By Greg DeMichillie [bio]
Posted: Mar. 8, 2004

• Illustration: Publishing a ClickOnce Application with Visual Studio

The following is the full text of an article published by Directions on Microsoft, an independent research firm focused exclusively on Microsoft strategy & technology. Each month we make one or more key articles available to non-subscribers.

ClickOnce, a new application installation feature in the next release of the .NET Framework, lets users invoke and install thick-client .NET applications by clicking on a link in a browser. ClickOnce improves on a similar feature in the current release of the .NET Framework, but it lacks some important features provided by the Windows Installer. It also muddies the waters for IT planners by introducing yet another application installation technology at a time when the rest of Microsoft is finally standardizing on the Windows Installer for application installation and patching.

Installation Barrier to Thick Clients

Microsoft continues to promote "thick-client" application architectures, which put application code on user PCs and mobile devices, over "thin-client" architectures, which rely on a generic client (typically a browser). The company contends that thick clients provide better user interfaces, superior integration with local applications, and better support for working offline.

However, installation has long been the bane of thick-client applications and is a key reason many corporations began deploying browser-based applications. Microsoft has gradually made application installation simpler and more reliable, most notably by providing a standard installation engine—the Windows Installer (sometimes referred to as the Microsoft Installer, or MSI). The Windows Installer performs common installation functions, such as copying files, configuring user options, and registering system components, and provides a means to remove the application. Many software vendors have adopted MSI, and Microsoft itself has said it will use MSI as the installation and patching technology for all of its products other than Windows.

However, MSI packages are difficult to build, and most developers rely on tools such as Visual Studio, InstallShield, or Wise to create installation packages.

.NET Application Installation

The .NET Framework offers an alternative to MSI: executing thick-client applications directly from the Web. With the .NET Framework 1.0 and 1.1, developers can copy an application to a Web server and the application can be executed by clicking on a link (for example, http://mysite/myapp.exe).

However, running an application via a URL imposes significant limitations that make it useless for many IT organizations. These limitations include the following:

Strict security restrictions. Applications invoked via a URL run with extremely limited security permissions. While this has the obvious benefit of preventing users from accidentally running viruses or other destructive applications, it also prevents legitimate applications from performing functions such as writing data to the local disk. IT administrators can change the default security permissions, but doing so requires them to deploy a custom security policy to every client computer that uses the application.

No local copy. Unlike conventionally installed applications, applications invoked via a URL are not actually installed on the user’s machine but are executed directly over the network. This can lead to poor performance over slow or overloaded networks and also makes it impossible for users to work with the application offline.

No support for "impact-full" applications. Applications that run from a URL are unable to modify the underlying system in any way. IT administrators can guarantee that running such an application will not have any side effects on the system, but the application cannot install or update system components, such as the Microsoft Database Engine (MSDE), create new file associations, or add items to the Start menu.

ClickOnce Removes Some Limitations

The next version of Visual Studio (code-named Whidbey) will provide tools that allow the developer to publish an application to a server (either a file server or a Web server). As part of the publishing step, the developer will specify whether the application is to be installed locally or run over the network. Visual Studio will then create a deployment manifest (a file with a ".deploy" extension). When the user clicks on a link to a deployment manifest, the .NET Framework Common Language Runtime (CLR), running on the local computer, will read the information and install the application with the appropriate settings.

ClickOnce removes some of the more onerous restrictions associated with running applications via a URL.

Option to install locally. Because they can be installed locally, ClickOnce applications can operate independently from the network, unaffected by its speed or the user’s connection status.

Start menu. The developer can specify whether or not an application is to appear in the Start menu of the local machine and ClickOnce will create the required interface elements. ClickOnce applications also appear in the Add/Remove Programs page of the Control Panel.

Auto-update. ClickOnce provides a way for applications to automatically check for updates, such as patches, either before the application runs or in the background.

Technical, Strategic Issues Warrant Caution

Although installation and updating applications via ClickOnce is undoubtedly simpler than building and installing an equivalent MSI package, IT organizations will need to exercise caution before proceeding. From a technical perspective, ClickOnce has some serious limitations that make it inappropriate for some applications, including the following:

.NET 2.0 prerequisite. ClickOnce is a feature of version 2.0 of the .NET Framework. Before an IT organization begins widespread use of ClickOnce, it must first deploy the next version of the .NET Framework to every desktop. Tools such as Microsoft’s System Management Server (SMS) simplify this task, but if organizations are using SMS, they already have the ability to automatically deploy applications to desktops without using ClickOnce.

System components must be installed separately. Any system components required by an application (such as MSDE, which is commonly used as a local database engine) must be installed before the application (via traditional MSI packages or SMS).

Logging support unclear. At this point, it is unclear how much support ClickOnce will provide for troubleshooting and logging installation problems. Although it aims to make application installation trouble-free, the variety of system configurations in most organizations means that things will eventually go wrong. The Windows Installer, in contrast, can provide an IT administrator with detailed logs of the installation process for troubleshooting problems.

All-or-nothing updating. Updating an application, even if the update contains nothing but bug fixes, risks introducing new problems. IT organizations using tools such as SMS have the ability to precisely target which users in their organizations receive which application updates, thereby minimizing the risk associated with updates. Updating via ClickOnce, however, is an all-or-nothing proposition. Once an update is published, it is applied for all users.

Strategic questions. From a strategic perspective, the addition of a new application installer is curious, coming just when the rest of the company is finally standardizing on a single technology—the Windows Installer and MSI packages—for installing and patching applications. It is unclear how long Microsoft will continue to invest in both of these technologies, and how or when they might eventually converge.

Resources

An introductory white paper on ClickOnce is at msdn.microsoft.com/library/en-us/dnwinforms/html/clickonce.asp.

Two sessions at Microsoft’s recent Professional Developer’s Conference discussed ClickOnce. For slides and streaming audio, see msdn.microsoft.com/longhorn/pdcmaterials/pdctalksfundamentals.

An overview of the Windows Installer can be found in the chapter "Windows Application Installation Improves" on page 30 of the Apr. 2003 Research Report, "Improving PC Management with Windows Server 2003."

For background information on SMS and software installation, see "Stronger Systems Management Server Worth a New Look" on page 9 of the Nov. 2003 Update.