FAQ and Best Practice Guide for Corporate and Tensor customers - TeamViewer Support
<main> <article class="userContent"> <p><br></p><h2 data-id="general">General</h2><div class="blockquote"><div class="blockquote-content"><p class="blockquote-line"><em>This article applies to all TeamViewer customers with a Corporate and Tensor license who will need multiple users set up and managed into the future as well as mass deployment.</em></p></div></div><p><br></p><h3></h3><h2 data-id="how-to-create-a-master-account">How to create a Master Account?</h2><p>To make sure there is no confusion later, we recommend all devices, groups, and modules must have a single account as their owner.</p><div class="js-embed embedResponsive" data-embedjson="{"body":"In the TeamViewer Management Console, it is possible to create an online company which allows you to use additional features to manage your license, groups, modules, user etc. in an easy and secure environment.","url":"https:\/\/community.teamviewer.com\/English\/kb\/articles\/24321-using-a-master-account-for-the-teamviewer-management-console","embedType":"link","name":"Using a Master Account for the TeamViewer Management Console - TeamViewer Support"}"> <a href="https://community.teamviewer.com/English/kb/articles/24321-using-a-master-account-for-the-teamviewer-management-console" rel="nofollow noreferrer ugc"> https://community.teamviewer.com/English/kb/articles/24321-using-a-master-account-for-the-teamviewer-management-console </a> </div><p>These can be viewed and modified by others with the correct rights, but some things are restricted to the owner such as:</p><ul><li>Deploying New Policies</li><li>Remotely assigning devices</li><li>Fixing some issues</li></ul><p>To ensure that your account stays centralised and as some functions can only be done by the admin, we would recommend that all of your deployment modules and groups be created and kept under a single master.</p><p>Generally, this would be set up with an email like "admin@yourcompany.com" or "support@yourcompany.com"</p><p>Y<strong><em>ou can have a person's account as the administrator. However, this user must make sure that they pass the account to someone else when they leave.</em></strong></p><p><strong><em>Also, note there are some functions that can only be performed by this user.</em></strong></p><p><br></p><h3 data-id="what-about-2-factor-authentication">What about 2 Factor Authentication?</h3><p>If using a centralised account, to keep the account secure and accessible to your admins, we would recommend protecting this account with 2FA (2 Factor Authentication)</p><p><a href="https://login.teamviewer.com/nav/profile/activate-tfa" rel="nofollow noreferrer ugc">More information on this can be found here</a></p><p>When this is set up, you will be given a QR code. This can be kept and used to activate more users at a later date but must be kept absolutely secure.</p><p>Each admin who should have access to the master should have the 2FA code running on their mobile.</p><p><strong>📌Note: </strong>Please also make sure you keep the recovery code is a safe place.</p><h3 data-id="sso-best-practice">SSO - Best Practice</h3><p>If using a centralised account and SSO (Tensor license users only), we would recommend the Admin account be exempt. This also serves to allow SSO to be fixed should something go wrong and your users get locked out.</p><p>See also: <a href="https://community.teamviewer.com/English/kb/articles/30784-single-sign-on-sso" rel="nofollow noreferrer ugc">Single Sign-On (SSO)</a> </p><p><br></p><h3 data-id="-1"></h3><h2 data-id="what-is-the-custom-host-for-deployment">What is the custom Host for deployment?</h2><p>A custom Host module has your settings and requirements pre-configured as well as your own branding for a custom look. See also: <a href="https://community.teamviewer.com/t5/Knowledge-Base/TeamViewer-modules/ta-p/30163#toc-hId-608701059" rel="nofollow noreferrer ugc">All about TeamViewer modules | Customized Host module</a></p><p> The settings of these can also be centralized which is explained in the next section on policies</p><h3 data-id="how-do-i-create-my-custom-host">How do I create my custom Host?</h3><p>A Host module is a version of the software that allows only incoming connections.