First-Time Sign-In & Two-Factor Setup

This guide walks you through signing in to your CRL account for the first time, setting up two-factor authentication (2FA), and registering the recovery options that let you reset your own password later. Work through the steps in order — it takes about 10–15 minutes.

Before you begin: keep your cell phone within reach (and a QR-code scanner app, if your camera doesn’t scan codes on its own). If IT issued you a THALES hardware token instead of using your phone for 2FA, have the token with you.

Step 1 — Sign in

Open Microsoft Edge.

Browse to https://portal.office365.us/. This is CRL’s GCC High sign-in portal. Don’t use office.com — CRL accounts live in the GCC High cloud and won’t authenticate there.

Click Sign in.

Enter your CRL email address and click Next.

Enter your password and continue. If you don’t have an initial password yet, ask the IT department or your team lead.

Step 2 — Approve your sign-in (2FA)

Two-factor authentication confirms it’s really you signing in. Use Option A to set up the DUO app on your phone, or Option B if IT issued you a THALES hardware token.

Option A — DUO mobile app

Begin DUO enrollment.

Choose Mobile Phone as your contact method and click Continue.

Type your phone number, tick the confirmation box, and click Continue.

Select your phone type.

Install DUO Mobile from the App Store (iPhone) or Play Store (Android).

In the DUO app, tap Add, then Use QR Code, and scan the code on your screen with your phone’s camera.

A green check mark confirms the scan worked.

Leave Ask me to choose an authentication method selected and click Continue.

Enrollment is complete.

Test it: click Send Me a Push. DUO displays a Request ID (for example, 9ZQV).

The push notification on your phone shows the matching Request ID.

Tap Approve to finish.

Detailed DUO setup guides: Android | iPhone / iOS

Option B — THALES hardware token

Click Enter a Passcode, type the code shown on your token, and click Log In.

Your token is now verified.

That completes 2FA. To also register your phone, click Add another Device and follow Option A — otherwise, skip ahead to Step 3.

Step 3 — Accept the CRL Terms of Use

Read the CRL Technologies Terms of Use and accept them to continue.

Step 4 — Register your account recovery methods

This step is separate from 2FA. DUO (or your token) approves your day-to-day sign-ins; the recovery methods below are what let you reset your own password if you’re ever locked out. You’ll see the Keep Your Account Secure prompts:

Register two recovery methods — a phone and an email.

Authentication phone — enter the number you want to use, then choose Text Me or Call Me.

Don’t choose Text Me for a landline — it can’t receive text messages. Use Call Me instead.

Authentication email — enter a personal, non-CRL email address you can open right away. Microsoft emails you a link to confirm it.

Never use your CRL email address here. If you’re locked out of your CRL account, you won’t be able to open it to verify the request — which defeats the purpose of a recovery method.

Click Next.

Step 5 — Finish signing in

Click Next to acknowledge, then sign in again.

Complete the 2FA prompt: click Send Me a Push and approve it on your phone, or click Enter a Passcode if you’re using a token.

When asked whether you’d like to stay signed in, click Yes.

Sign in one final time. You’ll then land on the Microsoft 365 home page.

Your Office applications — Outlook, Word, Excel, PowerPoint, and more — are listed down the left side of the page.

Next steps

For a quick-start guide on using CRL-H, see the CRL-H Quick Start Guide.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Changing Your CRL Password

Follow this guide to change your CRL-H password from the Microsoft 365 portal. This changes a password you already know — if you’re locked out and need a reset instead, see the note at the end of this article.

Step 1 — Sign in

Go to https://portal.office365.us/, click Sign in, and log in with your CRL email address (for example, LastFM@crltechnologies.com).

Use the GCC High portal, not office.com. CRL accounts live in the GCC High cloud and won’t sign in at office.com.

Step 2 — Open your account menu

Find your account icon (your initials or avatar). On the Microsoft 365 Home page it’s at the bottom of the Apps ribbon on the left. In a web app such as Outlook, it’s in the upper-right corner.

Click your initials (or avatar) to open the My Account panel.

Step 3 — Select Change Password

In the menu, select Change Password.

Step 4 — Set your new password

Enter your new password on this page. It must meet the following complexity requirements:

• A minimum of 7 characters.
• At least 3 of these 4 character types:
  1. an uppercase letter
  2. a lowercase letter
  3. a number (0–9)
  4. a special character (for example, $ ! # %)

A few additional rules apply:

• Your new password cannot match any of your last 24 passwords.
• You can change your password only once per day.
• Your CRL password SHALL NOT be reused for personal, non-work accounts.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Syncing Your Work Device

If a work application is running slowly or behaving oddly, or you get a notification that your PC is out of compliance, syncing your device is the first thing to try. A sync pulls down any updates or policy requirements your PC may be missing. Use these steps on any CRL-issued PC running Windows 10 or later.

Sync your device

1. On your device, select Start > Settings.
2. Select Accounts.
3. Select Access work or school.
   
4. Select your work account, marked with a briefcase icon or the Microsoft logo.
5. Select Info.
   
6. Select Sync.
   

Note: The sync can take up to 15 minutes. Please be patient and let it finish before doing anything else.

Once the sync is complete, reboot your PC.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Syncing Your Personal (BYO) Device

If a work application is running slowly or behaving oddly, or you get a notification that your device is out of compliance, syncing is the first thing to try. A sync pulls down any updates or policy requirements your device may be missing. On a personal (BYO) device, you do this from the Company Portal app.

Tip: If your device is flagged noncompliant, first correct the setting it’s asking for (for example, a passcode or OS update), then run the sync below to clear the flag.

iOS devices

1. Open the Company Portal app.
2. Go to Devices.
3. Select your device.
4. Tap Check status. Wait while Company Portal checks your settings — when it finishes, the device settings status tells you whether you have access to work resources.

Android devices

1. Sign in to the Company Portal app for Android.
2. Go to Settings.
3. Scroll down to Management Policy and tap Sync.
4. Wait while Company Portal syncs your device. The screen shows the timestamp of the last successful sync.

If the sync completes but your device is still flagged out of compliance, contact the IT Help Desk.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Managing the Groups You Own from the My Account Page

Overview

If you are listed as an owner of a Microsoft 365 group or security group, you can manage that group yourself from the My Account portal — no help desk ticket required. This includes viewing the membership, adding or removing members and owners, editing basic group details, and leaving or deleting a group where allowed.

Note: You can only manage groups where you are an owner. Groups you are only a member of appear under Groups I am in and are read-only to you. Groups with automatic (dynamic) membership cannot have members added or removed by hand.

Step 1 — Sign in to My Account

1. Open a web browser and go to https://myaccount.microsoft.us.
2. Enter your CRL email address (for example, yourname@crltechnologies.com) and select Next.
3. Enter your password and complete the multi-factor authentication (MFA) prompt on your phone or authenticator app.
4. You will land on your My Account home page.

Step 2 — Open "Groups I own"

1. In the left-hand navigation menu, select My Groups.
2. Under My Groups, select Groups I own. The number in parentheses (e.g., Groups I own (2)) shows how many groups you own.
3. The main pane lists each group's name, type (Microsoft 365 or Security), and expiration date if one applies.
4. Use the Filter by keyword box to quickly find a group if you own many.

