New Release Available in October – Stay tuned!
HaloSHARE GenNXT
1.1 1.0
1.1 1.0

Configuring the HaloSHARE GenNXT

This chapter describes how to configure HaloSHARE GenNXT by using the HaloSHARE GenNXT Configuration tool.

Administration

HaloSHARE GenNXT uses a key-based license to control application features. Obtain a license key from Secude Support before installing HaloSHARE GenNXT. After installation, enter the license key in the configuration tool to activate HaloSHARE GenNXT and enable all features.

This manual does not describe the license purchasing process. To obtain or renew a license, contact your Secude representative.

License Activation

Perform the following steps to activate the HaloSHARE GenNXT license:

  1. Navigate to the installation directory. The default location is C:\Program Files\Secude\HaloSHARE.

  2. Right-click HaloSHAREConfiguration.exe and select Run as administrator.

  3. In the HaloSHARE GenNXT Configuration screen, click Administration.

  4. The Administration screen appears.

    HaloSHARE Configuration screen.png

    License activation screen

  5. Enter the license key.

  6. Click Activate License.

  7. Wait until the activation is complete.

Result:

  • After the license is activated successfully, a confirmation message displays the license details, including License Status, Feature Count, and Expiry Date. Additional information is available in the Feature Name, Current Count, and Max Count fields.

  • If the license key is invalid, License Status displays LicenseNotFound.

  • If the license key is valid, License Status displays Active.

Related tasks:

  • If your license expires, enter a new license key and click Activate License. Alternatively, activate the license by using hsadm.exe, and then restart the HaloSHARE service. For more information, refer to “Configure the Service by Using the Admin Tool”.

  • When HaloSHARE GenNXT is uninstalled, the license is automatically deactivated.

  • License and service information is recorded in the log files located at: C:\Users\UserName\AppData\Local\Secude\HaloSHARE\log.

Autodesk Forma Settings

Autodesk Forma integration ensures seamless data flow and collaboration across platforms. HaloSHARE GenNXT enhances this ecosystem with MPIP protection, watermarking, CUI marking, digital signing, password protection, and metadata tagging to enable secure and efficient file sharing.

Before you begin, ensure that the following requirements are met:

  • A valid license with the Autodesk Forma feature enabled. If the Autodesk Forma feature is not enabled in the license, the Autodesk Forma tab is disabled. When you select the tab, the following message appears: “Autodesk Forma Settings are disabled. Please verify your license for more details.”

  • The Client ID and Client Secret for your Autodesk Platform Services application.

To configure HaloSHARE GenNXT with Autodesk Forma, follow these steps:

  1. In the HaloSHARE GenNXT Configuration screen, click Administration.

  2. In the Administration window, click the Autodesk Forma Settings tab.

  3. Enter the following credentials:

    1. Client id

    2. Client secret

    Autodesk Forma Settings.png

    Autodesk Forma Settings

  4. To display the credentials, click the Show/Hide (eye) icon.

  5. Click Authenticate. A confirmation message is displayed upon successful authentication.

  6. From the Hub list, select the Autodesk Forma hub.

  7. Configure the Source and Destination locations. Depending on your workflow, select one or both options.

    • If Autodesk Forma is selected, the folder selection dialog box displays Autodesk Forma folders.

    • Otherwise, the folder selection dialog box displays local or network folders.

  8. To delete processed source files from configured source folder, select Delete file(s) from Autodesk Forma source folder after processing.

  9. Click Save.

Result

A confirmation message appears after the settings are successfully saved.

Quick Start for Workflows

A workflow defines how HaloSHARE GenNXT processes files from a source location and transfers them to a destination location. Each workflow consists of one or more tasks that run sequentially when HaloSHARE GenNXT detects a new file in the source folder.

Each workflow can include one or more of the following tasks. The execution order is shown below.

  • Metadata Task – Embeds metadata into files.

  • Watermark Task – Adds watermarks to files.

  • Compliance Mark Task – Applies compliance markings to files.

  • Password Protection Task – Applies password protection to files.

  • File Signing Task – Digitally signs files.

  • MPIP Task – Applies Microsoft Purview Information Protection sensitivity labels to classify and protect files.

Workflow task execution order (combined configuration)

  • Metadata task

  • Watermark task

  • File Signing task

In a workflow, you cannot combine the Password Protection or File Signing subtasks with the MPIP task because they are mutually exclusive. The MIP SDK does not support digitally signed or password-protected files.

In the Workflow pane, expanding a top-level workflow displays the associated workflow tasks and source locations. For example, designers at Prestin Engineering may store sensitive files in the source folder location C:\PrestinEng\Source1 within the organization. To securely share these files with external users, they configure a destination location such as C:\SharePoint\PrestinEng_DestUser1. The same approach can be used to configure additional workflows.

