Enterprise Deployment & Policy Guide ENT

Deploying Slim Archiver Enterprise across an organization, and the complete policy.json reference for centralized governance.

Audience: IT / security administrators · Applies to: Slim Archiver Enterprise.

How this guide fits with the others

This is the master reference for administration. It documents deployment, licensing, and the full policy file. The most detailed subjects have their own companion guides — SSO / CAC, DLP Rules, and Cloud Connectors — which this guide points to rather than repeating.

1. Deploying the application

Slim Archiver is distributed as a Windows installer. Deploy it to managed machines using your normal software-distribution process (for example your endpoint-management or software-deployment tooling). Governance is applied separately through the machine policy file described in section 3 — the same policy applies to every user on the machine.

Two things to place on each machine1. The application (installer). 2. Your policy.json (optional — only if you use centralized governance) at the shared location in section 3. Licensing is handled per section 2.

1.1 The installer

Slim Archiver ships as a Windows NSIS installer (a single Setup .exe). It installs per-machine (for all users), so it requires administrative rights, and it is an assisted installer (it presents a short wizard when run interactively, and allows choosing the install directory).

1.2 Silent / unattended install

For unattended deployment through your management tooling, the NSIS installer supports standard silent-install switches:

Switch	Effect
`/S`	Silent install — no wizard or prompts (case-sensitive).
`/allusers`	Force a per-machine (all-users) install — recommended for silent enterprise deployment. Reflected in the uninstall strings the installer records (`/allusers /S`).
`/D=<path>`	Install to a specific directory. Must be the LAST parameter, unquoted, and after `/S`.

"Slim Archiver Setup 1.0.0.exe" /S /allusers
"Slim Archiver Setup 1.0.0.exe" /S /allusers /D=C:\Program Files\Slim Archiver

Because the installer is per-machine, run the silent command with administrative privileges (e.g. under the SYSTEM account via your deployment tool). The application can then be licensed and governed per sections 2 and 3.

Uninstall is available from the standard Windows “Installed apps” list; the uninstaller is placed in the install directory for scripted removal.

Verify the silent switches against your buildThe switches above are the standard NSIS behavior, and the installer's custom actions are all non-interactive (they add no prompts), so /S performs a fully unattended install. As a release check, still run /S once on a test machine with your current signed installer to confirm the end-to-end result before deploying at scale.

1.3 What the installer configures

Beyond copying the application, the per-machine installer sets up several system integrations that administrators should be aware of:

Command-line tools at the install root. slimarch.exe (and its support DLLs, the SFX stub, and readme.txt) are copied to the installation folder for direct CMD / PowerShell use — see the CLI Reference.
Explorer context menu. A machine-wide “Slim Archiver” right-click menu is added for files and folders (Open, Add to Archive, Extract, and Quick actions).
Shell extension. A property-sheet shell extension (slimarch_shell.dll) is registered; it is unregistered on uninstall.
Windows Event Log source. A SlimArchiver Event Log source is registered, so audit forwarding via writeToEventLog (section 5) works out of the box.
Audit log directory. C:\ProgramData\Slim Archiver\Logs is created during install (see the note below on its permissions).

Default permissions on the log directorySo that standard (non-administrator) users can write audit entries, the installer grants Authenticated Users Modify rights on the Logs directory. This is by design, but it means local users can read and alter local log files. If your compliance posture requires it, tighten this directory's NTFS permissions after install and rely on forwarded events (Event Log / SIEM) as your tamper-resistant system of record — see section 5 and the DLP Rules Reference.

2. Licensing & activation

Slim Archiver Enterprise is activated with a license file, license.lic. The application looks for it in this order:

Next to the application executable,
the current working directory,
then the per-user application-data folder (%APPDATA%\Slim Archiver\license.lic).

2.1 Per-machine vs. site licensing

License type	Behavior
Bound (per-machine)	Tied to a machine Hardware ID (HWID). Uses an online lease/grace model to stay valid.
Site (`HWID=ANY`)	A single site-wide key valid on any machine. Intentionally offline — never contacts a licensing server. Ideal for air-gapped or large deployments.

To obtain a bound license, retrieve a machine's Hardware ID with slimarch.exe -hwid and submit it for a license.lic. For a site deployment, request a HWID=ANY key and place the same file on every machine.

