title: Why does using ConfigurationManager.GetSection cause "SecurityException: Request failed" but ConfigurationManager.OpenExeConfiguration does not?
body: <p>I have something curious that I am hoping a .Net expert can help me with.  </p>
  
  <p>I have a custom configuration section and to get hold of it I do this:</p>
  
  <pre><code>var s = (TestConfigurationSection)ConfigurationManager
      .GetSection("testSection");
  </code></pre>
  
  <p>I run that on my development machine (<code>Windows 7</code>, 64 bit, Windows completely up to date) and it works fine.</p>
  
  <p>I take the exe with that code in and I put it in a directory inside <code>c:\users\public</code> on a <code>Windows Server 2008 R2</code> machine, open up a command prompt as administrator, run it and I get:</p>
  
  <blockquote>
    <p>System.Configuration.ConfigurationErrorsException: An error occurred creating the configuration section handler for testSection: Request failed. (C:\Users\Public\configtest\AppConfigTestConsoleApplication.exe.Config line 10) ---> System.Security.SecurityException: Request failed.</p>
  </blockquote>
  
  <p>Now I changed that code to do this:</p>
  
  <pre><code>var config = ConfigurationManager.OpenExeConfiguration(
      ConfigurationUserLevel.None);
  var s = (TestConfigurationSection) config
      .GetSection("testSection");
  </code></pre>
  
  <p>and it works fine on both machines.</p>
  
  <p>So, I am moderately happy (in as much as my application is working) but that little Gremlin in my head is confused so I ask here:</p>
  
  <p><strong>Why is this the case?</strong></p>
  
  <hr>
  
  <h2>Steps to reproduce</h2>
  
  <p>Create a new .net 4 Console application project called AppConfigTestConsoleApplication in visual studio 2010 and replace the contents of <code>Program.cs</code> with the following:</p>
  
  <pre><code>using System;
  using System.Configuration;
  
  namespace AppConfigTestConsoleApplication
  {
      public class TestConfigurationSection : ConfigurationSection
      {
          [ConfigurationProperty("someSetting")]
          public int SomeSetting
          {
              get { return (int) this["someSetting"]; }
              set { this["someSetting"] = value; }
          }
      }
  
      internal class Program
      {
          private static void Main()
          {
              try
              {
                  var s = (TestConfigurationSection) ConfigurationManager
                      .GetSection("testSection");
                  Console.WriteLine("First Method worked: " + s.SomeSetting);
              }
              catch (Exception ex)
              {
                  Console.WriteLine("First method failed");
                  Console.WriteLine(ex.ToString());
  
                  if (ex.InnerException != null)
                  {
                      var eex = ex.InnerException as SecurityException;
                      Console.WriteLine("Action: '{0}'", eex.Action.ToString());
                      Console.WriteLine("Demanded: '{0}'", eex.Demanded.ToString());
                      Console.WriteLine("RefusedSet: '{0}'", eex.RefusedSet);
                      Console.WriteLine("GrantedSet: '{0}'", eex.GrantedSet);
                  }
  
                  try
                  {
                      var config = ConfigurationManager.OpenExeConfiguration(
                          ConfigurationUserLevel.None);
  
                      var s = (TestConfigurationSection) config
                          .GetSection("testSection");
  
                      Console.WriteLine("Second Method worked: " 
                          + s.SomeSetting);
                  }
                  catch (Exception x)
                  {
                      Console.WriteLine("Even the second method failed!");
                      Console.WriteLine(ex.ToString());
                  }
              }
          }
      }
  }
  </code></pre>
  
  <p>Then add an application configuration file and replace the contents with the following:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
    &lt;configSections&gt;  
      &lt;section
        name="testSection"
        type="AppConfigTestConsoleApplication.TestConfigurationSection, AppConfigTestConsoleApplication"
        requirePermission="false"
        allowDefinition="Everywhere" /&gt;  
    &lt;/configSections&gt;
    &lt;testSection someSetting="10"&gt;&lt;/testSection&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Compile and run and this is the output I got:</p>
  