Workflow Behavior

  1. File handling behavior occurs when the same file is repeatedly added or moved to the same source folder.

    Case 1: Move to Destination is not selected

    • MPIP Task: Suppose the source location is configured for text files (.txt). When you copy a text file, such as sample.txt, to the source folder, the file is encrypted and renamed to sample.ptxt.

      If the same fresh or unprocessed sample.txt file is copied to the source folder again, the existing sample.ptxt file is overwritten.

    • Watermark Task: Suppose the source location is configured for PDF files (.pdf). When you copy a PDF file to the source folder, the file is watermarked.

      If the same fresh or unprocessed PDF file is copied to the source folder again, the existing processed file is overwritten.

    Case 2: Move to Destination is selected

    • MPIP Task: When a file is placed in the source location, it is encrypted and moved to the destination folder.

      If the same fresh or unprocessed file is added to the source folder again, it is treated as a new file, encrypted, and moved to the destination folder, overwriting the existing file with the same name.

    • Watermark Task: When a file is placed in the source location, it is watermarked and moved to the destination folder.

      • If an already processed file is added to the source folder again, the existing file in the destination folder is replaced without processing the file again.

      • If a fresh or unprocessed file with the same name is added to the source folder, it is treated as a new file, watermarked, and moved to the destination folder, overwriting the existing file with the same name.

    Note: The same behavior applies when a file is digitally signed, password-protected, CUI-marked, or metadata-tagged.

    For PDF, Excel, and DOCX files, if processing fails because of a library error, the failed file is cached and is not processed again during subsequent HaloSHARE GenNXT operations.

  2. The OneDrive and HaloSHARE services cannot access the same file simultaneously. Similarly, the HaloSHARE GenNXT and SharePoint services cannot access the same file at the same time. Simultaneous access results in an access violation or access denied error.

  3. Unconfigured file types: Files that are not configured in the HaloSHARE GenNXT Configuration tool are not moved to the destination folder. HaloSHARE GenNXT identifies such unconfigured file types and leaves them unchanged.

  4. A top-level workflow cannot be deleted if it contains configured tasks. Delete all tasks before deleting the top-level workflow.

  5. The same location cannot be configured more than once, and existing workflow names cannot be reused.

  6. The workflow name cannot be changed after it is created. To rename a workflow, delete the existing workflow and create a new workflow with the desired name.

  7. The source and destination paths can be swapped only within the same workflow. Configured paths cannot be swapped or used in another workflow.

File Processing in Forma

HaloSHARE GenNXT identifies each file in Forma using the Item ID and Version ID, ensuring that the source folder is not processed repeatedly.

  • When a new file is added to the source folder, HaloSHARE GenNXT processes and tracks it. If a file (for example, V1) is already processed by HaloSHARE GenNXT and added again without changes, HaloSHARE GenNXT skips processing. Processed files are tagged with Processed by HaloSHARE to prevent duplicate processing.

  • HaloSHARE GenNXT creates a new version when a file with the same name exists in the destination folder.

  • Unlike local folder configuration, when the Move to Destination option is selected in Autodesk Forma, files in the source folder remain unchanged, and the processed files are sent to the destination folder.

  • HaloSHARE GenNXT tracks the version of each file in the source (Autodesk Forma) folder and the destination folder. This ensures that if a user configures a folder in Autodesk Forma that already contains processed files, HaloSHARE GenNXT identifies them and does not process them again. File tracking details are stored in TrackVersions.json under C:\Users\Public\Secude\HaloSHARE\adfcache.

  • If a HaloSHARE GenNXT-protected file is uploaded and relabeling is required, HaloSHARE GenNXT does not process the file if it has already been processed.
    To decrypt or relabel the file and process it again, either delete the tracking version file or download the file and place it in a different folder. This approach prevents repeated processing of the same file when Autodesk Forma folders are configured by tracking item versions.

Configure Workflows

This section describes how to create and configure a HaloSHARE GenNXT workflow.

Prerequisite:

By default, the HaloSHARE GenNXT file extension is available for selection. To add additional extensions, update the hs_extension_list.json file. Newly added entries automatically appear in the extension list in the configuration tool.

To configure the workflow, follow the steps below:

  1. Navigate to the HaloSHARE GenNXT installation directory. The default folder is C:\Program Files\Secude\HaloSHARE.

  2. Double-click HaloSHAREConfiguration.exe.

  3. The HaloSHARE GenNXT Configuration screen appears.

    Generic Workflow Configuration fields.png

    Generic Workflow configuration fields

  4. In Workflow Name, enter a name for the workflow. Example: Prestin Engineering

  5. In Source Location, enter the path to the source folder that HaloSHARE GenNXT monitors, or click Browse to select the folder. The folders available in the dialog box depend on your configuration.

    • If Autodesk Forma is integrated and the Source and Destination options are enabled, Autodesk Forma folders are displayed. Example: RND_Test:\Project Files\Lib\Assembly.

