vendors supplying security.config files

[Glenn M]

is it bad practice for vendors to supply a machine level
security.config file in an msi package with their installations to
chnage security settings. Would i be right in thinking that this msi (
generated by the .net config tool) will overwrite any other settings
previously defined...and should be controlled centrally.

i have heard it is possible control config settngs via group policy.
id this through a policy object or is it just through software
installation of the msi file via group policy?

if the config file require changing frequently (e.g if a new intranet
application requires full trust rights). do you just keep distributing
new msi packages with a all the cumulative settings for all apps .

can this king of security elevation for an app be performed by a local
myapp.exe.config file instead.

thanks

glenn