# Exchange Transport Agent # Managing the Email Signature Manager Transport Agent registration All transport agents must be registered with Exchange Server to be invoked when email is processed. When the Email Signature Manager Transport Agent is installed, it is automatically registered with Exchange Server (and when uninstalled, it is automatically unregistered). If you need to review or manage the registration of the Email Signature Manager Transport Agent, you can do so in the Exchange Management Shell. ## Verifying the transport agent registration To determine if the Email Signature Manager Transport Agent is registered with Exchange Server, start an instance of Exchange Management Shell and execute the following command: ::note ```powershell Get-TransportAgent "Symprex Email Signature Manager Agent" ``` :: If the Transport Agent is registered, its details will be listed similar to the following: ::note ```text Identity Enabled Priority -------- ------- -------- Symprex Email Signature Manager Agent True 4 ``` :: To view the full details of the registration, execute the following command: ::note ```powershell Get-TransportAgent "Symprex Email Signature Manager Agent" | fl ``` :: To view all the registered transport agents, execute the following command: ::note ```powershell Get-TransportAgent ``` :: ## Restarting the Exchange Transport service After executing any of the commands below, the Microsoft Exchange Transport Service must be restarted. To restart the Microsoft Exchange Transport Service, execute the following command: ::note ```text Restart-Service MSExchangeTransport ``` :: ## Registering the transport agent To manually register the Email Signature Manager Transport Agent with Exchange Server, start an instance of Exchange Management Shell and execute the following command: ::note ```powershell Install-TransportAgent -Name "Symprex Email Signature Manager Agent" -AssemblyPath "C:\Program Files\Symprex\Email Signature Manager Transport Agent\signta.dll" -TransportAgentFactory "Symprex.EmailSignatureManager.TransportAgent.ESMRoutingAgentFactory" -TransportService Hub ``` :: Note the above command assumes the Transport Agent has been installed to the default location "C:\Program Files\Symprex\Email Signature Manager Transport Agent". If this is not the case, adjust the -AssemblyPath parameter as required. The output should be similar to the following: ::note ```text Identity Enabled Priority -------- ------- -------- Symprex Email Signature Manager Agent False 4 ``` :: If an error occurs, verify that the Transport Agent is installed. If you are running Exchange Server 2013 SP1 (equivalent to CU4), upgrade to CU5 or higher. ## Enabling the transport agent Once registered, the Transport Agent must be enabled by executing the following command: ::note ```text Enable-TransportAgent "Symprex Email Signature Manager Agent" -TransportService Hub ``` :: This cmdlet produces no output. You can verify the Transport Agent is registered and enabled using the **Get-TransportAgent** cmdlet as detailed in the previous section. ## Disabling the transport agent The Transport Agent can be disabled by executing the following command: ::note ```text Disable-TransportAgent "Symprex Email Signature Manager Agent" -TransportService Hub ``` :: This cmdlet produces no output. You can verify the Transport Agent has been disabled using the **Get-TransportAgent** cmdlet as detailed in the previous section. ## Unregistering the transport agent The Transport Agent can be unregistered by executing the following command: ::note ```text Uninstall-TransportAgent "Symprex Email Signature Manager Agent" -TransportService Hub ``` :: You can verify the Transport Agent has been unregistered using the **Get-TransportAgent** cmdlet as detailed in the previous section. If you want to manually remove the Email Signature Manager Transport Agent, it is important to unregister it first, or the Microsoft Exchange Transport Service may fail to start. # Exchange Server still uses old version after upgrading Email Signature Manager Transport Agent ## Problem After upgrading the Email Signature Manager Transport Agent to a newer version, Exchange Server is still using the old version. The Windows Control Panel shows the correct new version of the Transport Agent is installed. ## Reason The Email Signature Manager Transport Agent installer failed to restart the Exchange Transport Service. ## Solution To solve the problem, restart the Exchange Transport Service. ## Applies to Email Signature Manager, version 10, and later. # Are email signatures visible when composing emails? ## Question Are email signatures visible when composing emails? ## Answer Yes, signatures are inserted directly below the email when composing email in Outlook for Windows, Outlook for Mac, and Outlook on the Web. This works by running the Email Signature Manager Agent on users' machines. See the [documentation](https://docs.symprex.com/email-signature-manager/latest/html/index.html?using_outlook_agent.htm){rel=""nofollow""} for more information. Support for other email clients requires installing the Email Signature Manager Transport Agent on Exchange Server. See the [documentation](https://docs.symprex.com/email-signature-manager/latest/html/index.html?signature_injection.htm){rel=""nofollow""} for more information. When sending email from other email clients, signatures are added after email is sent and therefore not visible when composing email. # Can users make changes to the email signature? ## Question Can users edit the email signature? ## Answer You can configure if you want users to be able to make changes to the email signature in the Outlook Options dialog. By default, users cannot make changes to their email signature. If you allow changes, then users can make changes, and any such changes will only be overwritten if you change the Email Signature Manager template. See the [Install Read Only](https://docs.symprex.com/email-signature-manager/latest/html/index.html?manage_deployment.htm){rel=""nofollow""} option in the documentation for more information. Users can still edit the email signature when composing an individual email. If they do so the email signature will revert to the Email Signature Manager version on the next email they compose. It is not currently technically possible to lock the signature in the compose window. Emails are saved in Sent Items including the signature, and any changes the account may have made to the signature. # Frequently Asked Questions # General # Supported versions of Email Signature Manager Email Signature Manager is designed for On-Premises Exchange Server. The following versions are required for Exchange Server Subscription Edition support: - Email Signature Manager 11.0 and later - Email Signature Manager Agent 5.0 and later The following versions are the only versions that work with Microsoft 365 with limited support: - Email Signature Manager 10.1 - Email Signature Manager Agent 4.4 **Important notice regarding Microsoft 365 support in Email Signature Manager.** Symprex can no longer continue support for Microsoft 365 in Email Signature Manager, due to changes Microsoft has planned for Outlook, Exchange Online, and related APIs. Technical support for using Email Signature Manager with Microsoft 365 ends on September 30, 2026. Contact Symprex Sales about upgrading to [Signature 365](https://www.symprex.com/signature-365/){rel=""nofollow""}. Supported versions of Email Signature Manager are: - Version 11.X - end of support August 4, 2030 - Version 10.X - end of support September 30, 2026 - Version 9.X - end of support April 14, 2026 Supported versions of Email Signature Manager Agent are: - Version 5.X - end of support August 4, 2030 - Version 4.X - end of support September 30, 2026 Versions older than those listed above are no longer supported. If your license is under active maintenance, you can upgrade to the latest version at no charge. # Email Signature Manager ::categories-grid :::category --- description: Installation and configuration guides for Email Signature Manager icon: i-lucide-settings title: Setup to: https://support.symprex.com/email-signature-manager/setup --- ::: :::category --- description: General information and overview for Email Signature Manager icon: i-lucide-info title: General to: https://support.symprex.com/email-signature-manager/general --- ::: :::category --- description: Documentation for the Email Signature Manager Exchange Transport Agent icon: i-lucide-server title: Exchange Transport Agent to: https://support.symprex.com/email-signature-manager/exchange-transport-agent --- ::: :::category --- description: Troubleshooting guides and known issues for Email Signature Manager icon: i-lucide-wrench title: Problems & Solutions to: https://support.symprex.com/email-signature-manager/problems-solutions --- ::: :::category --- description: Common questions and answers about Email Signature Manager icon: i-lucide-circle-help title: Frequently Asked Questions to: https://support.symprex.com/email-signature-manager/frequently-asked-questions --- ::: :::category --- description: Release history for Email Signature Manager icon: i-lucide-tag title: Release Notes to: https://support.symprex.com/email-signature-manager/release-notes --- ::: :::category --- description: Release history for the Email Signature Manager Exchange Transport Agent icon: i-lucide-tag title: Release Notes (Agent) to: https://support.symprex.com/email-signature-manager/release-notes-agent --- ::: :: # Generate a debug log file for Email Signature Manager Deployment Tool V5/V6 Use the following steps to generate a debug log file for the Email Signature Manager Deployment Tool: - Determine where the deployment tool, **sign.exe**, is located. If **sign.exe** is started from a logon script, it will be started from a network share, otherwise, it will be installed on the machine. - Create a temporary folder C:\Temp to which all users have read/write access. - Start a command prompt. - Execute the following command: `\sign.exe /ShowWindow /LogFile=C:\Temp\ESM.Sign.LogFile.txt /Verbose /RawData` where `` is where the deployment tool, **sign.exe**, is located. - Allow the deployment tool to complete and for the window to close. - Locate the log file `C:\Temp\ESM.Sign.LogFile.txt`, zip it up (it can grow large) and email it to Symprex support. Note: If the deployment tool is started from a logon script, and the logon script supplies any command line arguments to sign.exe, add those command line arguments to the command above. # Generate a debug log file for the Email Signature Manager GUI V5/V6 Use the following steps to generate a debug log file for the Email Signature Manager GUI: - Create a temporary folder C:\Temp to which all users have read/write access. - Start a command prompt. - Change directory to where the application has been installed; this is normally C:\Program Files\Symprex\Email Signature Manager (or **Program Files (x86)** on 64-bit operating systems). - Execute the following command: `signmgr.exe /LogFile=C:\Temp\ESM.UI.LogFile.txt /Verbose /RawData` - Invoke the incorrect behaviour in the GUI; this will capture the appropriate information to the log file. - Close the application if possible; if it is not responsive, use **Windows Task Manager** to terminate the process. - Locate the log file `C:\Temp\ESM.UI.LogFile.txt`, zip it up (it can grow large) and email it to Symprex support. # Generate a debug log file for the Email Signature Manager GUI V7 Use the following steps to generate a debug log file for the Email Signature Manager GUI: - Create a temporary folder C:\Temp to which all users have read/write access. - Start a command prompt. - Change directory to where the application has been installed; this is normally C:\Program Files\Symprex\Email Signature Manager (or **Program Files (x86)** on 64-bit operating systems). - Execute the following command: `Symprex.EmailSignatureManager.exe /LogFile=C:\Temp\ESM.UI.LogFile.txt /Verbose /RawData` - Invoke the incorrect behaviour in the GUI; this will capture the appropriate information to the log file. - Close the application if possible; if it is not responsive, use **Windows Task Manager** to terminate the process. - Locate the log file `C:\Temp\ESM.UI.LogFile.txt`, zip it up (it can grow large) and email it to Symprex support. # Uninstalling Email Signature Manager version 4 fails If uninstalling Email Signature Manager version 4 fails then manual uninstallation can be performed using this tool: {rel=""nofollow""} This tool will uninstall Email Signature Manager version 4. # Email Signature Manager and Signature 365 Agent autodiscover mechanism and configuration Applies To: Email Signature Manager Agent v5.0.0 and above, Signature 365 Agent v2.4.0 and above. ### Preamble Two agent applications install signatures to Outlook on Windows: • The Email Signature Manager Agent; this document applies to v5.0.0 and above. • The Signature 365 Agent; this document applies to v2.4.0 and above. The Goldberg release of Email Signature Manager (v11) and Agent (v5) removed support for Exchange Online; Email Signature Manager now works purely with on-premises Microsoft Exchange Server. ## The Email Signature Manager Agent One of the key design goals of the Email Signature Manager Agent is to remove, as far as it is possible, the need for the customer to configure the Agent. To that end, the Agent can retrieve signatures from one of two sources automatically: • By obtaining the signatures using the Client Access Service (CAS). • By reading the settings from a hidden item on the user’s on-premises mailbox using Exchange Web Services (EWS). The principle is that the agent can autodiscover the service and make use of it automatically; how this autodiscover process works is set out in §2. To locate a service, the Agent requires the email address for which signatures will be installed. In addition, to configure the signature settings (such as the default signature for composing new emails), the profile needs to be determined; how these are determined is set out in §3. Despite all the automatic configuration that takes place, it is still sometimes necessary for the Agent to be manually configured; the options available are set out in §4. Note: When connecting to the Client Access Service does not require any form of authentication as it can only occur when the Agent is on-premises. §1 When calling Exchange Web Services, either the user’s Windows credentials are presented or custom credentials can be manually configured (which can be persisted to Windows Credentials Manager). ## The Signature 365 Agent The Signature 365 Agent can only retrieve signatures from the Signature 365 Generation API, for which it needs to be authenticated; authentication is a two-step process: 1. You authenticate with Microsoft 365; this can happen automatically when single sign-on is enabled. 2. A token exchange is performed with the Signature 365 Identity Server; this takes the Microsoft 365 access token and exchanges it for a Signature 365 access token. Once the Signature 365 access token is available, the Generation API can be called to generate the user’s signatures. The Signature 365 Agent needs to determine the profile to be updated, as set out in §3, and does support some advanced options, as set out in §4. ### The Autodiscover Mechanism Note: This section only applies to the Email Signature Manager Agent. Unless you have specified a custom service URL (see §4), the autodiscover mechanism uses the logic presented in the following sections. ### Autodiscover Schedule The autodiscover mechanism runs as follows: • When the Agent first starts. • At the start of each update cycle, unless disabled through settings or the command line. • If autodiscover fails, every hour or at the interval specified on the command line. #### Stage one – search the local network When the Agent is running on a domain, it first queries Active Directory for the Service Connection Point (SCP) for the Client Access Service (CAS). If the SCP is found, autodiscover finishes and signature installation proceeds using the CAS. Otherwise, autodiscover continues. #### Stage Two – Test Persisted EWS Server If signatures have previously been successfully downloaded from an EWS server, the details of that server are persisted to the registry. Autodiscover loads these details and tests the server. If the test succeeds, signature installation proceeds using the persisted server. Otherwise, the details are discarded and autodiscover continues. #### Stage three – discover the web service If no CAS or valid persisted on-premises EWS server is available, the Agent checks whether the mailbox is hosted on Microsoft 365 (see §5.2). If it is not, the Agent attempts to autodiscover an EWS endpoint (see §5.1). Once an EWS endpoint has been discovered, connectivity is tested. If the test succeeds, signature installation starts; otherwise, the process fails with an appropriate error in the log. If an authentication error is detected (i.e. the credentials that the Agent was able to find are not valid), you are prompted to enter credentials. \::note Email Signature Manager can be configured to run without an impersonation account, in which case signature settings are not written to the users’ mailboxes (using EWS). When so configured, once the Agent has successfully retrieved signature settings (from the CAS), it will persist this information to the registry and subsequently does not attempt to autodiscover the EWS endpoint again. \:: ### Determining the Outlook Profile and Email Address For the Agent to complete the autodiscover process and signature installation, it needs to know both the Outlook Profile to be updated and the email address for which signatures settings will be obtained. How this is accomplished is set out in the following sections. #### Determining the Outlook Profile The logic for determining the Outlook profile is as follows: • If there are no profiles, an error is reported. • Use the specified custom profile (see §0); if the profile does not exist (e.g. because it has been deleted), it is reported as an error. • If there is only one profile, it is used. • If there are multiple profiles and the Always use this profile option is selected (in the Mail Control Panel applet), the specified profile is used. • If there are multiple profiles and *Prompt for a profile to be used* is selected, the Agent checks each profile for an Exchange Server account. It uses the profile whose account matches the custom email address or the user’s primary SMTP email address. • At this stage, it is not possible to automatically select a profile; an error is reported. \::note So that the profile can be selected if the user goes off-domain, their primary SMTP email address (as defined on their domain account) is stored in the registry. \:: Alternatively, the profile to be used can be selected in the Options dialog. #### Determining the Email Address \::note This section only applies to the Email Signature Manager Agent. \:: The logic for determining the email address is as follows: • Use the specified custom email address (see [§4](https://support.symprex.com/#%C2%A74)). • Use the email address from the principal Exchange account3 on the selected Outlook profile. • Use the email address from the default send account on the selected profile. This works only with a direct database connection because the account does not connect to Exchange Server. • At this stage, it is not possible to automatically select an email address; an error is reported. The email address is displayed in the Status Monitor window. In some cases, a suffix will be shown in brackets to denote its provenance; the following suffixes can be used: • User-Defined: A user-defined email address; see [§4](https://support.symprex.com/#%C2%A74). • Automatic: The email address was set automatically from the user’s primary SMTP email address when there are multiple Outlook profiles. • No Suffix: The email address was determined from the Outlook profile. ### Custom Configuration The behaviour of the Agent can be configured in one of three ways; either through the Command Line, using an initialisation file, or using the Advanced Options dialog. #### Command Line Both the Email Signature Manager Agent and Signature 365 Agents support the following command line switches: \| Switch | Description | \| /UpdateInterval=xxx | Specifies, in hours, the interval for updating signatures. | \| /UpdateAndExit [=True/False] | Updates signatures and exits. Equivalent to *Close the Agent after the first automatic signature installation* on the Deployment Options dialog. The default is false. | \| /HideTrayIcon [=True/False] | Hides the Agent icon from the system tray. Equivalent to *Do not show the Agent icon in the system tray* on the Deployment Options dialog. The default is false. | \| /UpdateNow | Sends a command to the currently running instance of the Agent to perform an update (signature installation); if there is no running instance, this command has no effect. | \| /ShowStatusMonitor | Sends a command to the currently running instance of the Agent to show the Status Monitor window; if there is no running instance, this command has no effect. | \| /ShowOptions | Sends a command to the currently running instance of the Agent to show the Options window; if there is no running instance, this command has no effect. | The Email Signature Manager Agent supports the following additional command line switches. The Agent can use the User Principal Name (UPN) to identify an account. \| Switch | Description | \| /URL=xxx | Specifies the URL of the service used by the Agent. It can point to the Client Access Service (using the CAS:// prefix), an Autodiscover Service, or Exchange Web Services. | \| /Timeout=xxx | Specifies the timeout, in milliseconds, for communicating with a service. | \| /Server=xxx | Specifies the name of the server for establishing a connection direct to SQL Server. | \| /Database=xxx | Specifies the name of the database for establishing a connection direct to SQL Server. | \| /User=xxx | Specifies the user name for establishing a connection direct to SQL Server. | \| /Password=xxx | Specifies the user name for establishing a connection direct to SQL Server. | \| /CanConfigureUPN [=True/False] | Allows configuration of the UPN in the Advanced Options dialog; see §0. | \| /AutodiscoverEachCycle [=True/False] | Runs autodiscover on each update cycle. Equivalent to *Autodiscover on each update cycle* on the Deployment Options dialog. The default is true. | \| /SuppressAuthenticationErrorPopup [=True/False] | Suppresses the authentication error popup. Equivalent to *Suppress system tray authentication error messages* on the Deployment Options dialog. The default is false. | \| /ClientAccessServiceOnly [=True/False] | Determines if the Agent should run in Client Access Service (CAS) only mode. When enabled, the Agent will not attempt to use Exchange Web Services and only use the CAS to retrieve signature settings.