When you create an application scoped setting, the allowExeDefinition attribute on the <section> element is omitted.  For user setting, it’s added by VS and set to value “MachineToLocalUser”. 

 

The valid values for this setting are:

- MachineOnly = the ConfigurationSection can be defined only in the Machine.config file.  

- MachineToApplication = the ConfigurationSection can be defined either in the Machine.config file or in the Exe.config file in the client application directory. This is the default value. 

- MachineToLocalUser = the ConfigurationSection can be defined in the Machine.config MachineToLocalUser file, in the Exe.config file in the client application directory, in the User.config file in the roaming user directory, or in the User.config file in the local user directory. 

- MachineToRoamingUser = the ConfigurationSection can be defined in the Machine.config file, in the Exe.config file in the client application directory, or in the User.config file in the roaming user directory.  

 

 

If you don’t have allowExeDefinition (it’s missing) or it’s set to MachineToApplication or to MachineToRoamingUser, and you try to change user settings at run time

        WindowsApplication1.Properties.Settings.Default.MySetting = textBox1.Text;

     WindowsApplication1.Properties.Settings.Default.Save();

you’ll get “System.InvalidOperationException: ConfigurationSection properties cannot be edited when locked” exception:

 

If you have allowExeDefinition set to MachineOnly, you’ll get a different exception --

"It is an error to use a section registered as allowExeDefinition='MachineOnly' beyond machine.config”.

 

If you set allowExeDefinition to MachineToLocalUser, the code above will run without any errors.

 

Interestingly, if you remove or set the allowExeDefinition attribute to values other than MachineToLocalUser after the user.config file was created, you will no longer get the “System.InvalidOperationException: ConfigurationSection properties cannot be edited when locked” exception.  Instead, you’ll get "It is an error to use a section registered as allowExeDefinition='YourSettingHere' beyond machine.config”