</p><p>It can be configured with your own settings and be set to automatically add devices into your contacts list.</p><p><a href="https://community.teamviewer.com/t5/Knowledge-Base/TeamViewer-Host-setup/ta-p/3965" rel="nofollow noreferrer ugc">We have a walk through on this here</a></p><div class="embedExternal embedImage display-large float-none"> <div class="embedExternal-content"> <a class="embedImage-link" href="https://us.v-cdn.net/6032394/uploads/Z4JYUDDJCC79/image.png" rel="nofollow noreferrer noopener ugc" target="_blank"> <img class="embedImage-img" src="https://us.v-cdn.net/6032394/uploads/Z4JYUDDJCC79/image.png" alt="image.png" height="614" width="999" loading="lazy" data-display-size="large" data-float="none"></img></a> </div> </div> <p><br></p><p><strong>💡Hint</strong><em>: </em>Custom branding is dynamic. If you deploy the software and then change the branding or color scheme later, the changes will take effect on your endpoints on the next restart of the software.</p><h3 data-id="settings-for-the-host">Settings for the Host</h3><p><strong>User Visible </strong></p><p>The example on the left will be what your user sees. You can change colors, logos, and text here.</p><p><strong>Name </strong></p><p>This is just for your reference. Customers will not see this.</p><p><strong>Automatically add computers to a group in your contacts list </strong></p><p>We would recommend you create a group called "New Devices" or similar. This will be where unsorted devices go and they can be shifted to other groups later. If mass deploying, a different group can be specified on deployment, there is no need to create different modules to have them go into different groups.</p><p><strong>Allow Customer to Initiate a Service Case </strong></p><p>This will place a button on the host allowing users to create a support case within TeamViewer. If you want them to contact another way, unchecked this box. </p><p><a href="https://community.teamviewer.com/t5/Knowledge-Base/Improve-support-in-teams-with-the-Service-Queue/ta-p/3803" rel="nofollow noreferrer ugc">More information on service cases can be found here</a></p><p><strong>Policy </strong></p><p>Policies are covered in the next section. If you have only one policy you would like to set for your company, you can set this here. If you have multiple policies, we would recommend selecting "Inherit from group" and then set the policy on each of your contact groups. Policies will then reflect whatever group you move the device to at any time.</p><p><strong>💡Hint</strong>: Policies are only set when the software is deployed. If you deploy your host and then set a policy under <a href="https://login.teamviewer.com/nav/deploy" rel="nofollow noreferrer ugc">"Design and Deploy"</a> later, this policy will only apply to hosts that were installed after the policy specified</p><p><strong>Allow Account Assignment </strong></p><p>This box will allow assignment via Mass Deployment. This box is only available to Corporate licenses and higher.</p><p><strong>📌Note</strong> that if you click this box, if you download the .exe package from the download link, this will no longer automatically assign or appear in your groups. If you need a host like this, you will have to create a separate module.</p><p><strong>Permanent Link </strong></p><p>The Permanent link is a link you can create that will download your custom module. When installed it will follow the rules and get the logos specified in your host.<em> </em></p><p><strong>📌Note</strong> that this will not occur fully if you selected the "Allow Account Assignment" as mentioned above.</p><p><em> </em><strong>Download MSI </strong></p><p>This is only visible to Corporate users and above. You can download the MSI package here.</p><p>📌 <strong>Note</strong><em>: </em>The package has no customization when download. The instructions must be followed and the package is deployed with a script to get customizations as covered in sections below.</p><p><strong>Configuration ID </strong></p><p>This is used during mass deployment. This code is used to download these settings and customizations from the server and applies them to the MSI package.</p><h2 data-id="using-policies-to-control-teamviewer-settings">Using Policies to control TeamViewer Settings</h2><p>Policies are settings that will be deployed with your custom host. You can select a policy when creating or editing your Host.