| When connecting to SQL Server, the server and database names must be specified. If the user name and password are specified, the connection will be establishing using them; otherwise, Integrated Security will be used. The Signature 365 Agent supports for the following additional command line switches: \| Switch | Description | \| /UseWindowsBroker [=True/False] | Determines if the Agent should use Windows Broker when authenticating with Microsoft 365; see §0. | \| /UseSystemBrowser [=True/False] | Determines if the Agent use the system browser for performing the login; see §0. | \| /PreferUPNForOffice365Logon [=True/False] | Determines if the Agent should prefer the on-premises User Principal Name (UPN) for logon to Microsoft 365; refer to §4.6. | The command line switches always take precedence over any user configuration, the initialisation file, and options found in the settings during signature installation. \::note No command line options currently specify the email address, User Principal Name (UPN) or Outlook Profile. \:: #### Initialisation File (agent.ini) The initialisation file, agent.ini, can be used to specify a fixed connection to either a SQL Server database, the Client Access Service or Exchange Web Services. It can be deployed as followed: • Windows Installer (MSI): Place the file in the same folder as the MSI installer; it will be automatically copied to the installation folder. • Self-Extractor: Place the file in the same folder as the self-extractor executable; it will be automatically copied to the extraction folder. To create an initialisation file that connects to SQL Server, use *Save Configuration File…* on the Deployment Options dialog. This button is enabled only when *Direct database mode* is selected. The Save Database Connection Settings dialog helps you choose the connection type. Initialisation files that connect to either the Client Access Service or Exchange Web Services have to be created manually. The following is an example file: ```text [Options] URL=cas://ex1922.dm1922.local ``` The type of the service will be automatically determined from the specified URL, which can be in one of the following forms: • cas\://: Connect to the specified Client Access Service. • http [s] :// :server[/EWS/Exchange.asmx: Connect to EWS on the specified server. The settings in the initialisation file will take precedence over any settings defined by the user through Advanced Options dialog. There are also further settings that can be specified in the initialisation file: • Allowing the user to configure the User Principal Name (UPN): see §4.3.3. • Preferring the UPN for logon to Office 365; see §4.6] ### Advanced Options Dialog \::note This section only applies to the Email Signature Manager Agent. \:: The Advanced Options dialog allows the user to configure the Agent manually. The settings in the Service group control the autodiscover mechanism as follows: • Use the default autodiscover mechanism: the Agent will use the default autodiscover mechanism as described in §2. • Use the following autodiscover URL: the Agent will use the specified autodiscover service directly. • Use the service as the following URL: the Agent will use Exchange Web Services at the specified URL; this option effectively disables the autodiscover mechanism. \::note The Use the service as the following URL option can be used to specify either an Exchange Web Services URL or the Email Signature Manager Client Access Service by using the prefix cas\://; for example, entering a setting of cas\://ex1922.dm1922.local would cause the Agent to connect to the CAS on ex1922.dm1922.local In addition, the port can be specified using a colon after the server name; for example, entering a setting of cas\://ex1922.dm1922.local:1234 would cause the Agent to connect to the CAS on ex1922.dm1922.local on port 1234. \:: The *Email Address* setting in the *Identity* group can be used to set a specific email address to be used by the Agent, as set out in §3.2. Depending on configuration specified either through the command line or initialisation file, the appearance of the dialog will change, as shown in the following sections. #### Direct Database Connection When a direct database connection is specified through the command line or initialisation file, the Service group shows the connection details. The Status Monitor also shows that the connection is being made to the database. #### Connection to a Specified Service When a connection to a specific service is configured through the command line or initialisation file, the Service group shows that service and is disabled so the user cannot change it. ### Allowing the User to Configure the User Principal Name A crucial piece of information that the Agent requires is the User Principal Name (UPN) e.g. for shared mailboxes, for reading signature settings from the mailbox. It is important to note that whilst the format is the same, it is distinct from the user’s email address. Although it is often the case that the email address and UPN are identical, there are examples where they differ. Normally, the Agent will be able to determine UPN from the user’s domain account and will persist it to the registry for use if it is running off-premises (i.e. without a connection to the domain). However, in the event that the Agent always runs off-premises, it possible to allow the user to configure the UPN through the Advanced Options dialog; there are three ways to enable this feature. #### Command Line The feature can be enabled on the command line using the following switch: `/CanConfigureUPN[=True|Yes|False|No]` #### Initialisation File The feature can be enabled in the initialisation file (agent.ini) as follows: ```text [Options] CanUserConfigureUPN=True|Yes|False|No ``` #### Registry To allow an administrator to enable the feature through Group Policy, it can be configured through the registry as follows: • Registry Key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Agent • Value: Can User Configure UPN (string): True|Yes|False|No \::note HKEY\_LOCAL\_MACHINE has been intentionally chosen to prevent users making unauthorised changes to the configuration. \:: #### Changes in the User Interface When this option is enabled, the Advanced Options dialog will show an extra option to configure the UPN: The UPN is then shown in the Status Monitor: ### Configuring Windows Broker \::note This section only applies to the Signature 365 Agent. \:: The Agent uses the MSAL.NET library to perform authentication with Office 365. As part of this process, it is possible to use one or more brokers to complete login automatically. The principal broker for Windows is Windows Account Manager, which provides a seamless sign-on (SSO, also formerly known as single sign-on) experience when available, but it is possible to define other brokers (this is not required for the Agent) as part of the login flow. For the Agent to perform SSO, the following steps are required: • Enable support for Windows Account Manager • Enable the Windows Broker Flow Unfortunately, we have found that Windows Broker is not always reliable, especially when running on a remote desktop session. In previous versions of the Agent (prior to v4.2.1), using Windows Broker was hard-coded to be enabled; it is now configurable. Further, when running on a remote desktop session, it will default to be disabled (meaning that SSO will not be available). The use of Windows Broker can be configured as set out in the following sections. #### Command Line The setting can be configured on the command line using the following switch: ```text /UseWindowsBroker[=True|Yes|False|No] ``` #### Initialisation File The setting can be specified in the initialisation file (agent.ini) as follows: ```text [Options] UseWindowsBroker=True|Yes|False|No ``` #### Registry The setting can be configured in the Windows Registry: ```text Registry Key: HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER\SOFTWARE\Symprex\Email Signature Manager Agent Value: Use Windows Broker (string): True|Yes|False|No ``` #### Changes in the User Interface There are no User Interface changes when this setting is used. ### Use the System Browser \::note This section only applies to the Signature 365 Agent. \:: When MSAL.NET performs an interactive login to Office 365, it normally does so using an embedded browser; this browser is Internet Explorer 11. As a result of this, the login can fail with script errors, such as the following: This happens because IE cannot load the custom organisation logo. The only work-around to this problem is to use the system browser i.e. the login occurs in an external browser window. This does not provide a great experience for the user; in particular, it is not possible to detect if the browser window is closed (there is a 2 minute time-out that cancels the login if the browser does not complete it). However, it is better than the login not working. Important: When using a system browser, it is not possible to use the Windows Broker. #### Command Line The setting can be configured on the command line using the following switch: ```text /UseSystemBrowser[=True|Yes|False|No] ``` #### Initialisation File The setting can be specified in the initialisation file (agent.ini) as follows: ```text [Options] UseSystemBrowser=True|Yes|False|No ``` #### Registry The setting can be configured in the Windows Registry: ```text Registry Key: HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER\SOFTWARE\Symprex\Email Signature Manager Agent Value: Use System Browser (string): True|Yes|False|No ``` #### Changes in the User Interface There are no User Interface changes when this setting is used. ### Prefer User Principal Name to Email Address \::note This section only applies to the Signature 365 Agent. \:: When a user authenticates with Office 365, the credentials they enter are their EntraID User Principal Name (UPN) and password (and of course, if enabled, they also have to complete multi-factor authentication). This is an important distinction because the logon does not use their email address, even though in many instances (such as with symprex.com), the UPN and email address will match. However, there are various scenarios where they won’t match; for example, PowerShell can be used to change the UPN for a user or directory synchronisation can cause the Azure UPN to be synchronised with the on-premises UPN. To cater for these situations, the Agent can be configured to prefer the user’s domain User Principal Name to their email address when performing the logon to Office 365; in other words, the logon will be started using the UPN by default (when available) instead of the email address. \::important When this setting is not configured, the Agent will assume that the UPN matches the email address (this was the behaviour in all pre-release builds prior to v3.0.0.231) except when the Agent is connected to EntraID, when it will default to the UPN (because by definition, it will be the correct UPN for the user in Azure). \:: This setting can be configured as set out in the following sections. #### Command Line The setting can be configured on the command line using the following switch: ```text /PreferUPNForOffice365Logon[=True|Yes|False|No] ``` #### Initialisation File The setting can be specified in the initialisation file (agent.ini) as follows: ```text [Office365Application] PreferUPNForLogon=True|Yes|False|No ``` #### Registry To allow an administrator to push out the setting through Group Policy, it can be specified through the registry as follows: ```text Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Symprex\Email Signature Manager Agent\Office 365 Application Value: Prefer UPN For Logon (string): True|Yes|False|No ``` \::note HKEY\_LOCAL\_MACHINE has been intentionally chosen to prevent users making unauthorised changes to the configuration. \:: #### Changes in the User Interface There are no User Interface changes when this setting is used. ### Listening Port Range When the Agent starts, it opens a TCP/IP port to listen for command. To support a virtual environment, the Agent listens on the first free port within a range of ports (the port it is using is then subsequently stored in the registry). The default starting port is 9540 and the default range is 25. However, this can be configured in the registry as follows: ```text Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Symprex\Email Signature Manager Agent Value: Listening Port (DWORD): The starting port on which the Agent should listen (defaults to 9540). Value: Listening Port Range (DWORD): The range of ports on which the Agent should listen (defaults to 25). ``` \::note HKEY\_LOCAL\_MACHINE has been intentionally chosen to prevent users making unauthorised changes to the configuration. \:: ### TLS Security Protocol The TLS Security Protocol used by the Agent can be configured in the registry as follows: ```text Registry Key: HKEY_LOCAL_MACHINE|HKEY_CURRENT_USER\SOFTWARE\Symprex\Email Signature Manager Agent Value: Security Protocol (string): One of the following: ``` o Default o Tls11 o Tls12 o Tls13 o OperatingSystemDefault \::note The “Default” setting applies the Symprex defaults of using TLS 1.1 and 1.2. \:: ### Resetting Cached Settings Note: This section only applies to the Email Signature Manager Agent. The Options dialog has a Reset Cached Settings button that will reset the cached EWS server settings. ## Appendices ### Appendix One – On-Premises Exchange Web Services Autodiscover The autodiscover process is used to determine the location (i.e. the URL) of Exchange Web Services. The process involves first locating one or more autodiscover services, and then querying those services to obtain the details of the Exchange Web Services for the mailbox. The autodiscover process in the Agent reflects how Outlook is configured, which is accomplished through registry settings; the registry settings can either be set by the user or through Group Policy. Whilst there does not seem to be a specified MSDN page covering how this is configured, this article provides basic information about the available registry settings. The steps taken are set out in the following sections. #### Fixed Autodiscover URL If a custom autodiscover URL has been specified (see §0), then that service is queried. If the service returns the details for Exchange Web Services, those details are used; otherwise, the process fails and the Agent reports that signature installation has failed. #### Service Connection Point Lookup If the user is on-premises and the Outlook configuration permits it, the local domain is queried for any autodiscover Service Connection Points (SCPs), where the SCP is the URL of the autodiscover service. If any of the discovered services return the details for Exchange Web Services those details are used; otherwise, the process continues. #### Autodiscover HTTP Redirect If the Outlook configuration permits it, a check is made for an HTTP redirect on the autodiscover domain for the email address; this is the same process as that set out in §5.2.2. If the discovered service returns the details for Exchange Web Services, those details are used; otherwise, the process continues. #### HTTPS Autodiscover Domain If the Outlook configuration permits it, the URL for the autodiscover service in the autodiscover domain for the email address is constructed and queried; the URL will be in the following format: ```text https://autodiscover./autodiscover/autodiscover.xml ``` If the service returns the details for Exchange Web Services, those details are used; otherwise, the process continues. #### HTTPS Root Domain If the Outlook configuration permits it, the URL for the autodiscover service in the root domain for the email address is constructed and queried; the URL will be in the following format: ```text https:///autodiscover/autodiscover.xml ``` If the service returns the details for Exchange Web Services, those details are used; otherwise, the process continues. #### Service DNS Record Lookup If the Outlook configuration permits it, a lookup of the service (SRV) DNS records for the autodiscover TCP sub￾domain for the mail address is performed; the sub-domain is named as follows: ```text autodiscover._tcp. ``` Any returned records should point to the top-level domain where the autodiscover service is located; from there, the complete URL for the autodiscover service can be constructed and queried. For example: ```text Email address: info@scantruck.dk SRV Lookup Domain: _autodiscover._tcp.scantruck.dk SRV Lookup Result: autodiscover.nc-nielsen.dk ``` For each found record, the following steps are taken: • Query the autodiscover service at https\:// :record[/autodiscover/autodiscover.xml • Query the autodiscover service at {rel=""nofollow""}. :record[/autodiscover/autodiscover.xml if the record does not point to the autodiscover sub-domain. • Check for an HTTP redirect on the domain specified by the record (i.e. the same process as that set out in §5.2.2).]] If any of the steps yield the details for Exchange Web Services, those details are used; otherwise, the process fails. #### Appendix Two – Determining a Mailbox is Hosted by Exchange Online To determine if a mailbox is hosted by Exchange Online, the steps set out in the following sections are performed. #### Step One - Query On-Premises Autodiscover in a Hybrid Environment When the Agent is running on a domain, it will look for the Service Connection Points (SCPs) for the on-premises Exchange Server autodiscover service and query any it finds; the response can return one of three things: • If the mailbox is hosted in the Cloud, the redirect email address is returned; in this case, the process continues using that address (it must not be assumed that the redirect address is Office 365). • If the mailbox is hosted on-premises, the internal EWS URL is returned; in this case, because it is not an Office 365 mailbox, the standard autodiscover process is performed (see §5.1). • Otherwise, the mailbox is unknown to the on-premises Exchange and the process continues. Refer to Appendix Three in §5.3 for an example of how a mailbox hosted on Office 365 is configured in a hybrid environment. #### Step Two – Check for Autodiscover Redirect When a domain is hosted on Office 365, it is normal for the autodiscover sub-domain to be redirected to the Office 365 autodiscover domain. Hence, using the domain component of the email address, it is possible to check for this, as shown in the following example: ```text Email address: bea@symprex.com Standard autodiscover URL: https://autodiscover.symprex.com/autodiscover/autodiscover.xml Redirection response: https://autodiscover-s.outlook.com/autodiscover/autodiscover.xml ``` If a redirection to a standard Office 365 URL is found, it is known the mailbox is hosted on Office 365; otherwise, the process continues. #### Step Three – Query MX DNS Records When a domain is hosted on Office 365, its MX records may point to the Exchange Online endpoint for the tenant, which will be the form :tenant[.mail.protection.outlook.com. Hence, using the domain component of the email address, it is possible to check for this, as shown in the following example:] ```text Email address: bea@symprex.com MX record for symprex.com: symprex-com.mail.protection.outlook.com ``` In other cases, the MX records will point to an anti-spam or other email protection service such as Mimecast, for example: ```text Email address: peter.pallister@bidwells.co.uk MX records for bidwells.co.uk: eu-smtp-inbound-X.mimecast.com ``` If the MX record points to a standard Exchange Online endpoint, it is known the mailbox is hosted on Office 365; otherwise, it is assumed that the mailbox is not hosted by Exchange Online. ### Appendix Three – Exchange Online Hosted Mailbox in a Hybrid Environment When a hybrid Exchange environment is configured, there is a key attribute set on a user’s domain account when their mailbox is hosted in the Cloud; the targetAddress attribute. This attribute tells Exchange that email sent to that user should be redirected to that target address. The target address is always the alias address for the Exchange Online tenant, which takes the form :user[@ :tenant[.mail.onmicrosoft.com (this alias is determined as part of the hybrid environment configuration process); the on-premises Exchange Server than applies an email address policy to determine the hosted email address from the user’s account details.]] An on-premises Exchange Server in a hybrid environment distinguishes between Exchange Online and local mailboxes. It identifies Exchange Online mailboxes in the details pane. For a remote mailbox, the email address policy determines the primary email address. The hybrid environment configuration determines the secondary alias address. The remote routing address is the value of the `targetAddress` attribute, which identifies that the mailbox is hosted on Exchange Online. ### Appendix Four - Logging Logging in the Agent follows the same general principles as the other main UI applications. However, it has been altered in recent versions due to excessive memory usage. In addition, registry logging has to be explicitly enabled as it creates a huge amount of information in the log that is not normally required to debug issues in the Agent. #### v3.2.0 and Above In v3.2.0 and above, logging can be enabled either through the registry or the command line; any configuration on the command line will take precedence over the registry. #### Registry Logging The logging configuration is specified in `HKEY_CURRENT_USER\SOFTWARE\Symprex\Email Signature Manager Agent`. The following values are supported: \| Value | Type | Description | \| Verbose Logging | String or DWORD | “True” or “Yes” or 1 to enable verbose logging | \| Raw Data Logging | String or DWORD | “True” or “Yes” or 1 to enable raw data logging | \| TCP/IP Logging | String or DWORD | “True” or “Yes” or 1 to enable logging data received and sent over TCP/IP | \| Registry Logging | String or DWORD | “True” or “Yes” or 1 to enable registry logging (v3.2.1.255 and above only) | \| Log File | String | Specifies the full path to the log file| #### Command Line Arguments The following command line arguments are supported: \| Switch | Description | \| /Verbose [=True|Yes] | Enables verbose logging | \| /RawData [=True|Yes] | Enables raw data logging | \| /TcpIp [=True|Yes] | Enables logging data received and sent over TCP/IP | \| /Registry [=True|Yes] | Enables registry logging (v3.2.1.255 and above only) | \| /LogFile= :path[ | Specifies the full path to the log file |] #### Prior to v3.2.0 In versions of the Agent prior to v3.2.0, the Status Monitor kept an in-memory copy of the raw data log, which led to a number of “out of memory” exception reports in {smartassembly}. It was also impossible to turn this behaviour off using the registry or command line (the settings for the log file path do work). It is therefore recommended that customers upgrade to the latest version of the Agent to avoid any memory issues. ## §1 The CAS can also be accessed across a Virtual Private Network (VPN) of course but unless domain services are available, this will need to be manually configured. ## §2 The persisted server details are also discarded at various other times e.g. when saving changes in the Advanced Options dialog, when the Reset Cached Credentials button is clicked on the Options dialog, or when an authentication error occurs during an automatic update. ## §3 The principal Exchange account is always the first Exchange Server account added to a profile. # Agent Command Line Switches Below is a list of command line switches for the agent when running the executable version of the agent,
/url Specifies the URL of the web service (can be EWS, CAS or the Email Signature Manager (ESM) Web Service) that the Agent will use
/server Specifies the name of the SQL Server to which the Agent will connect
/database Specifies the name of the database the Agent will use
/user Specifies the login name for connecting to SQL Server (if omitted, uses integrated security)
/password Specifies the password for connecting to SQL Server (if omitted, uses integrated security)
/updateandexit Specifies that the Agent will perform one update cycle and then exit immediately
/hidetrayicon Specifies that the Agent icon will not be displayed in the system tray
Here are some common use cases: To force the agent to use a specific CAS: SignAgent.exe/url=cas\://ex1612.dm1612.local To force the agent to connect to EWS: SignAgent.exe/url={rel=""nofollow""} # Agent fails to connect to CAS due to old or incorrect SCP If there is an old SCP entry hanging around from an old server in Active Directory, then the invalid entry needs to be removed. Please save the following to a file called **listscp.vbs**: Set Conn = createobject("ADODB.Connection") Set Com = createobject("ADODB.Command") Set RootDSE = GetObject("LDAP://RootDSE") NamingContext = RootDSE.Get("defaultNamingContext") Conn.Provider = "ADsDSOObject" Conn.Open "ADs Provider" Query = "``;(objectClass=serviceConnectionPoint);cn,distinguishedName;subtree" Com.ActiveConnection = Conn Com.CommandText = Query Set Rs = Com.Execute While Not Rs.EOF If Rs.Fields("cn") = "Email Signature Manager Client Access Service" Then WScript.Echo Rs.Fields("distinguishedName") End If Rs.MoveNext Wend Please open a **Command Prompt** and run the script like this: cscript listscp.vbs Example output: CN=Email Signature Manager Client Access Service,CN=EX1008,OU=Domain Controllers,DC=dm1008,DC=local CN=Email Signature Manager Client Access Service,CN=W7X86O2010X86,CN=Computers,DC=dm1008,DC=local Remove the old or incorrect entry as follows: 1. Open **ADSI Edit** by running **adsiedit.msc**. 2. Right-click the **ADSI Edit** node, click **Connect to...** and connect to the **Default naming context**. 3. Expand the nodes from DN of the SCP that needs to be removed using the output from **listscp.vbs**. This will fix the problem. # Agent Microsoft Installer (MSI) Switches Email Signature Manager (and the Microsoft Installer (MSI) Agent) support the default MSI switches for installing. You can find a list of MSI switches: [https://docs.microsoft.com/](https://docs.microsoft.com/en-us/windows/desktop/msi/standard-installer-command-line-options){rel=""nofollow""} Some common use cases for this: Generate a log file while installing the agent: msiexec.exe/a SignAgent-3.0.0.msi /qn /L\*V "c:\temp\log.log" # Agent optional command line arguments The agent supports the following optional command line arguments: /updateandexit Make the agent update Outlook signatures and exit instead of running in the background. /hidetrayicon Make the agent hide the system tray icon. /updateinterval Set the agent update interval in hours. # Agent Registry Values All the agent options are available either within Email Signature Manager (ESM) (under **Configuration** > **Deployment Options**) or within the Agent configuration menu. It is possible for some of these to be configured by setting registry values. It is important to note some of these will be overwritten when the agent next pulls the signatures from the server. You can manually add these values and restart the agent. You can also push out this setting via batch file or Group Policy Object (GPO).
Key Location Key (type) Description
HKCU\Software\Symprex\Email Signature Manager Agent\ Profile Name (string) Specifies the name of the outlook profile the Agent will use
HKCU\Software\Symprex\Email Signature Manager Agent\ Web Service URL (string) Specifies the location where the Agent will attempt to pull signatures from.
