Hey, i always register my dll in com+ as application. Than you can export this application in a msi file. You can deploy for clientside and serverside. The security thing is a try and error. Good luck ;-)

What I have done within a DLL 'init' function that the client must call - AFTER the client has already loaded all its dll and such, is to create a new thread. All the work within the DLL I wrote was done from within this thread internal to the DLL. At the top of this thread place a PeekMessage call, so the thread will get a message queue. Then you can process 'posted thread messages' fromt this thread and it has its own independent message pump. Just because an app stared as a dialog app, or some other type of app, does not mean it can't have a DLL containing its own thread and its own message queue.