    • If Autodesk Forma is not integrated, local network folders are displayed. Example: C:\PrestinEng\Source1.

      Folder dialogs.png

      Folder dialogs

  6. Select one or more file extensions from the File Extensions list. You can also search for a file type and then select it from the results. Files with extensions that are not configured are ignored.

  7. To process files in all subfolders, select Recursive Scan. If this option is not selected, HaloSHARE GenNXT processes only files in the source folder.

  8. To move processed files to another location, select Move to Destination.

  9. In Destination Location, specify the destination folder where HaloSHARE GenNXT transfers the processed files. The destination folder can be a shared location, such as:

    • Microsoft SharePoint

    • Microsoft OneDrive

    • Autodesk Forma

    • Network folder

    Example: Files from C:\PrestinEng\Source1 are moved to C:\SharePoint\PrestinEng_DestUser1.

  10. Click Save.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane.

  • The Workflow Task list is enabled after you save the workflow successfully. Note: To add a workflow task, the user must have a valid license and a proper installation.

  • To create a new workflow, select top-level Workflow in the left pane. The empty fields appear. Enter the required details to create a new sub-level workflow.

Configure Metadata Task Attributes

This task configures HaloSHARE GenNXT to add metadata to files for classification, identification, and ownership.

To configure the Metadata Task, perform the following steps:

  1. As described in the Configure Workflows section, configure your workflow task.

  2. From the Workflow Task list, select the Metadata Task.

  3. On the HaloSHARE GenNXT Configuration screen, the metadata task options appear.

    Metadata Task configuration.png

    Metadata Task configuration

  4. Under Metadata Properties, enter the metadata values in the designated fields.

    Example:

    1. Category: Financial

    2. Keywords: Annual Report

  5. To remove the metadata properties, select the row, right-click, and choose Delete.

  6. Click Save, and then click Restart Service in the Administration UI. Repeat these steps to add additional workflows.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane at any time.

  • The files are tagged with the specified metadata values.

  • To delete a workflow, click Delete, and then confirm the action when prompted. The workflow is removed.

  • For examples of configuration output, see the Sample Results section.

Configure Watermark Task Attributes

This task configures HaloSHARE GenNXT to apply watermarks to files to indicate ownership, classification, or usage restrictions.

Prerequisite: Before configuring the watermark workflow task for files in Microsoft Excel and PowerPoint, configure the settings below.

Configure the Watermark Display in Microsoft Office Applications

By default, HaloSHARE GenNXT applies watermarks in the foreground in Microsoft PowerPoint and in the center of worksheets in Microsoft Excel. In Microsoft Excel, users cannot edit cells covered by the watermark, although the watermark can be repositioned within the worksheet. In these display modes, the watermark may interfere with content editing. To allow users to edit content while the watermark is displayed, manually configure the appropriate registry value.

Application

Name

Type

Value

Microsoft PowerPoint

enable_legacy

REG_SZ

true

Microsoft Excel

xl_wm_mode

REG_SZ

header or bkground

Registry keys

Registry Value Descriptions

  • true (Microsoft PowerPoint) – Displays the watermark in the background, allowing users to add and edit content in the presentation.

  • header (Microsoft Excel) – Displays the watermark in the worksheet header. The watermark is visible only in Page Layout view and on printed pages, while allowing users to edit worksheet content.

  • bkground (Microsoft Excel) – Displays the watermark as the worksheet background. The watermark is visible throughout the worksheet while allowing users to edit worksheet content.

To configure the Watermark Task, perform the following steps:

  1. As described in the Configure Workflows section, configure your workflow task.

  2. From the Workflow Task list, select the Watermark Task.

  3. On the HaloSHARE GenNXT Configuration screen, the watermark-related UI field appears.

    Watermark Task configuration.png

    Watermark Task configuration

  4. Enter the text to be embedded in the files. Enter text that matches the sensitivity level of the document on watermark lines 1, 2, and 3. Example:

    1. Watermark Line 1: Confidential

    2. Watermark Line 2: Prestin Engineering

    3. Watermark Line 3: All rights reserved. Refer to the disclaimer.

    4. Font Size: Select a font size between 8 and 72. HaloSHARE GenNXT uses the Times New Roman font for watermarking across all supported file types.

  5. Click Save.

  6. Restart the HaloSHARE service from the Administration UI. Repeat these steps to add additional workflows.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane at any time.

  • The files are watermarked with the specified text. By default, the watermark is applied diagonally.

  • For examples of configuration output, see the Sample Results section.

  • To delete a workflow, click Delete, and then confirm the action when prompted. The workflow is removed.

Watermarking Revit Files Using HaloSHARE GenNXT

This feature enables HaloSHARE GenNXT to apply watermarks to Revit files without requiring the HaloCAD Add-on for Revit.

Prerequisites

Before you begin, ensure that the following requirements are met:

  • AutoCAD and Revit are not running during the installation or uninstallation of HaloSHARE GenNXT.