HKCU\Software\Symprex\Email Signature Manager Agent\ Hide Tray Icon (string) Specifies the agent to hide the icon from the system tray. (values: yes/no)
HKCU\Software\Symprex\Email Signature Manager Agent\ Suppress Authentication Error Popup Specifies the agent to hide Authentication errors (when connecting to EWS) (values: yes/no)
HKLM\SOFTWARE\Symprex\Email Signature Manager Agent\ Listening Port Range (DWORD) [number of ports (Default is 25)]
Some common use cases for this are: **Set specific outlook profile for agent to use:** Location: HKCU\Software\Symprex\Email Signature Manager Agent Key: Profile Name (string) Data: {Outlook profile name} **Force agent to connect to a specific ESM Client Access Service (CAS) or EWS server** Location: HKCU\Software\Symprex\Email SignatureManager Agent Key: "Web Service Url"(String Value) Data: {value to your ESM Client Access Service (CAS) or exchange.asmx file} Example: Data: {rel=""nofollow""} Example: Data: cas\://srv2012r2.domain2012r2.local # Agent reporting "need admin approval" ## Problem When the agent attempts to connect via Exchange Web Services the agent may report it requires admin approval for example: ![Email Signature Manager agent error message requiring admin approval for Exchange Web Services](https://support.symprex.com/assets/email-signature-manager/internal/known-issues/agent-reporting-need-admin-approval/esm-agent-ews-admin-approval-error.png) ## Solution Login to the [Azure Portal](https://portal.azure.com){rel=""nofollow""} and navigate to **Entra ID** > **Enterprise Applications** > **Symprex Email Signature Manager Agent** > **Permissions** and select "Grant Admin Consent for \[tenant]". This will approve the agent for all users to use within the tenant. ## Applies to Email Signature Manager agent 3 and above. # Email Signature Manager Agent cannot support Microsoft One Outlook ## Background In May 2023, Microsoft started to introduce the new version of Outlook for Microsoft 365 subscriptions. This has currently been made available to the release preview ring of Microsoft 365. End users can enable it if you have not specifically blocked this through Exchange Online PowerShell or Group Policy configuration. One Outlook consolidates a number of differing Outlook codebases into a single application. ::note This change does not affect the Signature 365 Outlook Add-in, or perpetually licenced versions of Office (2016 / 2019 / 2021) :: ## Problem This version of Outlook now uses roaming signatures for users signatures, storing these on Microsoft 365. As signatures are no longer stored locally on the machine, the Email Signature Manager Agent is unable to set signatures if you are using the updated version of Outlook 365. The new version of Outlook 365 also prevents the use of COM add-ins, although this feature does not affect the Email Signature Manager Agent. ## Solution Currently the only solution to apply signatures for Outlook 365 installations once the application is forced to update by Microsoft is to migrate to the cloud solution, Signature 365. Microsoft have currently given no indication about a rollout date to the release version of Microsoft 365. Before the updated version is released, it is possible to use either the Office Deployment Tool or Group Policy to define a version for your Microsoft 365 clients to update to. ::note Symprex only recommends preventing updates to Microsoft 365 software for a limited period of time. Preventing updates for longer can stop the installation of important security patches and updates, and may result in software being unable to connect to Exchange Online in extreme circumstances. :: This can be done using the **TargetVersion** update setting to prevent Microsoft 365 apps from updating past a particular version. Please see the following article on how to achieve this. [Configure update settings for Microsoft 365 Apps - Deploy Office | Microsoft Learn](https://learn.microsoft.com/en-us/deployoffice/updates/configure-update-settings-microsoft-365-apps){rel=""nofollow""} It is also possible to disable the **Try the New Outlook** button within the Outlook app itself in a number of ways. Disabling access to new Outlook via Exchange Online PowerShell. {rel=""nofollow""} Using Group Policy to assign the following registry key to your users. ::note #### Registry key HKEY\_CURRENT\_USER\Software\Microsoft\Office\16.0\Outlook\Options\General DWORD: HideNewOutlookToggle Value: 1 :: Version 2304 (Build 16327.20247 Click to Run) is currently known to function with the locally stored version of signatures. This article will be updated with the last known version of Microsoft 365 to allow this functionality. # Ensure the agent is deploying the signature The agent can currently download the signatures by either of the following methods: \- When the agent is inside the office the agent will attempt to download the signature via the Email Signature Manager Client Access Service. \- If the agent is outside the office or is unable to find an Email Signature Manager Service Connection Point the agent will fall back to use Exchange Web Services to download the signatures from. Below are the steps to assist with troubleshooting issues. When troubleshooting the agent, the first thing to look for is where the agent is connected to. To find this, double click on the agent from the system tray to see the agent status window. 1. From the agent status window, if you look at the Update URL you will see the agent will either start with cas:\\\ or http\:// or https\://. If the agent starts with cas:\\\ then it is connected directly to where the Email Signature Manager Server is. If the agent starts with `http` or `https` then the agent is using Exchange Web Services to download the signature.![Email Signature Manager agent status window showing Update URL with cas or https prefix](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-agent-is-deploying-the-signature/esm-agent-status-window-update-url.png) 2. If the agent is using the Email Signature Manager (ESM) Client Access Service, it will pull the signatures directly from the server. If you are having issues with the agent, first ensure the service result is completing successfully. The service result column in the status monitor on the server should show "okay" for that user. You can refer to the following document to check and troubleshoot: [Ensure a signature is being generated for a user](https://support.symprex.com/a/solutions/articles/1000290963){rel=""nofollow""} 3. If the agent is connected via Exchange Web Services you need to ensure under **Configuration** > **Environment Configuration** has been set to your Exchange Environment. Using "Exchange with No Impersonation" will mean the service will not update EWS so when the agent connects there are no signatures to be downloaded so it will remove the signatures from the workstation. 4. Below is an example of a typical error which you may receive from the agent![Email Signature Manager agent showing a typical deployment error message](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-agent-is-deploying-the-signature/esm-agent-deployment-error-example.png) 5. Below are a list of common issues which you may experience with the agent:
Error Fix
ERROR: Failed to install signature: x images could not be downloaded to the local machine Show how to find the image and most common causes for this
ERROR: Failed to send/receive with any server that was returned by the DNS lookup of 'server.domain.local' Agent failed to connect to ESM Server most likely firewall blocking port 5757 to server
# Generate a debug log file for Email Signature Manager Agent V1 Use the following steps to generate a debug log file for the Email Signature Manager Agent: - Determine where the agent, **SignAgent.exe**, is located. If **SignAgent.exe** is started from a logon script, it will be started from a network share, otherwise, it will be installed on the machine. Create a temporary folder C:\Temp to which all users have read/write access. - Start a command prompt. - Execute the following command: `\SignAgent.exe /LogFile=C:\Temp\ESM.SignAgent.LogFile.txt /Verbose /RawData` where `` is where the agent, **SignAgent.exe**, is located. - Allow the agent to complete and for the window to close. - Locate the log file `C:\Temp\ESM.SignAgent.LogFile.txt`, zip it up (it can grow large) and email it to Symprex support. Note: If installed on the machine, the file name of the executable is **SignAgentNET.exe**, and all instances of **SignAgent.exe** above should be replaced by **SignAgentNET.exe**. # Uninstalling Microsoft Installer (MSI) version of the agent From a user's workstation, run the following PowerShell command: ```powershell get-wmiobject Win32_Product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize ``` From this you should be able to pull the "IdentifyingNumber" for the Version of Symprex Agent which you are looking to uninstall. IdentifyingNumber Name LocalPackage \----------------- ---- ------------ ****{c581d2f0-3f89-4c5f-9c17-6879a744d8fe=""} Symprex Email Signature Manager Agent c:\Windows\Installer\1bf6e.msi Once you have the IdentifyingNumber you can then use the following command to Uninstall the agent: msiexec /uninstall C581D2F0-3F89-4C5F-9C17-6879A744D8FE /qn /norestart /L\*V %temp%\ESMuninstall.txt Once you have this command you can then compile this into a VBScript then even use a Group Policy Object (GPO) to call the VBScript. JM: I tried to complete this however I will need to come back to this and revisit this. # Additional Mobile Rules For some devices which contain a hyperlink within the signature you will need to create a new rule which contains the HTML Code. Two examples of this are the Outlook app on both iOS and Android devices. Outlook for IOS contains a default signature of: Get Outlook for iOS To fix this you should create a new rule with the following: Text to Replace: 'Get `Outlook for iOS`' Rule contains HTML Code: Checked Rule is case-sensitive: unchecked Outlook for android contains a default signature of: Get Outlook for android Text to Replace: 'Get `Outlook for Android`' Rule contains HTML Code: Checked Rule is case-sensitive: unchecked **Note:** If you do not see the "Rule contains HTML Code" option you need to upgrade Email Signature Manager 8.3.0 or above. # Change number of threads Email Signature Manager Service uses. The default number of threads Email Signature Manager will use is 5 Threads You can reduce/increase the number of threads Email Signature Manager is using by: **Key:** HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Service **Setting:** Process Users Thread Count **Type:** DWORD **Value:** 0 You can change the value to the number of threads you want Email Signature Manager to use. This is useful if AD is timing out. # Configuration File Location The mac agent will attempt to write the configuration file to: /Library/Symprex/Email Signature Manager Agent/Symprex Email Signature Manager Agent.plist /Library/Symprex/Email Signature Manager Agent/Symprex Email Signature Manager Agent.txt /Users/\[user]/Library/Application Support/Symprex/Email Signature Manager Agent/Symprex Email Signature Manager Agent.txt If the agent does not appear to be picking up the configuration file, ensure you have both read and write access to this file. # Disable User Access Control If User Access Control has been enabled and you are unable to make any changes in Email Signature Manager complete the following: Using Manager Mode, User Access Control has been enabled and you are unable to make any changes you will need to re-open Email Signature Manager on the server as a Domain Administrator. You can also disable the User Access Control by opening the database editing the settings table and setting the following: Row: EnableAccessControl Value: 0 0 = Disabled 1 = Enabled # Email Signature Manager registry settings Key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Value Name: Enable Send-by-Email Attachment Configuration Value Type: DWORD Value Setting: 0 or 1 Key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Service Value: Maximum Upload Attempts Value Type: DWORD Value Setting: 0 (to disable) or up to 65,535 (number of upload attempts on failed upload) Key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Service Value Name: Process Users Thread Count Value Type: DWORD Value Setting: 0 (to disable) or greater to set the number of threads (default is 3) Key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Service Value Name: Maximum RTF Signature Size Value Type: DWORD Value Setting: The maximum size, in bytes, for the RTF signature (default is 2Mb), or zero to disable the mechanism (i.e. no check is made on the size) Key: HKEY\_LOCAL\_MACHINE\SOFTWARE\Symprex\Email Signature Manager Service Value Name: Disable Deployment Cleanup Value Type: DWORD Value Setting: 0 or 1 # Ensure a signature is being generated for a user For the agent to deploy the signature, the service needs to pre-generate that user's signature. This document will assist in troubleshooting issues with the service generating a user's signature. 1. After adding a user for deployment, you need to force the service to generate the signatures. The service will automatically run periodically (4 hours by default). You can force this to happen using the "Update All" option on the ribbon menu. - ![Email Signature Manager ribbon menu showing Update All option](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-a-signatures-is-being-generated-for-the-user/esm-ribbon-update-all-button.png) 2. After selecting "Update All" on the status bar you should see the service processing the request.![Email Signature Manager status bar showing service processing request](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-a-signatures-is-being-generated-for-the-user/esm-service-processing-status-bar.png) 3. After the service becomes idle is has finished processing the request.![Email Signature Manager status bar showing service idle after processing](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-a-signatures-is-being-generated-for-the-user/esm-service-idle-after-processing.png) 4. From the ribbon menu if you select the status monitor.![Email Signature Manager ribbon menu showing Status Monitor option](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-a-signatures-is-being-generated-for-the-user/esm-ribbon-status-monitor-option.png) 5. You should then see that user appearing in this list with the "Service Result" appearing "okay". If you are not seeing that user in this list or the "Service Result" is showing "Error", go to "[Service Result Troubleshooting](https://support.symprex.com/a/solutions/articles/1000290962){rel=""nofollow""}".![Email Signature Manager Status Monitor showing user with okay service result](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-a-signatures-is-being-generated-for-the-user/esm-status-monitor-user-ok-result.png) 6. You have now completed Step 2 of [Troubleshooting Document (Outlook)](https://support.symprex.com/a/solutions/articles/1000290957){rel=""nofollow""}. If you are still having issues please continue to Step 3. # Ensure a user is configured for deployment To deploy a signature, you need to ensure a user is configured for deployment. This document details the steps to complete this. 1. Under "Manage Deployment" you can target an Active Directory Group or user.![Email Signature Manager Manage Deployment dialog showing Active Directory group or user targeting](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-user-is-configured-for-deployment/esm-manage-deployment-targeting.png) 2. For troubleshooting, start with a single user. Go to "User Deployment (tab)" and select "Add" in the bottom left corner. You can then search for that user from Active Directory.![Email Signature Manager User Deployment tab showing Add button to search Active Directory users](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-user-is-configured-for-deployment/esm-user-deployment-add-user-dialog.png) - If that user does not appear when you search, check the following: - User is not disable within on-premises Active Directory![Active Directory user account properties showing account is not disabled](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-user-is-configured-for-deployment/esm-ad-user-account-enabled.png) - User has an email address entered in the email field within the General tab of their on-premises AD account.![Active Directory user properties General tab showing email address field](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-user-is-configured-for-deployment/esm-ad-user-general-tab-email.png) - Ensure their logon details are all entered.![Active Directory user Account tab showing logon name and pre-Windows 2000 logon name fields](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-user-is-configured-for-deployment/esm-ad-user-account-logon-details.png) - User is not hidden from the GAL within Exchange. 3. Select which signatures you want this user to receive. - This example uses the "Pole Position" signature for Outlook deployment, "Basic Signature" for OWA, and "Mobile Signature" for emails using the [Injection Method](https://docs.symprex.com/email-signature-manager/latest/html/index.html?signature_injection.htm){rel=""nofollow""}.![Email Signature Manager user deployment showing signature selection for Outlook, OWA, and mobile](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/ensure-the-user-is-configured-for-deployment/esm-user-deployment-signature-selection.png) 4. You have now completed Step 1 of [Troubleshooting Document (Outlook)](https://support.symprex.com/a/solutions/articles/1000290957){rel=""nofollow""}. If you are still having issues please continue to Step 2. # Error: "The user does not have a valid User Principal Name" **Problem** Some users are not getting a signature from Email Signature Manager. Within the Status Monitor, affected users are reported as "excluded". The "Service Result" for the affected users reports: ```text Unable to deploy/generate signatures because the user does not have a valid User Principal Name. ``` **Solution** You will need to complete the following steps to ensure a signature is generated for the affected users. 1. Open Active Directory Users and Computers, and browse to the affected users. 2. Select the "Account" (tab) and ensure the following have a value: User Logon name, User Logon Name (pre-Windows 2000) 3. Below is a screenshot of all the fields which need to have a value. ![Active Directory user Account tab showing User logon name and pre-Windows 2000 logon name fields required](https://support.symprex.com/assets/email-signature-manager/internal/known-issues/error-the-user-does-not-have-a-valid-user-principal-name/ad-user-account-tab-upn-fields.png) Once you have updated this, you will need to force Email Signature Manager to re-generate the signatures to do this complete the following 1. Open Email Signature Manager 2. Select "Update All" from the ribbon menu to force the service to re-generate the signatures. 3. Once the service has completed go back into the status monitor and confirm there are no errors. # Error Messages ::generated-category-children{generated} :: # No Outlook profiles found; unable to update signatures Problem Within the status monitor of Email Signature Manager if the "Service Result" column is showing "Error" for all users this usually suggests there is an issue with the service account. Looking at the "Service Result" for all users you may find the following error message: ```text No Outlook profiles found; unable to update signatures ``` The above error usually suggests Outlook cannot be found on the device. Please ensure in the first instance you are not running the windows store version of Outlook. (JM to attach a screenshot) highlighting the windows store version # Service Account incorrect permissions If you receive the following error then it would suggest the service account does not have the correct permission ```text The account does not have permission to impersonate the requested user ``` The solution to this is to re-create the service account using the steps provided in the affected product's User Guide: [Email Signature Manager User Guide](https://docs.symprex.com/email-signature-manager/latest/html/index.html?service_accounts.htm){rel=""nofollow""} [Folder Permissions Manager User Guide](https://docs.symprex.com/folder-permissions-manager/latest/html/index.html?permissions_requirements.htm){rel=""nofollow""} [Out of Office Manager User Guide](https://docs.symprex.com/out-of-office-manager/latest/html/index.html?permission_requirements.htm){rel=""nofollow""} [Out of Office Extender User Guide](https://docs.symprex.com/out-of-office-extender/latest/html/index.html?permissions_requirements.htm){rel=""nofollow""} # Service Account Password Expired/Pending password change **Problem** Within the status monitor of Email Signature Manager if the "Service Result" column is showing "Error" for all users this usually suggests there is an issue with the service account. Looking at the "Service Result" for all users you may find the following error message: ```text The remote server returned an error: (457) ``` The above error this usually suggests the service has either: \- an expired password or \- the account is pending a password change. **Solution** You will need to update the password within Microsoft 365 and complete the following steps: 1. Open Email Signature Manager 2. Go to **Configuration** > **Environment Configuration** 3. Under "Microsoft 365 Mailbox Access" re-enter the updated password. 4. Select "Test Connectivity" and search for a user who has a Microsoft 365 mailbox. 5. Confirm the test completes successfully. 6. Back on the main window select "Update All" from the ribbon menu to force the service to re-generate the signatures. 