Step 3 — Open a group and view its members

1. Select the group name (the blue link) to open it. Alternatively, select the … (ellipsis) at the end of the row for quick actions.
2. The group's detail page opens showing its Members and Owners tabs.
3. Select Members to see everyone currently in the group.

Step 4 — Add a member

1. On the group's detail page, select Add members (or the + button).
2. Start typing the person's name or CRL email address, then select them from the list. You can add more than one person at a time.
3. Select Add to confirm. The new member appears in the list immediately, though it can take a few minutes to take full effect across services such as SharePoint and Teams.

Step 5 — Remove a member

1. On the Members tab, find the person you want to remove.
2. Select the … next to their name (or select their row), then choose Remove.
3. Confirm when prompted. The person loses access to the group's resources on their next sign-in or sync.

Step 6 — Manage owners

Every group should have at least two owners so it is never left unmanaged.

1. Open the group and select the Owners tab.
2. Select Add owners, search for the person, and select Add.
3. To remove an owner, select the … next to their name and choose Remove. Do not remove yourself unless another owner remains.

Step 7 — Edit group details

1. Open the group and select Edit (pencil icon) or Edit details.
2. Update the name or description as needed. For Microsoft 365 groups you may also see privacy (Public/Private) options.
3. Select Save.

Editable fields vary by group type. Security groups generally allow name and description edits; some settings are managed only by IT.

Step 8 — Leave or delete a group

• Leave a group: From Groups I am in or the group's page, select Leave. (You cannot leave a group that automatically assigns your membership.)
• Delete a group: As an owner, open the group and select Delete. Deletion removes the group's mailbox, SharePoint site, and Teams content. A deleted Microsoft 365 group can be restored from Deleted groups for up to 30 days.

Caution: Deleting a group is a significant action. If you are unsure whether a group is still in use, contact the IT Help Desk before deleting it.

Things to know

• You will only see Groups I own populated if you are an owner of at least one group.
• Changes can take a few minutes to appear in Outlook, Teams, and SharePoint.
• Groups with dynamic membership (membership set by rules) cannot be edited by hand — the option will be greyed out.
• Some group settings at CRL are managed by IT policy and are not editable from My Account.

Need help?

If a group you expect to manage is missing, an option is unavailable, or you are unsure about a change, submit a ticket to the CRL IT Help Desk at helpdesk@crltechnologies.com.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Sharing Files & Folders

When your files are saved to OneDrive or SharePoint, you can share them directly from Microsoft 365 — the process is the same wherever you’re working.

In short: open or select the file or folder, select Share, set the permission level, and either enter recipients or copy a link.

For full step-by-step instructions, see Microsoft’s guide:

Share files and folders in Microsoft OneDrive (Microsoft Support)

Sharing outside CRL is restricted. As a GCC High environment, CRL limits sharing with people outside the organization to protect controlled and sensitive data. If a share link or recipient is blocked, that’s expected — do not attempt to work around it. Contact the CRL IT Team if you have a legitimate business need to share externally.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Microsoft 365 Training Resources

Microsoft offers a large library of free training. Start with the full catalog, or jump straight to a specific app below.

All apps

Microsoft 365 Training (full catalog)

By app

• Office on the Web — recommended starting point
• OneDrive
• Teams
• SharePoint

Before you dive in — two things to know

1. Your CRL account is a “work or school” account — not a personal account. Choose that option when signing in, or the training sites and apps won’t recognize your credentials.

2. CRL runs in Government Community Cloud High (GCC High), which is more secure and more restrictive than commercial or personal Microsoft 365. Some features or steps shown in Microsoft’s general training may look different or not be available to you.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

DUO Mobile Setup for CRL-H Login

Important: If you have a CRL-H laptop or PC, you must use the DUO Mobile app on your phone to log in. You do not have to enroll your phone into CRL-H to use DUO Mobile.

Step 1 — Install DUO Mobile

If you don’t already have it, install the DUO Mobile app on your phone:

iPhone — App Store
Android — Google Play

Look for the DUO logo, then download and install it following your device’s normal steps.

Step 2 — First login

Log in to your CRL asset (or unlock your PC) using your CRL email address and password.

If you haven’t activated Offline Login yet, you’ll be prompted to do so every time you sign in. You can choose Enroll Later to skip it, but that is not recommended — if you skip it, you won’t be able to log in when the PC is offline.

Step 3 — Windows Offline setup (one time)

This one-time setup syncs the DUO Mobile app on your phone with your PC, so you can still log in with a passcode when the PC has no internet connection.

On the PC: leave the default option (Duo Mobile Passcode) selected and click Activate Now. A QR code appears.

Pause here — you’ll need your phone for the next step.

On your phone: open the DUO app, tap the + (Add Account), and select Use QR Code.

Point your phone’s camera at the QR code on the PC screen to create the Windows Offline token. You can give it a more meaningful computer name or accept the default. This creates a second token on your phone labeled Windows Offline.

Back on the PC: click Enter Offline Code.

On your phone, open the Windows Offline token you just created and read the passcode. Enter that passcode on the PC (no spaces) and click Activate Offline Login.

If you’re returned to the login screen, just log in as you normally would. Setup is now complete.

Step 4 — What to expect when you log in

From now on, logging in to a CRL-H enrolled asset starts the same way: enter your email address and password. What happens next depends on whether the PC is online.

If you’re online

After you enter your email address and password, the DUO prompt appears. Click Send Push to send an authentication request to your phone, then approve it.

• The device or phone number the push went to is shown at the top.
• The Request ID is shown at the bottom of the push notification.
• Approve the push on your phone.

If you’re offline

The push will time out (or you can click Cancel), and you’ll need to choose Enter a Passcode.

• Open the Windows Offline token on your phone to get the passcode.
• Enter the 6-digit code and click Log In.

Offline logins are limited — the prompt shows how many you have left. They refresh automatically the next time you sign in while online, so connect to the network periodically.

Need help?

If you get stuck, submit a request to the CRL IT team.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Moving Duo Mobile to a New Phone

When you switch phones, you need to move your Duo Mobile accounts — including the one that authenticates your CRL sign-in — to the new device. The recommended method is Duo Restore, which backs up your accounts to your cloud account (iCloud or Google) and restores them on the new phone. Full Duo reference: Duo Restore guide.

Do this before you wipe, trade in, or return your old phone. Duo Restore relies on a backup created on the old device. Once you restore or reactivate your CRL (Duo-protected) account on the new phone, it is automatically deactivated on the old phone — so finish the move in one sitting.

Step 1 — Turn on Duo Restore (on your OLD phone)

Make sure you’re running the latest Duo Mobile app, then enable backup for your platform:

iPhone (iOS)

Backup is automatic as long as iCloud Backup and iCloud Keychain are turned on (Settings > your name > iCloud). Nightly iCloud backups then include your Duo Restore data — there’s no toggle inside Duo Mobile for this.

Android

1. Open your device Settings > Google > Backup, and make sure backup (including Other device data) is on. Your phone needs a PIN, pattern, or password lock.
2. Open Duo Mobile > Settings > Duo Instant Restore to confirm backup is active.