  • The HaloCAD Add-on for Revit and HaloCAD Add-on for AutoCAD are not installed on the watermarking server.

  • HaloSHARE GenNXT is installed and running.

  • Restart the HaloSHARE service before proceeding.

  • Ensure that hsmetadataMessageProcessor.exe is running in the background. After a fresh installation, log off and log on again to start the process automatically, or start the process manually.

  • Ensure that Revit and AutoCAD do not display any pop-ups or errors when started manually. Watermarking automation must not be interrupted by pop-ups or errors; otherwise, the application may become unresponsive.

To add a watermark to Revit files, follow these steps:

  1. Open Task Manager, and then select the Details tab.

  2. Verify that hsmetadataMessageProcessor.exe is running.

  3. If the process is not running, navigate to the HaloSHARE GenNXT installation path
    (C:\Program Files\Secude\common\<version>) and double-click hsmetadataMessageProcessor.exe to start it.

  4. Configure a workflow to process Revit (.rvt) files by specifying the source and destination folders.

  5. Copy the Revit file to the configured source folder.

Result

  • HaloSHARE applies the configured watermark to the Revit file.

  • The processed file is moved to the configured destination folder.

  • To view the watermark text in Revit, refer to the section “Watermark in RevitLookup”.

Configure Compliance Mark Task Attributes

This task configures HaloSHARE GenNXT to apply Controlled Unclassified Information markings to files.

To configure the CUI marking, follow these steps:

  1. As described in the Configure Workflows section, configure your workflow task.

  2. From the Workflow Task list, select Compliance Mark Task.

  3. On the HaloSHARE GenNXT Configuration screen, the compliance marking options appear.

    CUI with LDC configuration.png

    CUI with LDC configuration

  4. Select one of the following compliance marking options:

    • CUI with LDC (Limited Dissemination Control)

    • CUI with DS (Distribution Statement)

  5. Specify the required CUI values in the corresponding fields.

    Example:

    1. CUI Banner: IMPS

    2. Controlled by: OSDSSI

    3. CUI Category: NIPI

    4. LDC: NIP-UIUY

    5. POC: Smith, 5670-3456

  6. To remove custom properties, select the row, right-click, and choose Delete.

  7. Click Save.

  8. Restart the HaloSHARE service from the Administration UI. Repeat these steps to add additional workflows.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane at any time.

  • The first page of the document displays the CUI values as defined in the configuration.

  • To delete a workflow, click Delete, and then confirm the action when prompted. The workflow is removed.

  • For examples of configuration output, see the Sample Results section.

Configure Password Protection Task Attributes

This task configures HaloSHARE GenNXT to protect files using a user-defined password. HaloSHARE GenNXT applies only the password; all other behavior is determined by the native functionality of Microsoft Office and PDF applications.

To protect files using a password, follow these steps:

  1. As described in the Configure Workflows section, configure your workflow task.

  2. From the Workflow Task list, select the Password Protection Task.

  3. On the HaloSHARE GenNXT Configuration screen, the password protection field appears.

    Password Protection Task configuration.png

    Password Protection Task configuration

  4. Enter a password and keep a record of it, as it is required to edit the file later. The password must be 8–15 characters long and can contain letters, numbers, or a combination of both. Spaces and special characters are not allowed.

  5. To view the password, click the eye icon next to it.

  6. Click Save.

  7. Restart the HaloSHARE service from the Administration UI. Repeat these steps to add additional workflows.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane at any time.

  • Files in the source folder are protected by a user-defined password and moved to the destination folder.

  • For examples of configuration output, see the Sample Results section.

  • To delete a workflow, click Delete, and then confirm the action when prompted. The workflow is removed.

Configure File Signing Task Attributes

This task configures HaloSHARE GenNXT to automatically apply a digital signature to files in the background to help ensure file integrity and authenticity.

You can select either Local Computer or Current User. However, both options have certain restrictions.

  • If you select Local Computer, the service-running user must have access to the Local Computer certificates or to the specific certificate in the Local Computer store. If the service-running user is a local non-admin user, promote the service-running user to a local admin user or grant the service-running user access to the private key.

  •  If you select Current User, the selected certificate must be installed in the certificate store of the service running user.

To sign files, follow these steps:

  1. As described in the Configure Workflows section, configure your workflow task.

  2. From the Workflow Task list, select File Signing Task.

  3. On the HaloSHARE GenNXT Configuration screen, the file signing options appear.

    File Signing Task configuration.png

    File Signing Task configuration

  4. Under Select Certificate Store, select Current User or Local Computer.

  5. From the list, select the appropriate certificate.

  6. Click Save.

  7. Restart the HaloSHARE service from the Administration UI. Repeat these steps to add additional workflows.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane at any time.

  • Files in the source folder are digitally signed and moved to the destination folder.

  • For examples of configuration output, see the Sample Results section.

