12.2 Windows deployment
12.2.1 What is installed where
| Item | Location / name |
|---|---|
| Programs | C:\Program Files\AdaClassification\ —
service\ (Ada Agent Service.exe,
Ada Guard Service.exe), addin\
(Ada.OfficeAddin.Word/Excel/PowerPoint/Outlook.dll,
Ada.Classification.dll, AdaNotify.exe,
AdaOverlay.exe, Ada.Uninstall.exe),
addin\classify\Ada.ClassifyTool.exe |
| State, policy cache, logs | C:\ProgramData\AdaClassification\:
policy.json, agent-id (persistent GUID — do
not delete), ingest.token, agent-status.json,
pending.tsv, manifests\,
recovery\, logs\ |
| Services | AdaAgentService (policy sync, file monitoring,
heartbeat, commands, AI worker child process) and
AdaGuardService (watchdog). Both LocalSystem, automatic
start. |
| User-session helpers | AdaNotify.exe (tray) and AdaOverlay.exe
(screen watermark). The service starts them in each signed-in session
and restarts them. They are not in the Run key. |
| COM add-ins | ProgIDs AdaClassification.WordAddin,
.ExcelAddin, .PowerPointAddin,
.OutlookAddin. Registered under
HKLM\Software\Microsoft\Office\<App>\Addins, the
WOW6432Node mirror, and the signed-in user’s hive, with
LoadBehavior=3. Office’s disabled items and
crashing add-in lists are cleared. |
| Add-in lock | Office policy …\Resiliency\AddinList and
DoNotDisableAddinList, plus a deny-write ACE on the user’s
add-in key, so users cannot untick the add-in. Controlled by
Policy → Rules → Agent Rules → Office add-in lock. |
| Classic Outlook pin | In the signed-in user’s hive: UseNewOutlook=0 and
policy HideNewOutlookToggle=1. New Outlook does not run COM
add-ins. If nobody is signed in, this is skipped; push the same values
by GPO. |
| Outlook toolbar | The ADA Data Classification button is added to the Outlook Quick Access Toolbar, unless a customised toolbar already exists |
| Right-click menu | Classify with ADA for 23 extensions
(.docx .docm .dotx .dotm .doc .dot .xlsx .xlsm .xltx .xltm .xlsb .xls .xlt .pptx .pptm .potx .potm .ppsx .ppsm .ppt .pot .pps .pdf)
and for folders (bulk labelling). The text is fixed at install time from
the Windows UI language. |
| Root CA | LocalMachine\Root store |
| Add/Remove Programs | “Ada Data Classification Agent”, publisher “Ada”. Written by the EXE installer only. |
Install-time options map to components like this: -
-WithEnforcement (or the EXE without
/AGENTONLY) adds everything in the COM, lock, pin, toolbar
and right-click rows. - -WithAgent turns on file
monitoring. - The EXE always passes -WithAgent.
12.2.2 Unsigned binaries — caveats before rollout
Release 1.3.83 binaries carry no Authenticode signature. The installer is shipped byte-for-byte as built so that you, or a later release, can sign it. Check these before deploying:
| Control | Effect | What to do |
|---|---|---|
Office Trust Center — “Require Application Add-ins to be
signed by Trusted Publisher”
(RequireAddinSig) |
The four COM add-ins do not load. Save/print/send enforcement, the ribbon button and Office markings silently stop. The service side keeps working (file agent, audit, screen watermark, awareness). There is no publisher or location exception for unsigned COM add-ins. | Leave the policy off on Ada machines. Check GPO User Configuration →
Microsoft Office 2016 → Security Settings → Trust Center, and the
per-app policies
(HKCU\Software\Policies\Microsoft\Office\16.0\Common\Security\RequireAddinSig = 0). |
| SmartScreen | A browser-downloaded EXE shows “Windows protected your PC” | Deploy as SYSTEM through SCCM/Intune/GPO, or run
Unblock-File on the zip |
PowerShell AllSigned |
The setup script will not run | The commands use -Scope Process Bypass. Where GPO
forbids Bypass, use the EXE as SYSTEM. |
| AppLocker / WDAC | No publisher rule is possible | Create hash or path rules for
C:\Program Files\AdaClassification\ (and
ProgramData if needed). Regenerate hash rules each
release. |
| EDR / AV | An unsigned SYSTEM service, keyboard hooks and an overlay window may be flagged | Exclude both Ada folders and the Ada processes. Verify file hashes
with Get-FileHash. |
12.2.3 Procedure — single machine
- On Agents → Setup, click Copy on the Windows client card.
- On the client, open PowerShell as Administrator and paste.
- Watch the numbered steps:
[1]Root certificate[2]Manifests[3]Web add-in catalog note[4]File agent[5]Token, service, add-ins ([5b]), Outlook pin ([5c]), right-click ([5d])SETUP COMPLETE.
- Fully close Office (no
WINWORD,EXCELorOUTLOOKleft in Task Manager) and reopen it. - Within 60 seconds the machine appears on Agents → Agents.