In-Browser Elevated Permissions Setup with SL5 Issues

Question

I am having a devil of a time setting up in-browser elevation with an application I'm developing for a client.
Software's purpose: Download excel, docx and other writable files to a user's system, launch the file in the default viewer, let the user edit it and save the file, monitor for that file change, and prompt the the user to upload the changed
file back to the server.
I know this sounds like a dropbox or sharepoint type of thing but it's to store files that will be used with the SEC, we have a back end that stores the files according to the SEC's requirements. While I can get the Download, Monitor, Prompt and Upload all
to work, I need Elevated Permissions In Browser to launch the files. For obvious security reasons, this is made to be hard but it's proven far beyond that.
I have the following actions taking place to set up the program and the end user's system such that all this should work:
XAP package is code-signed with a certificate provided by DigiCert (Issued By: DigiCert SHA2 Assured ID Code Signing CA, Issued to my Client, Expires Dec 2017). This enabled the lovely blue install prompt method for OOB instead of the yellow
warning one, and is required for elevated in browser to work properly.
I have enabled Out of Browser for the purpose of allowing the user to launch the SL app in an area where there are less security restrictions. When run out of browser, it performs the following actions, and then quits (the user is only intended to run out
of browser once, to make these system changes):
1. Detects that it is in OOB mode
2. Checks for the existence of C:\Program Files (x86) (to see if it's a 64-bit system)
4. Creates a COM object (WScript.Shell) and uses shell.RegWrite to write the following Keys
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight", "");
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight\AllowInstallOfElevatedTrustApps", 0x00000001, "REG_DWORD");
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight\AllowLaunchOfElevatedTrustApps", 0x00000001, "REG_DWORD");
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight\AllowElevatedTrustAppsInBrowser", 0x00000001, "REG_DWORD");
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight\UpdateConsentMode", 0x00000001, "REG_DWORD");
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight\Components\", "");
shell.RegWrite(@"HKLM\SOFTWARE\Microsoft\Silverlight\Components\Debugging\", "");
It does the same keys with Wow6432Node in there as well if it detected 64-bit
5. Downloads the DigiCert.cer file I exported to the Silverlight Isolated Storage and does a shell.Run against it so it pops open
6. Prompts the user to install it to Trusted Root Certificate Authorities
The only other action that I have added onto this process is to add the site to the IE Security Trusted Sites list to get around Protected Mode.
While this all together should be enabling In-Browser Elevation, I have mixed results. On my development machine, Win 8.1 x64 Pro, going to the website (NOT localhost, since that ignores the security requirements) I receive elevation. Going to it inside
the server (Win2008R2) to the website also works. However, my Win7x64 box doesn't get it and another development team member I work with and her Win 8.1 box doesn't work either.
My core questions are:
1. Is there anything obvious I have missed, such as a registry setting, or program setting I need to check/change
2. What specific certificate store should the DigiCert.cer be imported to?
3. What specific certificate should I have exported from my development machine for importing to client machines?
4. Has anyone experienced this issue where everything looks right but only works on some machines?

Answer 1

As I said in the post "I have enabled Out of Browser"
Here is my InBrowserSettings.xml file content:
<InBrowserSettings>
<InBrowserSettings.SecuritySettings>
<SecuritySettings ElevatedPermissions="Required" />
</InBrowserSettings.SecuritySettings>
</InBrowserSettings>
And here is my OutOfBrowserSettings.xml file content:
<OutOfBrowserSettings ShortName="XXXXX" EnableGPUAcceleration="False" ShowInstallMenuItem="True">
<OutOfBrowserSettings.Blurb>You only need to run this once</OutOfBrowserSettings.Blurb>
<OutOfBrowserSettings.WindowSettings>
<WindowSettings Title="XXXXX" Height="500" Width="600" />
</OutOfBrowserSettings.WindowSettings>
<OutOfBrowserSettings.SecuritySettings>
<SecuritySettings ElevatedPermissions="Required" />
</OutOfBrowserSettings.SecuritySettings>
<OutOfBrowserSettings.Icons>
<Icon Size="16,16">Images/favicon.png</Icon>
</OutOfBrowserSettings.Icons>
</OutOfBrowserSettings>