  • To delete a workflow, click Delete, and then confirm the action when prompted. The workflow is removed.

Configure MPIP Task Attributes

This task configures HaloSHARE GenNXT to protect files by applying Microsoft Purview Information Protection sensitivity labels or custom permissions. Files protected with sensitivity labels can be relabeled by using custom permissions. Likewise, files protected with custom permissions can be relabeled by using sensitivity labels. Note: You cannot configure File Signing, Metadata, or Password Protection tasks together with the MPIP task. Compliance Mark and Watermark tasks can be configured if your license supports these features.

Relabeling prerequisites

Before relabeling files, ensure that one of the following conditions is met:

  • The user is the document owner.

  • The user has superuser privileges.

  • The user has export permissions assigned to the applied label.

  • The API permission for relabeling is configured in the application. Refer to section “Additional Permission (Only for Relabeling)”.

Difference between sensitivity labels and custom permissions

Sensitivity Labels

Sensitivity labels are defined and managed by administrators in the Microsoft Entra admin center. Each sensitivity label includes a predefined set of permissions and is referred to as an administrator-defined permission.

Custom Permissions

Custom permissions allow users to define permission settings when applying protection to a file. These permissions are referred to as user-defined permissions.

To apply file protection, follow these steps:

  1. As described in the Configure Workflows section, configure your workflow task.

  2. From the Workflow Task list, select MPIP Task.

  3. On the HaloSHARE GenNXT Configuration screen, the following MPIP task options appear:

    MPIP Task configuration.png

    MPIP Task configuration

  4. MPIP Encrypt is selected by default, but you can clear it. When selected, the MPIP Label list shows both protection and non-protection labels. When cleared, the MPIP Label list shows only non-protection labels.

  5. To apply MPIP labels to files, select MPIP Label/Relabel. This option acts as a toggle between labeling and relabeling.

    1. Select a sensitivity label from the MPIP Label list.

    2. You may also choose a label without encryption settings. In that case, the following message appears “The selected MPIP label has no encryption settings and can only be applied to MIP SDK–supported file types.” To apply such a label, specify the supported file types, for example, .txt, .docx, and .pdf.

    3. Skip to step 8.

  6. To apply user-defined permissions, select Custom Permissions. The author can then assign permissions to users, groups, or organizations based on the selected permission level.

    Custom Permissions.png

    Custom permissions

  7. From the Select Permission list, choose the required permission level:

    1. Viewer – View only

    2. Reviewer – View and Edit

    3. Co-Author – View, Edit, Copy, and Print

    4. Co-Owner – Full permissions

    5. Only for me – Grants access only to the file author. To know the usage rights of the permissions, please refer to the section "Permissions Level and Usage Rights".

    6. In Enter Users, Groups, or Organizations, specify the users, groups, or organization domains that can access the file. Separate multiple entries with commas, spaces, or semicolons. For example partner@halosecude.com;prestin-support@prestin.com;prestin-techcad@prestin.com

    7. In Expire Access, specify how long users can access the protected file.

      1. Select Never to allow unlimited access.

      2. Specify an expiration date to restrict access after the selected date.

    8. To remove the selected expiration date, click Clear date selection.

  8. To decrypt a file, select MPIP RemoveLabel/Decrypt.

  9. To make a user the file owner and grant full access, enter the user’s email ID in the Workflow Owner field. For example, Designer@halosecude.onmicrosoft.com.

  10. Click Save.

  11. Restart the HaloSHARE service from the Administration UI. Repeat these steps to add additional workflows.

Result:

  • After you successfully add the workflow, a confirmation message appears. The workflow name appears in the left pane under the top-level workflow. Select the workflow name to view its details in the right pane at any time.

  • MPIP protection: Files are protected based on the selected label.

  • Relabeling: Files in the workflow folder are updated with the new label.

  • Remove protection: Files in the workflow folder are decrypted successfully.

  • For examples of configuration output, see the Sample Results section.

  • To delete a workflow, click Delete, and then confirm the action when prompted. The workflow is removed.

Configure Combined Workflows

A combined workflow enables HaloSHARE GenNXT to execute multiple workflow tasks sequentially on the same file.

Workflow Task Execution Order (Combined Configuration):

  • Metadata task

  • Watermark task

  • File Signing task

In a workflow, you cannot combine the Password Protection or File Signing subtasks with the MPIP task because they are mutually exclusive. The MIP SDK does not support digitally signed or password-protected files. Attempting to combine them results in the following error message.

Mutual Exclusive message.png

Mutually exclusive error message

Follow the procedure for a combined Workflow:

  1. Select an existing workflow. Example: Combined.

  2. Under the selected workflow, add the required subworkflow tasks.

  3. From the Workflow Task list, select a task. Example: Select the Watermark Task.

    1. Enter the required details.

    2. Click Save.

  4. From the Workflow Task list, select another task. Example: Select the Compliance Mark Task.

    1. Enter the required details.

    2. Click Save.

  5. From the Workflow Task list, select another task. Example: Select the MPIP Task.

    1. Enter the required details.

    2. Click Save.

      Combined workflow.png

      Combined workflow

  6. Restart the HaloSHARE service from the Administration UI.

Result

  • A confirmation message appears after the workflow is saved successfully.