7. Once the service has completed go back into the status monitor and confirm there are no errors. **Extra Steps** To prevent the issue from happening again you can also set the service account password never to expire. Microsoft provides the steps for this in the following article: [https://docs.microsoft.com/](https://docs.microsoft.com/en-us/office365/admin/add-users/set-password-to-never-expire?view=o365-worldwide){rel=""nofollow""} # Unable to acquire the OAuth token to connect to Exchange Web Services ## Problem Email Signature Manager is failing to update signatures for users, and you see the below error in the Status Monitor and if you perform a Connectivity Test: ::note Unable to acquire the OAuth token to connect to Exchange Web Services :: ## Reason Email Signature Manager is not correctly renewing the authentication token that was generated when you authenticated credentials for Microsoft 365. The authentication token by default expires after 90 days. ## Solution Two possible solutions to this problem exist: - Upgrade to Email Signature Manager version 9 or later. - Open the Environment Configuration dialog and re-enter Microsoft 365 credentials to generate a new authentication token. ## Applies to Email Signature Manager, version 7 and 8 # Exchange Online RBAC Deprecation In February 2024, Microsoft announced plans for deprecation of the ApplicationImpersonation role in EWS as described in the Critical Update below: [Critical Update: ApplicationImpersonation RBAC Role Deprecation in Exchange Online](https://techcommunity.microsoft.com/blog/exchange/critical-update-applicationimpersonation-rbac-role-deprecation-in-exchange-onlin/4295762){rel=""nofollow""} As a result, all Symprex on-premises applications are replacing existing access that uses the Application Impersonation role by moving to the full\_access\_as\_app permission. This ensures access to all mailboxes without requiring permissions to be explicitly set on each mailbox. Using full\_access\_as\_app through a delegated user account would require explicit permissions to be granted access to all mailboxes, and would need to grant the delegated user access to any new mailboxes created after initial setup. Previously, this was achieved using a delegated permission due to the ability to configure access as a specific user in combination with the ApplicationImpersonation role. Version 10 of Email Signature Manager, Folder Permissions Manager, and Out of Office Manager, and version 9 of Out of Office Extender, were released in September 2024. This allows customers with maintenance agreements to upgrade and use the latest authentication mechanism. These can be downloaded from [www.symprex.com/download/](https://www.symprex.com/download/){rel=""nofollow""} - installation / upgrade can be completed on an existing instance of any of the Symprex tools. Existing authentication will continue to function until disabled by Microsoft. For customers without a maintenance agreement, please contact the sales team at to discuss this. Licence keys are restricted to major version numbers, so must be updated to activate the software. The installation process with prompt for the authentication method to be updated if the previous RBAC method is still in use. This can be completed using the internal wizard, or manually performed using the article below: [Manually registering an entra id application for symprex on premises products](https://support.symprex.com/en/support/solutions/articles/1000323328-manually-registering-an-entra-id-application-for-symprex-on-premises-products){rel=""nofollow""} If you experience any issues with the creation / update process, please raise a ticket with the support team at # Generate a debug log file for the Email Signature Manager Client Access Service Use the following steps to generate a debug log file for the Email Signature Manager Client Access Service: - Create a temporary folder C:\Temp to which all users have read/write access. - Check if the file `C:\Temp\ESM.CAService.LogFile.txt` exists; if it does, delete it. - Open **Services Control Manager** in **Control Panel** > **Administrative Tools**. - Right-click the **Symprex Email Signature Manager Client Access Service** and select **Properties**. - If the service is currently running, click the **Stop** button to stop it (it may take a few moments to stop). - In the **Start parameters** box, enter the following: `/LogFile=C:\Temp\ESM.CAService.LogFile.txt /Verbose /RawData` - Click the **Start** button to start the service. - In the Email Signature Manager Agent, perform the actions that invoke the incorrect behaviour. - Click the **Stop** button to stop the service. - Close the **Properties** dialog for the service and restart the service from the main window of Services Control Manager. - Locate the log file `C:\Temp\ESM.CAService.LogFile.txt`, zip it up (it can grow large) and email it to Symprex support. # Generate a debug log file for the Email Signature Manager Service Use the following steps to generate a debug log file for the Email Signature Manager Service: - Create a temporary folder C:\Temp to which all users have read/write access. - Check if the file `C:\Temp\ESM.Service.LogFile.txt` exists; if it does, delete it. - Open **Services Control Manager** in **Control Panel** > **Administrative Tools**. - Right-click the **Symprex Email Signature Manager Service** and select **Properties**. - If the service is currently running, click the **Stop** button to stop it (it may take a few moments to stop). - In the **Start parameters** box, enter the following: `/LogFile=C:\Temp\ESM.Service.LogFile.txt /Verbose /RawData` - Click the **Start** button to start the service. - Allow the service to complete a full processing cycle (you can monitor this using the Windows Event Viewer). - Click the **Stop** button to stop the service. - Close the **Properties** dialog for the service and restart the service from the main window of Services Control Manager. - Locate the log file `C:\Temp\ESM.Service.LogFile.txt`, zip it up (it can grow large) and email it to Symprex support. # Generate a debug log file for the Email Signature Manager Transport Agent Use the following steps to generate a detailed log file from the Email Signature Manager Transport Agent: - On your Exchange Server (where the transport agent is installed), start regedit. Navigate to the following registry key: `HKEY_LOCAL_MACHINE\Software\Symprex\Email Signature Manager Transport Agent` - Create the following entries: - **Name:** Log File - **Type:** String - **Value:** *Leave blank for the time being* - **Name:** Verbose Logging - **Type:** String - **Value:** True - **Name:** Raw Data Logging - **Type:** String - **Value:** True - **Note:** At this stage, no log file is being created. - Create a folder C:\Temp and ensure all users have read/write access to it. - On a mobile device, prepare to send a test email that will invoke the unwanted behaviour but *do not send it as this point*. - On the Exchange Server, using regedit, set the following entry: - **Name:** Log File - **Value:** `C:\Temp\ESM.TransportAgent.LogFile.txt` - **Note:** This will cause the Transport Agent to start logging to the file above. It will grow large depending on the throughput of your server, so configure it for the shortest time possible to keep the log concise. - Send the test email from the mobile device. Once it has been delivered, verify that the incorrect behaviour has occurred; this will ensure the log file has captured what the Transport Agent did when the email was processed. - In regedit, clear the value of the Log File entry (this will stop any further information being written to the log file). - Locate the file `C:\Temp\ESM.TransportAgent.LogFile.txt`, zip it up, and email it to Symprex support. **Important:** While logging is enabled, the details of *all* emails that are processed by the Transport Agent will be recorded. Therefore, wherever possible, it is recommended that this procedure is followed at a time when the Exchange Server is not busy to keep the log file as short and as concise as possible. # How to setup the Signature Injection Service for Microsoft 365 **How to setup the Signature Injection Service for Microsoft 365** **First download the latest Email Signature Manager V9 from the Download page on Symprex.com:** You can download and install this version over your current version to upgrade. Active maintenance is required to use the Signature Injection Service and allows you to upgrade to V9. **Next follow these steps to configure Email Signature Manager and Microsoft 365 as follows:** 1. Start Email Signature Manager. 2. Click the blue **Configuration** ribbon. 3. Click the **Mobile Device Signatures** button to open the **Mobile Device Signatures** dialog. 4. Enable the option **Inject signatures into emails sent from mobile devices using rules**. 5. Optionally enable the option **Convert plain-text emails sent from mobile devices to HTML**. 6. Click the **Microsoft 365 Integration** button to open the **Microsoft 365 Integration** dialog. 7. Provide Microsoft 365 administrative credentials to logon. 8. Check the list of **Accepted Domains**. 9. Configure the SPF record for each of your accepted domains to include spf.symprex.net. Do this by adding `include:spf.symprex.net` to the SPF record, as shown in this example: ```text v=spf1 include:spf.protection.outlook.com include:spf.symprex.net -all ``` 10. Press the **Refresh** button to update the list of **Accepted Domains** and verify there are no errors or warnings. 11. Press the **Configure** button, and Email Signature Manager will create the required connectors and transport rule in your Microsoft 365 tenant. Normally, it will take a few minutes for these to become active. *Note that you can scope the integration to only process specific users, groups, or domains. The effective scope combines user, group, and domain scope. You can use scoping to initially test the integration for one or more test users.* 12. Before you close the **Microsoft 365 Integration** dialog, add **Technical Contacts** in the Microsoft 365 Integration dialog. Symprex uses these contacts to reach you if there are any problems with your service. 13. Close the **Microsoft 365 Integration** dialog, and close the **Mobile Device Signatures** dialog. 14. Click **Update All** in the ribbon and Email Signature Manager will generate and upload your mobile device signatures to the cloud. 15. Send a test email from a mobile device with a signature matching a rule, and you should see the appropriate signature being injected. # Certificate validation checks in on-prem products You can alter how the on-prem apps validate certificates by setting values in ```text HKEY_LOCAL_MACHINE\SOFTWARE\Symprex\Common. ``` Specifically, you can set the ```text Certificate Validation Mode ``` value as follows: - `All`: validate all certificates (this is the default) - `Microsoft`: only valid Microsoft certificates - `None`: do not validate certificates (how the code behaved before the Franklin releases). # Database corruption If Email Signature Manager is using the built-in MDB database, complete these recovery steps: 1. Close **Email Signature Manager**. 2. Stop both **Symprex Email Signature Manager** services in `services.msc`. 3. Open `C:\ProgramData\Symprex\`. 4. Take a backup copy of `Symprex.EmailSignatureManager.Database.mdb`. 5. Open the `.mdb` file in Microsoft Access. If needed, copy it to another workstation that has Access installed. 6. Run **Compact and Repair Database**. 7. If you repaired the database on another workstation, copy the repaired file back to the original location. 8. Open **Email Signature Manager**. 9. Start both Symprex services again. # Known Issues ::generated-category-children{generated} :: # Manually registering an Entra ID application for Symprex on-premises products ## Scenario Due to the deprecation of the application impersonation role by Microsoft, you want to configure a new Entra ID registered application using the full\_access\_as\_app permission for an on-premises Symprex product. You do not want to use the automated method of doing this. ::warning This process requires knowledge of security certificates and an account with Global Administrator permissions for your Microsoft 365 tenant :: ::note Newly created applications through the Microsoft admin portal can take some time to become active. Wait 24 hours between creating the application registration and configuring Email Signature Manager :: ## Solution This article will detail how to manually create an Entra ID registered application and assign a self-signed certificate to allow an on-premises Symprex product to integrate with Microsoft 365. As part of this process, the setup wizard can generate a self-signed certificate and upload this to Entra. It is also possible to import an existing certificate from PFX file using a private key. - Log on to the Entra portal at the [Azure Portal](https://support.symprex.com/portal.azure.com) and select the **Microsoft Entra ID** service ![Azure Portal showing Microsoft Entra ID service selection](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/azure-portal-entra-id-service.png) - Select the **Manage** > **App registrations** menu option ![Microsoft Entra ID portal showing Manage App registrations menu option](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-manage-app-registrations.png) - Select **+ New registration** from the horizontal menu ![Entra ID App registrations page showing New registration button](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-app-registrations-new.png) - Name the application. Use **Symprex {application name}**![Entra ID app registration form showing application name field](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-register-app-name-field.png) - Set the supported account types as required. For a single tenant select the top option - Click the **Register** button to create the application - This creates and opens the app. Select the API Permissions menu option then **+ Add a permission**![Entra ID app API Permissions page showing Add a permission option](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-app-api-permissions-add.png) - Select the **APIs my organisation uses** tab and type **Office** in the search box. Click the **Office 365 Exchange Online** option ![Entra ID Request permissions showing Office 365 Exchange Online selection](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-api-office-365-exchange-online.png) - Select **Application permissions,** **full\_access\_as\_app** and click **Add permissions**![Microsoft Entra permissions showing full\_access\_as\_app application permission selection](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-api-full-access-as-app.png) - Select the **Grant admin consent for {domain}** option ![Microsoft Entra permissions page showing Grant admin consent option](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-grant-admin-consent.png) - Select **Yes** to enable the permission for your domain ![Entra ID confirmation dialog for granting admin consent](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-grant-consent-confirm.png) - A pop up will confirm the consent is granted, and permissions now show as **Granted for {domain}**![Microsoft Entra permissions showing full\_access\_as\_app granted for domain](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-permissions-granted.png) The application registration process is now completed. At this point, leave the application registration window open, as it is needed to add the certificate once it is created, and return to Email Signature Manager. On starting Email Signature Manager (ESM), existing installations should select **Configuration** > **Environment Configuration** as the screenshot below. For new installations a screen will be displayed by default, noting that the application must be configured. ![Email Signature Manager Configuration Environment Configuration dialog](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-environment-configuration-screen.png) - Select the correct option for your environment and click the **Configure** button ![Email Signature Manager environment selection dialog with Configure button](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-environment-select-configure.png) - Select the **Use an existing Entra ID application** option ![Email Signature Manager wizard showing Use an existing Entra ID application option](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-use-existing-entra-id-app.png){style="width: 540px;"} - You will see the following screen. The **Application ID** and **Directory ID** values can be found by viewing the Application created in the steps at the start of the guide ![Email Signature Manager wizard showing Application ID and Directory ID fields](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-entra-app-directory-id-fields.png){style="width: 539px;"}![Entra ID application overview showing Application and Directory ID values](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-app-overview-ids.png){style="width: 566px;"} - At this point, you can choose to select your own certificate file and enter the password for the certificate, or use the wizard to generate a self-signed certificate. If you choose to use your own certificate, please follow the guidelines below: - A 2048-bit key length. While longer values are supported, the 2048-bit size is highly recommended for the best combination of security and performance. - Microsoft Entra ID currently supports only the RSA cryptographic algorithm. - The certificate should be signed using at minimum the SHA256 hash algorithm. Microsoft Entra ID also supports certificates signed with SHA384 and SHA512 hash algorithms. - If generating a certificate using the wizard, select the validity and set the password for the certificate. You should keep a record of the password used. ![Email Signature Manager certificate wizard showing validity period and password fields](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-certificate-wizard-validity.png) - Name the certificate and save to a location on your ESM device ![Email Signature Manager certificate save dialog showing name and file location fields](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-certificate-save-dialog.png){style="width: 508px;"} - The certificate details will be automatically completed in the wizard. Hit the **Next** button to proceed. ![Email Signature Manager wizard showing auto-completed certificate details and Next button](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-certificate-details-completed.png){style="width: 506px;"} - You will see the completion screen, advising you that the application has been configured correctly. Click **Finish** to return to the main application. ![Email Signature Manager wizard completion screen confirming application configured correctly](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/esm-wizard-completion-screen.png) You must now upload the certificate used to the Entra app created earlier to allow authentication. Return to the App Registration window that was open previously. - Select the **Certificates and secrets** option from the left-hand menu, and select the **Upload certificate** option. ![Entra ID Certificates and secrets page showing Upload certificate option](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-certificates-secrets-upload.png) - In the flyout that opens, select the certificate that was created as part of the ESM configuration, enter a description as desired, and select the **Add** button at the bottom of the flyout. ![Entra ID upload certificate flyout showing certificate selection and Add button](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-upload-certificate-flyout.png) - You will see the new certificate and its start and expiry date listed. ![Entra ID Certificates and secrets showing uploaded certificate with start and expiry dates](https://support.symprex.com/assets/email-signature-manager/internal/office-365/manually-registering-an-entra-id-application-for-symprex-on-premises-products/entra-id-certificate-uploaded-listed.png) Return to Email Signature Manager and test the mailbox access by selecting the **Test Connectivity...** option and selecting a mailbox to access. # Service Result Troubleshooting So, either a specific user did not appear in the status monitor, or the service result produced an error. To troubleshoot this first open the status monitor from the ribbon menu and ensure the following two checkboxes are checked:![Email Signature Manager Status Monitor showing two checkboxes to enable full display](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/service-result-troubleshooting/esm-status-monitor-checkboxes.png) 1. If a user is not appearing in the status monitor, check [Ensure a user is configured for deployment](https://support.symprex.com/a/solutions/articles/1000290956){rel=""nofollow""} 2. If you are getting an error message, select that user in the status monitor - Tip: You can either work in the Status Monitor or left click in the Service Result Log and either - Right click and select all, right click copy OR - Control + A, then Control + C - then paste this into your favorite text editor to view full screen. 3. The best approach is to look for any of these phrases in the log, and check the resolution for that phrase. If you see a log entry that is not in the table below, send it to . -
Error Fix
The account does not have permission to impersonate the requested user The service account configured under **Configuration** > **Environment Configuration** does not have the role ability to impersonate users. More information on creating a service account can be found: Here
The remote server returned an error: (457) Error: "The remote server returned an error: (457)"
The user does not have a valid User Principal Name Error: "The user does not have a valid User Principal Name"
Unable to acquire the OAuth token to connect to Exchange Web Services Error: "Unable to acquire the OAuth token to connect to Exchange Web Services"
For example, using the table above, looking for the text "The account does not have permission to impersonate the requested user" is highlighted multiple times: - \- ERROR: Failed to write the Xml via Exchange Web Services: **The account does not have permission to impersonate the requested user**. [Here](https://docs.symprex.com/email-signature-manager/latest/html/index.html?service_accounts.htm){rel=""nofollow""} # Troubleshooting Document (Outlook) Help ! My signatures are not working. **Step 1**: [Ensure a user is configured for deployment](https://support.symprex.com/a/solutions/articles/1000290956){rel=""nofollow""} **Step 2:** [Ensure a signature is being generated for a user](https://support.symprex.com/a/solutions/articles/1000290963){rel=""nofollow""} **Step 3:** Ensure the agent is deploying the signature. # Mac Agent ::generated-category-children{generated} :: # Troubleshooting Mac Agent issues **Troubleshooting agent installing issues** Launch "Console" app and the filter for Email Signature Manager and you should see the log entries # Manually creating an Email Signature Manager (ESM) SCP These steps will detail how to manually create the Email Signature Manager Service Connection Point. 1. Open ADSI Edit 2. Connect to the Default naming context. 3. Browse to the server in question. This example uses "Server2019". 4. Right click on the server in question and select **New** > **Object**. 5. Select "serviceConnectionPoint" followed by **Next**. 6. under value enter: Email Signature Manager Client Access Service followed by **Next** and **Finish**. 7. You should now see a new entry as follows:![ADSI Edit showing newly created Email Signature Manager Client Access Service connection point](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/manually-creating-esm-scp/adsi-edit-esm-scp-entry.png) 8. Right click on "CN=Email Signature Manager Client Access Service" and select **Properties**. 9. Under **Filter**make sure the following options as set 1. Show only attributes that have values - unchecked 2. Show only writable attributes - checked 10. You will then need to enter the following information
Attribute Value
keywords bfeea0b4-921b-4444-836f-e66f39d54500
serviceBindingInformation cas://{FQDN to ESM server} example: cas://ESMServer.domain.local
serviceDNSName {FQDN to ESM server} example: ESMServer.domain.local
You should then click **Apply**. If you go back into Email Signature Manager and go to **Configuration** > **Deployment Options** > **Client Access Service**, under "Service Connection Point" select "Test". It should then find the SCP you just created, depending on the replication of this information. # Notes on debug logging in Email Signature Manager - Using Email Signature Manager 7.1.0, and later, it should not normally be necessary to use the **/RawData** switch. The **/Verbose** switch alone should be enough in most cases to determine what is going wrong. - Using Email Signature Manager 7.2.2, and later, TCP/IP logging can be enabled using **/TcpIp** switch for the Client Access Service. - Using Email Signature Manager Agent 1.2.2, and later, TCP/IP logging can be enabled using **/TcpIp** switch. # Microsoft 365 ::generated-category-children{generated} :: # On-premises software - configuration and licence transfer Configuration information for on-premises products is stored in the "HKCU\Software\Symprex\\``\\" Reg key, under the **Environment** string value. This can be used to transfer configuration between devices, and allows a single application registration to be used to integrate with Microsoft 365. The value can be exported as past of the reg hive, or copied directly as data. ![Windows Registry showing Symprex product Environment string value under HKCU](https://support.symprex.com/assets/email-signature-manager/internal/other-details/on-premise-software-configuration-and-licence-transfer/registry-symprex-environment-config.png) Licence information for all on-premises products are stored in the "HKCU\Software\Symprex\\``\Licence registry key. This information can be transferred to users on the same device. **This information can be used to bypass licence requirements. Do not give it to companies that do not require it.** ![Windows Registry showing Symprex product Licence registry key under HKCU](https://support.symprex.com/assets/email-signature-manager/internal/other-details/on-premise-software-configuration-and-licence-transfer/registry-symprex-licence-key.png) # Other Details ::generated-category-children{generated} :: # Outlook DPI Note: All the following screenshots were taken from a workstation and outside the VM where the DPI settings were changed. Here are the findings from investigating images with different DPI settings for Outlook created signatures and Symprex created signatures. **Created signatures** - These are images of the signature being created.
