Deployment of AutoCAD 2022 ignore TrustedPaths

[ReisenhoferA]

Hello,

I created a Deployment through manage.autodesk.com for AutoCAD 2022 for downloading to network path and installing later from the network path. I added several entries to TrustedPaths and TrustedDomains. The download to network path and installing for Deployment is successful.

However, the installed AutoCAD 2022 ignore TrustedPaths and TrustedDomains settings. AutoCAD 2022 use only "Program Files" folder and nothing else. I'm not able to adjust it - but that isn't the real problem, if there where our paths included. All of them are local, but maybe not available during installation.

I see my entries in the Collection.xml (ACADProfile_TrustedPaths, ACADProfile_TrustedDomains) file. Also I see my entries in registry - it looks like the were installed correctly. It seems to me AutoCAD ignore them? The exactly version: 2022.1.1 with german language.

Please for help.

[natasha.l]

Hello @ReisenhoferA, 

Thank you for sharing this information with us.

I would first verify that the proper selection was made during deployment creation there are two options under Install Settings, Install or Deploy. Network deployments require that the "Deploy" be selected to create a network deployment. The custom settings then need to be set up as described in Create a deployment from a Autodesk Account and Include custom user settings in a Autodesk Account deployment. 

Please "Accept Solution" if a reply or replies have helped resolve the issue or answered your question, to help others in the community.

[ReisenhoferA]

Hello @natasha.l ,

thank you very much for your answer. Yes, we are using the correct selection. I take a look at both url's and there were no mistakes.

According to my first post, the installation was successful. It ignore only our security settings - the rest is applied correctly. By the way, it doesn't care which selection we use. The installation always ignores our security settings - more precisely the set paths. The level and lock look correctly.

[natasha.l]

Hello @ReisenhoferA, 

Make sure the path is accessible, meaning that user permissions are set to full control and that network security isn't blocking access.  

Make sure to enter a deployment image path (step #5 of Create deployments from Autodesk Account).

This is the location on your network share where the deployment is created. You can use a UNC (Uniform Naming Convention) path name or a drive letter and path, for example: \\servername\path or S:\Autodesk\Deployments. This should be a valid Windows path to an empty folder.

Note: Autodesk doesn't recommend using mapped drives, as an improperly mapped drive may cause the install to fail.

[ReisenhoferA]

Hello @natasha.l ,

Thank you for your response...   but, please read my post carefully. The answer does not fit my problem at all. The trusted locations set in the deployment are all local. No network path is used.

Up to AutoCAD 2021, these were correctly adopted. With the new procedure via the web interface, this no longer works for AutoCAD 2022. Has this been readjusted before? I mean, the trusted locations in Deployment extended. Additional, selected the high security option and then checked on successful installation?

Just by the way... no user should have "full control" on ordinary network paths. Besides... no user should have write access to trusted locations. This is not only logical, but is stated exactly this way by AutoDesk. If this is not the case, AutoCAD warns about existing write permissions in the system paths when it is started. However, this is nothing new and has been the case for several versions and has to do with the numerous AutoCAD / AutoLisp viruses.

[m_latz]

Out of interest, whether this works in principle, I have tried this once:

I tested also if environment variables are resolved if defined. And yes, this works also.

So the question is, what is different on your site ?

regards

Markus

[ReisenhoferA]

Hello @m_latz ,

Thank you for your response. According to your screenshot, you don't have the same options. Missing "Lock security settings" and "Security level High".

As you use a German setup like we, it should be enabling "Sicherheitseinstellungen sperren" and changing "Sicherheitsstufe" to "Hoch". I'm still a little unsure, but it seems once the security settings are locked, the additional security paths are ignored. This was not the case in previous versions.

[m_latz]

Good Morning @ReisenhoferA ,

I will try later with the additional settings ....

regards

Markus

[m_latz]

Good Morning @ReisenhoferA ,

I tried now with "Sicherheitseinstellungen sperren" and "Sicherheitsstufe Hoch" and get the same result.

Without the "security lock" it works, because AutoCAD reads the settings from the registry from HKEY_CURRENT_USER where the user has read/write access.

But if I activate the security lock I want that the user (or some malware programs) can not modify this setting or modify my trusted paths. So the only way is not read the setting from a "place" where the current user has read/write access.

And this does AutoCAD. If you lock the security settings it reads the trusted paths and trusted domains from HKEY_LOCAL_MACHINE where the normal user has no write access and can not modify this settings.

You can control this after the installation as administrator with the CAD manager control utility.

To solve this problem you can modify the acadps.msi with a transformation (add a component which sets the correct registry keys and control this setting with a condition, that the component is only installed if the security settings are locked).

Or you can just create a .reg file or a powershell script which sets the correct registry keys during the installation.

regards

Markus

[m_latz · Accepted solution]

Just took a closer look and it seems, that the "security settings" are not all passed to acadprivate.msi. To correct you have to modify the "pkg.acadprivate.xml" with the following two lines:

Add this two lines:

<MsiProperty name="ACADProfile_TrustedPaths" value="%ACADProfile_TrustedPaths%"/>
<MsiProperty name="ACADProfile_TrustedDomains" value="%ACADProfile_TrustedDomains%"/>

Only a small error in the installer configuration 🙂

regards

Markus

[ReisenhoferA]

@m_latzThank you for your response. It is good to know that the error has been found. With the workaround, this also works for us.