Common Admin Scenarios

End-to-end recipes combining deployment and policy for typical Deck configurations

Worked recipes that combine the MSI and the policies. Each lists the settings to configure; see the Policy Reference for the full definition of each.

Recipe 1 - Lock users to IT-approved profiles only

Users can switch between profiles you publish, but cannot create or change any.

1. Author and publish a managed-profiles file - see Managing Profiles Centrally.

2. Set these policies (machine scope):

   Policy	Value
   ProfileManagementMode	AdminOnly
   ManagedProfilesPath	\\fileserver\deck$\profiles.json

Users see the managed profiles as read-only and can activate them; the create/edit/delete actions are removed.

Recipe 2 - Manage only Excel and Outlook

Hide Word and PowerPoint add-ins so Deck focuses on the apps you care about.

Add-ins for the unlisted apps are hidden and left untouched.

Recipe 3 - Fully locked-down silent deployment

A per-machine install with a minimal, IT-controlled surface.

1. Install per-machine, silently (device context):

   msiexec /i VediramDeckSetup-1.8.0-x64.msi ALLUSERS=1 /qn /l*v C:\Windows\Temp\deck.log
   

2. Apply policy (machine scope):

   Policy	Value	Effect
   ProfileManagementMode	AdminOnly	No user-created profiles
   ManagedProfilesPath	\\fileserver\deck$\profiles.json	The approved profiles
   DisableLiveToggle	1	Registry-only activation, no COM into running Office
   DisableCrashAnalysis	1	Removes the Crashes page
   PollingInterval	15	Fixed, lighter metrics cadence
   AutoStart	1 (user scope)	Deck always runs

See Silent & Command-Line Install and Enterprise Deployment for delivery.

Recipe 4 - Redirect logs to a central share for support

Collect daemon logs off the endpoint so support can inspect them.

Ensure the client (or SYSTEM, for a per-machine install) can write to the target. See also Collecting diagnostic logs.

Recipe 5 - Enforce a required Excel XLL stack

Guarantee two .xll add-ins always load in a fixed order and permanently block a third. Set these under Managed Extensions (machine scope):

Full behavior and precedence rules: Managing Excel XLL Extensions.

Verifying any recipe

After applying policy, refresh and confirm the values landed:

gpupdate /force
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Vediram\Deck" -ErrorAction SilentlyContinue
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Vediram\Deck\ManagedExtensions" -ErrorAction SilentlyContinue

Then restart Deck (or the Core daemon) so it re-reads policy. Configured settings show a managed by IT indicator in the UI.