Step 2 — Restore on your NEW phone

First install Duo Mobile — be sure it’s the app published by Duo Security LLC:

iPhone — App Store  •  Android — Google Play

iPhone (iOS)

1. Set up the new iPhone and restore it from your iCloud backup (with iCloud Keychain enabled).
2. Open Duo Mobile and tap Continue on the welcome screen. Your Duo-protected accounts are located and restored automatically.
3. Duo sends a “new device” push to your old phone. Since you initiated the move, tap Yes to confirm — this deactivates the account on the old phone. (If you did not initiate it, tap No, which alerts IT to possible fraud.)

Android

1. During new-device setup, sign in to your Google account and choose to restore your previous backup.
2. Install and open Duo Mobile — it locates your backup and restores your accounts.
3. If it doesn’t restore automatically, tap I have existing accounts, select your Google account, then follow the prompt to scan a QR code displayed in Duo Mobile on your old phone (Settings > Connect a new phone > View QR code).

Step 3 — Re-do Windows Offline login (CRL PC users)

Duo Restore does not carry over Windows Offline access. If you use a CRL-H PC or laptop, you must set up Windows Offline login again on your new phone. If a restored Windows Offline token appears in Duo Mobile after the migration, delete it first, then reactivate.

Follow Step 3 (Windows Offline setup) in the DUO Mobile Setup for CRL-H Login article to create a fresh offline token. Duo’s reference: Microsoft Windows Logon — offline access.

Don’t have your old phone?

If your old phone is lost, damaged, or already wiped — or Duo Restore isn’t available — your CRL account must be reactivated rather than restored. If self-service is enabled, use My Settings & Devices from the Duo prompt. Otherwise, submit a request to the CRL IT team and we’ll reactivate it for you.

Third-party accounts (Google, Microsoft personal, etc.)

Personal (non-CRL) accounts you’ve added to Duo Mobile only transfer if you set a recovery password before backing up. Without it, you’ll re-add each one through that service’s own 2FA setup. See Third-Party Accounts.

Need help?

If anything doesn’t transfer or you can’t sign in, submit a request to the CRL IT team.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Accessing Your CRL Email (Outlook)

Your CRL email (Outlook 365) can be reached in three ways — the Outlook desktop app on your CRL PC, Outlook on the web from any browser, or the Outlook mobile app. Use whichever fits how you’re working.

Option 1 — Outlook desktop app (CRL PC)

Use the Microsoft Outlook app installed on your CRL-issued device. On a CRL PC, Outlook configures itself the first time you open it while connected to the CRL domain — there’s no manual setup to do.

Option 2 — Outlook on the web

Reach your mailbox from any device with a web browser, using your CRL-H sign-in credentials.

1. Open the Microsoft Edge web browser.
   
2. Go to https://outlook.office365.us/ and sign in.

Use the GCC High address, not office.com. CRL mailboxes live in the GCC High cloud, so Outlook on the web is at outlook.office365.us. The commercial office.com site won’t sign in to your CRL account.

Option 3 — Outlook mobile app

Install the Microsoft Outlook app from the Apple App Store or Google Play. Setting up work email on a mobile device goes through Company Portal — follow the guide for your platform:

• CRL-H — Accessing Company Resources on an iOS Device
• CRL-H — Accessing Company Resources on an Android Device

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Set Up Automatic Replies (Out of Office)

Automatic replies — also called an “out of office” or OOO message — send a reply on your behalf while you’re away, so people know when to expect a response. Set it once and it turns itself off on the date you choose. This takes about 5 minutes.

Good to know: you can write two different messages — one for people inside CRL and, optionally, a separate one for people outside the company. Setting a start and end time is the easy way to make sure the message stops on its own when you’re back.

Option A — New Outlook for Windows

This is the Outlook app on your CRL computer. If you see a New Outlook toggle in the top-right corner, leave it on.

Click the View tab, then View settings.

Go to Accounts → Automatic Replies.

Turn on the Automatic replies toggle.

Tick Send replies only during a time period, then set your start and end dates and times. (Skip this if you’d rather turn it off manually later.)

Under Send replies inside your organization, type the message CRL coworkers will see.

To reply to outside senders too, tick Send replies outside your organization and type a separate message. Choose whether it goes to anyone who emails you or only to people already in your Contacts.

Click Save.

Option B — Outlook on the web

Use this from any browser — handy when you’re away from your CRL computer.

Sign in at https://outlook.office365.us/. This is CRL’s GCC High webmail address. Don’t use outlook.office.com — your CRL account won’t sign in there.

Click the Settings gear in the top-right corner.

Go to Accounts → Automatic replies.

Turn on Automatic replies, set the time period and messages exactly as in Option A, and click Save.

On your phone

In the Outlook mobile app, tap your profile picture (top-left) → Settings (gear) → tap your CRL account → Automatic Replies. The options match the steps above.

Turning it off

If you set a time period, the reply stops automatically at your end time — nothing more to do. To end it early, return to the same screen and switch the Automatic replies toggle off.

Tip: keep the message short and factual — the dates you’re out, when you’ll reply, and who to contact for anything urgent. There’s no need to include personal details about where you’re going.

Next steps

For more on your CRL mailbox, see the CRL Email Accounts chapter of this knowledge base.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Recover a Deleted Email

Deleted an email you needed? In most cases you can get it back yourself in a couple of minutes. There are two places to look, in order: your Deleted Items folder first, then the hidden Recoverable Items area if it’s no longer in Deleted Items.

Act promptly. Recoverable items are kept for a limited time before they’re purged for good. If a message is important and you can’t find it with the steps below, submit a helpdesk request right away — the sooner IT looks, the more likely it can be recovered.

Step 1 — Check the Deleted Items folder

In Outlook (desktop or web at https://outlook.office365.us/), click Deleted Items in the folder list on the left.

Find the message. To put it back, right-click it and choose Move → Inbox (or drag it into any folder you like).

Step 2 — Recover items deleted from this folder

If it’s not in Deleted Items — for example, you emptied the folder or pressed Shift + Delete — look in Recoverable Items:

Select the Deleted Items folder, then click Recover items deleted from this folder at the top of the message list.

Hover over a message and tick the box next to it (select as many as you need).

Click Restore. Recovered messages return to the Deleted Items folder — move them to your Inbox from there.

Tip: the list can be long. Click the date or subject column heading to sort, which makes a specific message much easier to spot.

Still can’t find it?

If the message isn’t in either place, it may have aged out of the recovery window. Submit a helpdesk request with the sender, rough date, and subject if you remember them — the more detail, the better the chance of recovery.

Next steps

For more on your CRL mailbox, see the CRL Email Accounts chapter of this knowledge base.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Accessing Company Resources on an iOS Device

Enrolling your iOS device in Company Portal lets you access CRL resources — including email — on your iPhone or iPad. Complete the prerequisite below first, then follow the enrollment steps.

Prerequisites

Before enrolling, complete the first-time user login process: CRL-H — First-Time Sign-In & Two-Factor Setup.

iOS enrollment process

To set up your iOS device to access company resources, including email, follow Microsoft’s step-by-step guide:

• Set up your personal iOS device for work (Microsoft Learn)
• Prefer to watch? Company Portal iOS enrollment video

Already have Company Portal installed?

Make sure you’re on the latest version: How to update the Company Portal app (Microsoft Learn). You can also update it directly from the Apple App Store.

Need help? Contact the CRL IT Team if you run into any installation or enrollment issues.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Accessing Company Resources on an Android Device

Enrolling your Android device in Company Portal lets you access CRL resources — including email — on your phone or tablet. Enrollment creates a separate work profile that keeps your personal apps and data apart from work data. Complete the prerequisite below first, then follow the enrollment steps.

