Office Plugin Installation Manual via Group Policy Objects

Introduction

This manual describes the installation process for the ZIVVER Office Plugin for Outlook. This manual describes the process to install the plugin via Group Policy Objects (GPO) for Microsoft Windows. The installation process in this manual consists of several parts:

  • Required:
    • Installation of the Office plugin via GPO.
    • Implementation of required settings via GPO - These settings, which are applied in the registry, will be configured using custom Administrative Template (ADM) files in the .ADMX and .ADML formats.
  • Optional:
    • Implementation of additional settings via GPO: There are several optional settings available that add or change functionalities of the plugin. These settings are included in the ADM files, and are addressed at the end of this manual.

Technical requirements

To install the Office plugin via GPO, as well as the additional required settings, you will need the following:

  • Administrator rights in Microsoft Active Directory (AD) to create and deploy new GPO’s, for example Domain Administrator. Note: If you are a member of the Group Policy Creator Owners group, you are able to create and edit new GPO’s, but you will not be able to assign them to AD groups or users.
  • Access to a domain controller (DC), for example via Remote Desktop Protocol (RDP) or the Remote Server Administration Tools.
  • ZIVVER Office plugin installation file. The latest version is available for download via this link.
  • The users’ (virtual) desktops must meet the following requirements to use the plugin:
    • Outlook 2010 or higher
    • Windows 7 or higher
    • .NET Framework 4.5 or higher
    • Must be able to connect to https://*.zivver.com over TLS v1.2 via port 443

To install the additional required settings specifically, you will need the following:

  • ADM files for the additional settings, available for download here:
  • If you are applying the settings locally on a standalone system, you need administrator access.
  • If you are implementing the settings within an AD domain, you will need the following:
    • Administrator rights in AD to create and deploy new GPO’s, for example Domain Administrator. Note: If you are a member of the Group Policy Creator Owners group, you are able to create and edit new GPO’s, but you will not be able to assign them to AD groups or users.
    • Access to one of the following:
      • Recommended: Access to a DC’s SYSVOL folder to install the ADM files in the domain’s GPO Central Store, so that they are replicated across the entire domain, and can be managed from other domain servers.
      • Alternatively: If you do not use the Central Store, the ADM files can be installed locally on a DC. The downside to this option is that the ADM files will not be available automatically on other domain servers, and can only be managed on this server.

Installation

This chapter of the manual describes how to install the Office plugin via GPO.

Please make sure that you also implement the additional required settings, in addition to installing the plugin, as described in the chapter Additional required settings.

Share the plugin

To be able to deploy the Office plugin via GPO, it must be available to users on the network. Follow the steps below to create a distribution point on the server:

  1. Log in on a domain server as administrator.
  2. Create a new shared network folder, or select an existing one.
  3. Put the Office plugin installer package in this folder. The latest version is available for download via this link.
  4. Make sure that users can access the package, and change the permissions on the shared folder if necessary.

The plugin is now available for installation across the domain.

Create a GPO

Follow the steps below to create a new GPO to install the plugin. If you want to use an existing GPO, then skip this section of the manual and proceed to the chapter Deploy the plugin.

  1. Log in on the DC as administrator.
  2. Open Group Policy Management, for example with the run command GPMC.MSC.
  3. Expand the folder for the domain you want to apply the GPO to.
  4. Right-click Group Policy Objects.
  5. Click New to create a new GPO.
  6. Enter a name for the GPO. For example ZIVVER Office Plugin.
  7. Leave Source Starter GPO as (none).
  8. Click OK to confirm and create the new GPO.

Continue to the next chapter to configure the installation of the plugin in the new GPO.

Deploy the plugin

This section explains how to configure the new GPO to deploy the Office plugin. The two different methods to deploy the plugin via GPO, Assign and Publish, are described below:

  • Assign: The plugin will be deployed on a system level (For-all-users installation) or a user level (Just-for-me installation). The plugin will be installed automatically when the system starts or when the user logs in.
  • Publish: The plugin will be deployed on a user level. Users will be able to install the plugin manually from the Add and remove programs pane in Control panel. A package can not be published on a system level.
Assign is the recommended option.

Assign the plugin

Follow the steps below to install the plugin via GPO with deployment method Assign:

  1. Right-click the GPO from the chapter Create a GPO.
  2. Click the option Edit to open the Group Policy Management Editor.
  3. Choose to deploy the plugin on a user level or a system level:
    • User: Select User configuration.
    • System: Select Computer configuration.
  4. Expand the folder Policies.
  5. Expand the folder Software Settings.
  6. Right-click Software installation.
  7. Select New > Package…
  8. Select the package in the shared network folder from the chapter Share the plugin.
  9. Click Open to confirm the selected installer package.
  10. Select Assigned as the deployment method.
  11. Click OK to confirm.
  12. Wait a moment for the package to appear in the Software installation pane.
  13. Right-click the package, and choose Properties.
  14. Go to the Deployment tab.
  15. If you assigned the package on a user level, follow these steps (not available for computer level):
    1. Under Deployment options, activate the option Install this application at logon.
    2. Under Installation user interface options, select Basic.
    3. (Optional) If you want to hide the plugin from the Add and remove programs pane in Control panel, then select the option Do not display this application in the Add/Remove Programs control panel under Deployment options.
  16. Optional: If you want the plugin to be automatically uninstalled when the user or system is no longer linked to this GPO, select the option Uninstall this application when it falls out of the scope of management under Deployment options.
  17. Click OK to confirm and close the Properties window.
  18. Close the Group Policy Management Editor.

The GPO is now configured to assign the plugin. Continue to the chapter Link the GPO to assign the GPO to users or computers.

Publish the plugin

Follow the steps below to install the plugin via GPO with deployment method Publish:

  1. Right-click the GPO from the chapter Create a GPO.
  2. Click the option Edit to open the Group Policy Management Editor.
  3. A package can only be published on a user level, so select User configuration.
  4. Expand the folder Policies.
  5. Expand the folder Software Settings.
  6. Right-click Software installation.
  7. Select New > Package….
  8. Select the package in the shared network folder from the chapter Share the plugin.
  9. Click Open to confirm the selected installer package.
  10. Select Published as the deployment method.
  11. Click OK to confirm.
  12. Wait a moment for the package to appear in the Software installation pane.
  13. Right-click the package, and choose Properties.
  14. Go to the Deployment tab.
  15. Under Deployment options, deactivate the option Auto-install this application by file extension activation, as this setting does not do anything for the Office plugin.
  16. Under Installation user interface options, select Basic.
  17. Optional: If you want the plugin to be automatically uninstalled when the user is no longer linked to this GPO, select the option Uninstall this application when it falls out of the scope of management under Deployment options.
  18. Click OK to confirm and close the Properties window.
  19. Close the Group Policy Management Editor.

The GPO is now configured to publish the plugin. Continue to the chapter Link the GPO to assign the GPO to users or computers.

In this chapter, the GPO is linked to a domain or to specific Organizational Units (OU’s), so that the plugin will be deployed to the AD users and/or computers within that domain or OU.

Important notes:
- If you assign the plugin on a system level, make sure the GPO is linked to an OU that contains computer objects. Please verify this by checking the contents of the linked OU in the AD.
- Similarly, if you assign or publish the plugin on a user level, make sure the GPO is linked to an OU that contains user objects.
- Do not deploy the plugin on a system level and apply the GPO to a OU with only user objects, or vice versa.

Follow the steps below to link the GPO:

  1. Open the Group Policy Management.
  2. Right-click the domain or the OU you want to install the plugin for.
  3. Select Link an Existing GPO….
  4. Select the GPO you created in the previous chapters.
  5. Click OK to confirm.

If you chose the option to assign the package, the Office plugin will now be installed automatically for linked AD objects. This happens on the following moments specifically:

  • On system restart, if you chose to assign the package on a system level.
  • On user logon, if you chose the option to assign the package on a user level.

If you chose the deployment method Publish, then the plugin will be available for users to install manually from the Add and remove programs pane in Control panel.

Test the installation

Follow these steps to test the installation of the plugin via GPO:

  1. Apply the new GPO to the specified domain or OU:
    1. Open Group Policy Management, for example with the run command GPMC.MSC.
    2. Right-click the OU the GPO is linked to.
    3. Select the option Group Policy Update….
    4. The GPO will now be updated for AD objects in this OU.
  2. Verify the installation of the plugin for an AD object that is linked to the GPO:
    • If the package was assigned on computer level: The plugin is installed automatically when the system starts and should be visible in Outlook.
    • If the package was assigned on user level: The plugin is installed automatically when the user logs in and should be visible in Outlook.
    • If the package was published: The plugin should be available for manual installation from Add and remove programs in the Control panel.

Update the plugin

Follow these steps to update the current version of the plugin when a new version is released:

  1. Open Group Policy Management, for example with the run command GPMC.MSC.
  2. Under Group Policy Objects, right-click the GPO for the Office plugin.
  3. Select the option Edit… to open the Group Policy Management Editor.
  4. Select either Computer Configuration or User Configuration, depending on your deployment preference.
  5. Go to Policies > Software Settings > Software Installation.
  6. Right-click Software Installation.
  7. Select the option New > Package….
  8. Select the new version of the plugin. The latest version is always available for download via this link.
  9. As the Deployment method, choose Published or Assigned, depending on your selection during the chapter Deploy the plugin.
  10. Click OK to confirm the deployment method.
  11. Right-click the old (original) version of the plugin installer package.
  12. Select the option Properties.
  13. Go to the Upgrades tab.
  14. Click Add….
  15. Select Current Group Policy Object (GPO).
  16. Under Package to upgrade, select the new version of the plugin.
  17. Select the option Package can upgrade over the existing package.
  18. Click OK to confirm and close the Upgrade package window.
  19. Click OK to close the plugin properties window.
  20. Close the Group Policy Management Editor.
  21. Close Group Policy Management.

The new version of the Office plugin will now be installed over the existing version.

If you chose to publish the package, users will need to install the update manually from Add and remove programs in the Control panel.

Uninstall the plugin

Follow the steps below to uninstall the plugin via GPO, for example when users will not be working with the Office plugin anymore:

  1. Open Group Policy Management, for example with the run command GPMC.MSC.
  2. Under Group Policy Objects, right-click the GPO for the Office plugin. Note: If you only want to uninstall the plugin for a selection of the systems/users, then create a new (separate) GPO.
  3. Select the option Edit… to open the Group Policy Management Editor.
  4. Select either Computer Configuration or User Configuration, depending on your deployment preference.
  5. Go to Policies > Software Settings > Software Installation.
  6. Right-click Software Installation.
  7. Select the option Properties.
  8. Go to the tab Advanced.
  9. Activate the option Uninstall the applications when they fall out of the scope of management.
  10. Click OK to confirm.
  11. In the right pane, right-click the plugin package.
  12. Click All Tasks > Remove….
  13. Select the option Immediately uninstall the software from users and computers.
  14. Click OK to confirm.
  15. Close the Group Policy Management Editor.
  16. Close Group Policy Management.
  17. Optional: If you created a new GPO for the uninstallation (step 2), then make sure to link this policy to the preferred users or computers. Additionally, unlink the existing GPO for installation of the plugin from the same users or computers, or these will conflict (i.e. undo each other every restart).

The plugin will be uninstalled when the computers are restarted.

Additional required settings

This section of the manual describes the process to install and configure additional settings related to the ZIVVER Office plugin. The settings are configured in a GPO, and can be deployed to users or systems within an AD domain, or implemented locally on standalone systems (without AD).

To configure the settings in a Group policy, you need the ADM files, which are available for download here:
- ADMX
- ADML

Install the template files

The ADM files can be installed in one of 3 different ways:
- In the AD domain’s GPO Central Store - By installing the files in the Central Store, they will automatically replicate to other servers within the domain. This way, the GPO settings are available on other domain servers and can be managed from any of these.
- Locally on an AD server - By installing the files locally on a domain server, they can be deployed across the domain, but they are not automatically replicated to other servers. This means that the GPO settings can only be managed from the server they were installed on.
- On a standalone system (without AD) - If you are not using AD, or want to implement the settings on a standalone computer, then the files can be installed on the system itself. This allows you to easily configure the settings, so you do not have to do this manually in the registry.

Install in Central Store

Follow the steps below to install the ADM files in the domain’s GPO Central Store:

  1. Connect to one of your DC’s with administrator rights.
  2. Open File Explorer.
  3. Access the Central Store in the SYSVOL share: %LogonServer%\SYSVOL\%UserDnsDomain%\Policies\PolicyDefinitions. For example, \\ZIVVER_Server\SYSVOL\ZIVVER.local\Policies\PolicyDefinitions.
  4. Put the ADMX file in the folder %LogonServer%\SYSVOL\%UserDnsDomain%\Policies\PolicyDefinitions.
  5. Put the ADML file in the folder %LogonServer%\SYSVOL\%UserDnsDomain%\Policies\PolicyDefinitions\en-US.

The files are now installed in the Central Store, and should be available as ZIVVER Office Plugin Settings under Policies > Administrative Templates in the Group Policy Management Editor (run GPMC.MSC and edit any policy).

Install locally on domain server

Follow the steps below to install the ADM files in the domain’s GPO Central Store.

  1. Log in on a domain server with administrator rights.
  2. Open File Explorer.
  3. Access following folder: %WinDir%\PolicyDefinitions. For example, C:\Windows\PolicyDefinitions.
  4. Put the ADMX file in the folder %WinDir%\PolicyDefinitions.
  5. Put the ADML file in the folder %WinDir%\PolicyDefinitions\en-US.

The files are now installed on the domain server, and should be available as ZIVVER Office Plugin Settings under Policies > Administrative Templates in the Group Policy Management Editor (run GPMC.MSC and edit any policy).

If your organization is using the GPO Central Store, and you installed the ADM files using this method, then the Policy settings will not appear in the Group Policy Management Editor, because the files in the Central Store supersede the local files. Install the files in the Central Store instead.

Install on standalone computer

Follow the steps below to install the ADM files on a standalone system:

  1. Log in on the system with administrator rights.
  2. Open File Explorer.
  3. Access following folder: %WinDir%\PolicyDefinitions. For example, C:\Windows\PolicyDefinitions.
  4. Put the ADMX file in the folder %WinDir%\PolicyDefinitions.
  5. Put the ADML file in the folder %WinDir%\PolicyDefinitions\en-US.

The files are now installed on the local computer, and should be available as ZIVVER Office Plugin Settings under Administrative Templates in the Local Group Policy Editor (run GPEDIT.MSC).

Create a new GPO

Follow the steps below to create a new GPO. This GPO will contain the configured settings and apply them to users or computers. If you want to use an existing GPO, or if you are configuring these settings on a standalone computer, then skip this section of the manual and proceed to the chapter Configure the settings.

  1. Log in on the DC as administrator.
  2. Open Group Policy Management, for example with the run command GPMC.MSC.
  3. Expand the folder for the domain you want to apply the GPO to.
  4. Right-click Group Policy Objects.
  5. Click New to create a new GPO.
  6. Enter a name for the GPO. For example ZIVVER Additional Settings.
  7. Leave Source Starter GPO as (none).
  8. Click OK to confirm and create the new GPO.

Continue to the next chapter to configure the additional settings in this new GPO.

Configure the settings

Follow these steps to configure the additional settings in the GPO:

  1. Right-click the GPO from the chapter Create a new GPO.
  2. Click the option Edit to open the Group Policy Management Editor. Note: if you are configuring these settings on a standalone computer, then open Local Group Policy Editor instead by running the command GPEDIT.MSC.
  3. Choose to apply the settings on a user level or a system level:
    • User: Select User configuration.
    • System: Select Computer configuration.
  4. Expand the folder Policies.
  5. Expand the folder Administrative Templates.
  6. Expand the folder ZIVVER Office Plugin Settings.
  7. Configure the additional settings. Please see the chapter Required plugin settings explained below for more information on each setting and their options, as well as the descriptions in Group Policy Management Editor.
    1. Expand the folder Load Behavior.
    2. Select the folder AddinList.
    3. Set Prevent users from disabling the plugin in Outlook to Enabled. Note: Choose the setting that corresponds with your version of Outlook. Does not work for Outlook 2010
    4. Select the folder DoNotDisableAddinList.
    5. Set Prevent Outlook from disabling the plugin to Enabled. Note: Choose the setting that corresponds with your version of Outlook. Does not work for Outlook 2010.
    6. Select the folder LoadBehavior.
    7. Set Set the plugin load behavior to Enabled and LoadBehavior = 3. Note: Use the Wow6432Node version if you use a 32-bit version of Outlook on 64-bit systems.
    8. Expand the folder Single Sign-On.
    9. Set Automatically add existing SSO accounts in the plugin to Enabled. Note: Only works if Single Sign-On (SSO) is configured for ZIVVER.
    10. Set Automatically log in users via SSO to Enabled. Note: Only works if SSO is configured for ZIVVER.
  8. Close the Group Policy Management Editor.

The GPO with the additional settings is now ready to be assigned to users and/or computers in the chapter Assign the GPO.

If you only configured the settings on a standalone system, then you can skip the chapter to assign the GPO, since this does not apply to your situation and the settings are now applied locally.

Required plugin settings explained

The ADM files contain the following settings. You can read more detailed descriptions of all the settings and their options in the Group Policy Management Editor or the Local Group Policy Editor. All of these settings can be set a user or system level.

Load Behavior

The settings below determine the activation and load behavior of the Office plugin in Outlook. These settings are all required for the implementation of the plugin.

  • LoadBehavior - The LoadBehavior setting determines whether the plugin is active or not in Outlook. The recommended value for this settings is 3 to activate the plugin. This setting has a default option, as well as an option for 32-bit versions of Outlook on 64-bit systems.
  • AddinList - The AddinList setting blocks users from disabling the plugin themselves in Outlook. This setting has an option for Outlook 2013, as well as an option for Outlook 2016 and 2019.
  • DoNotDisableAddinList - This setting prevents Outlook from disabling the plugin automatically. This setting has an option for Outlook 2013, as well as an option for Outlook 2016 and 2019.
Single Sign-On

These settings enable automatic activation and sign-in via SSO. These settings are required if your organization uses SSO, because users will have to log in and activate their accounts manually otherwise. If SSO is not configured for your organization in ZIVVER, then these settings will not work.

  • Automatically add existing SSO accounts in the plugin - This setting will activate users’ ZIVVER accounts via SSO in the plugin.
  • Automatically log in users via SSO - This setting will keep users signed in via SSO. Active sessions will automatically be renewed after 30 days.
Additional optional settings

Several optional settings are included in the ADM files. For more information on these settings, see the chapter Additional settings.

Assign the GPO

In this chapter, the GPO you created is linked to a domain or to specific OU’s in the AD, so that the plugin is deployed to users and/or computers.

Important notes:
- If you apply the settings on a system level, make sure the GPO is linked to an OU that contains computer objects.
- Similarly, if you apply the settings on a user level, make sure the GPO is linked to an OU that contains user objects.
- Do not deploy the settings on a system level and apply the GPO to a OU with only user objects, or vice versa.

Follow the steps below to link the GPO:

  1. Open the Group Policy Management.
  2. Right-click the domain or the OU you want to apply the settings to.
  3. Select Link an Existing GPO….
  4. Select the GPO you created in the previous chapters.
  5. Click OK to confirm.

The settings will now be applied to the linked AD objects when the systems restart.

Test the settings

Follow these steps to test if the settings were applied successfully:

  1. Apply the new GPO to the specified domain or OU:
    1. Open Group Policy Management, for example with the run command GPMC.MSC.
    2. Right-click the OU the GPO is linked to.
    3. Select the option Group Policy Update….
    4. The GPO will now be updated for all AD objects in this OU.
  2. Verify if the settings were applied successfully for an AD object that is linked to the GPO:
    1. Access a system the GPO was applied to.
    2. Run Outlook on the system.
    3. Test the following:
      • Is the plugin active in Outlook? Check for the ZIVVER tab in the ribbon of Outlook.
      • Is the user’s account activated and logged in automatically? Check under Account management in the ZIVVER tab in Outlook.
      • Can the user disable the plugin? Check in Outlook under File > Options > Addins > Manage: COM-addins > Go….
      • Can Outlook disable the plugin automatically? Check in Outlook under File > Slow and disabled COM-addins. There should be a message that the plugin is managed by the system administrator.

Undo the settings

Follow the steps in this chapter to undo all of the settings in the registry, for example when users will not be working with the ZIVVER Office Plugin anymore:

  1. Open Group Policy Management, for example with the run command GPMC.MSC. Note: If you only configured the settings on a standalone computer, then open Local Group Policy Editor by running the command GPEDIT.MSC, and then go to step 4.
  2. Under Group Policy Objects, right-click the GPO for additional settings.
  3. Select the option Edit… to open the Group Policy Management Editor.
  4. Select either Computer Configuration or User Configuration, depending on whether you applied the settings on a system or user level.
  5. Expand the folder Policies.
  6. Expand the folder Administrative Templates.
  7. Expand the folder ZIVVER Office Plugin Settings.
  8. Change the settings you want to undo back to the default options. In most cases, this will be the option Disabled. See the descriptions in the Group Policy Editor for more information on each setting.
  9. Close the Group Policy Management Editor. Note: If you only configured the settings on a standalone computer, then close the Local Group Policy Editor and skip the remaining steps.
  10. Right-click the OU the GPO is linked to.
  11. Select the option Group Policy Update… to update the new GPO for all AD objects in the OU.

The settings will now be undone for all systems and users they were applied to.

Additional settings

This section of the manual briefly describes the additional settings that are available in the ADM files. These settings are not required, but may be configured for additional features or troubleshooting purposes.

To apply these settings, simply follow the steps again in the chapters Configure the settings and Assign the GPO.

  • Set maximum size for attachments to be stored unencrypted - Supported in Office plugin version 3.0 and higher. This setting increases the size of attachments that will be stored unencrypted, if the corresponding settings are used in the Office plugin. Only use this setting when your mail server supports large attachments.
  • Enable additional logging for the debug version - This setting enables the extensive logging feature of the special debug version of the plugin.
  • Do not show tutorials to new users - Supported in Office plugin version 3.0 and higher. The plugin shows several tutorials to new users during certain events. This setting disables those tutorials.
  • Synchronize Sent Items with ZIVVER - Adds a user setting to the ZIVVER Office Plugin settings menu. Once set, it becomes possible for users to download ZIVVER messages to the Sent Items folder in Outlook.

    Users must enable the [corresponding setting]() in their personal Outlook environments for the functionality to work.

Supported in Office plugin version 4.0 and higher. - Allow messages to be forwarded unencrypted - Supported in Office plugin version 3.0 and higher. This setting controls the option for your users to forward ZIVVER messages unencrypted. This option is disabled by default since version 3.2, and enabled by default in earlier versions.
- Set additional confirmation when sending messages - Supported in Office plugin version 4.0 and higher. With this setting, the plugin can show additional confirmation pop-ups to users when sending messages.
- Turn off WebSocket communication - This setting disables the WebSocket communication between the plugin and ZIVVER. Note: Only use for troubleshooting purposes if requested by ZIVVER, as this setting has a negative impact on the functionality of the plugin (e.g. new messages will not show automatically).
- Interrupt user’s send flow upon business rule violation - When enabled, ZIVVER displays a list of business rule violations (if any exist), even when a message is sent without ZIVVER. The setting is enabled by default.
Supported in Office plugin version 4.0 and higher. - Use Email Verification when guest verification is missing - Supported in Office plugin version 3.2 and higher. With this setting, the verification method Email Verification will automatically be set for ZIVVER messages, when there is no other verification method known for the recipient, such as SMS Code or Access Code. This setting is disabled by default, because Email Verification is less secure than the other options.
- Send as normal email - Supported in Office plugin version 3.2 and higher. By default, the plugin cancels the regular sending process when sending a ZIVVER message: The message is sent via ZIVVER, and not as a regular email. Because of this, other plugins and integrations may not work for messages that are sent via ZIVVER. Use this setting to send a copy of the ZIVVER message to the Exchange server.
In addition, a separate mail flow rule must be configured on the Exchange server to delete the normal email. This rule is absolutely necessary, because it prevents that messages are sent unencrypted via Exchange when this setting is enabled. See this manual for instructions on creating this rule.

If you use the setting Send as normal email, make sure that you configure the additional mail flow rule and test if it works as expected (i.e. no ZIVVER messages are sent unencrypted). If you do not configure and test the rule properly, you may cause a data leak.

Was this article helpful?

thumb_up thumb_down