  • HaloSHARE GenNXT processes each file by executing the configured tasks in sequence.

  • The processed file is then moved to the configured destination folder if Move to Destination is enabled.

  • For examples of configuration output, see the Sample Results section.

Configure the Service by Using the Admin Tool

After installing HaloSHARE GenNXT, you may want to change the configuration. To do so, run the tool ...\Secude\HaloSHARE\hsadm.exe to view the commands. Please note that the admin tool does not support uppercase.

How to update MPIP labels in HaloSHARE GenNXT?

If an MPIP label is added, removed, or updated in the Microsoft Entra admin center, the administrator should restart the HaloSHARE Service for the changes to take effect.

When is it necessary to restart the HaloSHARE service?
Whenever you modify the HaloSHARE GenNXT registry settings, you need to restart the HaloSHARE Service.

hsadm.exe commands.png

hsadm.exe commands

Service Control Commands

hsadm.exe -sc list

Use this command to view the service.

Output

For a Domain User

Display Name: Secude HaloSHARE
Service Name: HaloSHARE
Domain: HC.test
User Name: HC.test\administrator
Service Mode: MPIP

For a Non-Domain local user:

Display Name: Secude HaloSHARE
Service Name: HaloSHARE
Domain: .
User Name: .\superdocs
Service Mode: MPIP

hsadm.exe -sc start <service>

Use this command to start HaloSHARE GenNXT. Note: This can be used only after setting user credentials to run HaloSHARE GenNXT.

For example,

hsadm.exe -sc start HaloSHARE

Output

Service Started successfully.

hsadm.exe -sc stop <service>

Use this command to stop HaloSHARE GenNXT.

For example,

hsadm.exe -sc stop HaloSHARE

Output

Service Stopped successfully.

Log Command

hsadm.exe -log <clean|on|off>

  1. clean: removes all files from the logging directory.

  2. on: enables the service logging.

  3. off: disables the service logging.

For example,

hsadm.exe -log on

Output

Current log enabled, level = 3.

INFO,Log already on.
C:\Users\Administrator\AppData\Local\Secude\HaloSHARE\log\

hsadm.exe -log level <1|2|3|4>

  1. Log level: 1: Error and Info

  2. Log level: 2: Error, Warning, and Info

  3. Log level: 3: Error, Warning, and Info

  4. Log level: 4: Error, Warning, Info, and Debug

For example,

hsadm.exe -log level 4

Output

Current log enabled, level = 3.

INFO,Logging enabled, level = 4.

hsadm.exe -log purge <days>

Use this command to configure the log purge duration, which defines the number of days after which log files are deleted.

For example,

hsadm.exe -log purge 2

Output

Current log enabled, level = 4.

INFO,Log files purge set to 2 day(s).

FIPS

hsadm.exe -enablefips <true|false>

Use this command to enable/disable the FIPS mode.

For example,

hsadm.exe -enablefips true

Output

Enabling FIPS module started.

Service Stopped successfully.

Extracting fips module files done.

Trying to Install fips modules for this pc.

fips modules configuration generated for this pc successfully.

Service Started successfully.

MPIP Commands

Update MPIP Certificate

hsadm.exe -sc updatempipkeycba <service> <Certificate Store ("Current User"|"Local Computer")> <Certificate Thumbprint> <Tenant Name> <Application ID>

Use this command to update the new MPIP CBA (Certificate-Based Authentication) Keys.

For example,

hsadm.exe -sc updatempipkeycba HaloSHARE "Current User" 6e9685132e2e86d1b0af75a848fcc7c0ec29839b halosecude.onmicrosoft.com u8352197-65e0-4fd2-9efb-b90027b801fb

Output

Policy XML file fetched successfully.

MPIP key updated successfully.

Update MPIP License Key

hsadm.exe -sc updatelickey <service> <License Key>

Use this command to update the License Key

For example,

hsadm.exe -sc updatelickey HaloSHARE B27N-CMTO-LWGH-AKEQ

Output

Spring License Key updated successfully

Display MPIP key

hsadm.exe -sc getvault -user <domain\user> -pwd <password>

Use this command to know your MPIP key information.

For example,

hsadm.exe -sc getvault -user .\administrator -pwd #9y->\"raQ8<

Output
Application ID: u8352197-65e0-4fd2-9efb-b90027b801fb

Tenant ID/Name: halosecude.onmicrosoft.com

Certificate Store: LocalComputer

Certificate Thumbprint: 6e9685132e2e86d1b0af75a848fcc7c0ec29839b 

License Spring Key: B27N-CMTO-LWGH-AKEQ

Watermark details

Display Watermark key

hsadm.exe -sc getvaultWM -user <domain\user> -pwd <password>

Use this command to get your watermark licensing key information.