Prerequisites

If you haven’t already, complete the first-time user login process: CRL-H — First-Time Sign-In & Two-Factor Setup.

Android enrollment process

To set up your Android device to access company resources, including email, follow Microsoft’s step-by-step guide:

• Enroll your device and create an Android work profile (Microsoft Learn)
• Prefer to watch? Company Portal Android work profile enrollment video

Already have Company Portal installed?

Make sure you’re on the latest version: How to update the Company Portal app (Microsoft Learn). You can also update it directly from the Google Play Store.

Need help? Contact the CRL IT Team if you run into any installation or enrollment issues.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

OneDrive — Your Personal File Storage

Your personal files live in Microsoft OneDrive — a secure cloud storage space provided to individually licensed CRL users. OneDrive lets you store and back up your files, share and collaborate on documents, and sync files to your CRL computer so they’re available on the web and offline.

Most of your files sync to OneDrive automatically, including files on your Desktop and in your Documents and Pictures folders. It’s also the default save location for your Office apps, including:

• Word
• Excel
• PowerPoint
• Project
• Visio

Opening OneDrive

Open File Explorer from the taskbar icon on your desktop:

— or type “OneDrive” in the search bar:

Once open, select OneDrive in the left pane:

Using OneDrive

Use OneDrive just like any other folder — open, save, move, and organize files as usual. Changes sync to the cloud automatically.

Note — .zip files

The OneDrive web interface cannot unzip .zip files. To open a zipped file, use the OneDrive desktop app: in your synced OneDrive folder, right-click the .zip file, choose Extract All, and the contents will be unzipped on your computer.

Learn more

For Microsoft’s full OneDrive help and training, see OneDrive help & learning (Microsoft Support).

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Configuring the OneDrive Desktop App

This checklist configures the OneDrive desktop app on your CRL PC with the settings CRL recommends — so your files sync reliably and your Desktop, Documents, and Pictures folders are backed up to the cloud.

Company-controlled setting: To protect company data, CRL IT automatically enforces OneDrive folder backup and syncing through device policy. This is a company-controlled setting and can’t be turned off or overridden. The steps below let you confirm your configuration — if anything doesn’t match, contact the CRL IT Team.

Step 1 — Open OneDrive

Open the OneDrive app using its cloud icon in the taskbar:

Step 2 — Open Settings

Confirm OneDrive is connected to the CRL Technologies Inc tenant, then click the Settings (gear) icon:

Step 3 — Sync & backup preferences

On the Sync and backup page, set the following:

• Start OneDrive when I sign in to Windows — ON
• Pause syncing when this device is in battery saver mode — OFF
• Pause syncing when this device is on a metered network — OFF

Step 4 — Advanced settings

Click Advanced settings, then set:

• File collaboration — ON
  • Open the drop-down and set “Ask before keeping both copies of a file that has a conflict” — ON
• Files On-Demand — OFF
• Limit download rate — OFF
• Limit upload rate — OFF

Why Files On-Demand is OFF: with it off, your synced files are kept fully downloaded on the PC, so they’re available even when you’re offline.

Step 5 — Manage backup

Click the Manage backup button at the top of the Sync and backup window:

Select these folders to back up:

• Desktop
• Documents
• Pictures

Then click Start backup:

The selected folders are now backing up to OneDrive. Let the CRL IT Team know if you encounter any issues.

Learn more

Microsoft’s OneDrive help and training: OneDrive help & learning (Microsoft Support).

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Send a Large File

If an attachment is too big, your email will bounce back or refuse to send. The fix is to put the file in OneDrive and email a link to it instead. The recipient clicks the link to open or download the file, and it doesn’t count against the email size limit.

Why a link works better: plain email attachments are capped at roughly 20–25 MB. A OneDrive link has no practical size limit for everyday files, and everyone always opens the same, current version.

Option A — Let Outlook do it while composing

Start your email. On the ribbon, click Attach File and pick the file from Browse this PC.

If the file is large, Outlook offers to upload it to OneDrive — accept, and the attachment becomes a link automatically.

Already attached as a copy? Click the down-arrow on the attachment and choose Upload to OneDrive — it converts to a link. Use the same down-arrow to set whether recipients can edit or view only.

Option B — Share a link from OneDrive

Save the file to your OneDrive (in File Explorer, that’s the blue-cloud OneDrive - CRL Technologies folder).

Right-click the file and choose OneDrive → Copy link (or Share, then Copy link). Set can edit or can view as needed.

Paste the link (Ctrl + V) into your email and send.

Sending to someone outside CRL

A OneDrive link only works for people inside the CRL tenant. Anyone outside CRL — a customer, partner, or subcontractor — will not be able to open a link to your internal files. Don’t use OneDrive links to send files outside the company.

Compliance note. To send files to anyone outside CRL, use DoD SAFE, or check with your PM or supervisor for the authorized file-sharing method — especially for CUI or other controlled information. Never move CRL files to a personal OneDrive, Google Drive, Dropbox, or other consumer file-sharing site.

Next steps

New to OneDrive? See the CRL Account OneDrive chapter of this knowledge base for setup and an overview.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Getting Started with Microsoft Teams

Microsoft Teams is CRL’s hub for messaging and online meetings. This guide gets you signed in, oriented, and comfortable with the two things you’ll use most on day one: chat and meetings. It takes about 10 minutes to read through.

Before you begin: finish your first-time sign-in and 2FA setup first — Teams uses the same CRL account and DUO approval as the rest of Microsoft 365. If you haven’t done that yet, start there and come back.

Step 1 — Open Teams

On your CRL computer, Teams is already installed and kept up to date for you. Click Start, type Teams, and open Microsoft Teams. Pin it to your taskbar so it’s one click away.

Only the “new Teams” client is supported. The older “classic” Teams reached end of support and no longer works — if you still see two Teams icons, use the one simply named Microsoft Teams and let IT know so the old one can be removed.

Prefer the browser, or on a device without the app? Go to https://gov.teams.microsoft.us/ — this is CRL’s GCC High web address for Teams. Don’t use teams.microsoft.com; CRL accounts live in the GCC High cloud and won’t sign in there.

Step 2 — Sign in

Enter your CRL email address, then your password. Approve the DUO push on your phone (or enter a passcode from your THALES token) exactly as you do for Outlook and the Microsoft 365 portal. When asked whether to stay signed in, click Yes on your CRL device.

Step 3 — Find your way around

The app bar runs down the left side of the window. The four you’ll use most:

Activity

Your notification feed — @mentions, replies, and missed calls all collect here. Check it first thing to see what needs your attention.

Chat

One-on-one and group conversations. Best for quick, informal back-and-forth that doesn’t need to live in a shared team.

Teams & channels

A team is a shared workspace for a group or project; each team is divided into channels by topic. Conversations here are visible to everyone on the team, so this is where project discussion and files belong. You’ll be added to the teams you need.

Calendar

The same meetings you see in Outlook. Join, schedule, and start meetings from here.

Step 4 — Send a chat

Click Chat, then the New chat (pencil) icon. Start typing a coworker’s name and pick them from the list, type your message, and press Enter to send. Add more than one name to start a group chat.