Air-gapped / offline sitesA site (HWID=ANY) license never needs network access for licensing. If your environment routes licensing through an internal service, the endpoint is configurable in policy (licenseApiBase) — see section 3.

3. The policy file (policy.json)

Centralized governance is configured in a single machine-wide file:

C:\ProgramData\Slim Archiver\policy.json

It applies to all users on the machine, is read at startup, and holds only non-secret configuration. Save it as UTF-8 (a leading BOM is tolerated). Deploy or update it with your normal configuration-management process.

A malformed policy file is reported, not silently ignoredIf policy.json is present but invalid (bad JSON), Slim Archiver flags it as present but invalid rather than silently applying no governance. Validate the file after any change — an unnoticed syntax error would otherwise mean none of your policy is enforced.

3.1 Full key reference

All keys are optional; include only what you need.

Key	Type	Purpose
`requireSsoForEnterprise`	bool	Require Entra ID sign-in for Enterprise features. See the SSO / CAC guide.
`ssoTenantId`	string	Your Entra Directory (tenant) ID. Required when SSO is enforced.
`ssoSessionLifespanHours`	number	Sign-in validity window before re-authentication.
`ssoClientId`	string	The Entra application (client) ID used for sign-in.
`ssoRedirectUri`	string	The sign-in redirect URI (native-client).
`dlp`	object	Data Loss Prevention: `enabled` + `rules[]`. See the DLP Rules Reference.
`disableExecutables`	bool	Block extraction of executable file types (`.exe`, `.msi`, `.bat`, `.cmd`, `.vbs`, `.scr`, `.ps1`, `.com`, etc.).
`lockedSettings`	object	Lock compression defaults so users can't change them (greyed as GPO-locked in the UI).
`writeToEventLog`	bool	Forward audit events to the Windows Event Log.
`syslogEndpoint`	string	Forward audit events to a syslog collector (`host:port`) for your SIEM.
`licenseApiBase`	string	Override the licensing service endpoint (e.g. an internal/air-gapped service).

SSO keys are detailed in the SSO / CAC guide; the dlp object is detailed in the DLP Rules Reference. The remaining enforcement and audit keys are covered below.

4. Enforcement & interface controls

4.1 Blocking executable extraction

Set disableExecutables to true to prevent users from extracting executable file types from archives — a common measure to stop malware delivered inside archives. Attempts to extract a blocked type are refused.

4.2 Locking settings

Use lockedSettings to fix compression defaults organization-wide. Locked controls are applied to both standard and quick compression and are shown as locked (greyed) in the interface so users understand they are administrator-controlled.

5. Audit & compliance logging

Slim Archiver records governance events (such as DLP matches and blocked operations). Beyond the local DLP audit log (see the DLP guide), you can forward events to enterprise systems:

Destination	Policy key	Notes
Windows Event Log	`writeToEventLog: true`	Writes events to the local Windows Event Log for collection by your agents.
Syslog / SIEM	`syslogEndpoint: "host:port"`	Sends events to a syslog collector; security events (failures/blocks) are prioritized accordingly.

Protect local logsLocal logs live under C:\ProgramData\Slim Archiver\Logs and are readable by local users by default. Restrict the directory with NTFS permissions, and prefer forwarding to a tamper-resistant central system (Event Log / SIEM) as your system of record.

6. Recommended rollout

Pilot first. Deploy to a small group with your intended policy.json and confirm behavior before org-wide rollout.
Validate the policy file. After every change, confirm it is valid (the app flags an invalid file) so governance is actually applied.
Test each control you enable — a DLP rule (DLP guide), SSO enforcement (SSO/CAC guide), executable blocking, and locked settings — on a test machine before wide deployment.
Set up audit forwarding (Event Log or syslog) so compliance evidence is captured centrally from day one.
Choose the right license model — bound per-machine, or a HWID=ANY site key for scale / air-gapped environments.

7. Troubleshooting

Symptom	Meaning & fix
No governance is applied	`policy.json` missing or invalid. Confirm the path and valid JSON; the app flags an invalid file.
Enterprise features unavailable	No valid Enterprise license, or (if SSO enforced) no sign-in. Check `license.lic` and SSO status.
A setting can't be changed	It is locked by `lockedSettings`. This is expected under policy.
Executable won't extract	`disableExecutables` is on. Expected; adjust policy only if appropriate.
No events in SIEM	Confirm `syslogEndpoint` host:port and network path; confirm `writeToEventLog` for Event Log.