Trusted Locations don't include plugin directory?

[soonhui]

For unknown reason, the AutoCAD Trusted Locations don't include the Application Plugin directory  (at %appdata%\ApplicationPlugins). Any reason??

To me this is imperative that the Application Plugin directory is by default in Trusted Locations. Because you do want people to write Plugins for AutoCAD right? Or what message is conveyed if Plugin directory is not default not trusted?

Furthermore, there is already an Unknown Publisher verification on plugin level. So it's not like one can easily distribute malware or spyware.  And if one is determined to do so, not adding plugin directory to Trusted Locations is not going to help a lot. 

[auermaureen275]

I totally agree with your point. As a fellow AutoCAD user, it feels counterintuitive that the Application Plugin directory isn’t included by default in Trusted Locations. Most developers rely on that folder to deploy plugins safely, and with the existing Unknown Publisher verification, the risk is already managed. Not trusting the directory by default seems more like an unnecessary hurdle than a meaningful security measure.

[pendean]

@soonhui Not seeing anything like that here, what error / messages are you seeing other than the first load authorization that comes up with a new tool add?

[Norman_Yuan]

@soonhui ,

%appdata%\ApplicationPlugins (C:\ProgramData\...\ApplicationPlugins) was trusted location by default in AutoCAD version earlier. It is Autodesk's latest move to narrow it down to only be "C:\program files\...". Effectively, Autodesk is saying, "it is at your own security risk if you make any location other than C:\program files\.... a trusted location, do not blame me." If you paid enough attention to latest AutoCAD release changes, you would have known it.

[soonhui]

OK, I've found the reference via Kean's post

---

This is a change from prior versions, where an ApplicationPlugins folder under the current user's (and all users') application data was also trusted. We realised this was actually a bad idea and so removed automatic trust for such folders in 2016.

---

That's pretty much the only reference I can find because all the typepad links are dead. 

BUT, later on it also said that

The good news is that if an application module was signed using a trusted digital certificate, then it doesn't matter if it's in a trusted location or not.

My application DLL is already really signed with a trusted digital cert, and yet, the dialog box ( %ApplicationPlugin% directory is not trusted) still pops up. This is not expected.

@Norman_Yuan , do you get the same behavior?

[Norman_Yuan · Accepted solution]

The change that only trust  %PROGRAMFILES%\Autodesk\ApplicationPlugins by default was JUST started with Acad2026. See Autodesk's documentation here:

https://help.autodesk.com/view/OARX/2026/ENU/?guid=GUID-5E50A846-C80B-4FFD-8DD3-C20B22098008