Use the icons under the message box to attach a file, add an emoji, or start a call with the person you’re chatting with. Press Shift + Enter for a new line without sending.

Step 5 — Join and run a meeting

To join: open Calendar, find the meeting, and click Join. (You can also click Join in the Outlook invitation.) On the pre-join screen, set your camera and microphone, then click Join now.

To start one now: in Calendar, click Meet now. To schedule ahead, click New meeting, add people and a time, and send — it lands on their Teams and Outlook calendars.

During a meeting, the toolbar lets you mute/unmute, turn your camera on or off, Share your screen, open Chat, see People, and Raise hand. Click Leave to exit.

Tip: a headset gives noticeably clearer audio than your laptop’s built-in mic and speakers, and prevents echo for everyone else on the call.

Teams calls vs. your desk phone

Teams can place audio and video calls to other CRL people over the internet — handy for a quick voice chat with someone you’re already messaging. That’s different from your business phone line.

For regular phone calls, use Zultys ZAC — that’s CRL’s phone system for calling outside numbers, your extension, voicemail, and conference calls. Teams is not connected to the phone network, so use it for internal chat, meetings, and quick person-to-person calls only. See the Zultys ZAC articles in this knowledge base to get set up.

Working with people outside CRL

Because CRL runs in the GCC High government cloud, collaborating with people outside the company works differently than it does on personal or commercial accounts, and some of it is intentionally restricted.

Compliance note — external collaboration is limited by design. Casual chats and meetings with people on personal or commercial (non-government) Teams accounts are not available in GCC High. External access is only possible with organizations IT has specifically approved. Do not attempt to route CRL data through a personal Teams account or an outside file-sharing tool. If you need to chat, meet, or share files with a customer, partner, or subcontractor, contact IT first so access can be set up the compliant way — and never place CUI or other controlled information in a chat, channel, or meeting unless that space has been approved for it.

Next steps

For a broader tour of your CRL Microsoft 365 tools, see the CRL Account Training Guide. For phone setup, see the Zultys ZAC articles in this knowledge base.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Zultys ZAC — Login & Setup

Summary: Use Zultys Advanced Communicator (ZAC) to place and receive work calls from your CRL PC (softphone) while keeping your personal number private.

What is ZAC?

Zultys Advanced Communicator (ZAC) lets you use your CRL work number on your computer, and optionally your mobile device.

• Single Number Reach (SNR): one work number across devices.
• Consistent Caller ID: calls show your CRL identity regardless of device.
• Voicemail to Email: voicemails are delivered to your CRL mailbox.

Before you start

You’ll need:

• A CRL-issued Windows PC with ZAC installed (or a smartphone with the ZAC app installed).
• Your CRL username — the part before @ in your email, all lowercase.
• Your ZAC/voice password (provided by IT).
• A working headset or speakers and microphone.

Sign in on your CRL PC (softphone)

1. Open ZAC from the Windows Start menu. If it’s not installed, open a HelpSpot ticket.
2. At the login screen, enter:
   • Login: your CRL username (lowercase)
   • Password: your ZAC/voice password (provided by IT)
   • Host: mxe.crltechnologies.com
   • Use Windows Credentials: leave off
   • Remember password: optional, on trusted CRL devices only
3. Click Login.

First-time prompts: Role & Location

On first sign-in you may be prompted to choose:

• Role Selection: if you don’t see this, no role is assigned (default). If you do, follow guidance from your manager.
• Location: choose your CRL office or the site you’re working from. If none apply, select Unknown.
• Apply to future login: toggle on to save your choices. Leave off if you regularly switch sites.

You can change these later in Settings.

First-time voicemail setup (recorded name)

You only need to record your name — keep the default greeting.

1. In ZAC, open Voicemail from the left panel, then click Greetings. The Voicemail Settings dialog opens.

2. Under Recorded Name, click the microphone icon to start recording.

3. Say your name loudly and clearly.

4. Click the Stop icon.

5. Your recorded name is saved.

6. Click OK to close the window and save your settings.

Bind to Softphone (use your PC for calls)

1. In the lower-left of the ZAC window, click Bind to….
2. Choose Bind softphone. The footer should show Softphone once bound.

Note: Binding connects ZAC to a calling device (your PC softphone or a physical desk phone). This article covers softphone binding.

Post-setup checks (recommended)

• Outbound test: call IT at ext. 2204 or a teammate. Confirm your mic and speakers work.
• Inbound test: have someone call your extension. Verify ZAC rings and you can answer.
• Voicemail test: leave yourself a voicemail. Confirm it arrives in your CRL email within a few minutes.

Troubleshooting

Can’t sign in

• Confirm your username is all lowercase.
• Verify Host is mxe.crltechnologies.com.
• Re-enter the ZAC/voice password (check for typos).
• Still stuck? Open a HelpSpot ticket with IT.

No audio / can’t hear caller

• Check Windows sound settings and that your headset is the default device.
• Ensure ZAC is Bound to Softphone (see the footer).
• Try unplugging/replugging the headset, or select the device in ZAC audio settings.

Voicemail not in email

• Wait a few minutes and check your Junk Email.
• If still missing, open a HelpSpot ticket with IT.

Support

If you need ZAC installed, password assistance, or run into errors, open a HelpSpot ticket and include:

• Your full name and CRL username
• Device name/asset tag (if known)
• A brief description of the issue and any error text
• Whether you’re on-site or remote, and a callback number

Video walkthrough: How to use ZAC (YouTube).

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Using Mobile ZAC on iPhone

Mobile ZAC is the Zultys app that puts your CRL work number on your iPhone — place and receive work calls, check voicemail, chat, and join conferences, all while keeping your personal number private.

Mobile ZAC replaces the older apps. If you have the old green Zultys Mobile Communicator or the MX Mobile app installed, uninstall it — both are being retired and MX Mobile is no longer supported. Install Mobile ZAC and sign in as shown below.

Step 1 — Install Mobile ZAC

1. Open the App Store on your iPhone and search for Mobile ZAC (published by Zultys), or use this link: Mobile ZAC on the App Store.
2. Download and install it like any other app.

Step 2 — Sign in

1. Open Mobile ZAC. When prompted to send notifications, tap Allow — this is required for call, message, and voicemail alerts.
2. Enter your sign-in details:
   • Login / Username: your CRL username, all lowercase
   • Password: your ZAC/voice password (provided by IT)
   • Host / Server: mxe.crltechnologies.com
3. Tap Login.

Two things to get right: your username must be all lowercase, and the server (FQDN) is mxe.crltechnologies.com. Most sign-in problems come down to one of these two.

Step 3 — What you can do

Mobile ZAC has feature parity with the desktop app. From your iPhone you can:

• Make and take work calls over Wi-Fi/data or your mobile carrier network — your CRL number shows as the caller ID, and your personal number stays private.
• Move a call between devices — push or pull an active call between your iPhone, desk phone, and PC softphone without the caller noticing.
• Check voicemail with the visual voicemail list (voicemails also arrive in your CRL email).
• Message and chat — instant messages, SMS/MMS, file and image sharing.
• Use the company directory with presence and notes.
• Start or join conferences, including ad-hoc and scheduled calls, plus call controls like hold, park, and transfer.

Need help?

If you need help installing the app, resetting your ZAC/voice password, or you hit an error, open a HelpSpot ticket with the IT Team.