  <pre><code>C:\Users\Public\configtest&gt;AppConfigTestConsoleApplication.exe
  First method failed
  System.Configuration.ConfigurationErrorsException: An error occurred creating the configuration section handler for testSection: Request failed. (C:\Users\Public\configtest\AppConfigTestConsoleApplication.exe.Config line 10) ---&gt; System.Security.SecurityException: Request failed.
     at System.RuntimeMethodHandle.PerformSecurityCheck(Object obj, RuntimeMethodHandleInternal method, RuntimeType parent, UInt32 invocationFlags)
     at System.RuntimeMethodHandle.PerformSecurityCheck(Object obj, IRuntimeMethodInfo method, RuntimeType parent, UInt32 invocationFlags)
     at System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
     at System.Reflection.ConstructorInfo.Invoke(Object[] parameters)
     at System.Configuration.TypeUtil.InvokeCtorWithReflectionPermission(ConstructorInfo ctor)
     at System.Configuration.RuntimeConfigurationRecord.RuntimeConfigurationFactory.CreateSectionImpl(RuntimeConfigurationRecord configRecord, FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentConfig, ConfigXmlReader reader)
     at System.Configuration.RuntimeConfigurationRecord.RuntimeConfigurationFactory.CreateSectionWithRestrictedPermissions(RuntimeConfigurationRecord configRecord, FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentConfig, ConfigXmlReader reader)
     at System.Configuration.RuntimeConfigurationRecord.CreateSection(Boolean inputIsTrusted, FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentConfig, ConfigXmlReader reader)
     at System.Configuration.BaseConfigurationRecord.CallCreateSection(Boolean inputIsTrusted, FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentConfig, ConfigXmlReader reader, String filename, Int32 line)
     --- End of inner exception stack trace ---
     at System.Configuration.BaseConfigurationRecord.EvaluateOne(String[] keys, SectionInput input, Boolean isTrusted, FactoryRecord factoryRecord, SectionRecordsectionRecord, Object parentResult)
     at System.Configuration.BaseConfigurationRecord.Evaluate(FactoryRecord factoryRecord, SectionRecord sectionRecord, Object parentResult, Boolean getLkg, Boolean getRuntimeObject, Object&amp; result, Object&amp; resultRuntimeObject)
     at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object&amp; result, Object&amp; resultRuntimeObject)
     at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object&amp; result, Object&amp; resultRuntimeObject)
     at System.Configuration.BaseConfigurationRecord.GetSectionRecursive(String configKey, Boolean getLkg, Boolean checkPermission, Boolean getRuntimeObject, Boolean requestIsHere, Object&amp; result, Object&amp; resultRuntimeObject)
     at System.Configuration.BaseConfigurationRecord.GetSection(String configKey)
     at System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(String sectionName)
     at System.Configuration.ConfigurationManager.GetSection(String sectionName)
     at AppConfigTestConsoleApplication.Program.Main()
  Action: 'Demand'
  Demanded: '&lt;PermissionSet class="System.Security.PermissionSet"
  version="1"
  Unrestricted="true"/&gt;
  '
  RefusedSet: ''
  GrantedSet: ''
  Second Method worked: 10
  </code></pre>
  
  <h2>Process Monitor</h2>
  
  <p>I ran <a href="http://technet.microsoft.com/en-us/sysinternals/bb896645" rel="nofollow noreferrer">Process Monitor</a> and set the filter like so:</p>
  
  <p><img src="https://i.stack.imgur.com/101DN.png" alt="Process Monitor Filter"></p>
  
  <p>And that left 508 events that are all one of:</p>
  
  <ul>
  <li>NAME NOT FOUND</li>
  <li>NO MORE ENTRIES </li>
  <li>PATH NOT FOUND</li>
  <li>FILE LOCKED WITH ONLY READERS</li>
  <li>NO SUCH FILE (just once for <strong>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\93e7df09dacd5fef442cc22d28efec83\mscorlib.ni.dll</strong> and <strong>C:\Users\Public\configtest\AppConfigTestConsoleApplication.exe.config</strong>)</li>
  <li>BUFFER OVERFLOW (for <strong>HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages</strong>, <strong>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache</strong>, </li>
  </ul>
  
  <p>Does anyone have any advice perhaps on what filter to set to get to the root cause?</p>