For example,

hsadm.exe -sc getvaultWM -user .\administrator -pwd #9y->\"raQ8<

Output

License Spring Key: B37N-CSUO-LWIJ-AKBS

Help Commands

Registry Settings

The following section explains how the registry is used to store service settings. To modify the registry value, open Registry Editor, navigate to this path Registry Root Directory = HKEY_LOCAL_MACHINE\SOFTWARE\Secude\HaloSHARE, and modify the Reg Key as you want. Any changes to the registry require a restart of HaloSHARE GenNXT to take effect.

Name

Default value

Type

Description

dir_common

common

REG_SZ

The path to the directory where all the dependent DLL files are stored for the execution of HaloSHARE GenNXT.

dir_log

log

REG_SZ

Log files are generated in the service running user's local profile, i.e., in the following location %LOCALAPPDATA%\Secude\HaloSHARE\log.

dir_tmp

tmp

REG_SZ

It stores the temporary files located at %LOCALAPPDATA%\Secude\HaloSHARE\tmp.

dir_vendor

C:\Program Files\Secude\

REG_SZ

This is Secude’s vendor directory under which Secude components are installed. For example, HaloSHARE.

enable_fips

false

REG_SZ

  1. true: By selecting this option, MPIP only uses FIPS-compliant encryption algorithms.

  2. false: MPIP uses standard encryption algorithms.

enable_relabeling

on

REG_SZ

Defines the status of the relabeling.

  • on = Relabel feature is enabled to change the applied label or remove the label to decrypt the file.

  • off = Relabel feature is disabled.

haloshare_config_file

haloshare_config.enc

REG_SZ

Name of the configuration file that includes information about the folders and other essential parameters.

log_enable

on

REG_SZ

Defines the status of the log.

  • On = A log file is generated in the default location.

  • Off = No log file is generated.

  • Clean = Log files are deleted. This parameter deletes only the logs and does not change the log_enable value from "On/Off" to "Clean".

log_level

3

REG_SZ

  • Log level: 1: Error and Info

  • Log level: 2: Error, Warning, and Info

  • Log level: 3: Error, Warning, and Info

  • Log level: 4: Error, Warning, Info, and Debug

log_purge

7

REG_SZ

It indicates the removal of files older than a defined time frame. By default, log files older than 7 days are deleted.

ls_proxy


REG_SZ

Allows you to use a proxy server to access Secude’s License Manager. This is an optional feature that should only be used if your firewall is blocking License Manager. Enter proxy server settings in the format <URL>:<PORT>. For example, http://10.41.0.130:808.

Please make sure to restart the service.

scan_wait_time

5

REG_SZ

Specifies the service wait time. For any modification in the local source folder, the service scans every 5 seconds. For the Autodesk Forma folder, the service scans for changes every 30 seconds. If a rate limiter issue is expected, then you can increase the scan time. Example: 2 minutes (120 seconds).

version


REG_SZ

The version number of the installed service.

Configuration in the Registry

Endpoint Description

Registry path of endpoint = HKEY_LOCAL_MACHINE\SOFTWARE\Secude\HaloSHARE\ep\HaloSHARE

Name

Default value

Type

Description

block_pii

false

REG_SZ

Enable or disable the visibility of Personally Identifiable Information (PII) in the MIP SDK logs. The MIP SDK logs are located at%LOCALAPPDATA%\Secude\HaloSHARE Service\log\mip_cache_storage\mip\logs\mip_sdk.miplog.

  • false — PII is visible in clear text in the MIP SDK logs.

  • true — PII is masked with asterisks in the MIP SDK logs, helping to protect the confidentiality of the PII.

cachetype

1

REG_SZ

MPIP cache storage type used by the service.

  • In Memory—0, maintains the storage cache in memory in the application.

  • On Disk — 1 (default storage type), stores the database (SQLite3) on disk in the directory provided in the settings object. The database is stored in plaintext.

  • On Disk Encrypted — 2, stores the database (SQLite3) on disk in the directory provided in the settings object. The database is encrypted using OS-specific APIs.

cacheuserlicense

1

REG_SZ

  • 0 — false: The End User License (EUL) is not stored in the MPIP cache storage.

  • 1 — true (default): The End User License (EUL) is stored in the MPIP cache storage.

cloudtype


REG_SZ

User's Azure Cloud Type. For example: Commercial.

credential


REG_SZ

Domain or computer name, name of the user under which the HaloSHARE service runs

databoundary

Default

REG_SZ

Audit and telemetry events are sent to the nearest collector, where these events are stored and processed.

domain


REG_SZ

Name of the domain.

enableCUI

false

REG_SZ

  1. true — CUI Marking feature is installed.