Zultys also has a short walkthrough: Mobile ZAC video tutorials.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Using Mobile ZAC on Android

Mobile ZAC is the Zultys app that puts your CRL work number on your Android phone — place and receive work calls, check voicemail, chat, and join conferences, all while keeping your personal number private.

Mobile ZAC replaces the older apps. If you have the old Zultys Mobile app or the MX Mobile app installed, uninstall it — both are being retired and MX Mobile is no longer supported. Install Mobile ZAC and sign in as shown below.

Step 1 — Install Mobile ZAC

1. Open the Google Play Store on your Android device and search for Mobile ZAC (published by Zultys), or use this link: Mobile ZAC on Google Play.
2. Tap Install, then open the app.

Step 2 — Allow permissions

On first launch, Android will ask for a few permissions. Approve them so calls and alerts work correctly:

• Notifications — required for call, message, and voicemail alerts.
• Microphone — required to speak and be heard on calls.
• Phone / Contacts (if prompted) — allows call handling and directory features.

Step 3 — Sign in

1. In Mobile ZAC, enter your sign-in details:
   • Login / Username: your CRL username, all lowercase
   • Password: your ZAC/voice password (provided by IT)
   • Host / Server: mxe.crltechnologies.com
2. Tap Login.

Two things to get right: your username must be all lowercase, and the server (FQDN) is mxe.crltechnologies.com. Most sign-in problems come down to one of these two.

Step 4 — What you can do

Mobile ZAC has feature parity with the desktop app. From your Android phone you can:

• Make and take work calls over Wi-Fi/data or your mobile carrier network — your CRL number shows as the caller ID, and your personal number stays private.
• Move a call between devices — push or pull an active call between your phone, desk phone, and PC softphone without the caller noticing.
• Check voicemail with the visual voicemail list (voicemails also arrive in your CRL email).
• Message and chat — instant messages, SMS/MMS, file and image sharing.
• Use the company directory with presence and notes.
• Start or join conferences, including ad-hoc and scheduled calls, plus call controls like hold, park, and transfer.

Need help?

If you need help installing the app, resetting your ZAC/voice password, or you hit an error, open a HelpSpot ticket with the IT Team.

Zultys also has a short walkthrough: Mobile ZAC video tutorials.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Conference Calls Using ZAC

Use Zultys Advanced Communicator (ZAC) to schedule and host conference calls from your CRL PC. If you don’t have ZAC installed, request it from the IT Team through HelpSpot.

Open and sign in to ZAC

Open the ZAC app on your CRL PC:

Sign in with your CRL login credentials:

• Username must be all lowercase.
• Ensure Use Windows Credentials is unchecked (slider to the left).

Host tip: If you’re the host and may need to leave the conference before it ends, uncheck “End call on host leave” (shown above). This is common for schedulers who start meetings and then leave to handle other duties or start additional meetings.

Create a conference

1. Click the Conference icon.
2. Click Schedule.
3. Enter the conference name, frequency (type), date, time, and duration.
   • Leave Web Collaboration set to NONE.
   • Duration is for scheduling purposes only — the call will not end after the selected number of minutes.
4. Set the End call on host leave option as appropriate (see the host tip above).
5. Click Save and Invite. An email template (“Meeting Maker”) with the conference details opens — add recipients and send it.
6. Or click Save to create the conference without sending invites.

Example of the Outlook calendar invite:

Start the conference

1. Click the conference you want to start.
2. Click the start icon:
3. The audio connects.
4. Music plays if only one participant is in the meeting.

Manage participants

As the conference owner, once the conference has started you can mute or disconnect participants. Click the icon to display the Participants menu, then click Participants:

Once a conference is created, you can start, edit, invite users to, or delete it.

NAVAIR support

To set up a recurring conference, eligible users must contact the NAVAIR National Help Desk. The help desk schedules the conference and then sends the Meeting Maker, including a dial-in number and conference ID.

NAVAIR National Help Desk
Phone: 301-342-3104  or  1-888-292-5919
Email: nav_helpdesk.fct@navy.mil

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

CRL Software Policy

Policy

The CRL IT Team tracks, reviews, approves or disapproves, and logs changes to all organizational systems.

• Only CRL Systems Administrators (SAs) and CRL privileged users (PUs) may install or remove software on CRL Information Systems (IS). Non-baseline software must be approved by the IT Team before installation.
• All requested changes are presented for review, security impact analysis, discussion (if required), and approval.
• All emergency changes are presented for review, security impact analysis, discussion, and approval as outlined in the applicable process — unless time constraints require the change to be made first, in which case it must be submitted to the appropriate reviewer(s) after the fact.

Software baseline

The software approved for use on CRL Information Systems is listed here:

Approved Software List

How to request new software

If you need software that isn’t on the Approved Software List, request it as follows:

1. Submit a ticket in CRL HelpSpot: Submit a Request for Assistance.
2. Under “How would you categorize this request,” choose option number 4.
3. Fill out all pertinent fields.
   • The more detail you provide, the better the IT Team can assess the requirement — please be as detailed as you can.
4. Stand by for updates. Testing and approval time varies based on several factors:
   • Software compatibility with CRL systems
   • Software expense and funding decisions
   • Software security and vulnerability research
   • Software version control and patching considerations

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Admin Access & Installing Software on Your CRL Computer

On CRL computers, your everyday account runs as a standard user — it doesn’t carry full-time (“standing”) local administrator rights. When you need to do something that requires admin, such as installing approved software, you request a quick, one-time elevation. This article explains how that works.

How to install software or run something that needs admin

1. Find the installer or app you need to run.
2. Right-click it and choose “Run with elevated access.”
3. Enter a short business justification (for example, “Installing X to do Y”).
4. Complete the quick verification prompt.

That sends a request to IT. It won’t run right away — once we approve it, you’ll get a notification on your device and can go ahead.

What to expect

• Everyday work: no admin needed — you work normally.
• Installs and admin tasks: a quick approval step instead of instant admin — usually fast during business hours.
• Every elevation is logged. That’s normal and expected — it’s part of keeping our systems and data secure.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Home & Office Printer Setup

Printers at the CRL office are mapped by default. If you’d like to add another printer or set up a home printer, follow the steps below. For a wireless printer, see Wireless printer setup further down.

Wired / USB printer setup

1. At home: connect the printer to your computer with the USB cable and turn it on. If you’re at the CRL office, skip to step 2.
2. Open Printers & scanners from the Start menu (type “Printers” in the search bar and select the best match).
   
   
3. Next to Add a printer or scanner, click Add device.
4. Set the “Show printers and scanners associated with my” dropdown to Work or school.
   
   
5. Wait for the list to populate, find the printer you want, and click Add device next to it. Follow any on-screen prompts to finish.

Having trouble? Note your device’s make and model. The IT Team may be able to download the drivers and installation tools for your printer and assist with installation. This requires IT Manager approval and may involve some additional steps.

Wireless printer setup

Steps vary by manufacturer, but most modern printers detect your network and largely automate the setup.

1. Use the printer’s LCD panel to enter the wireless setup.
2. Select your Wi-Fi network. You’ll need your home network’s SSID (network name), which you can see by hovering over the Wi-Fi icon in the taskbar.
3. Enter your network password.