Symprex Created Signature Outlook Created Signature
DPI set to 100% Symprex created signature at 100% DPI Outlook created signature at 100% DPI
DPI set to 125% Symprex created signature at 125% DPI Outlook created signature at 125% DPI
**Viewing signatures at 100% DPI**
Symprex Created Signature Outlook Created Signature
Signature Created at 100% Symprex signature (created at 100%) viewed at 100% DPI Outlook signature (created at 100%) viewed at 100% DPI
Signature Created at 125% Symprex signature (created at 125%) viewed at 100% DPI Outlook signature (created at 125%) viewed at 100% DPI
**Viewing Signatures at 125%**
Symprex Created Signature Outlook Created Signature
Signature Created at 100% Symprex signature (created at 100%) viewed at 125% DPI Outlook signature (created at 100%) viewed at 125% DPI
Signature Created at 125% Symprex signature (created at 125%) viewed at 125% DPI Outlook signature (created at 125%) viewed at 125% DPI
**Analysis** The images below have been highlighted to show where they line up with the rest of the signature. **Viewing at 100%**
Symprex Created Signature Outlook Created Signature
Created at 100% Analysis: Symprex signature (created at 100%) viewed at 100% DPI with alignment highlighted Analysis: Outlook signature (created at 100%) viewed at 100% DPI with alignment highlighted
Created at 125% Analysis: Symprex signature (created at 125%) viewed at 100% DPI with alignment highlighted Analysis: Outlook signature (created at 125%) viewed at 100% DPI with alignment highlighted
**Viewing at 125%**
Symprex Created Signature Outlook Created Signature
Created at 100% Analysis: Symprex signature (created at 100%) viewed at 125% DPI with alignment highlighted Analysis: Outlook signature (created at 100%) viewed at 125% DPI with alignment highlighted
Created at 125% Analysis: Symprex signature (created at 125%) viewed at 125% DPI with alignment highlighted Analysis: Outlook signature (created at 125%) viewed at 125% DPI with alignment highlighted
**Conclusion** It looks like signatures created within Outlook does scale the images with the DPI, however signatures created within Symprex do not appear to scale. This is using the Beta version of the agent (3.0.2.214) which contains the V-shape information: `` `` !\[]\(file:///C:\Users\TU\AppData\Roaming\Microsoft\Signatures\Pole Position Signature\checkeredflag.jpg) `` # Proxy Server The below steps are for the below version and above: - Email Signature Manager v9.6.1.397 - Folder Permissions Manager v9.3.2.170 - Out-of-Office Manager v9.3.2.129 - Out of Office Extender v8.3.2.108 Various ways exist to use netsh to set the proxy, but the basic syntax is: > netsh winhttp set proxy ``:`` `` The exception list accepts wildcard (\*) and *should* be enclosed in double-quotes (`` at the end is the netsh equivalent of the checkbox *"Don't use the proxy server for local (intranet) addresses"*): > `netsh winhttp set proxy proxy.domain.com:3128 "*.exception1.com;*.exception2.com;192.168.*;"` Settings can also be imported from the current user's proxy settings: > netsh winhttp import proxy source=ie **Another Option:** Manually configure the proxy server for the account in which you are logged in with using Windows 10/11 proxy server details, for example: ![Windows 10/11 proxy server settings configuration dialog](https://support.symprex.com/assets/email-signature-manager/internal/error-messages/proxy-server/windows-proxy-server-settings.png){style="width: 297px;"} Some applications have a service that run under the "LocalSystem" account (notably Email Signature Manager (ESM) and OoO Extender). For these, complete the above steps to create a configuration to copy, and then: 1. In the registry, search for the value `DefaultConnectionSettings` as REG\_BINARY under the registry key `**HKCU**\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings` and copy it. 2. Under `**HKEY_USERS\S-1-5-18**\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings` add/update this to be the same as the above step. The service for both Symprex Email Signature Manager and Out Of Office Extender will now also use the proxy server. Detailed instructions from Microsoft can be found: [Configure endpoint proxy and Internet connectivity settings - Microsoft Defender for Identity | Microsoft Learn](https://learn.microsoft.com/en-us/defender-for-identity/configure-proxy#configure-proxy-server-using-the-registry){rel=""nofollow""} **Below are the steps for older versions of the product (and information only).** **Issue:** When using a proxy server the Email Signature Manager GUI reports the service can communicate with the Exchange server such as Microsoft 365, however when the service runs it fails to communicate with Exchange. This is often the case when a proxy server is configured per user. **Resolution:** To resolve this, complete the following steps: 1\. Browse to `c:\program files (x86)\symprex\email signature manager\` 2\. Take a copy of `Symprex.EmailSignatureManager.Service.exe.config` 3\. Edit `Symprex.EmailSignatureManager.Service.exe.config` and the selection in orange `` `` `` `` `` `` `` `` `` `` `` `` **Note\*\***:\*\* In a hybrid environment you may also need to complete the next step: Under **Configuration** > **Environment Configuration** ensure the on-prem user name is in the format domain\user and Microsoft 365 is in the format user\@domain # Send on Behalf of Signatures If you have a shared mailbox called "Sales" and User A,B,C access and send emails from this shared mailbox. You would do the following: 1. Under "Manage Deployment", add users A, B, and C on the left-hand side (or add a group that contains those users for group deployment). 2. Add the "sales" user under **User/Group can Send on Behalf of.** 3. Under **Signatures to Deploy** select the email signatures to deploy as Send-on-Behalf signatures that will have the details of the "sales" user. The end result will be that users A, B and C have their own email signatures, but also additional signatures that can be selected in the **Signature** dropdown when composing email in Outlook. These additional Send-on-Behalf signatures will have the details of the "sales" user. It is not currently possible to make a Send-on-Behalf signature default. If you want it as default, specify "" as the default signature for those users. Users will then have to select the Send-on-Behalf signature as default in Outlook options themselves. Finally it is not currently possible for Outlook to use the appropriate signature depending on the sending account. # Settings stored in mailboxes by the agent The agent stores information in mailboxes in a hidden message object with message class 'EmailSignatureManager.Signatures.Settings'. This is in exactly the same way and location as Microsoft stores, for example, out-of-office assistant settings in a hidden message object with message class 'IPM.Microsoft.OOF.UserOofSettings'. This follows the Microsoft guidelines for persisting application settings in a mailbox. Hidden messages are stored in the Inbox in a way so that they are not available in email clients such as Outlook, but only via programming interfaces such as EWS and MAPI. The hidden message stores serialised signatures and signature settings, and nothing else. These settings allow the agent to update Outlook signatures directly from settings in the mailbox. # User does not appear in the status monitor When attempting to deploy a signature to a user, that user does not appear in the status monitor on the server after running a service cycle. In most cases this is due to that user not having an email address entered in the email field in their Active Directory account under the General tab. # User email address setting `UserEmailAddress` is stored in `~/Library/Preferences/com.Symprex.EmailSignatureManagerAgent.plist` or under `~/Library/SyncedPreferences/` Set email address using this command: `defaults write com.Symprex.EmailSignatureManagerAgent UserEmailAddress -string ` For example: `defaults write com.Symprex.EmailSignatureManagerAgent UserEmailAddress -string test@domain.com` Note: Make sure not to include .plist extension. # Where to find the user's guide for Email Signature Manager Below you can find links to the user's guide for older versions: - [Email Signature Manager V9 user's guide](https://docs.symprex.com/email-signature-manager/archive/963/html/){rel=""nofollow""} (9.6.3) - [Email Signature Manager V8 user's guide](https://docs.symprex.com/email-signature-manager/archive/851/html/){rel=""nofollow""} (8.5.1) - [Email Signature Manager V7 user's guide](https://docs.symprex.com/email-signature-manager/archive/732/html/){rel=""nofollow""} (7.3.2) Note you can always press the F1 key in Email Signature Manager to open the user's guide for the version you have installed. # Image in email signature in reply email is replaced with placeholder ## Problem When you reply to, or forward, an email in the Mail app on an Apple iPhone or iPad, images in the HTML email are replaced with file names. Examples include image001.png, image002.png, and so on. ## Reason This is by design of the Mail app on Apple iOS devices. ## Solution This problem has no solution. ## Applies to Email Signature Manager, all versions # Problems & Solutions # OWA signatures are not updating in Microsoft 365 ## Scenario OWA signatures are not updating in Microsoft 365 even though deployment is successful and there are no errors reported. ## Information Microsoft enabled the roaming signatures feature on all Microsoft 365 tenants in April 2023. Even if you later disable it, Microsoft is known to re-enable roaming signatures at a later date. Email Signature Manager is unable to update OWA signatures when roaming signatures are enabled. ## Recommendation ::note Symprex recommends upgrading to Signature 365, which is designed for Microsoft 365. Signature 365 supports Outlook on all platforms, including mobile and New Outlook. Special pricing is available for existing Email Signature Manager customers, and Email Signature Manager settings can be migrated directly to Signature 365. It is recommended to upgrade to Signature 365 before September 2026, when Microsoft will disable the Exchange Web Services (EWS) API in Exchange Online. :: ## Solution ::warning Version 10.1 or later of Email Signature Manager is required for OWA signatures to work with Exchange Online. :: Microsoft has provided the following PowerShell command to disable roaming signatures on a Microsoft 365 tenant: ```powershell Set-OrganizationConfig -PostponeRoamingSignaturesUntilLater $true ``` **To confirm roaming signatures have been disabled:** 1. Log on to OWA. 2. Open **Settings**, select **Account**, and select **Signatures**. 3. If your **Signatures** page appears as the image below, the roaming signatures feature has been enabled on your Microsoft 365 tenant: ![OWA Signatures settings page showing roaming signatures are enabled](https://support.symprex.com/assets/email-signature-manager/problems-solutions/owa-signatures-are-not-updating-in-office-365/owa-signatures-roaming-enabled.png) 4. If your **Signatures** page appears as the image below, roaming signatures are disabled: ![OWA Signatures settings page showing roaming signatures are disabled](https://support.symprex.com/assets/email-signature-manager/problems-solutions/owa-signatures-are-not-updating-in-office-365/owa-signatures-roaming-disabled.png) ## Applies to Email Signature Manager, v9, v10 # Uninstalling the Email Signature Manager Agent programmatically ## Problem You wish to uninstall the Email Signature Manager Agent programmatically from a number of machines on your network. ## Solution Several methods can remove the Agent installation from your network. This can be done using a PowerShell script for ClickOnce or Microsoft Installer (MSI) installed Agents, or an MSI uninstallation for MSI installed Agents. ::warning It is always recommended to run the uninstallation scripts on a test machine before these are deployed to your network. :: In some cases when installed via MSI, the PowerShell script is known to be unable to remove the Agent installation. In this case, use the MSI uninstallation script instead. ### PowerShell The following PowerShell script will in most cases remove both the ClickOnce and MSI installed Agent from your devices. The .ps1 script below should be saved to your local machine. To run a saved script you will need to allow unsigned scripts to run. This can be done using the following command through an Administrative PowerShell window. ::note Set-ExecutionPolicy -Bypass :: [Agent Removal Tool](https://www.symprex.net/downloads/utils/RemoveEmailSignatureManagerAgent.zip){rel=""nofollow""} ### MSI uninstallation Owing to the nature of MSI installation, you must find the correct Local Package for the installed software. This can be done using PowerShell commands and the resulting information used with an RMM package or Group Policy Object (GPO) to remove the software from your computers. ::note If installed as a Machine based installation, the user running the commands will require local administrative permissions on the device. Remove Machine and User based installations as two distinct steps. If you have multiple versions of the software installed on your network, you will need to repeat this for all versions. :: Open a PowerShell window on a device with the Agent installed, and run the following command. ::note Get-WmiObject Win32\_product | Format-Table IdentifyingNumber, Name, LocalPackage -AutoSize :: ![PowerShell output showing Email Signature Manager agent MSI identifying number and local package path](https://support.symprex.com/assets/email-signature-manager/problems-solutions/uninstalling-the-email-signature-manager-agent-programmatically/esm-agent-msi-local-package-info.png) Using the LocalPackage field, you can use the following command to uninstall the agent. You will require write permissions to %temp% to run the command. ::note msiexec /uninstall C:\Windows\Installer\2fba28.msi /qn /norestart /L\*V %temp%\ESMuninstall.txt :: This command can be used with a boot/login script or RMM solution to remove the Agent as desired from your network. # User is not receiving signature and is not visible in Email Signature Manager ## Problem You have a user that is a member of a deployment group, but they are not receiving a signature. Further, if you try to add this specific user in the **Manage Deployment** dialog, on its **Users** tab, they do not appear in the **Select User** dialog. ## Reason Email Signature Manager only includes users that have their **User logon name** and **`E-mail`** properties configured in Active Directory. ## Solution Perform the steps below to solve the problem: 1. Open **Active Directory Users and Computers**. 2. Find the affected user and open **Properties**. 3. On the **General** tab, ensure the **`E-mail`** field contains an email address: ![Active Directory user Properties General tab showing the address field](https://support.symprex.com/assets/email-signature-manager/problems-solutions/user-is-not-receiving-signature-and-is-not-visible-in-email-signature-manager/ad-user-general-tab-email-field.png) 4. On the **Account** tab, confirm a value is set for **User logon name**: ![Active Directory user Properties Account tab showing User logon name field](https://support.symprex.com/assets/email-signature-manager/problems-solutions/user-is-not-receiving-signature-and-is-not-visible-in-email-signature-manager/ad-user-account-tab-logon-name.png) 5. In Email Signature Manager, click **Update All** in the ribbon and wait for the service to process all users. You can open the **Status Monitor** in Email Signature Manager to verify the affected user is now listed. The affected user can either wait for the Email Signature Manager Agent to automatically get the signature or perform a manual **Update Now**. ## Applies to Email Signature Manager, version 10 and later # Email Signature Manager Agent V4 Release Notes ### Email Signature Manager Agent 4.4.0 Released October 22, 2024. New features, enhancements and bug fixes: - Improved image handling. - Improved logging. - Security updates. - Other minor enhancements. ### Email Signature Manager Agent 4.3.3 Released January 23, 2024. New features, enhancements and bug fixes: - Upgraded user interface controls to latest version. - Upgraded HTTPS client library. ### Email Signature Manager Agent 4.3.2 Released September 25, 2023. New features, enhancements and bug fixes: - Fixed potential errors connecting to Exchange Online due to TLS 1.3 being enabled. - Fixed potential installation issue due to unsigned installer custom assemblies. - Fixed invalid response received from server due to authentication bug. - Fixed issue with not using Windows proxy settings. - Updated to check if user is on-domain during each Autodiscover cycle. ### Email Signature Manager Agent 4.3.1 Released May 1, 2023. New features, enhancements and bug fixes: - Fixed potential failure to install signatures not prompting for Microsoft 365 credentials as required. - Fixed potential null reference exception when acquiring authentication token silently. - Fixed issue with certificate validation resulting in error connecting to Exchange. - Fixed Exchange Web Services connection errors due to TLS 1.3 being enabled. - Updated installer custom action assemblies to be digitally signed. ### Email Signature Manager Agent 4.3.0 Released March 9, 2023. New features, enhancements and bug fixes: - Installer verifies .NET 4.7.2 or later is installed. - Status monitor shows details of any images that fail to download. - Added support for Windows Extended Protection including when enabled in Exchange Server 2013, 2016, and 2019. ### Email Signature Manager Agent 4.2.1 Released January 4, 2023. New features, enhancements and bug fixes: - Fixed login prompt occurring again after having successfully authenticated previously. - Fixed authentication issues on Remote Desktop Services and Citrix. ### Email Signature Manager Agent 4.2.0 Released October 18, 2022. New features, enhancements and bug fixes: - Fixed browser errors during authentication when using third-party solutions such as Duo security. - Fixed signatures may be removed when agent cannot connect to Email Signature Manager server. - Fixed special characters in download image names not always correctly decoded for file names. - Will not attempt to get signatures from mailbox when signatures are not stored in mailboxes. Requires Email Signature Manager 9.2.0 or later. - Will not use signatures from mailbox if outdated compared to already installed signatures. - Improved support for Azure joined workstations. ### Email Signature Manager Agent 4.1.2 Released April 12, 2022. New features, enhancements and bug fixes: - Fixed incorrectly attempts WAM authentication on older operating systems where not supported. ### Email Signature Manager Agent 4.1.1 Released February 15, 2022. New features, enhancements and bug fixes: - Remembers account in situations where user has multiple and must choose manually. ### Email Signature Manager Agent 4.1.0 Released February 8, 2022. New features, enhancements and bug fixes: - Built for .NET Framework 4.7.2 or later and this is now a system requirement. - Added support for WAM authentication. ### Email Signature Manager Agent 4.0.2 Released December 2, 2021. New features, enhancements and bug fixes: - Fixed issue where the agent would not install signatures to non-Exchange email accounts. - Fixed images may have incorrect size when image width and/or height not specified in HTML. - Fixed read only flag not removed on signature files after allowing users to change signatures. ### Email Signature Manager Agent 4.0.1 Released October 1, 2021. New features, enhancements and bug fixes: - Fixed rare issue introduced in version 4.0.0 with images not working if containing spaces in name. - Updated ClickOnce installer so re-authentication is no longer required after upgrade. - Updated ClickOnce installer to automatically upgrade from this version onwards. ### Email Signature Manager Agent 4.0.0 Released September 20, 2021. New features, enhancements and bug fixes: - Added support for Windows 11 and Windows Server 2022. - Updated to use Microsoft Authentication Library (MSAL) to connect with Microsoft 365. - General improvements to service for signature generation and deployment. - Automatically creates RTF signatures from HTML signatures. - Improved Autodiscover. - Security updates. - Other minor enhancements. # Email Signature Manager Agent V5 Release Notes ### Email Signature Manager Agent 5.0.0 Released August 4, 2025. New features, enhancements and bug fixes: - New version for Email Signature Manager 11. - No longer supports Microsoft 365. - Other minor enhancements. # Release Notes (Agent) # Email Signature Manager V10 Release Notes ### Email Signature Manager 10.1.0 Released February 21, 2025. New features, enhancements and bug fixes: - Removed support for retired ApplicationImpersonation role. - Updated Configure Microsoft 365 Mailbox Access topic in user. - Fixed replacing self-signed certificate does not work. - Fixed Email Signature Manager Client Access Service crashing in some cases. ### Email Signature Manager 10.0.0 Released October 22, 2024. New features, enhancements and bug fixes: - Now uses more secure full\_access\_as\_app permission for Exchange Online in place of retired ApplicationImpersonation role. - New server-side signature mode and combo signature mode when using Exchange Server. - New support for Office 2024 on Windows and Mac. - Signature 365 Migration Wizard updates. - Other minor enhancements. # Email Signature Manager V11 Release Notes ### Email Signature Manager 11.0.1 Released October 28, 2025. New features, enhancements and bug fixes: - Fixed extension attribute fields not always being populated in signatures. - Fixed some Active Directory trust types not being recognised. - Signature 365 Migration Wizard improvements. ### Email Signature Manager 11.0.0 Released August 4, 2025. New features, enhancements and bug fixes: - Designed for Exchange Server and no longer supports Microsoft 365. - Added support for Exchange Server Subscription Edition. - Signature 365 Migration Wizard updates. - Other minor enhancements. # Release Notes # Animated gif images are not supported by Outlook and most other email clients Animated gif images are not supported by Outlook or most other emails client. While animated gif images will work correctly in the Email Signature Manager editor, it is recommended not to use animated gif images. # Can email signatures include logos and other graphics? Yes, you can include logos and other graphics in email signatures. This can be graphics such as social media icons, employee photos, and QR codes. Graphics can link to static or dynamic generated links that are individual for each user. For best results images should be placed on a public web location and references from there. # Can the agent be configured to update signatures at logon and then exit? Yes, when using Email Signature Manager version 7 and later, the agent can be configured to update signatures at logon and then exit. Open the **Deployment Options** dialog in Email Signature Manager and enable the option **Close the Agent after the first automatic signature installation**. Default this option is disabled and the agent will stay running in the background to update signatures continuously. The agent is required to ensure email signatures are visible when composing email in Outlook. # Could not access network location when trying to uninstall a Microsoft Installer (MSI) package ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Information This article describes how to forcibly uninstall a Microsoft Installer (MSI) package from a computer. This can be necessary if the network share from which it was installed has since been removed. In such a situation, the information in this article may be helpful to forcibly uninstall the Email Signature Manager Agent or Email Signature Manager Deployment Tool. ### Symptoms When trying to uninstall, repair or upgrade an MSI package, the process fails with this error message: Could not access network location \\\server\share ### Cause This problem is a known issue with Windows Installer that occurs when the original network share from which an application was installed has since been removed. ### Resolution The MSI package can be forcibly uninstalled from a computer using the **Windows Program Install and Uninstall Troubleshooter** published by Microsoft following these steps: 1. Launch the troubleshooter from the following page: {rel=""nofollow""} Note: It is recommended that you use Internet Explorer to launch the troubleshooter. 2. Click the **Accept** button to accept the terms of the Microsoft Licensing Agreement. 3. Once the troubleshooter has analysed your computer, select the **Detect problems and let me select the fixes to apply** option. 4. On the **Are you having problems installing or uninstalling a program?** page, select **Uninstalling**. 5. In the **Select the program you want to uninstall** list, select the application to uninstall, and click the **Next** button. 6. On the **Uninstall and cleanup?** page, select **Yes, try uninstall**. 7. On the **Diagnosis is complete** page, click the **Next** button. 8. Wait for the troubleshooter to uninstall the Deployment Tool (this can take a little while to complete). 9. On the **Troubleshooting is complete** page, verify that the **Cannot install or uninstall a program issue** is reported as **Fixed**. 10. In **Program and Features** (in the Windows Control Panel), verify that the application has been removed. 11. In the Troubleshooting Wizard, click the **Next** button. 12. On the **Did this fix your problem?** page, select the **Yes, the problem has been fixed** option and click the **Next** button. 13. On the **Thank You!