</p><p>We have a walk through on creating policies as well as all of their functions here:</p><div class="js-embed embedResponsive" data-embedjson="{"body":"Settings policies provide you with the ability to set options for all your installed TeamViewer clients centrally via the TeamViewer Management Console. This way, you can deploy and enforce the same settings to all your clients.","url":"https:\/\/community.teamviewer.com\/English\/kb\/articles\/4860-how-to-add-a-new-settings-policy","embedType":"link","name":"How to add a new settings policy - TeamViewer Support"}"> <a href="https://community.teamviewer.com/English/kb/articles/4860-how-to-add-a-new-settings-policy" rel="nofollow noreferrer ugc"> https://community.teamviewer.com/English/kb/articles/4860-how-to-add-a-new-settings-policy </a> </div><p><br></p><p><strong>📌Note</strong> that passwords cannot be deployed through policies – This can only be set through a reg file covered later in this guide.</p><p><strong>Enforce</strong></p><p>The <strong>Enforce</strong> button stops and users from changing this setting. We would recommend this is checked for all options.</p><p>Settings are based on hierarchy as shown below where 1 will override 2 and so on.</p><ol><li>Enforced Policy</li><li>User set setting</li><li>Policy without enforce</li><li>Default Settings</li></ol><h4 data-id="our-most-recommended-policies-are%3A">Our most recommended Policies are:</h4><p><strong>Block and Allowlist </strong> </p><p>This secures your devices so that only specified people can connect to your devices.</p><p>We have a guide on this here:</p><div class="js-embed embedResponsive" data-embedjson="{"body":"This article applies to all TeamViewer users. General You have the possibility to restrict remote access to your device by using the Block and Allowlist feature in the TeamViewer full version and the TeamViewer Host. You can find the feature easily by clicking in your TeamViewer fullversion on Extras --> Options -->…","url":"https:\/\/community.teamviewer.com\/English\/kb\/articles\/29739-block-and-allowlist","embedType":"link","name":"Block and allowlist - TeamViewer Support"}"> <a href="https://community.teamviewer.com/English/kb/articles/29739-block-and-allowlist" rel="nofollow noreferrer ugc"> https://community.teamviewer.com/English/kb/articles/29739-block-and-allowlist </a> </div><p><br></p><p>If you are unsure, we recommend this is set to your company. This ensures that all users under <a href="https://login.teamviewer.com/nav/users/company" rel="nofollow noreferrer ugc">"User Management"</a> can connect</p><p><strong>Password Strength</strong></p><p>This controls the random password displayed on the front of the software. If no ad-hoc connections are needed and you have set up unattended access, we would recommend you set this to “Disabled”</p><p><strong>Disable TeamViewer Shutdown </strong></p><p>This is a good setting as it stops end users from being able to shut down the software unless they are admins.</p><p><strong>Access Control – Incoming Connections </strong></p><p>This is a good setting if you want to control how your users connect. For example, if you don’t want your techs able to jump into any device at any time, change this to “Confirm All” and the end-user would need to click “Allow” before you can connect.</p><p><strong>Full Access Control When Connecting to the Windows Login Screen </strong></p><p>If you have set access control to “Confirm” above, this</p><p><strong>Prevent removing account assignment </strong></p><p>This will stop end users removing your ability to apply policies</p><p><strong>Report connections to this device </strong></p><p>This will make sure all connections to any device is recorded for security purposes.</p><p>These logs are recorded under <a href="https://login.teamviewer.com/nav/home/sessions" rel="nofollow noreferrer ugc">device reports</a></p><h2 data-id="sharing-your-contacts-list-with-others">Sharing your contacts list with others</h2><p>The contacts list and groups are not shared by default.</p><p>You need to make sure that groups are shared with users who need to be able to access the devices contained.