Skip to main content

Outlook (Classic) Plugin Installation

The Cyberhaven Windows Sensor installs the CyberhavenOutlookMonitor add-in to trace Outlook (Classic) email activity. Use this guide to deploy the sensor, confirm the plugin is active, and keep it enabled for users.

Looking for other Office plugins? See Word, Excel, and PowerPoint plugin installation or the New Outlook add-in deployment guide.

Installation workflow​

  1. Confirm prerequisites: Review the Plugin Prerequisites so the endpoint meets the supported Windows, Outlook, and Cyberhaven Sensor requirements.
  2. Download the sensor: Get the latest Cyberhaven Sensor package for Windows from the Cyberhaven console.
  3. Install the sensor: Deploy the sensor with your preferred software distribution method (interactive MSI, Microsoft Intune, Microsoft Configuration Manager, or another tool). The Outlook plugin is enabled by default—no extra switches required.
  4. Restart Outlook: If Outlook was running during installation, restart it so the plugin initializes. The Endpoint Sensors page shows a "Restart Outlook" action until the application relaunches.
  5. Verify the add-in: In Outlook, go to File > Options > Add-ins and confirm CyberhavenOutlookMonitor is listed under Active Application Add-ins. If it appears under Disabled Application Add-ins, re-enable it via COM Add-ins.

Silent installation example​

msiexec /i CyberhavenSensorSetup.msi /qn

After a silent deployment, prompt users (or script a post-install task) to relaunch Outlook so the plugin loads.

Keep the plugin enabled​

  • Configure the add-in as a managed add-in through Group Policy or another endpoint-management tool to prevent non-admin users from disabling it.
  • At sensor startup Cyberhaven enforces the following registry policies when no value is present, ensuring Outlook keeps the add-in enabled:
[HKEY_USERS\*\Software\Policies\Microsoft\Office\16.0\Outlook\Resiliency\AddinList]
"CyberhavenOutlookMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\16.0\Outlook\Resiliency\AddinList]
"CyberhavenOutlookMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\15.0\Outlook\Resiliency\AddinList]
"CyberhavenOutlookMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\15.0\Outlook\Resiliency\AddinList]
"CyberhavenOutlookMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\14.0\Outlook\Resiliency\AddinList]
"CyberhavenOutlookMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\14.0\Outlook\Resiliency\AddinList]
"CyberhavenOutlookMonitor"="1"

Cyberhaven never overwrites an existing value, allowing organizations to define GPO policies without conflict. Registry keys are protected by Windows permissions, so only administrators can modify them.

Suppress performance warning banners​

If Outlook displays the message "Outlook disabled the add-in 'Cyberhaven Outlook Add-In'. It caused Outlook to start slowly," set the following registry values to mark the add-in as healthy:

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\NotificationReminderAddinData]
"CyberhavenOutlookMonitor\\dtype"="0"
[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Resiliency\NotificationReminderAddinData]
"CyberhavenOutlookMonitor\\dtype"="0"
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Resiliency\NotificationReminderAddinData]
"CyberhavenOutlookMonitor\\dtype"="0"

Deploy the change via GPO, Jamf, Microsoft Intune, or another device-management platform to enforce it consistently.

Troubleshooting​

For diagnostics, registry validation, TRACE logging, and other recovery steps, see Troubleshooting Office Plugins.