** page, click the **Close** button. # Deployment to Microsoft 365 fails ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes how to resolve common problems when deploying signatures to Microsoft 365. **Important** This article assumes that the service account has been configured. Please see the following topics in the User's Guide for more information: Version 8: {rel=""nofollow""} Version 7: {rel=""nofollow""} ### Symptoms In some circumstances, deployment of signatures to Microsoft 365 can fail, even when the service account has been configured. In the **Status Monitor**, you see the following information: Deploying signature '``'. User data loaded from Active Directory. Installing to Outlook. Installing to OWA. ```text Updating via Exchange Web Services at 'https://outlook.office365.com/EWS/Exchange.asmx'. Failed to install signature via EWS: Failed to set the signature in OWA through Exchange Web Services ``` Errors were encountered deploying the signature. When using the **Test Office 365 Connectivity** dialog, you receive one of the following error messages: - Unable to determine any identities for the user to query the autodiscover service - The impersonation principal name is invalid ### Cause These failures occur because there is either missing or incorrect information on the affected user's Active Directory account. Without this information, they cannot be identified correctly on Microsoft 365. ### Resolution The affected user's account must have the correct **primary** email address (as configured in Microsoft 365) configured on their Active Directory account. For example, when looking at the details of a user in Microsoft 365, you will see the following: ![Microsoft 365 user account showing primary email address](https://support.symprex.com/assets/email-signature-manager/review/deployment-to-office-365-fails/office-365-user-primary-email-address.png) The listed **Primary email address** must be set in the **Email** property of the affected user's Active Directory account: ![Active Directory user account Properties showing Email field matching Microsoft 365 primary email](https://support.symprex.com/assets/email-signature-manager/review/deployment-to-office-365-fails/office-365-user-domain-account.png) **Note:** To keep accounts synchronised automatically between your local domain and Microsoft 365, deploy the Microsoft Domain Synchronisation tool; more details can be found in the following TechNet article: {rel=""nofollow""} # Email signature does not appear when composing email in Outlook ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes troubleshooting why email signatures do not appear in Outlook when composing email, even though there are no errors in the deployment log. ### Information The following are common reasons why email signatures that have deployed without any errors do not show in Outlook when composing email: - The signature template does not include all email formats. For example, only an HTML template has been created, but email is being composed in RTF or Plain Text format. - Outlook meeting invitations are in RTF format. If an RTF template has not been created, then the meeting invitation will appear to have no signature included. - Group policy is configured to disable Outlook signatures, which results default signatures configured by Email Signature Manager being disabled. If you are experiencing problems, upgrade to the latest versions of Email Signature Manager and the Email Signature Manager Agent. You can verify if signatures are correctly installed in Outlook and if defaults are correct as follows: - On the **File** page, click **Options**. - Select the **Mail** page and click the **Signatures...** button. - Use the **Signatures and Stationery** dialog to check the settings. # Email signature does not appear when composing email in OWA ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes troubleshooting why email signatures do not appear in OWA when composing email. ### Information Follow these steps to troubleshoot why an email signature does not appear in OWA when a user composes an email: 1. Open Email Signature Manager. 2. Open the **Status Monitor** dialog. 3. Find the affected user. 4. If you cannot find the affected user, they are not a member of any groups defined to receive signatures in the **Manage Deployment** dialog. Add them to the correct group to resolve this. 5. If you can find the affected user, select the **Service Log** tab, and review the service log for them. Two possible reasons explain why email signatures, that have deployed without any errors, do not show in OWA when composing email: - The HTML signature size exceeds the maximum size imposed by Exchange Server. The maximum signature size is 8KB. Remove white space from the HTML template to decrease size. - OWA Light supports only plain text email. If a Plain Text template has not been created, then no signature will be applied when composing email in OWA Light. When using a web browser that does not support the full feature set, OWA Light opens. Open the signature and create a Plain Text template. ### Verifying the Email signature in OWA In OWA in Microsoft 365, Exchange Server 2016, and Exchange Server 2013, the email signature settings can be found as follows: - Click the Gear icon in the top bar of the page and select **Options** in the drop-down menu, - Select the **Settings** page. - Review the signature in the **email signature** section of the **mail** tab. In OWA in Exchange Server 2010, the email signature settings can be found as follows: - In the **Options** drop-down menu, select **See All Options...** - Select the **Settings** page. - Review the signature in the **E-Mail Signature** section of the **Mail** tab. In OWA in Exchange Server 2007, the email signature settings can be found as follows: - Click **Options** in the top bar of the page. - Review the signature in the **Email Signature** section. # Email Signature Manager Agent sometimes removes all signatures ### Applies to Email Signature Manager version 7.x ### Summary This article describes the symptoms and cause of a known issues where the Email Signature Manager Agent sometimes removes all previously deployed email signatures for a user. This article also describes the resolution for this issue. ### Symptoms When the Email Signature Manager Agent updates, the local Status Monitor shows the agent connecting to the Email Signature Manager Client Access Service and determining that no signatures are to be deployed. The agent then removes all previously deployed email signatures. ### Cause The potential causes for this problem are: - Known issue in Email Signature Manager Agent before version 1.2.2, where the agent will remove previously deployed email signatures on communication failure with the service. - Known issue in Email Signature Manager Client Access Service before version 7.2.3, where the service stops listening for connections in specific circumstances. ### Resolution Upgrade Email Signature Manager Agent to version 1.2.2 or later. Upgrade Email Signature Manager to version 7.2.3 or later ### Status The problem is resolved as described above. # Email Signature Manager Service fails to start due to process termination ### Applies to Email Signature Manager version 7.0.0-7.2.1 ### Summary This article describes the symptoms and cause of a known issue where the Email Signature Manager Service fails to start due to process termination. This article also describes the resolution for this issue. ### Symptoms The Email Signature Manager Service fails to start with the following error: `Windows could not start the Symprex Email Signature Manager Service service on the local computer.` `Error 1067: The process terminated unexpectedly.` ### Cause The Email Signature Manager Service status XML file has become corrupted. ### Resolution Upgrade Email Signature Manager to version 7.2.2 or later will resolve this issue. Alternatively, delete the **Symprex.EmailSignatureManager.ServiceStatus.xml** from the **C:\ProgramData\Symprex** folder and the service will start. ### Status The problem is resolved as described above. The problem no longer occurs when using Email Signature Manager 7.2.2 and later. # Failed to create the Service Connection Point error during installation ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes the symptoms and cause of a known error about a failure to create Service Connection point during installation of Email Signature Manager. This article also describes the resolution for this issue. ### Symptoms During installation of Email Signature Manager the following error occurs: Failed to create the Service Connection Point: Unknown error (0x80005000) ### Cause The Email Signature Manager installer attempts to update Active Directory with a Service Connection Point for the Email Signature Manager Client Access Service, but fails due to missing permissions. ### Resolution Run the Email Signature Manager installer as a Domain Administrator. ### Status The problem is resolved as described above. The installer will be updated to verify permissions in a future version. # How to deploy Outlook signatures when using Citrix XenApp ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Information You need to run the agent in the same XenApp session as Outlook. Signatures will then be updated when Outlook starts. Please download the SignAgent ZIP file from the Download page on Symprex.com. The SignAgent ZIP file contains SignAgent.exe. Next follow these instructions: 1. Create a folder **C:\SignAgent** on the server. 2. Put **SignAgent.exe** into the **C:\SignAgent** folder. 3. Create a file in **C:\SignAgent** named **OutlookWithSignAgent.vbs** with this content: ```vbscript Dim objShell Set objShell = WScript.CreateObject("WScript.Shell") objShell.Run("C:\\SignAgent\\SignAgent.exe /updateandexit") objShell.Run("""C:\\Program Files (x86)\\Microsoft Office\\Office16\\OUTLOOK.EXE""") Set objShell = Nothing WScript.Quit ``` 4. Create a new Outlook virtual application to run this command: :br C:\Windows\System32\wscript.exe C:\SignAgent\OutlookWithSignAgent.vbs 5. Set the XenApp icon to the Outlook icon running this command: :br Set-RDRemoteApp -CollectionName "``" -Alias "OutlookWithSignAgent.vbs" -IconPath "C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE" -IconIndex 0 Note you must replace `` with the appropriate collection name. When you run the new Outlook virtual application the agent will update signatures and exit, and then Outlook will start. NOTE: In point 3 and 5 you need to amend the path for the Outlook executable according to the version of Outlook you are using. # How to deploy Outlook signatures when using Microsoft RemoteApp ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Information You need to run the agent in the same RemoteApp session as Outlook. Signatures will then be updated when Outlook starts. Please download the SignAgent ZIP file from the Download page on Symprex.com. The SignAgent ZIP file contains SignAgent.exe. Next follow these instructions: 1. Create a folder **C:\SignAgent** on the server. 2. Put **SignAgent.exe** into the **C:\SignAgent** folder. 3. Create a file in **C:\SignAgent** named **OutlookWithSignAgent.cmd** with this content: :br C:\Windows\System32\wscript.exe C:\SignAgent\OutlookWithSignAgent.vbs 4. Create a file in **C:\SignAgent** named **OutlookWithSignAgent.vbs** with this content: ```vbscript Dim objShell Set objShell = WScript.CreateObject("WScript.Shell") objShell.Run("C:\\SignAgent\\SignAgent.exe /updateandexit") objShell.Run("""C:\\Program Files (x86)\\Microsoft Office\\Office16\\OUTLOOK.EXE""") Set objShell = Nothing WScript.Quit ``` 5. Create a new Outlook virtual application to run this command: :br C:\SignAgent\OutlookWithSignAgent.cmd 6. Set the RemoteApp icon to the Outlook icon running this command: :br Set-RDRemoteApp -CollectionName "``" -Alias "OutlookWithSignAgent.vbs" -IconPath "C:\Program Files (x86)\Microsoft Office\Office16\OUTLOOK.EXE" -IconIndex 0 Note you must replace `` with the appropriate collection name. When you run the new Outlook virtual application the agent will update signatures and exit, and then Outlook will start. NOTE: In point 4 and 6 you need to amend the path for the Outlook executable according to the version of Outlook you are using. # How to disable text wrap in table cell To disable text wrap in a table cell: 1. Set **white-space** inline style to **nowrap** on the **td** tag. Example: ``...`` # How to include employee photos in email signatures ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Information You can include employee photos in your email signatures as follows: 1. Create a folder on your web server containing a picture file with a photo for each employee using **emailaddress.jpg** as file name (e.g. ****). 2. Link to the images in your signature using HTML like this: ![Example image tag linking to an employee photo using the email merge field in the file name](https://support.symprex.com/%5Bhttp://www.domain.com/images/employees/%7Bemail%7D.jpg%5D\(http://www.domain.com/images/employees/%7Bemail%7D.jpg\)) Note how the domain and path in the URL is fixed, but the file name is generated using the ****{email=""} merge field. If you need further tips on this, please feel free to contact Symprex Support. # How to remove blue border around hyperlink images To remove the blue border around hyperlink images: 1. Set **border** attribute to **0** on the **img** tag. 2. Set **border** inline style to **0** on the **img** tag. 3. Set **text-decoration** inline style to **none** on the **img** tag. 4. Set **outline** inline style to **none** on the **img** tag. Example: ![Example image tag with the border, text-decoration, and outline styles set to remove the hyperlink border](https://support.symprex.com/...){style="border:0; text-decoration:none; outline:none;"} # How to remove underline on hyperlinks To remove underline on hyperlinks: 1. Set **text-decoration** inline style to **none** on the **a** tag. Example: `Hyperlink` # How to repair or fully rebuild Windows WMI Repository ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes the symptoms and cause of a known issue where Email Signature Manager starts in Manager Only mode even though it is installed in Full Installation mode. This article also describes the resolution for this issue. ### Symptoms Email Signature Manager starts in Manager Only mode even though it is installed in Full Installation mode. ### Cause This problem occurs when the Windows WMI Repository is not functioning correctly. ### Resolution The Windows WMI Repository must be rebuilt/repaired. Run the following command: winmgmt /verifyrepository If the result is shown as inconsistent, run the following command: winmgmt /salvagerepository To verify the repair was successful, run the following command again: winmgmt /verifyrepository Now restart Email Signature Manager and it should work correctly. If the problem persists, please proceed to this Microsoft Knowledge Base article for instructions how to fully rebuild the Windows WMI Repository: {rel=""nofollow""} ### Status The problem is resolved as described above. # How to set the text colour on hyperlinks To set the text colour on hyperlinks: 1. Set **`color`** inline style to the required colour code on a **span** tag within the **a** tag. Example: ````Hyperlink```` # HTML and CSS support in the Outlook email client Outlook 2007–2019 only supports a subset of HTML and CSS. You can read more here: {rel=""nofollow""} While this information specifically is for Outlook 2007 it remains valid for Outlook 2010–2019. # Image in email signature is replaced with red X when email is created ### Applies to Email Signature Manager version 5.x Email Signature Manager version 6.x Email Signature Manager version 7.x ### Symptoms Image in email signature is replaced with red X when email is created by the sender. ### Resolution This problem occurs when the image is inaccessible from the email client. Common reasons are that the image no longer exists, or that the sender does not have permissions to access the image. If the image is hosted on a network share, a simple way to verify is to browse to the network share in Windows Explorer and then attempt to open the image. If the image is hosted on a web server, a simple way to verify is to browse to the image URL in Internet Explorer and verify the image appears. # Image in email signature is replaced with red X when email is received ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Symptoms Image in email signature is replaced with red X when email is received by the recipient. ### Resolution The resolution below presumes that the image appears correctly when the email is created. If it does not, review the alternative article about images being replaced with a red X when email is created in the [Problems & Solutions](https://support.symprex.com/solution/folders/1000178048){rel=""nofollow""} section. When the option **Copy linked images in HTML templates to local drive** is enabled in the **Deployment Options** dialog, make sure to also enable the options **Send pictures options** and **Send pictures from the Internet**. Click **Update All** in the ribbon to make the service process the changes, and the Email Signature Manager Agent will update the Outlook settings when it next updates for each user. # Image in email signature is wrong size in Outlook or OWA ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Symptoms In certain circumstances, for example when Windows font size is configured as 125% or 150% on high resolution displays, Outlook and OWA resize images if the image size if not specified in the HTML signature. ### Resolution Email Signature Manager 8.4.0 and later, used in combination with Email Signature Manager Agent 3.1.0 and later, automatically sets the image size in the HTML signature. It also includes code to ensure the image shows correctly at different Windows font size settings. If you are using an earlier version you will need to upgrade to resolve the issue. # Image maps are not supported by Outlook and most other emails client Image maps are not supported by Outlook or most other emails client. While image maps will work correctly in the Email Signature Manager editor, it is recommended not to use image maps. The substitute is to use a table without borders, break the image up into relevant squares, and link each image as appropriate. # Review # Is it mandatory to install the agent on workstations? No, the Email Signature Manager Agent does not have to be installed on workstations. The Email Signature Manager Agent is a single, small executable, and can be started from a logon script from a network share. Alternatively, if preferred the Email Signature Manager Agent Microsoft Installer (MSI) package can be deployed using a Group Policy Object (GPO), SCCM, or similar. For customers upgrading to version 7.x from earlier versions, SignAgent.exe is simply a new version of sign.exe, and the SignAgent MSI package simply a new version of the Sign MSI package. The Email Signature Manager Agent can be configured to deploy signatures at logon and exit immediately, or to stay running in the background to update signatures continuously. The Email Signature Manager Agent is required to ensure email signatures are visible when composing email in Outlook. # Signature can not be deployed to OWA because a user has a shared mailbox ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes the symptoms and cause of a problem where the service log for a user shows that the OWA signature cannot be deployed because they have a shared mailbox. This article also describes the resolution for this issue. ### Symptoms The service log for a user shows that the OWA signature cannot be deployed because they have a shared mailbox. The following error information will be showing for affected users in the Status Monitor dialog in the Service Log: `Signature '' can not be deployed to OWA because the user has a shared mailbox.` ### Cause This user shares a primary email address with at least one other user in Active Directory. This means two or more users are linked to the same mailbox. Email Signature Manager cannot deploy OWA email signatures for different users to one single mailbox, as this would cause unexpected results. ### Resolution The only resolution to this problem is to maintain the email signature for such "shared" mailboxes manually in OWA. ### Status The problem is resolved as described above. # Troubleshooting conditional statements in HTML templates ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes troubleshooting when conditional statements in HTML templates are not working as expected. ### Information To ensure that conditional statements in HTML templates work follow these steps: - Verify in the HTML source that each conditional statement is on one line, and not broken into multiple lines. - Verify in the HTML source that each conditional statement is correctly formatted without any additional spaces (multiple spaces in the source will only appear as one space in Design Mode). - Verify in the HTML source that each conditional statement is correctly formatted without any spaces appearing in the HTML encoded form ( ). # Troubleshooting the Email Signature Manager Transport Agent ### Applies to Email Signature Manager version 8.x Email Signature Manager version 7.x ### Summary This article describes how to troubleshoot problems with the Email Signature Manager Transport Agent and signatures not being injected into email as expected. ### Information The recommended version 8.x to use is version 8.4.1 or later. The recommended version 7.x to use is version 7.3.2. The recommended versions include fixes to known issues in earlier versions. ### How the transport agent works The Email Signature Manager Transport Agent works by processing emails as they are delivered through Exchange Server by: 1. Connecting to the Email Signature Manager database on SQL Server; if the connection fails, nothing will happen to the email content. 2. Searching the database for a pre-generated signature using the sender's email address; if no signature can be found, nothing will happen to the email content. 3. Scanning the email content for a rule text match using the rules defined in Transport Agent Rules in Email Signature Manager; if no rule match can be found, nothing will happen to the email content. 4. Injecting the pre-generated signature into the email at the location of the rule text match. This guide looks at each of these steps in turn to troubleshoot problems. ### Known issues Specific Exchange Server versions prohibit transport agents from working correctly: - Exchange 2010 SP3 RU1 (upgrade to Exchange 2010 SP3 RU2 or newer) - Exchange 2013 SP1 (upgrade to Exchange 2013 CU5 or newer) Note also that the mailbox anchoring feature introduced in Exchange 2013 CU11 and removed again in Exchange 2013 CU12 may result in registration of transport agents being registered in a different Exchange server that intended. Some third-party transport agents for Exchange Server prohibits the Email Signature Manager Transport Agent from processing email. When this is the case the priority of the Email Signature Manager Transport Agent can be increased using the following cmdlet: Set-TransportAgent -Identity "Symprex Email Signature Manager Agent" -Priority 1 ### Verify the transport agent installation Verify the configuration following these steps: 1. Ensure the Transport Agent is installed on each Exchange Server 2007 and 2010 that has the **Hub Transport** role installed. 2. Ensure the Transport Agent is installed on each Exchange Server 2013 and 2016 that has the **Mailbox Server** role installed. 3. Ensure the Microsoft Exchange Transport Service was restarted after installing/upgrading the Transport Agent. 4. Ensure the major version of the Transport Agent matches the major version of Email Signature Manager. Note that Exchange Server 2016 requires using Email Signature Manager 7.0.0 or later. ### Verify the transport agent registration To verify if the Transport Agent is registered with Exchange Server, start an instance of Exchange Management Shell and execute the following cmdlet: Get-TransportAgent If the Transport Agent is registered with Exchange Server, its details will be listed and should appear similar to the following: Identity Enabled Priority \-------- ------- -------- Symprex Email Signature Manager Agent True 4 If the Transport Agent is not registered, it can be manually registered using the appropriate cmdlet. ### Verify the transport agent configuration Verify the configuration following these steps: 1. Open the **Transport Agent Configuration Utility** on each Exchange Server where the Transport Agent is installed. 2. Verify configuration is to use **SQL Server Authentication** (**Windows Authentication** or **Integrated Security** will not work). 3. Click the **Test Connection** button to ensure a connection can be made to the database on SQL Server. ### Verify the transport agent rule configuration Verify the configuration following these steps: 1. Open Email Signature Manager. 2. If you are using version 7.2 or later, open the **Mobile Device Signatures** dialog by clicking the **Mobile Device Signatures** button in the **Configuration** ribbon. If you are using an earlier version, open the **Configure Transport Agent Rules** dialog by clicking the **Transport Agent Rules** button in the **Configuration** ribbon. 3. Verify the **Enable signature generation and apply signatures to emails sent from mobile devices** option is enabled. 