In some cases you may need to temporarily connect the printer to your computer by USB to install its software. Otherwise, that’s it — the printer should appear automatically under Printers & scanners in Settings.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Pairing a Bluetooth Device

Follow these steps to pair a Bluetooth device — such as a headset, mouse, keyboard, or speaker — with your CRL computer.

Pair a device

1. Type “Bluetooth” in the search bar at the lower-left of your desktop and press Enter to open Bluetooth settings.
   
2. Make sure Bluetooth is turned On.
3. Put your device into pairing mode — this is usually a button you press and hold until a light blinks. Check the manufacturer’s instructions if you’re not sure.
4. Click Add Bluetooth or other device, then choose Bluetooth.
5. Select your device from the list when it appears, and follow any on-screen prompts (some devices show a PIN to confirm). When it reads Connected, you’re done.

Device not showing up? Confirm it’s charged, in pairing mode, and close to your PC. If it was previously paired to a phone or another computer, disconnect it there first — many devices only pair with one host at a time.

No Bluetooth option at all? Bluetooth may be turned off in hardware or restricted by CRL security policy on some devices. Contact the IT Helpdesk if you need it enabled for an approved device.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Exporting Your Edge Favorites

Exporting your Edge favorites creates a single HTML file containing all your bookmarks. You can keep it as a backup or import it into the same or a different browser — handy before a PC refresh or when moving to a new computer.

Tip: Save the exported file to your Desktop and give it a name you’ll recognize (for example, edge-favorites-2026-07-17). Even better, save it to OneDrive — that way the file is backed up and available on any device, so you can import your favorites on a new computer without moving the file around.

Export Edge favorites to an HTML file

1. Open Microsoft Edge.
2. Click the Favorites (star) button on the toolbar, or press Ctrl + Shift + O.
3. In the Favorites pane, click the More options (three-dot) button.
4. Select Export favorites.
5. Choose a folder (your Desktop) and enter a descriptive file name.
6. Click Save.

Edge saves an HTML file (named something like favorites_MM_DD_YY.html) that you can back up or import elsewhere.

Prefer the address bar? Type edge://favorites and press Enter, click the More options (three-dot) button at the top right, and choose Export favorites.

Note: Exporting must be done in desktop Edge. The Edge mobile app (iPhone/iPad/Android) does not have an Export favorites button.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Exporting Your Chrome Bookmarks

Take your Chrome bookmarks with you by exporting them to a single HTML file. You can keep it as a backup or import it into the same or a different browser — handy before a PC refresh or when moving to a new computer.

Tip: Save the exported file to your Desktop and give it a name you’ll recognize (for example, chrome-bookmarks-2026-07-17). Even better, save it to OneDrive — that way the file is backed up and available on any device, so you can import your bookmarks on a new computer without moving the file around.

Export Chrome bookmarks to an HTML file

1. On your computer, open Chrome.
2. At the top right, click More (three-dot button), then select Bookmarks and lists > Bookmark Manager. (Or press Ctrl + Shift + O to open the Bookmark Manager directly.)
3. In the Bookmark Manager, click the More (three-dot) button at the top right.
4. Select Export bookmarks.
5. Choose a folder (your Desktop or OneDrive) and enter a descriptive file name.
6. Click Save.

Chrome exports your bookmarks as an HTML file that you can back up or import into another browser.

Note: Exporting must be done in desktop Chrome. The Chrome mobile app (iPhone/iPad/Android) does not have an Export bookmarks option.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Clearing Cache & Cookies in Microsoft Edge

Clearing your browser’s cache and cookies often fixes pages that won’t load correctly, out-of-date content, or sign-in problems. Here’s how to do it in Microsoft Edge.

Shortcut: Press Ctrl + Shift + Delete in Edge to open the Clear browsing data dialog directly (steps 1–2 below).

Clear cache and cookies

1. Open Microsoft Edge and select Settings and more (the … menu, top right) > Settings > Privacy, search, and services.
2. Under Clear browsing data, select Choose what to clear.
3. Under Time range, choose a range (for example, All time).
4. Check Cookies and other site data and Cached images and files.
5. Select Clear now.

Heads up: Clearing cookies signs you out of most websites, so you’ll need to sign back in. It does not affect your saved favorites or passwords.

Delete cookies from one specific site

1. Select Settings and more (…) > Settings > Cookies and site permissions > Manage and delete cookies and site data.
2. Select See all cookies and site data.
3. Search for the site whose cookies you want to remove, then delete them.

Clear cookies automatically when you close Edge

1. Select Settings and more (…) > Settings > Privacy, search, and services.
2. Under Clear browsing data, select Choose what to clear every time you close the browser.
3. Turn on the Cookies and other site data toggle (and any other data you want cleared on close).

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Updating DoD Certificates Using InstallRoot

This guide walks you through updating Department of Defense (DoD) certificates using InstallRoot, the tool the Defense Information Systems Agency (DISA) provides to manage DoD PKI certificates on Windows. Keeping these certificates current is what lets your computer trust DoD (.mil) websites and CAC-enabled resources without certificate errors.

Source of truth: InstallRoot and the DoD certificate bundles are published on the DoD Cyber Exchange — PKI/PKE Tools & Configuration Files page. Always download from there (or a link the IT Team provides) — never from a third-party site.

1. Download and install InstallRoot

• Go to the DoD Cyber Exchange PKI/PKE Tools & Configuration Files page and download the latest InstallRoot (currently version 5.6) for NIPR. Choose the Administrator installer if you have admin rights, or the Non-Administrator installer if you don’t.
• Run the downloaded installer.
• Follow the on-screen prompts. Installing the Administrator version requires admin rights — if you don’t have them, use the Non-Administrator installer or request an elevation.

2. Launch InstallRoot

• Open InstallRoot from the Start menu or its desktop shortcut.
• If prompted to allow the app to make changes, click Yes (or enter admin credentials) to continue.

3. Select certificate stores

InstallRoot shows tabs for the different certificate stores it can manage:

• Microsoft Store — for DoD certificates used by Windows and Edge/Chrome.
• Firefox Store — for the Firefox browser.
• Java Store — for applications that rely on Java. Java is not commonly installed on CRL endpoints, so this applies on a case-by-case basis — only if a specific application you use requires it.

Select the store(s) you need. For most CRL users the Microsoft Store is sufficient; add Firefox or Java only if you use them.

4. Install / update the certificates

• Click Install Certificates. InstallRoot installs the current DoD root and intermediate certificates into the selected store(s).
• Updating overwrites outdated certificates and adds any new ones, so this both installs and refreshes in one step.

5. Verify the installation

• On the Microsoft Store tab, scroll the list of installed certificates.
• Confirm the current DoD roots are present and valid — today those are DoD Root CA 3, DoD Root CA 5, and DoD Root CA 6. (Older roots such as CA 2 and CA 4 have been retired.)

Don’t worry about tracking individual CA numbers — InstallRoot always installs the full current set. The names above are just what you should expect to see.

6. Close InstallRoot

Once you’ve verified the certificates, close InstallRoot.

7. Test (optional)

• Visit a DoD site such as https://www.dmdc.osd.mil.
• Confirm the page loads with no certificate-trust errors.

