP both have an issue loading .NET 2.0 addins. They get loaded using the .NET 1.1 Framework (if present on the machine, which is very likely). You therefore need to patch your Office installation with the Shared Add-in Support Update for the Microsoft .NET Framework 2.0 (KB908002).

You should definitely include this patch to the pre-requisites of your installer.

Find more details in the answer to this questions.

And of course, you must have the correct version of the PIAs installed on your target system (almost forgot this point, wrong or missing PIAs is one of the main problems why add-ins won't load).

Update: KB908002 requires VS 2005 on the PC in order to add the Shared Add-in Support Update to the pre-requisites dialog of the setup projects. The following workaround must be used in this case:

If you are using Visual Studio 2008 then you have to follow the workaround mentioned below to get KB908002 listed under add pre-requisites dialog:

1. Download and install the fix on a machine which has Visual Studio 2005 installed.
2. Navigate to C:\Program Files\Microsoft Visual Studio 8\SDK\v2.0\BootStrapper\Packages, locate KB908002 folder.
3. Log on to the machine which has Visual Studio 2008 installed and copy KB908002 folder to C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bootstrapper\Packages
4. Now, if you go to pre-requisites list on Visual Studio 2008 machine you would see the fix listed.

Another option where you don't need VS 2005 at all would be:

1. Download the fix to a temporary folder.

2. Open a command prompt, navigate to the folder where the fix is located and launch the following command to extract the files from the self-extracting installation file:

   vs2005-kb908002-enu-x86.exe /C /T:C:\KB908002\
   cd \KB908002
   

   Now the folder C:\KB908002 will contain three files, vs2005-kb908002-enu-x86.exe /C /T:C:\tmp\KB908002\tmp, setup.exe and bootstrapper.msi

3. We are interested in the contents of bootstapper.msi, so we extract the content of this file:

   msiexec /a bootstrapper.msi /qb TARGETDIR=C:\KB908002\tmp\
   cd tmp
   

4. Finally, we copy the packages folder that we extracted to the bootstrapper folder of the Windows SDK

   xcopy /E "C:\KB908002\tmp\SDK\BootStrapper\Packages" "C:\Program Files\Microsoft SDKs\Windows\v6.0A\Bootstrapper\Packages"
   

5. Now, if you go to pre-requisites list in Visual Studio 2008 you would see the fix listed.

Answer 3

You can manually run the following command to set security to allow the word to run the assembly from outside the GAC. This creates a new group with full trust which is what allows the assembly to run.

caspol.exe -u -addgroup All_Code -url "\*"  FullTrust -n AssemblyName.dll

Microsoft have an example custom action for an installer at the following site link to MSDN, which will allow you to include this command as an installer custom action.