Admin Topics

• Administration Overview
  • ndMail Product Work Flow Diagram
  • Best Practices for ndMail Administration Setup and Configuration
  • ndMail Setup Requirements
  • Download ndMail Add-in Software (must purchase/license separately)
  • Create an ndMail Service Account
    
• Server-side Configuration for Admins
  • Configure Exchange Web Services for ndMail
    • Enable Exchange Web Services
    • Configure Ports
    • Outlook Client and ndMail Services Interaction
    • Whitelist Exchange Web Services
      
  • Configure Impersonation or Service Account for ndMail
    • Configure Exchange Connection on the Repository
    • Authenticate the ndMail Service Account to ndMail for Every Cabinet 
  • Client-side Push-out and Configuration for Admins
  • ndMail Registry Information

Administration Overview

This section outlines the best practices in setting up ndMail for your organization. 

• ndMail Product Work Flow Diagram
• Best Practices for ndMail Administration Setup and Configuration
• ndMail Setup Requirements
• Download ndMail Add-in Software (must purchase/license separately)
• Create an ndMail Service Account

ndMail Product Work Flow Diagram

The ndMail Product Work Flow Diagram shows the components and parts of the ndMail architecture so that you can set up a working environment for your organization. 

Component parts include:

• ndMail Services. The main ndMail Services component on the cloud interacts between the various ndMail components to provide predictive search and quick filing location recommendations and for filing items (emails, documents, and so forth) to the NetDocuments Content Repository.
• ndMail Client Plug-in for Outlook. The main location where the user receives predictive filing location recommendations and submits a request to file an item at a certain filing location.
• Microsoft Exchange (on-premise or online). ndMail communicates using Exchange Web Services (EWS) to between the ndMail Services and Microsoft Exchange.
• Exchange Web Services. ndMail communicates using Exchange Web Services (EWS) between the ndMail Services and Microsoft Exchange.
• NetDocuments Content Repository. After interaction with the ndMail Client Plugin for Outlook and communication via EWS to Exchange Services, the ndMail Services checks for already filed copies of an item, and if not already filed (or user doesn't have sufficient rights to view the item already filed), then it uploads an item to the NetDocuments Content Repository. 

Best Practices for ndMail Administration Setup and Configuration

To set up and configure ndMail successfully, you must meet all the administration setup requirements; an administrator must ensure that the Exchange Server is configured correctly for ndMail. On the client side, you need to ensure ndOffice and ndMail are working correctly with the exchange server. 

First, configure the server-side components:

1. Ensure you have met all ndMail Client- and Server-side Setup Requirements.
2. Have a NetDocuments Administrator with Repository and Cabinet rights create an ndMail Service Account.
3. Configure Exchange Web Services for ndMail
   
   1. Enable Exchange Web Services
   2. Configure Ports
   3. Whitelist Exchange Web Services
4. Configure Impersonation Account for Microsoft Exchange
5. Configure Exchange Connection on the NetDocuments Content Repository

Second, push out ndMail to client end-points and configure clients. See: 

1. ndMail Installation for IT Administration
2. ndOffice Installation Configuration Steps for ndMail
3. ndMail Registry Information
   1. ndMail Settings Registry Keys
   2. ndMail Collapse or Expand Registry Keys
   3. ndMail Settings Registry Keys

Third, provide the ndMail Product Page to your users as a resource to help them learn how to use ndMail. 

 Back to Top

ndMail Client- and Server-side Setup Requirements

Before installing the ndMail add-in, you must have Visual Studio Tools for Office Runtime (VSTO), Microsoft .NET Framework 4.5.2+, ndOffice application, and all available Windows updates installed on a computer.

 Back to Top

Download ndMail Add-in Software

The ndMail software is an add-in software to purchase separately. To download the ndMail Add-in and install successfully, contact Sales@netdocuments.com to subscribe to the ndMail add-in:

• https://apps.netdocuments.com/apps/ndMail/ndMailSetup.exe
• https://apps.netdocuments.com/apps/ndMail/ndMailSetup.msi
• https://apps.netdocuments.com/apps/ndMail/ndMailSetup-1.1.1.5.zip

Create an ndMail Service Account

ndMail runs a backend process as a ndMail Service Account (similar to an internal admin account), which is an Administrative proxy account with both Repository and Cabinet administrative access.