If you still experience problems, let the CRL IT Team know by submitting a request for assistance: Submit a Request for Assistance.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Using Internet Explorer (IE) Mode in Microsoft Edge

Some older websites — including certain legacy government (.mil/.gov) applications — only work correctly in Internet Explorer. Microsoft Edge includes Internet Explorer (IE) mode to render those sites. Follow the steps below to turn it on and reload a page in IE mode.

Step 1 — Turn on IE mode

1. In Edge, click the Settings and more (…) button at the top right and select Settings. (Or type edge://settings/defaultBrowser in the address bar and press Enter.)
2. Select Default browser in the left pane.
3. Under Internet Explorer compatibility, set Allow sites to be reloaded in Internet Explorer mode to Allow.
4. Click Restart to restart Edge and apply the change.

Step 2 — Reload a page in IE mode

1. Navigate to the site you need to view.
2. Click the Settings and more (…) button and select Reload in Internet Explorer mode.
3. You’re in IE mode when the Internet Explorer logo appears to the left of the address bar.

Optional — Always open a site in IE mode

When a page opens in IE mode, a bar appears at the top. Toggle Open this page in Internet Explorer mode next time to On to have Edge remember the choice for that site.

Good to know: This per-site preference expires after 30 days. When it lapses, just turn it on again. To leave IE mode at any time, click Leave in the bar (or Open in Microsoft Edge).

Don’t see the setting, or a site still won’t load in IE mode? It may be controlled by CRL policy, or the site may not be configured for IE mode. Open a HelpSpot ticket and the IT Team can help — include the site’s address.

IE mode in Edge is supported by Microsoft through at least 2029. Reference: Internet Explorer mode in Microsoft Edge (Microsoft Support).

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Password-Protecting a PDF

You can add a password — and optionally encryption — to a PDF using Adobe Acrobat. For any sensitive or controlled document, use the desktop method below.

Using Adobe Acrobat (desktop) — recommended

1. Select All Tools (called Tools in older versions), in the menu at the top of the page.

2. Select Protect from the Tools list.

Alternatively, select Protect from the tools menu on the right side of the page:

3. Select Protect using password (in the toolbar above the document).

4. Fill out the prompt. To encrypt, expand Advanced Options and choose Encrypt with Password.

More detail on the available options: Choosing a security method for PDFs (Adobe).

Using Acrobat Reader (free online tool)

If you only have Acrobat Reader (not the full Acrobat app), Adobe offers a free online tool: Encrypt a PDF with password protection (Adobe Acrobat online).

Adobe states that files are handled on its servers and deleted unless you sign in to save them — but that still means the file leaves your control, which is why it’s off-limits for anything controlled.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Adobe Acrobat — Quick Start Setup

This quick start gets you signed in and using Adobe Acrobat (formerly Acrobat DC) with your CRL license. Be sure to read the important security note at the end before you start working with documents.

1. Open Adobe Acrobat

Double-click the Acrobat icon on your desktop.

2. Sign in with your CRL account

Create/sign in to an account using your CRL Technologies email address, then click Continue.

3. Verify your account

Your account/email can be verified two ways:

• Verification link: an email is sent with a link that verifies your account. You’ll still need to log in with your new Adobe ID to use the software.
• Verification code: you’ll also receive a code by email — enter it on the “Verify your identity” screen.

If successful, Acrobat starts and you can begin using the software.

If you see “account created but no license”

This message means you successfully created an account but haven’t been assigned a license.

If you believe you’ve reached this in error, contact the Helpdesk. The best way is to reply to the Software Request ticket you submitted to have Acrobat assigned to you.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Fixing the “Please wait…” PDF Error

The problem

You try to open a PDF and see this message instead of the document:

“Please wait… If this message is not eventually replaced by the proper contents of the document, your PDF viewer may not be able to display this type of document.”

Why it happens

This appears when a PDF — usually a fillable form, including many government forms — is opened in a web browser’s built-in viewer instead of a dedicated PDF reader. These forms need Adobe Acrobat (or Adobe Acrobat Reader) to display correctly.

The fix

1. Right-click the PDF file and choose Open with > Choose another app.
2. Select Adobe Acrobat (or Adobe Acrobat Reader) from the list, then choose Always to make it the default for .pdf files.

Your PDFs will now open in Adobe Acrobat, and this error won’t come back.

Alternative: you can set the default for all PDFs at once in Settings > Apps > Default apps — search .pdf, click the current default, and choose Adobe Acrobat.

Opened from a website? If the form opened inside your browser, you can also download the PDF first (save it to your computer), then open the saved file — it will launch in Adobe Acrobat.

Still having trouble? Contact the CRL IT Team.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Can’t Sign a PDF in Adobe Acrobat

Some users can’t sign a PDF in Adobe Acrobat, even after signing out and back in. This is usually related to the signing tool, the specific PDF file, or the type of signature being used. Work through the steps below.

1. Open the PDF in Adobe Acrobat (not a browser)

Most signing problems come down to the PDF being open in a browser or another viewer instead of the full Acrobat app.

1. Save the PDF to your Desktop.
2. Right-click the PDF file and select Open with > Adobe Acrobat.
3. With the file open in Acrobat, select All Tools on the left.
4. Choose Fill & Sign (or Request e-signatures, depending on what you’re doing).
5. To add your own signature, select Add Signature and place it on the document.
6. Save the file to your computer, then try signing again.

2. Test with a different PDF

If the signing option is still unavailable, try signing a different PDF. This tells you whether the problem is specific to one file.

3. Capture what you see (for support)

Take a screenshot of what happens when you try to sign, including any error message.

Controlled documents: Use Fill & Sign on the desktop to sign locally. Request e-signatures sends the document through Adobe’s online service, so don’t use it for CRL proprietary, FOUO, CUI, or other controlled material.

If these steps don’t resolve the issue, submit a help desk ticket and include your screenshot and the exact error message text.

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.

Sending a PDF Securely with a Security Envelope

A security envelope lets you encrypt one or more files inside a protected PDF “envelope” so you can email them safely. The recipient needs the password to open the contents. Use Adobe Acrobat on the desktop for the steps below.

Create a security envelope

1. Select All Tools (called Tools in older versions), in the menu at the top of the page.

2. Select Protect from the Tools list.

Alternatively, select Protect from the tools menu on the right side of the page:

3. Expand the Advanced Options drop-down and select Create Security Envelope (in the toolbar above the document).

4. Under Files to Enclose, add the file(s) you want to send, then click Next.

5. Choose an envelope template and click Next (if you’re unsure, just click Next).

6. Choose the delivery method (Send the envelope now).

You may see this pop-up — select Yes and continue:

7. Select a policy from the list (you may need to check Show all policies).
8. Select Encrypt with Password and click Next.
9. Optional: create your own security policy by selecting New Policy.

Optional — create a security policy

If you choose to create a policy:

1. Select the type of security (Use passwords).

2. In General Settings, choose Save these settings as a policy and click Next.

3. Choose the password and encryption options and click Next.

Tip: For controlled or sensitive content, select the strongest option — 256-bit AES encryption.

4. Review the summary and click Finish.
5. Select the policy from the list (again, you may need to check Show all policies).

Send the envelope

1. Prepare the email by clicking Finish.

2. Confirm the Password Security settings and click OK.

3. Select your Send email preference.

More detail on Acrobat security options: Choosing a security method for PDFs (Adobe).

© CRL Technologies, Inc. — Internal IT Knowledge Base. For CRL staff use only.