  2. false — CUI Marking feature is not installed.

enabledke

0

REG_SZ

Double Key Encryption

  • 0 (default value) — disables the DKE functionality in the HaloSHARE service.

  • 1 (On) — Enables the DKE functionality in the HaloSHARE service.

Please be aware that DKE labels are only visible when DKE functionality is enabled.

enablefiletracking

0

REG_SZ

Obtain the protected file's content ID to track the file.

  • 0 (default value) — The content ID is not extracted for use in File Tracking.

  • 1 — The content ID is extracted for use in File Tracking.

enableMIP

false

REG_SZ

  1. true — When set to true, the CUI Marking feature is enabled.

  2. false — When set to false, the CUI Marking feature is disabled.

enableWM

false

REG_SZ

  1. true — When this option is selected, the Watermarking feature is enabled.

  2. false — When this option is not selected, the Watermarking feature is disabled.

IterationLimit

10

REG_SZ

Iteration limit for Creo file types. The default value is 10, however, you can modify and set your limit. Example: test.prt.1, test.asm.2

MIPAuthType


REG_SZ

Type of authentication method. MSALCBA for MPIP mode.

mode


REG_SZ

Type of HaloSHARE GenNXT features. MPIP, Watermarking, or Combined.

policycloudurl


REG_SZ

Policy Cloud URL. For example: https://dataservice.protection.outlook.com

protectioncloudurl


REG_SZ

Protection Cloud URL. For example: https://api.aadrm.com

service

HaloSHARE

REG_SZ

Name of the service. By default, it is HaloSHARE GenNXT.

streambuffersize

10

REG_SZ

It is a buffer size used for memory-based encryption with the MIP SDK. When the allotted buffer size is exceeded, an additional memory of stream buffer size is allocated, and this process is repeated until the encryption/decryption operation is completed. The default setting is 10 MB.

Configuring Endpoint

Proxy Configuration

Many enterprises enforce a Group Policy Objects (GPO) that requires all outbound internet traffic routed through a proxy server. These proxy settings must be used by both the MIP SDK and the MSAL library for MPIP authentication and functionality. To use proxy settings for the MSAL library, we need to set the msal_proxy_address in HKEY_LOCAL_MACHINE\SOFTWARE\Secude\HaloSHARE.

Name

Type

Data

msal_proxy_address

REG_SZ

<http://IP Address>

 Configuring MSAL proxy

If the above steps do not work for the service running user, set the ProxyServer and ProxyEnable registry keys under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings for the service running user.

Name

Type

Data

ProxyServer

REG_SZ

<http://IP Address>

ProxyEnable

REG_SZ

  • 1 to enable.

  • 0 to disable.

Configuring proxy

To allow MIP SDK to use the proxy settings set up in your environment, follow the steps below:

Determine whether the proxy server has been properly set up by running the following command.

C:\Windows\system32>netsh winhttp show proxy
Current WinHTTP proxy settings:
Direct access (no proxy server).

If the response to the command is as shown above, it indicates that the proxy server has not been configured in the registry for WinHTTP.

To configure the proxy server for WinHTTP, use the following command:

Syntax: C:\Windows\system32>netsh winhttp set proxy <proxyservername>:<portnumber>

Example: C:\Windows\system32>netsh winhttp set proxy 190.160.166.191:8080

In this case, the proxy server has been set up with 190.160.166.191:8080. Once this command is executed successfully, the registry is updated with the proxy server URL, and the HaloENGINE Tomcat Service ensures that the configured proxy settings are applied.

Access Protected Files

After setting HaloSHARE GenNXT in your environment, you may start sharing business files in folders. Once the files have been protected, you should know how to open MPIP-protected files with HaloCAD Add-ons. For information on how to open a protected file, refer to the corresponding HaloCAD Add-on documentation.

Sample Results

To view the HaloSHARE GenNXT watermarked CAD files, the HaloCAD Add-on is required for the CAD application. For information on how to view a HaloSHARE GenNXT watermarked CAD file, refer to the HaloCAD Add-on documentation.

Viewing Watermark metadata in CAD files:

  1. RVT: Install the RevitLookup tool to view the metadata. For more details, please refer to “Watermark in RevitLookup”.

  2. DWG: Go to the file's Custom Properties to view the metadata.

  3. IFC: Open the file in any text editor and scroll to the end to view the metadata.

Metadata Task

Metadata Task.png

Sample - Metadata Task

Watermark Task

Watermark Task.png

Sample - Watermark Task

Compliance Task

Compliance Task.png

Sample - Compliance Task

Password Protection Task

Password Protection Task.png

Sample - Password Protection Task

File Signing Task

Sample - File Signing Task.png

Sample - File Signing Task

MPIP Task

MPIP protected file.png

Sample - MPIP Task

Combined Workflow

Combined Workflows.png

Sample - Combined Workflow



Last updated: