Outlook Plug-in Deployment failure

[webabc123]

I created a startup script to deploy the Outlook plugin and config file to our Windows 7 and 8.1 computers following the instructions in the 7.3 guide because I cannot find the 7.4 guide posted.

This is what is in the script:

\\servername\share\CiscoIronPortEmailSecurity_7-4-0-254.exe /exenoui /qn
UseCustomConfig="\\servername\share\config\BCE_Config_signed.xml"

Servername\share is changed here. I have the correct path in the script.

The software installation is successful, but the config does not seem to be applied.because the "Encrypt Message" button is grayed out and I don't see the config file in the  C:\ProgramData\Cisco\Cisco IronPort Email Security Plug-In\Common directory.

Is there a syntax error in the commands above?  Do you put the full path to the config file?  The guide says this:

[Robert Sherwin · Accepted solution]

7.4 User Guide:

http://www.cisco.com/c/dam/en/us/td/docs/security/iea/plugin7-4/Admin_Guide.pdf

With 'New Email', why is Encrypt Message grayed out? 

 

A valid and signed BCE XML config file has not been presented to the account.

This can be done one of two ways:

#1) A CRES administrator can securely email the BCE XML config file directly to the end-user.

#2) Upon plug-in installation, a signed BCE XML config file can be specified with a custom configuration installation.

In order to get the BCE XML:

Log in to CRES admin (https://res.cisco.com/admin) --- click Accounts --- then click the hyperlink for the account #.

This will take you to the Account Management section; Click BCE Config tab.

Leave the CRES radio selected.

Click Download Template.  Select "Keep" or save locally – per your normal browser download steps.

Now Just select "Choose File", selecting the file you just got --- and "Upload and Sign".

This will re-download as signed.

Finally --- you can send from CRES there in step 5 --- this will send the XML in encrypted email to yourself.

Follow this example to open and apply the XML in Outlook:

DOUBLE click the actual email in the inbox of Outlook to prompt the decrypt --->

Enter in CRES password

Click Yes

Create new mail.

Select the Encrypt Message option:

You can also manually install the BCE XML, here is my TechNote on the operation:

http://www.cisco.com/c/en/us/support/docs/security/email-encryption/118397-technote-esa-00.html

-Robert

[webabc123]

Thanks, but the sending the file in email method will not work for us since it would be very difficult to get a list of email addresses of only the workers that work in the office and have a workstation with Outlook and the email will just confuse a lot of users.  There are also new employees coming and going daily making it too easy to miss many of them.  We could not just copy and paste every address in the company address book because that would include too many non applicable email addresses and cause mass confusion.

It would also be too much time and labor to install the config file manually.  We could do one manually just to test and confirm that the config file works as expected, but we can't do that for everyone.

We must automate deploying both the plugin and the config file using the silent installation command option shown in the admin guide.  We would need to deploy the software and config file to workstations so that any user that logs into the workstation would automatically have access to the encryption plugin.

Shouldn't the instructions in the admin guide for mass deploying using the commands I posted above work?  

[Robert Sherwin]

AH - I see - I do apologize on that...

You have:

\\servername\share\CiscoIronPortEmailSecurity_7-4-0-254.exe /exenoui /qn
UseCustomConfig="\\servername\share\config\BCE_Config_signed.xml"

You should not specify the filename in the line --- only the directory of where the file lives.

This is what is in the script:

\\servername\share\CiscoIronPortEmailSecurity_7-4-0-254.exe /exenoui /qn
UseCustomConfig="\\servername\share\config"

My scratch notes from previous installs on my side, installs w/o issue & places the XML, where as 172.16.6.130 is my virtual storage:

C:\Users\robsherw\Desktop>CiscoIronPortEmailSecurity_7-3-0-102.exe /exenoui /qn

UseCustomConfig="\\172.16.6.130\Users\robsherw\Desktop\my_share\plugin_test"

Try that and let me know if corrects...

[webabc123]

It still doesn't work.

I was able to get further when I realized they all the examples are showing the commands on two separate lines, but it must be on one line with no line breaks.

Now I at least see the BCE_Config_signed.xml file copied to the computer in the config folder.

However, it still does not work.  

Outlook 2010 opens and hangs and displays ugly errors after the plugin is installed.

[Paul Cardelli]

I had a similar issues, but was able to figure it out after a day of fighting it: 

Prep-

• Uninstall all Cisco Outlook plugins (especially previous versions as their configs are not compatible with the new client)
• Install the new Cisco Plugin

BCE Configuration  (You cannot make changes to this file once it has been configured and e-mail to yourself):

1. Download the BCE Config Template from CRES
2. Make changes to this file, For example I make the reporting buttons send the phish, spam, as raw so I can track Simulated phish e-mails vs other emails. If you need help configuring this file you will need to contact support as it can get complicated.
3. you will need to generate the BCE Config file from CRES and send the signed BCE config it to yourself.
4. When you go to open the e-mail in outlook with the new client it will ask if you want to configure it. Go ahead and do so. Also save a copy of the BCE_Config from this e-mail.
5. Now you should be working one this machine, but what fun is that? So now you will need to copy the entire config folder from your computer to a file share. I' used my DFS netlogon share in my domain but you can through it anywhere it is accesible by your domain computers.
6. My Config folder has a common folder in it. I found that there will be a couple extra files you will need to delete to make it work. This I did not find out in the documentation, but through trial and error (over a day). In the Common folder you should have a few other folders and a few xml files.
7. Go ahead and delete all the other XML files except the CommonComponentConfig.xml. 
8. Copy the BCE config XML file you received encrypted and signed by CRES in your e-mail to this the Common Folder and rename it to config_1.xml

Test your new config folder before your run your script.

1. Close/Stop Outlook
2. Delete the entire config folder from your local profile
3. Copy the one we just created in your server share. 
4. Launch outlook, you should get no errors or popups, and the encrypt button should work and not be grayed out.
   • If not, you can Close outlook, delete the config folder, and launch outlook and open that encrypted BCE file in your email again to reconfig.

Now Robert is correct about the script you point to the entire folder. What this does is copies the entire folder to the computers default profile so that each user that signs in will have the new config. 

Somethings I have found with this change in the config in mass deployments:

• Sometimes the old client does not uninstall the old config or at all. Requires me to go to each machine and manually remove delete.
• SOmetimes the configuration does not copy properly on a few machines. After which I uninstall and reinstall with the script. 
• DoNet is required as well as Java, this will save you some deployment issues. I have had a few windows 8.1 that .Net would not install properly. 
• If there are extra files in your config file it will error out.

The extra files turned out to be what was holding up my deployment. So your Config/common folder should look like this:

Cisco Share:

Config Folder: 

Common Folder:

[webabc123]

I got the configuration to work on the one machine.  I found it doesn't work when you open the doc from Outlook preview.

" copy the entire config folder from your computer to a file share"  ?? I do not have any folder named "config" to copy from the computer.  The only "config" folder is the one I created on the network.

I have "Cisco IronPort Email Security Plug-in" folder and inside that folder I see "Common" and a folder with the user name.

I cannot find any way to make this work by manually copying the config files or using the script.  It keeps giving the errors I posted earlier.  I can only get it to work using the encrypted email attachment.

[Paul Cardelli · Accepted solution]

Yes your correct, you should be copying the common folder to your config folder you created in the network share. You would point the script to the config folder.

You should make sure that the only two files other then the folders that exist in the common folder are:

CommonComponentsConfig

config_1

I believe there are a few extra files created in the common folder you will need to delete these, and you need to replace copy the BCE file into the common folder renaming to config_1.

[t81767100]

Hi we're running into similar issues where we can't use CRES for deployment.  When overwriting the "Common" folder using the script, do we also need to make sure the "username" folder gets deleted before?  Or the information will flow from the "common" folder to the "username" folder?

Thanks for your help!!

[webabc123]

.