PROTECT Quick Start Guide

Overview

GuardWare PROTECT encrypts and secures all file types, including MS Office documents, PDFs, images, videos, and AutoCAD files. It ensures files remain protected from unauthorised use and theft, whether stored locally or shared externally via USB, cloud drives, email, or other methods. Only authorised users and applications can open protected files. These users and applications are configured in the GuardWare Management Console by administrators.

End users interact with GuardWare PROTECT Client through the Windows Explorer right-click menu. From there, users can protect sensitive files by applying classifications, restricting access to specific Security Groups, limiting file circulation, adding an expiry date, and so on.

For Microsoft Office files, PROTECT works with Microsoft Purview Information Protection (MIP) to apply protection based on the file's classification. See PROTECT and MIP for more details.

What this guide covers

• Console sign-in and admin access
• Microsoft 365 integration and key setup
• Agent download and endpoint rollout
• Security Groups and User Policies
• Applications and Office protection

Before getting started, make sure you have installed the GuardWare Server and can access the GuardWare Management Console URL.

1

Log in to the Console

1. Open the GuardWare Management Console.
2. Sign in with your Super Admin or organisation admin account.
3. Complete 2FA, accept the EULA, and change the password if prompted.

2

Microsoft 365 integration

Before integrating, ensure you have:

• An active Microsoft Azure subscription. We recommend using a Pay-As-You-Go subscription.
• Access to the Microsoft Azure Portal with the required administrative permissions.

Without an active Azure subscription, GuardWare PROTECT cannot be implemented.

1. Navigate to ORGANISATION > Integrations.
2. Click Connect Microsoft 365.
3. Sign in with a Global Administrator account.
4. Review the requested permissions.
5. Select Consent on behalf of your organisation.
6. Click Accept.

This creates the Azure application that PROTECT uses for Azure Key Vault setup.

3

Set up Azure Key Vault and Key Server

We recommend creating the key vault from the Management Console.

1. Navigate to PROTECT > Key Vault.
2. Click Log in with Azure.
3. Sign in with an account that has Azure admin permissions.
4. Select the Subscription.
5. Choose or create the Resource group.
6. Enter a unique Key Vault name.
7. Select the Region and Pricing tier.
8. Click Create.

See Key Vault for more details.

4

Download the PROTECT Agent

1. Navigate to Resources > Agent Download.
2. Go to PROTECT Agent.
3. Enter your Azure external and internal domains and location.
4. Click Submit. The Download link only appears after the configuration is complete.

Once the installation settings are complete, the Download Installer link becomes available. Click it to download the agent with the configured settings.

5

Whitelist PROTECT on endpoints

Whitelist PROTECT in the endpoints' AV, EDR, or XDR platforms.

1. Add C:\Program Files\GuardWare\PROTECT to the allowlist.
2. Add C:\ProgramData\Guardware to the allowlist.
3. Allow GWProtectDesktop.exe to reach <KeyVaultName>.vault.azure.net over the port 443.

See Whitelist GuardWare PROTECT for the full list of files, services, and network exceptions.

6

Install PROTECT Agent on endpoints

1. Run the PROTECT Agent installer on the endpoint.
2. Complete the setup wizard.
3. Install Azure CLI or Visual C++ if prompted.
4. Restart the device when installation finishes.
5. In the Welcome wizard, click Login with Azure.
6. Select the correct Tenant ID and Subscription.
7. Allow GWProtectDesktop through the Windows firewall if prompted.

After the agent is installed and the user signs in, the device appears in PROTECT Devices. From there, admins can enable or disable the agent, uninstall the agent, and open user details to enable or disable a user, enable or disable Force Encrypt, and decrypt files for that user.

See Install PROTECT Agent for full device setup.

7

Create Security Groups and assign users

Security Groups define who can open protected files.

1. Navigate to PROTECT > Security Groups.
2. Click +New Security Group.
3. Create the group manually or import it from AD.
4. Choose the encryption mode.
5. Save the group.
6. Click +Assign Users to add members.

Any new user who signs in successfully is added to All Users by default.

See Security Groups for more details.

8

Create a User policy and assign users

User Policies control which client actions users can access.

1. Navigate to PROTECT > User Policies.
2. Click +New User Policy.
3. Enter the policy title and description.
4. Enable the features your users need.
5. Save the policy.
6. Assign the policy to users.

See User Policies for more details.

9

Add applications

Applications define which programs can open, edit, and save protected files.

1. Navigate to PROTECT > Applications.
2. Click +New Application.
3. Enter the Executable Name and Application Suite.
4. Add the Folder Path if needed.
5. Define which extensions the application can encrypt and decrypt.
6. Enable Network Drive Support if required.
7. Click Save.

See Applications for more details.

10

PROTECT Office

Choose how Office files are protected.

You can use:

• MIP only
• MIP and PROTECT
• PROTECT only

To configure this:

1. Navigate to ORGANISATION > Integrations.
2. Enable Protect Office files using MIP if required.
3. Enable Protect Office files using both MIP and PROTECT if you want layered protection.
4. Click Submit.

See Protection Mode for more details.

11

Optional next steps

After the baseline setup, you can expand the rollout.

• Configure Data Types and classifications
• Configure Websites and Office Add-in
• Set up SCAN & ENCRYPT if you need to locate and encrypt files with sensitive data located in file servers and SharePoint.

With these steps complete, PROTECT is ready to protect files across your organisation using the policies, groups, and applications you configured.