5. First deployment walkthrough
A first-day checklist from licence to the first pilot machines.
A new installation ships with an empty policy: nothing is classified or enforced until you publish labels. This chapter is the checklist for the first day; each step links to the chapter with the details.
| # | Step | Where | Details |
|---|---|---|---|
| 1 | Sign in as admin. Print the generated password once
with sudo adactl admin initial-password, then set a new
one. |
Console | 4.1, 7.4 |
| 2 | Install the licence. Send the Installation ID to
your licence provider and upload license.lic. The console
stays on the License page until a valid licence is installed. |
Settings → License | 6.2 |
| 3 | Certificates. Optionally put a certificate from your corporate CA on the admin console (9443). Leave the client certificate (443) on the built-in CA unless you have a plan for every client. | Settings → Certificate | 6.3 |
| 4 | Time zone and NTP. Reports, schedules and “today” use this time zone. | Settings → Time | 6.4 |
| 5 | Active Directory. Add the LDAPS connection, pin the DC certificate, test it. AD groups then become available to groups, console roles and alert recipients. | Settings → Active Directory | 6.5 |
| 6 | E-mail (SMTP). Needed for alerts, scheduled reports and password-reset links. Send a test. | Settings → Email (SMTP) | 6.6 |
| 7 | Syslog. Forward audit events to your SIEM (CEF or RFC 3164). | Settings → Syslog | 6.7 |
| 8 | Security. Lock-out, console and manifest network allow-lists, sign-in notice, sessions, password policy, agent approval. | Settings → Security | 6.8 |
| 9 | Console users. Map AD groups to Administrator and Auditor; keep one local break-glass admin. | Administration → Users | 7 |
| 10 | Labels. Create 3–5 labels, put them in order (lowest sensitivity at the top), add markings and restrictions. | Policy → Labels | 8 |
| 11 | Groups. Create groups by machine name, operating system or AD group/user/e-mail for pilots and departments. | Policy → Groups | 9 |
| 12 | Rules. Start with Recommend rules from templates; set Outlook enforcement and Agent Rules modules. | Policy → Rules | 10 |
| 13 | Publish & Sign. | Top bar | 4.4 |
| 14 | Deploy agents to a pilot group with the enterprise installer or the setup script. | Agents → Setup | 12 |
| 15 | Verify the pilot machines in the Agents list (online, policy version, add-ins loaded), then try labeling, a blocked send and a print. | Agents, Audit Log | 13, 15 |
| 16 | Backups. Generate the backup key, record it, turn on scheduled backups. | Administration → Backup | 16.5 |
| 17 | Alerts. Choose which categories notify by e-mail and syslog. | Reports → Alerts | 15.5 |
Appendix D describes a staged rollout from pilot to the whole organisation.