4. Review the rules and in particular, the **Text to Replace**, and selected options such as **New Lines** being set for example to **Before & After**. ### Verify the manage deployment configuration Verify the configuration following these steps: - Open Email Signature Manager. - Open the **Manage Deployment** dialog by clicking the **Manage Deployment** button in the **Home** ribbon. - Verify on the **Groups** and **Users** tabs that the appropriate groups and users have a **Mobile Device Signature** selected. ### Verify Signature generation Verify mobile device signatures are being generated for the Transport Agent to inject. Check the relevant log for affected users in the **Status Monitor** in Email Signature Manager, and for each affected user, verify the mobile device signature has been generated. ### Enable logging of signature injection Enable logging of signature injection for further troubleshooting: - Open Email Signature Manager. - Open the **Deployment Options** dialog, select the **Advanced** tab, and enable the **Record status information about signature injection** option. - Review the logs as emails are being processed to identify and correct problems. - For performance disable the **Record status information about signature injection** option when troubleshooting is completed. ### Contact Symprex technical support If you are still unable to determine why mobile device signatures are not being applied, please contact Symprex Technical Support for further assistance. # Using logos and other images in email signatures You can use logos, social media icons, and other images in your email signatures. These are the recommendations for optimal results: - Use JPG image format. - Use RGB colour mode for JPG images. - Use 96 dpi resolution images. - Specify the image size in HTML templates. **Use JPG image format** JPG is good for pictures and hi-colour images with lots of gradients. GIF is good for logos with few colours and large areas with solid colours. PNG is best overall, but has limited support in older versions of Outlook, and should be avoided. The recommendation is to use JPG. **Use RGB colour mode for JPG images** JPG images must use RGB colour mode. JPG images using CMYK colour mode may appear in wrong colours and/or rastered. **Use 96 dpi resolution images** Outlook will rescale images that are not 96 dpi to 96 dpi. This may cause images to become blurry/fuzzy/unsharp/smaller/change in size. **Specify the image size in HTML templates** You should set the image **width** and **height** attributes on the **img** tag in your HTML. For example, if your image is: ![Example image tag without width and height attributes](http://www.myserver.com/images/myimage.jpg) It needs to be updated like this: ![Example image tag with width and height attributes added](http://www.myserver.com/images/myimage.jpg) Where **x** is the width in pixels and **y** is the height in pixels. Do not use this to scale the image. Use an image that has already been edited to have the dimensions you want. Do not use inline CSS. Use the width and height attributes as shown above. Note that Email Signature Manager 7.2.0 and later will set image width and height automatically so there is no need to do this manually. # Which fonts can be used in email signatures You should only use fonts that are available across different operating systems. Otherwise, your signature may not appear as intended when people receive email from you. This is because fonts are not embedded. In email signatures, it is recommended to use fonts such as Calibri, Arial, Verdana, Georgia, Times New Roman, and Courier. These fonts are often referred to as web safe fonts. Most email clients do not support web fonts. If you use a web font that the receiving email client cannot display then it will be shown using a fall back font. This will usually be Helvetica, Arial, or a generic sans serif font. # Windows security warning shows when starting SignAgent.exe and how to unblock ## Problem When you run SignAgent.exe the following security warning appears: ## Reason Executable files downloaded from the Internet are automatically marked by Windows as unsafe (downloaded from untrusted source). It is this marker that makes Windows show the Security Warning when you run the executable. ## Solution Follow the steps below to unblock the executable: 1. Right-click **SignAgent.exe** in **Windows Explorer** and open **Properties**. 2. On the **General** tab click the **Unblock** button. The security warning will no longer appear. Once the executable has been unblocked it can be copied to other locations, such as network shares, and will remain unblocked. ## Applies to Email Signature Manager Agent, all versions # How to move Email Signature Manager to a different server ## Scenario You have a working installation of Email Signature Manager that you want to move to a different server. ## Solution Follow the steps below to move Email Signature Manager from the old server to the new server. ### Move shares and files from old to new server If the old server has any network shares used for images or agent deployment: 1. Re-create the network shares on the new server 2. Copy files from the old network shares to the new network shares 3. Update your signature templates to use images from the new network shares 4. Update any other scripts or policies, for example for agent deployment, to use the new network shares ### Stop services on old server On the old server: 1. Open **Services** from **Administrative Tools** in Windows 2. Stop the service **Symprex Email Signature Manager Service** 3. Stop the service **Symprex** **Email Signature Manager Client Access Service** ### Move database from old to new server On the old server: 1. Open Email Signature Manager 2. Click the **Configuration** tab in the ribbon 3. Select the **Database** page in the backstage 4. Click the **Settings Database** button 5. In the **Settings Database** dialog, confirm if Email Signature Manager is using the **Built-in Database** or a database on **SQL Server** If Email Signature Manager is using the **Built-in Database**: 1. Close Email Signature Manager 2. Create the folder **C:\ProgramData\Symprex\\** on your new server 3. Copy the file **C:\ProgramData\Symprex\Symprex.EmailSignatureManager.Database.mdb** from the old server to the same location on the new server If Email Signature Manager is using a database on **SQL Server**: 1. If the old server is running SQL Server, and you wish to migrate this to the new server, install the version of SQL Server you wish to use on the new machine. Then migrate the SQL database to the new server. ### Install and configure on new server On the new server: 1. Install Email Signature Manager with a **Full Installation**. 2. Start Email Signature Manager and connect to the database. 3. Click **Update All** in the ribbon to make Email Signature Manager process all users. ### Remove old installation On the old server: 1. Open Email Signature Manager 2. Select the **Configuration** tab in the ribbon 3. Select the **Configuration** page in the backstage 4. Click the **Deployment Options** button 5. In the **Deployment Options** dialog, select the **Client Access Service** tab 6. Under **Service Connection Point**, click the **Delete** button 7. Confirm you want to delete the Service Connection Point in Active Directory 8. Test the Email Signature Manager Agent connects to the new server 9. Close Email Signature Manager 10. Uninstall Email Signature Manager ## Applies to Email Signature Manager, version 10 and later # How to perform automated installation in Manager Only mode ## Scenario You have a working **Full Installation** of Email Signature Manager. You want to perform automated installation of Email Signature Manager in **Manager Only** mode to be able to manage your Email Signature Manager installation from other servers or workstations. ## Solution Follow these steps to automatically install and configure Email Signature Manager in **Manager Only** mode: 1. Run the Email Signature Manager installer with arguments /qn for silent installation, for example: ```text Symprex_Email_Signature_Manager_10.0.0_Setup.exe /qn ``` 2. Copy the file **C:\ProgramData\Symprex\Symprex.EmailSignatureManager.Settings.xml** from the **Full Installation** server to the same location on the new **Manager Only** machine ## Applies to Email Signature Manager, version 10 and later # Setup # General # Logging permissions changes to SQL database ## Logging permissions changes For information about how to enable logging of permissions changes in Folder Permissions Manager to a SQL Server database, see the [documentation](https://docs.symprex.com/folder-permissions-manager/latest/html/index.html?database_logging_dialog.htm){rel=""nofollow""}. All changes to folder permissions will be logged to the SQL Server database. ## Viewing logged permissions changes Folder Permissions Manager does not have any functionality to view the logs. You can view the logs in SQL Server Management Studio. Expand **Views**, right-click the view **dbo.vw\_permissionsChanges** and click **Select Top 1000 rows**. You can also connect other applications to the SQL database to load and analyse data. # Supported versions of Folder Permissions Manager Supported versions of Folder Permissions Manager are: - Version 10.1.X - end of support October 22, 2029 Versions older than those listed above are no longer supported. If your license is under active maintenance, you can upgrade to the latest version at no charge. Folder Permissions Manager version 10 uses EWS to access Exchange Online mailboxes. Microsoft has released a new Exchange Online Admin API, but this currently has a known issue managing mailbox folder permissions and does not support managing delegates. Symprex is working directly with Microsoft to attempt to get these issues resolved. In the meantime it is possible to extend EWS until at least to April, 2027. Instructions for extending EWS are available in the following Knowledge Base article: [Folder Permissions Manager and the retirement of Exchange Web Services](https://support.symprex.com/folder-permissions-manager/problems-solutions/exchange-web-services-retirement-in-exchange-online){rel=""nofollow""} # Folder Permissions Manager ::categories-grid :::category --- description: General information and overview for Folder Permissions Manager icon: i-lucide-info title: General to: /folder-permissions-manager/general --- ::: :::category --- description: Troubleshooting guides and known issues for Folder Permissions Manager icon: i-lucide-wrench title: Problems & Solutions to: /folder-permissions-manager/problems-solutions --- ::: :::category --- description: Release history for Folder Permissions Manager icon: i-lucide-tag title: Release Notes to: /folder-permissions-manager/release-notes --- ::: :: # Known Issues ::generated-category-children{generated} :: # This permissions could not be applied because the user identifier is invalid If you receive the following error: ```text This permissions could not be applied because the user identifier is invalid ``` There could be a number of reasons for this: - Trying to apply permissions for an Exchange Online mailbox to an on-premises mailbox # Unable to access and manage folder permissions for Exchange Online Archive mailboxes ## Problem You use Folder Permissions Manager and want to manage folder permissions for Exchange Online Archive mailboxes, but Exchange Online Archive mailboxes are not available. ## Reason Folder Permissions Manager manages folder permissions using Exchange Web Services (EWS). EWS does not support managing folder permissions in Exchange Online Archive mailboxes. At the time of writing Microsoft does not offer any API or PowerShell cmdlets to manage permissions in Exchange Online Archive mailboxes. ## Solution Symprex plans to add support for managing folder permissions in Exchange Online Archive mailboxes if/when Microsoft adds support for this. # Changing delegates removes delegates added in Exchange admin center ## Problem Folder Permissions Manager does not show delegates added to a mailbox using the Exchange admin center. Also changing delegates using Folder Permissions Manager, removes any delegates added to a mailbox using the Exchange admin center. ## Reason This is a known issue with Microsoft Exchange Web Services (EWS). Folder Permissions Manager uses EWS to get and update delegates. When getting delegates, EWS does not return delegates added using the Exchange admin center. When applying changes to delegates, EWS removes any delegates added using the Exchange admin center. ## Solution To solve the problem, manage delegates using only Folder Permissions Manager. Do not manage delegates in the Exchange admin center (**Exchange admin center** > **Mailboxes** > **User mailbox** > **Manage mailbox delegation** > **Send on behalf**). # Error occurs when applying changes to delegates on specific mailbox ## Problem You are using Folder Permissions Manager to apply changes to delegates on a specific mailbox, but the changes fail to apply with this error message: ::note The logon account does not have the appropriate permissions to complete the operation on mailbox 'User Name'. :: ## Reason This is a known issue with Microsoft Exchange Web Services (EWS). Folder Permissions Manager uses EWS to update delegates. EWS fails to apply changes when any existing delegates are orphaned (the associated Active Directory accounts no longer exist). In this case EWS returns (500) Internal Server Error. ## Solution To solve the problem, the workaround is to open the affected mailbox in Outlook and manually remove the delegates that are orphaned (the associated Active Directory accounts no longer exist). Delegates on the affected mailbox can now be managed using Folder Permissions Manager. # Folder Permissions Manager and the retirement of Exchange Web Services #### Summary Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. The retirement will take place in two stages: - 1 October 2026: Microsoft begins phased EWS disablement across Exchange Online organisations. - 1 April 2027: EWS is disabled in Exchange Online. Find out more at [Deprecation of Exchange Web Services in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-ews-exchange-online){rel=""nofollow""} #### Folder Permissions Manager and EWS Folder Permissions Manager version 10 uses EWS to access Exchange Online mailboxes. Microsoft has released a new Exchange Online Admin API, but this currently has a known issue managing mailbox folder permissions and does not support managing delegates. Symprex is working directly with Microsoft to attempt to get these issues resolved. #### Workaround It is possible to extend EWS until at least to April, 2027. The following steps detail how to enable this on your Microsoft 365 tenant: 1. Obtain the application ID from Microsoft Entra - Sign in to the Microsoft Entra admin centre - Go to **Microsoft Entra ID** > **Enterprise Applications** > **All applications** - Search for "Symprex Folder Permissions Manager" - On the application’s Overview page, copy the value labelled `Application ID` 2. Open PowerShell as an administrator and connect to Exchange Online: :br`Connect-ExchangeOnline` 3. Sign in using an Exchange Administrator or Global Administrator account 4. :prose-caution[You **MUST** ensure that any existing `applicationIDs` you have previously configured to use EWS are preserved, and the new `applicationID` for Folder Permissions Manager is added to the list. Failing to do this will remove all `applicationIDs` which are not included in the new list]. Enable EWS by running the following: :br`Set-OrganizationConfig -EwsEnabled $true -EwsAllowedAppIDs "{applicationIDlist}"`:br where `{applicationIDlist}` is a list of comma separated application IDs, including the value copied in step 1. 5. Confirm EWS is enabled on the tenant and the list of configured application ID's by running the following commands: :br`Get-OrganizationConfig | Format-List EwsEnabled`:br`Get-OrganizationConfig -RetrieveEwsOperationAccessPolicy Format-List EwsAllowedAppIDs` # Folder Permissions Manager is slow with SQL database logging enabled ## Problem Folder Permissions Manager is slow when SQL database logging is enabled. ## Reason If the connection to SQL server is not working or lost, you will not be prompted in Folder Permissions Manager. Instead, the application will be slow as it continues to try to connect to the SQL server. ## Solution Follow these steps to solve the problem: 1. Open Folder Permissions Manager. 2. Click the **File** menu and select **About** page. 3. Click the **Options** button to open the **Folder Permissions Manager Options** dialog. 4. Click the link in the **Database Logging** section to open the **Database Logging** dialog. 5. Update the **Connection Settings** as required. 6. Click the **Test** button to test the connection. # Problems & Solutions # Timeout errors when using SQL database logging ## Problem You are using Folder Permissions Manager with SQL database logging and experience intermittent timeout errors. ## Reason From time to time Folder Permissions Manager deletes old records from the SQL database. If the database is large, deleting old records may take longer than the default timeout of 30 seconds. ## Solution Follow these steps to resolve the problem: 1. Use Folder Permissions Manager version 9.0.1 or later. 2. Open the Windows Registry Editor. 3. Browse to the following registry key (create it if it does not exist): ```text HKEY_LOCAL_MACHINE\SOFTWARE\Symprex\Folder Permissions Manager\Database Logging ``` 4. Create a new DWORD value with name: ```text Command Timeout ``` 5. Set the new value to the desired timeout value in seconds (the default is 30). If you change the value, you need to restart Folder Permissions Manager for the new value to take effect. # Using Folder Permissions Manager in Hybrid Environments You wish to use Folder Permissions Manager in a Hybrid Exchange on-premises / Exchange online environment but would like to understand the limitations and requirements of this configuration. As a first step in diagnosis, please ensure you are using the latest version of Folder Permissions Manager. Troubleshooting is not available for older versions. #### Scenario: Applying permissions across on-premises and cloud mailboxes You wish to use Folder Permissions Manager to apply permissions from a cloud user/distribution list/security group to an on-prem mailbox, or vice versa. You cannot apply permissions other than **Full Access** or **Send on Behalf** to the mailbox. #### Cause: Cross-domain permissions are not supported As detailed in the following Microsoft article, it is not possible to assign cross-domain (cloud to on-prem or on-prem to cloud) permissions using Outlook or the EWS console. This applies even if the accounts in question are synced across domains. This information is covered in more detail in the following Microsoft article concerning cross-domain permissions. [Permissions in Exchange hybrid environments](https://learn.microsoft.com/en-us/exchange/permissions#mailbox-permissions-and-capabilities-not-supported-in-hybrid-environments){rel=""nofollow""} Attempting to use cross-domain permissions can result in the following errors in File Permissions Manager: User or Group is not found when searching for user Email Address is not populated for a group This permission could not be applied because the user identifier is invalid #### Scenario: Entra ID-only user not found in search You are attempting to use Folder Permissions Manager to apply permissions to a user located in Entra ID, however, the account is not displayed when using the search function #### Cause: Users must exist in the on-premises AD domain Users must be present within the on-premises AD domain to be visible within Folder Permissions Manager. Users that only exist within Entra ID cannot be listed by the search function, because it is unable to connect to Entra ID. # Folder Permissions Manager V10 Release Notes ### Folder Permissions Manager 10.1.1 Released September 1, 2026. New features, enhancements and bug fixes: - Adds support for using groups as delegates. - Fixes an issue where the `#TIME#` token did not work when used in log file names. ### Folder Permissions Manager 10.1.0 Released February 21, 2025. New features, enhancements and bug fixes: - Removed support for retired ApplicationImpersonation role. - Updated Configure Microsoft 365 Mailbox Access topic in user guide. - Fixed replacing self-signed certificate does not work. ### Folder Permissions Manager 10.0.0 Released October 22, 2024. New features, enhancements and bug fixes: - Now uses more secure `full_access_as_app` permission for Exchange Online in place of retired ApplicationImpersonation role. - Other minor enhancements. # Folder Permissions Manager V9 Release Notes ### Folder Permissions Manager 9.3.4 Released January 30, 2024. New features, enhancements and bug fixes: - Fixed Select User and/or Groups dialog not finding any results. ### Folder Permissions Manager 9.3.3 Released January 23, 2024. New features, enhancements and bug fixes: - Fixed not correctly handling delegate "Delegate Receives Copies" option. - Removed password length warning for Exchange Server Environment. - Upgraded user interface controls to latest version. - Upgraded HTTPS client library. ### Folder Permissions Manager 9.3.2 Released September 25, 2023. New features, enhancements and bug fixes: - Fixed not correctly setting delegate "Deliver Meeting Requests" option. - Fixed export only exporting top-level folders and not sub-folders. - Fixed issue with not using Windows proxy settings. - Improved retry mechanism when querying against Active Directory. ### Folder Permissions Manager 9.3.1 Released May 1, 2023. New features, enhancements and bug fixes: - Fixed issue with certificate validation resulting in error connecting to Exchange. - Fixed Exchange Web Services connection errors due to TLS 1.3 being enabled. - Updated installer custom action assemblies to be digitally signed. ### Folder Permissions Manager 9.3.0 Released March 3, 2023. New features, enhancements and bug fixes: - Added support for Windows Extended Protection including when enabled in Exchange Server 2013, 2016, and 2019. ### Folder Permissions Manager 9.2.2 Released January 12, 2023. New features, enhancements and bug fixes: - Updated help file software to new version. ### Folder Permissions Manager 9.2.1 Released October 25, 2022. New features, enhancements and bug fixes: - Fixed authentication fails on redirect to Microsoft 365 for mailbox access in hybrid environments. ### Folder Permissions Manager 9.2.0 Released October 18, 2022. New features, enhancements and bug fixes: - Fixed browser errors during authentication when using third-party solutions such as Duo security. ### Folder Permissions Manager 9.1.0 Released February 8, 2022. New features, enhancements and bug fixes: - Built for .NET Framework 4.7.2 or later and this is now a system requirement. ### Folder Permissions Manager 9.0.0 Released September 20, 2021. New features, enhancements and bug fixes: - Updated user interface to match latest Office theme. - Added support for Windows Server 2022 and Windows 11. - Updated to use Microsoft Authentication Library (MSAL) to connect with Microsoft 365. - Apply to sub-folders now works per sub-folder using group and template apply. - Import now uses folder path instead of ID for easier migration of permissions. - Improved Autodiscover. - Security updates. - Other minor enhancements. # Release Notes # General # Supported versions of Out of Office Extender Supported versions of Out of Office Extender are: - Version 10.X - end of support September 1, 2029 Version 10 uses Microsoft Graph to access Exchange Online mailboxes (retiring use of Exchange Web Services (EWS)) and includes official support for Exchange Server Subscription Edition. Versions older than those listed above are no longer supported. If your license is under active maintenance, you can upgrade to the latest version at no charge. # Out of Office Extender ### Out-of-Office Manager 9.3.3 Released January 23, 2024. New features, enhancements and bug fixes: - Removed password length warning for Exchange Server Environment. - Upgraded user interface controls to latest version. - Upgraded HTTPS client library. ### Out-of-Office Manager 9.3.2 Released September 25, 2023. New features, enhancements and bug fixes: - Fixed issue with not using Windows proxy settings. - Improved retry mechanism when querying against Active Directory. ### Out-of-Office Manager 9.3.1 Released May 1, 2023. New features, enhancements and bug fixes: - Fixed rare issue where application stops responding when displaying results of group apply. - Fixed issue with certificate validation resulting in error connecting to Exchange. - Fixed Exchange Web Services connection errors due to TLS 1.3 being enabled. - Updated installer custom action assemblies to be digitally signed. ### Out-of-Office Manager 9.3.0 Released March 3, 2023. New features, enhancements and bug fixes: - Added support for Windows Extended Protection including when enabled in Exchange Server 2013, 2016, and 2019. ### Out-of-Office Manager 9.2.2 Released January 12, 2023. New features, enhancements and bug fixes: - Updated help file software to new version. ### Out-of-Office Manager 9.2.1 Released October 25, 2022. New features, enhancements and bug fixes: - Fixed authentication fails on redirect to Microsoft 365 for mailbox access in hybrid environments. ### Out-of-Office Manager 9.2.0 Released October 18, 2022. New features, enhancements and bug fixes: - Fixed browser errors during authentication when using third-party solutions such as Duo security. ### Out-of-Office Manager 9.1.0 Released February 8, 2022. New features, enhancements and bug fixes: - Built for .NET Framework 4.7.2 or later and this is now a system requirement. ### Out-of-Office Manager 9.0.0 Released September 20, 2021. New features, enhancements and bug fixes: - Updated user interface to match latest Office theme. - Added support for Windows Server 2022 and Windows 11. - Updated to use Microsoft Authentication Library (MSAL) to connect with Microsoft 365. - Improved Autodiscover. - Security updates. - Other minor enhancements. # Release Notes # Out of Office Extender V10 release notes ### Out of Office Extender 10.0.0 Released September 1, 2026. New features, enhancements and bug fixes: - Replaces use of Exchange Web Services (EWS) with use of Microsoft Graph to access Exchange Online mailboxes. - Adds official support for Exchange Server Subscription Edition. - Other minor enhancements. # Out of Office Extender V8 Release Notes ### Out of Office Extender 8.3.3 Released January 23, 2024. New features, enhancements and bug fixes: - Removed password length warning for Exchange Server Environment. - Upgraded user interface controls to latest version. - Upgraded HTTPS client library. ### Out of Office Extender 8.3.2 Released September 25, 2023. New features, enhancements and bug fixes: - Fixed issue with not using Windows proxy settings. - Improved retry mechanism when querying against Active Directory. ### Out of Office Extender 8.3.1 Released May 1, 2023. New features, enhancements and bug fixes: - Fixed issue with certificate validation resulting in error connecting to Exchange. - Fixed Exchange Web Services connection errors due to TLS 1.3 being enabled. - Updated installer custom action assemblies to be digitally signed. ### Out of Office Extender 8.3.0 Released March 3, 2023. New features, enhancements and bug fixes: - Added support for Windows Extended Protection including when enabled in Exchange Server 2013, 