Best practices regarding this ndMail Service Account include:

• Create a new account with a unique email address named ndMail Service Account and do not associate it with an existing user. If an existing Admin leaves and you remove the ndMail Service account (which is the same as the personal Admin account), ndMail ceases to function.
• NetDocuments recommends creating a new service account solely for ndMail.  (If you have another service account created for ndThread or another NetDocuments service, do not use that other service account for ndThread.) There is no extra charge for the service account/new internal user. ndThread requires workspace cabinets and ndMail does not so you have greater flexibility without combining them.
• Have a NetDocuments Admin create this new Service Account like a new Admin:
  • Trigger sending the Welcome email
  • A unique email address (Best practice using the same email domain as your other internal users, but that is not required.)
  • If the internal users in your cabinet authenticate with a username and password, then you need access to this email address to receive the link that is sent via email to create the password for that account.
  • The service account must be a Cabinet Administrator in every workspace-based cabinet in the repository to ensure the service account has access to all the content in those cabinets.
  • The service account must also be a Cabinet Administrator in the cabinet identified if the cabinet where you plan to store direct messages.
  • To make a user a Cabinet Administrator, access the Administration page for every cabinet and on every such page, go to this part of the administration page, selecting the service account user and select Add. Edit the page and select Submit for the changes to take effect. 

Configure Exchange Web Services for ndMail 

ndMail uses Exchange Web Services (EWS) to interact with user email messages and folders. For best practices, ensure to configure the following:

Configure Impersonation

ndMail requires the ability to impersonate users in the Exchange domain to retrieve and file email for subscribed users. Use RBAC (role-based access control) on the Exchange Server to enable impersonation.

Service Application Access for an Impersonation Role

Exchange integration for ndMail is built and deployed as a service application. Create a new account specifically for the ndMail Exchange service account. When correctly configured with impersonation rights, this Exchange user account can read emails to ANY user in the Exchange domain. Also, use Exchange roles to limit this to certain users, if desired or applicable to your implementation. 

To access the service application:

1. Create a service account.
   
   ndMail uses basic authentication with the optional second factor of limiting access to our datacenter IP address for Exchange Web Services with an impersonation role assigned, allowing it to impersonate Exchange users to read folders and emails.
   
   
2. Grant the service account a user impersonation role.

As an administrator, you can manage EWS access controls using Exchange Management Shell and the following cmdlets:

Get-CASMailbox
Set-CASMailbox
Get-OrganizationConfig
Set-OrganizationConfig

Open the web-based Exchange Admin Center (EAC) of the Exchange Server.

To configure impersonation on Exchange Server 2013, 2016:

1.  Select the Permissions tab.
2. To create a new administrative role, select the  icon.
3. In the new role group dialog box:
   a. Enter a name for the new administrative role.
   b. Under Roles, select the  icon, and select ApplicationImpersonation.
   c. Under Users, select the  icon.
   d. To collect the mailbox data from Exchange Server (SyncUser), select the account > OK.
   e. Select Save.

Note: Configure Exchange 2013 and 2017 using the Exchange Management Shell cmdlets to control access management for EWS applications and the RBAC for impersonation. For more information, see the following table, which includes steps and links on how to use Exchange Management Shell - a PowerShell-enabled command-line processor with command handlers for Exchange.

Note: Do not install the New-ManagementRoleAssignment cmdlet in your Exchange Management Shell. To add the cmdlet, type Add-PSSnapin Microsoft.Exchange.Management.PowerShell.E2010 in the Exchange Management Shell, and then press Enter.

 Back to Top

Configure Exchange Connection on the Repository

Important: After setting up the impersonation service account, you might have to wait for a minimum one hour before you can use the account to log in at the Exchange Configuration. The error returned is vague that you are unable to connect, but the account is not quite set up.