2016, and 2019. ### Out of Office Extender 8.2.2 Released January 12, 2023. New features, enhancements and bug fixes: - Updated help file software to new version. ### Out of Office Extender 8.2.1 Released October 25, 2022. New features, enhancements and bug fixes: - Fixed authentication fails on redirect to Microsoft 365 for mailbox access in hybrid environments. ### Out of Office Extender 8.2.0 Released October 18, 2022. New features, enhancements and bug fixes: - Fixed browser errors during authentication when using third-party solutions such as Duo security. ### Out of Office Extender 8.1.0 Released February 8, 2022. New features, enhancements and bug fixes: - Built for .NET Framework 4.7.2 or later and this is now a system requirement. ### Out of Office Extender 8.0.0 Released September 20, 2021. New features, enhancements and bug fixes: - Updated user interface to match latest Office theme. - Added support for Windows Server 2022. - Updated to use Microsoft Authentication Library (MSAL) to connect with Microsoft 365. - Improved Autodiscover. - Security updates. - Other minor enhancements. # Out of Office Extender V9 Release Notes ### Out of Office Extender 9.1.0 Released February 21, 2025. New features, enhancements and bug fixes: - Removed support for retired ApplicationImpersonation role. - Updated Configure Microsoft 365 Mailbox Access topic in user guide. - Fixed replacing self-signed certificate does not work. ### Out of Office Extender 9.0.0 Released October 22, 2024. New features, enhancements and bug fixes: - Now uses more secure full\_access\_as\_app permission for Exchange Online in place of retired ApplicationImpersonation role. - Other minor enhancements. # General # Supported versions of Out-of-Office Manager Supported versions of Out-of-Office Manager are: - Version 11.X - end of support September 1, 2029 Version 11 uses Microsoft Graph to access Exchange Online mailboxes (retiring use of Exchange Web Services (EWS)) and includes official support for Exchange Server Subscription Edition. Versions older than those listed above are no longer supported. If your license is under active maintenance, you can upgrade to the latest version at no charge. # Out-of-Office Manager ::categories-grid :::category --- description: General information and guides for Out-of-Office Manager icon: i-lucide-info title: General to: https://support.symprex.com/out-of-office-manager/general --- ::: :::category --- description: Release history for Out-of-Office Manager icon: i-lucide-tag title: Release Notes to: https://support.symprex.com/out-of-office-manager/release-notes --- ::: :: # Release Notes # Out-of-Office Manager V10 Release Notes ### Out-of-Office Manager 10.1.0 Released February 21, 2025. New features, enhancements and bug fixes: - Removed support for retired ApplicationImpersonation role. - Updated Configure Microsoft 365 Mailbox Access topic in user guide. - Fixed replacing self-signed certificate does not work. ### Out-of-Office Manager 10.0.0 Released October 22, 2024. New features, enhancements and bug fixes: - Now uses more secure `full_access_as_app` permission for Exchange Online in place of retired ApplicationImpersonation role. - Other minor enhancements. # Out of Office Manager V11 release notes ### Out of Office Manager 11.0.0 Released September 1, 2026. New features, enhancements and bug fixes: - Replaces use of Exchange Web Services (EWS) with use of Microsoft Graph to access Exchange Online mailboxes. - Adds official support for Microsoft Exchange Server Subscription Edition. - Other minor enhancements. # Out-of-Office Manager V9 Release Notes ### Out-of-Office Manager 9.3.3 Released January 23, 2024. New features, enhancements and bug fixes: - Removed password length warning for Exchange Server Environment. - Upgraded user interface controls to latest version. - Upgraded HTTPS client library. ### Out-of-Office Manager 9.3.2 Released September 25, 2023. New features, enhancements and bug fixes: - Fixed issue with not using Windows proxy settings. - Improved retry mechanism when querying against Active Directory. ### Out-of-Office Manager 9.3.1 Released May 1, 2023. New features, enhancements and bug fixes: - Fixed rare issue where application stops responding when displaying results of group apply. - Fixed issue with certificate validation resulting in error connecting to Exchange. - Fixed Exchange Web Services connection errors due to TLS 1.3 being enabled. - Updated installer custom action assemblies to be digitally signed. ### Out-of-Office Manager 9.3.0 Released March 3, 2023. New features, enhancements and bug fixes: - Added support for Windows Extended Protection including when enabled in Exchange Server 2013, 2016, and 2019. ### Out-of-Office Manager 9.2.2 Released January 12, 2023. New features, enhancements and bug fixes: - Updated help file software to new version. ### Out-of-Office Manager 9.2.1 Released October 25, 2022. New features, enhancements and bug fixes: - Fixed authentication fails on redirect to Microsoft 365 for mailbox access in hybrid environments. ### Out-of-Office Manager 9.2.0 Released October 18, 2022. New features, enhancements and bug fixes: - Fixed browser errors during authentication when using third-party solutions such as Duo security. ### Out-of-Office Manager 9.1.0 Released February 8, 2022. New features, enhancements and bug fixes: - Built for .NET Framework 4.7.2 or later and this is now a system requirement. ### Out-of-Office Manager 9.0.0 Released September 20, 2021. New features, enhancements and bug fixes: - Updated user interface to match latest Office theme. - Added support for Windows Server 2022 and Windows 11. - Updated to use Microsoft Authentication Library (MSAL) to connect with Microsoft 365. - Improved Autodiscover. - Security updates. - Other minor enhancements. # Enable legacy Exchange Online tokens You wish to continue to use legacy tokens in Exchange Online because you need more time to upgrade the Signature 365 add-in. ::caution Legacy tokens will be disabled by Microsoft in June 2025. This method should only be used as a temporary measure to allow more time to upgrade the add-in to version 3.0 or grant the required permissions for earlier versions. :: - Open PowerShell on your device - Run the following cmdlet and sign in with your Microsoft 365 administrator credentials: ```powershell Connect-ExchangeOnline ``` - Run the following cmdlet to enable legacy tokens: ```powershell Set-AuthenticationPolicy –AllowLegacyExchangeTokens -Identity "LegacyExchangeTokens" ``` The command will return "Success" You can confirm this has been successfully completed by running the following cmdlet: ```powershell Get-AuthenticationPolicy -AllowLegacyExchangeTokens ``` This cmdlet will return the following if successful: ```text AllowLegacyExchangeTokens: True ``` For more information on enabling and disabling Exchange Online legacy tokens, see the following Microsoft article: [Turn legacy Exchange Online tokens on or off - Office Add-ins | Microsoft Learn](https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/turn-exchange-tokens-on-off){rel=""nofollow""} # How Outlook client-side signatures work Use client-side signatures when you want users to see and insert signatures while they compose messages in Outlook. This mode is enabled when you choose **Client-side** or **Both** in the setup wizard. ![Signature 365 setup wizard showing client-side and both signature deployment options](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-outlook-client-side-signatures-work/setup-wizard-client-side-option.png) When client-side signatures are enabled, Signature 365 inserts the signature into newly composed messages in supported Outlook clients. - For Microsoft 365 subscription clients, deploy the [Outlook add-in](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in). - For perpetual Outlook desktop versions, deploy the [Outlook (Classic) agent](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-classic-agent). If you are deciding between client-side and server-side delivery, compare the two approaches in [What is the difference between client-side and server-side signatures?](https://support.symprex.com/signature-365/get-started/service-information/what-is-the-difference-between-client-side-and-server-side-signatures). For the server-side routing model, see [How Microsoft 365 server-side signatures work](https://support.symprex.com/signature-365/server-side/deployment-and-configuration/how-microsoft-365-server-side-signatures-work). ## Next steps - [How to install the Outlook add-in](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in) - [How to install the Outlook (Classic) agent](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-classic-agent) - [Applying signatures to users and groups](https://support.symprex.com/signature-365/get-started/applying-signatures-to-users-and-groups) # How to enable debug log in Outlook add-in You may be asked by technical support to enable debug logging in the Signature 365 add-in for Outlook on Windows. ## How to enable debug logging Follow the steps below to enable debug logging: 1. Open the Windows Registry Editor 2. Add a **RuntimeLogging** registry key under the following registry key: HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\Office\16.0\WEF\Developer\ :note[If the **Developer** key does not already exist under HKEY\_CURRENT\_USER\SOFTWARE\Microsoft\Office\16.0\WEF\\, complete the following steps to create it.] 1. Right-click the **WEF** key and select **New** > **Key**. 2. Name the new key **Developer**. 3. Set the default value of the **RuntimeLogging** key to the full path of the file where you want the log to be written. :note[The directory in which the log file will be written must already exist, and you must have write permissions to it.] The following image shows what the registry should look like. ![Windows Registry Editor showing RuntimeLogging key under HKCU Office WEF Developer](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-enable-debug-log-in-outlook-add-in/registry-runtime-logging-key.png) ## How to disable debug logging To turn the feature off, remove the **RuntimeLogging** key from the registry. # How to install the Outlook add-in The Signature 365 add-in for Outlook allows users to preview signatures and add signatures to emails so they appear directly below the email being composed. Users can also select an alternative signature if additional signatures have been assigned to them. ::note The Outlook Add-in is only supported for Outlook 365 subscription versions due to limitations from Microsoft. If you are using perpetually licenced versions of Outlook (2016 / 2019 / 2021), use the Outlook Classic Agent by following [How to install the Outlook (Classic) agent](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-classic-agent). :: The add-in can be deployed from the Microsoft 365 Admin Center to apply to users, groups, or your entire organisation. Alternatively, it can be installed from the "Get Add-ins" option in Microsoft 365 for individual users or testing purposes. ::warning Outlook Add-in **must** be deployed to your users using one of the methods below. If the add-in is installed manually by a user from the Add-in store, it will be unable to insert signatures due to a security limitation imposed by Microsoft. :: ::accordion :::accordion-item --- label: Deploying the add-in from the Microsoft 365 Admin center --- Log on to the [Microsoft 365 Admin Center](http://admin.microsoft.com){rel=""nofollow""} as a Global Administrator. Go to **Settings** > **Integrated apps** to open the **Integrated apps** page. Click the **Get apps** link to search for an app. ![Microsoft 365 Admin Center Integrated apps page with Get apps link](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/m365-admin-integrated-apps-get-apps.png) In the search bar, enter **Signature 365**, and select the **Get it now** option under **Signature 365 for Outlook** ![AppSource search results showing Signature 365 for Outlook with Get it now option](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/appsource-search-signature-365.png) Click **Get it now** in the next screen and you will be asked to deploy the add-in. ![Signature 365 for Outlook app page with Get it now button](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/signature-365-app-get-it-now.png){style="width: 381px;"} In the **Deploy New App** flyout, select the **Just me** option, and hit the **Next** button. You will be able to assign additional users to the app later in the process. ![Deploy New App flyout with Just me option selected](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/deploy-new-app-just-me-option.png){style="width: 609px;"} You will be asked to accept the required permissions for the add-in. Click the **Accept permissions** button. ![Deployment page prompting to accept required permissions for Signature 365 add-in](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/App-permissions-accept-permissions.png?v=1787303360816) This will open a new window prompting you to sign in and accept these permissions. Review the required permissions and click the **Accept** button. ![Microsoft sign-in dialog requesting permission acceptance for Signature 365](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/permissions-accept-dialog.png){style="width: 313px;"} The **Permissions accepted** text will update on the page, click the **Next** button that is now active. ![Deployment page showing Permissions accepted with Next button active](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/App-permissions-permissions-accepted.png?v=1787303402269){style="width: 500px;"} On the Review and finish deployment screen, click the **Finish deployment** button. ![Review and finish deployment screen with Finish deployment button](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/deploy-review-finish-deployment.png) The Deployment in progress screen will show the progress, updating to **Deployment completed** when finished. Click the **Done** button to return to Integrated apps. ![Deployment in progress screen for Signature 365 add-in](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/deploy-deployment-in-progress.png)![Deployment completed screen for Signature 365 add-in](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/deploy-deployment-completed.png) The Signature 365 add-in will now be visible and available to deploy to other users. ![Integrated apps page listing Signature 365 add-in available for deployment](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/integrated-apps-signature-365-listed.png) Click anywhere on the app name to open the status bar. ![Signature 365 app status flyout panel in Integrated apps](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/integrated-apps-signature-365-status-flyout.png){style="width: 457px;"} Select the **Users** tab, and select the users you wish to deploy the add-in to, then click the **Deploy** button. When you select the Specific users/groups option, Microsoft 365 will send users an email notification by default unless you disable this option. While it is possible to deploy to the entire organisation, create a dynamic security group of users within Microsoft Entra, due to Microsoft not providing an option to exclude users from a deployment. ::::warning When you use the **Specific users/groups** option, Microsoft 365 will only deploy the add-in to users who are direct members of the groups you specify. It will not include members of nested groups. This is a limitation of Microsoft 365. :::: ![Users tab showing user selection and Deploy button for Signature 365 add-in](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/deploy-users-tab-deploy-button.png){style="width: 432px;"} The following screen will be displayed, when both apps show as **Completed**, click **Done**. ![Deployment screen showing both apps as Completed with Done button](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/deploy-apps-completed-done.png){style="width: 458px;"} The add-in may not be available to all users immediately. The deployment usually only takes a few minutes but can take up to 72 hours according to Microsoft. For some users the add-in may not be available until Outlook has been restarted. Click **Done** to close the add-in pane. The Outlook add-in now will deploy to your selected users. ::: :::accordion-item{label="Installing from Classic Outlook"} ::::note Microsoft are in the process of removing the Get Add-ins option from Classic Outlook. Use this option if you see **All Apps** as a menu item. ![Classic Outlook ribbon showing the All Apps menu item](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/classic-outlook-all-apps-menu.png) :::: Open a browser and navigate to {rel=""nofollow""} Use your browser to save the webpage to your machine - in the Chrome or Edge menu > **More Tools > Save page as...** Select **File** from the menu within Outlook, and select the **Manage Add-ins** item. ![Classic Outlook File menu with Manage Add-ins option highlighted](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/classic-outlook-file-manage-add-ins.png){style="width: 553px;"} This will open OWA in your default web browser. In the **Add-ins for Outlook** window that opens, select **My add-ins**, and scroll down until you see the **Custom Addins** section. Click **+ Add a custom add-in** and in the dropdown that appears select the **Add from File...** option. The **Add from URL...** option has been removed by Microsoft. ![Outlook Web App My add-ins section showing Add from File option in dropdown](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/owa-add-custom-add-in-from-file.png) In the window that opens, select the manifest.xml file you previously saved. ![File picker window for selecting the saved manifest.xml file](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/install-select-manifest-xml-file.png){style="width: 561px;"} Review the warning and select **Install**. ![Warning dialog for installing custom Outlook add-in with Install button](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/install-add-in-warning-install.png) The Signature 365 add-in will appear in the **Custom Addins** section, and will now be available when composing a new message. ![Custom Addins section showing Signature 365 add-in installed and available](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/custom-addins-signature-365-installed.png){style="width: 403px;"} ::: :::accordion-item --- label: Installing from the Get Add-ins window in New Outlook or OWA --- Open a browser and navigate to {rel=""nofollow""} Use your browser to save the webpage to your machine - in the Chrome or Edge menu > **More Tools > Save page as...** In the Outlook menu ribbon, click the **Get Add-ins** button. ![New Outlook ribbon showing the Get Add-ins button](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/new-outlook-get-add-ins-button.png) In some cases, the **Get Add-ins** button may be unavailable. If you see this issue, navigate to [aka.ms/olksideload](https://aka.ms/olksideload){rel=""nofollow""} In the **Add-ins** window that opens, select **My add-ins**, and scroll down until you see the **Custom Addins** section. Click **+ Add a custom add-in** and in the dropdown that appears select the **Add from File...** option. The **Add from URL...** option has been removed by Microsoft. ![Outlook Web App My add-ins section showing Add from File option in dropdown](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/owa-add-custom-add-in-from-file.png) In the window that opens, select the manifest.xml file you previously saved. ![File picker window for selecting the saved manifest.xml file](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/install-select-manifest-xml-file.png){style="width: 561px;"} Review the warning and select **Install**. ![Warning dialog for installing custom Outlook add-in with Install button](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/install-add-in-warning-install.png) The Signature 365 add-in will appear in the **Custom Addins** section, and will now be available when composing a new message. ![Custom Addins section showing Signature 365 add-in installed and available](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in/custom-addins-signature-365-installed.png){style="width: 403px;"} ::: :: # How to install the Outlook (Classic) agent Install the Signature 365 Classic Agent when you need on-compose signatures in Outlook 2016, 2019, 2021, or 2024 on Windows. Before you install it, review [Signature 365 system requirements](https://support.symprex.com/signature-365/get-started/signature-365-system-requirements) and [Supported Outlook versions for Signature 365 client signatures](https://support.symprex.com/signature-365/client-side/troubleshooting/supported-outlook-versions-for-signature-365-client-signatures) to confirm the Classic Agent is the right option for your users. ::caution The Signature 365 Classic Agent is not compatible with New Outlook. If you are moving users to New Outlook or Microsoft 365 subscription versions, use [How to install the Outlook add-in](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in) and review [Signature 365 Classic Agent cannot support Microsoft One Outlook](https://support.symprex.com/signature-365/client-side/troubleshooting/signature-365-classic-agent-cannot-support-microsoft-one-outlook) . :: ## Configuration page {rel=""nofollow""} ## System requirements Operating system: - Windows 10 and later - Windows Server 2012 or later .NET Framework: - .NET Framework 4.7.2 or later ## MSI package Download link: {rel=""nofollow""} ## ClickOnce installer ::warning ClickOnce add-ins must be installed using Internet Explorer or Microsoft Edge Chromium. This is due to limitations by Microsoft. :: Installer link: {rel=""nofollow""} This version automatically updates when new versions are available. ## Limitations of the agent The Signature 365 Agent for Outlook does not support different signatures, campaigns, or disclaimers based on internal or external email. The agent only selects signatures, campaigns, or disclaimers based on new and reply or forward email. ## Next steps - [How Outlook client-side signatures work](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-outlook-client-side-signatures-work) - [Managing personal signatures, fonts and stationery for Outlook Classic desktop](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/managing-personal-signatures-classic-outlook) - [How to install the Outlook add-in](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/how-to-install-the-outlook-add-in) for supported Microsoft 365 subscription clients # How to set Outlook default fonts for all users You wish to control the default outlook messaging fonts while using Signature 365. Use the Symprex Email Signature Utility to do this. For more details, see [Managing personal signatures, fonts, and stationery for classic Outlook desktop](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/managing-personal-signatures-classic-outlook). # Deployment and configuration ::generated-category-children{generated} :: # Managing Outlook's default signature options with the Signature 365 Outlook add-in You are looking to understand the options for setting user signatures using the Signature 365 add-in. The Signature 365 add-in is configured to set the default internal Outlook signatures to none, and insert the default signature as set in the portal. This is done to ensure that signatures defined for each user in Signature 365 are correctly set, and will always remove a default signature set by that user. It is possible to configure the behaviour of the add-in to change the behaviour of the auto-insert function, and / or to prevent the internal Outlook default signature being set to none. Follow these steps to configure this: ::note These settings affect your entire Signature 365 tenant and cannot be changed on a per-user basis. :: - Log on to the [Signature 365 portal](https://app.signature365.com/){rel=""nofollow""} and open the [Outlook Integrations](https://app.signature365.com/integrations/outlook-add-in){rel=""nofollow""} page from **Integrations** > **Outlook**. - Deselect the **Clear Outlook's default signature** or **Auto-insert signature** options as required for your use case. :br![Signature 365 Outlook Integrations page showing Clear default signature and Auto-insert options](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/managing-outlook-default-signature-options/outlook-integrations-signature-insert-options.png) ## More information To remove access to all classic Outlook signature settings, see [Managing personal signatures, fonts, and stationery for Outlook desktop](https://support.symprex.com/signature-365/client-side/deployment-and-configuration/managing-personal-signatures-classic-outlook). To remove access to signatures for devices using roaming signatures (new Outlook / Outlook on the web), see [Disabling Outlook signatures in new Outlook and Outlook on the web](https://support.symprex.com/signature-365/client-side/troubleshooting/disabling-outlook-signatures-in-new-outlook-and-owa). # Managing personal signatures, fonts and stationery for Outlook Classic desktop You wish to control internal settings of the Classic Outlook desktop client while using Signature 365. You can use the Symprex Email Signature Utility to set font type, size and colour, remove personal Outlook signatures and stationery, and disable personal Outlook signatures entirely. You will need to run the utility locally on all devices you wish to set these options. This cannot be set within Signature 365 and must be deployed using a login script, via command line, or similar. 1. Download the Symprex Email Signature Utility from [here](https://go.symprex.com/symprex-email-signature-utility-download){rel=""nofollow""} 2. Unzip the SymprexEmailSignatureUtility.exe executable Right-click the file, open **Properties**, check the **Unblock** option, and click **Apply**: :br ![Windows file Properties dialog with Unblock checkbox option](https://support.symprex.com/assets/signature-365/client-side/deployment-and-configuration/managing-personal-signatures-classic-outlook/file-properties-unblock-option.png){height="" width=""} **Setting Outlook default fonts** The following command line arguments can be used to set message fonts: **Set new email font:**:br /SetNewEmailFont=\,\,\