</p><p>We have a guide here on how to share groups:</p><div class="js-embed embedResponsive" data-embedjson="{"body":"This article applies to all TeamViewer free users and customers with a Business, Premium, Corporate or Tensor plan. General You have the option to share groups with with individual contacts from your Computers & Contacts list. In this way, entire groups can be made available to other contacts quickly and easily. 📌Note: A…","url":"https:\/\/community.teamviewer.com\/English\/kb\/articles\/30221-sharing-groups","embedType":"link","name":"Sharing groups - TeamViewer Support"}"> <a href="https://community.teamviewer.com/English/kb/articles/30221-sharing-groups" rel="nofollow noreferrer ugc"> https://community.teamviewer.com/English/kb/articles/30221-sharing-groups </a> </div><h2 data-id="-2"></h2><h2 data-id="mass-deploying-the-software">Mass Deploying the Software</h2><p>You can mass deploy the software using common deployment methods.</p><h3 data-id="creating-your-deployment-script">Creating your deployment script</h3><p>This script controls the behavior of your install and also allows it to pop up in your list automatically without confirmation.</p><p>Full instructions are here:</p><div class="js-embed embedResponsive" data-embedjson="{"body":"This article applies to all TeamViewer customers with a Corporate or Tensor license. This article applies to TeamViewer version 13.2 or newer. Supported Windows versions: Win 7, Win 8 and Win 10 This article explains how you can deploy TeamViewer Host and TeamViewer Full in a mass deployment scenario on Windows.…","url":"https:\/\/community.teamviewer.com\/English\/kb\/articles\/39639-mass-deployment-improvements","embedType":"link","name":"Mass deployment improvements - TeamViewer Support"}"> <a href="https://community.teamviewer.com/English/kb/articles/39639-mass-deployment-improvements" rel="nofollow noreferrer ugc"> https://community.teamviewer.com/English/kb/articles/39639-mass-deployment-improvements </a> </div><p><br></p><p>Example:</p><pre class="code codeBlock" spellcheck="false" tabindex="0">msiexec /i "X:\TeamViewer_Host.msi" /qn CUSTOMCONFIGID=<Config ID> IMPORTREGFILE=1 APITOKEN=<APItoken> ASSIGNMENTOPTIONS="--alias %COMPUTERNAME% --grant-easy-access --reassign" </pre><p><strong>CUSTOMCONFIGID</strong></p><p>set the logo and look of the host (the Config ID is created when you create your custom module)</p><p>APITOKEN - Assigns to your account (The API token is created when you create your custom module)</p><p><strong>IMPORTREGFILE</strong></p><p>Starting with TeamViewer 15.10.5 this is obsolete because now we use the "tvopt" file. </p><p>A reg file can't be exported anymore from the Client when using the latest version.</p><p>Also for the example MSI Parameter</p><p><strong>ASSIGNMENTOPTIONS:</strong></p><p>Controls the behavior of the install and link to your TeamViewer account</p><p><strong>--alias</strong></p><p>Sets the name of the device as it appears in your console</p><p><strong>--grant-easy-access </strong></p><p>makes sure that the account this is assigned to can connect without a password</p><p><strong>--reassign </strong></p><p>makes sure the device is assigned to you even if it has been assigned to another account before</p><h3 data-id="setting-personal-passwords-and-other-settings">Setting personal passwords and other settings</h3><p>If you want to provide a predefined password for your installation, you can put the settings file "TeamViewer_Settings.reg" (file name is mandatory) in the same directory as the MSI file.</p><p>This can also contain other settings if you would like.</p><h4 data-id="how-to-get-the-settings-file">How to get the settings file</h4><p>📌The following only applies to TeamViewer in versions 15.9 or older:</p><p>On a device with TeamViewer already installed:</p><p>In the Options dialog (<strong>Extras</strong> | <strong>Options</strong>) in the category, <strong>Advanced</strong> use the Button <strong>Export…</strong></p><p>in order to export the *.reg file and name it <strong>TeamViewer_Settings.reg</strong></p><p>If you only want a password, you can uncheck all the boxes in the window that appears and just enter the password.</p><p>Make sure to add the property IMPORTREGFILE=1 to your command when installing TeamViewer_Host.msi (version 13.2 or higher) or TeamViewer_Full.msi (version 14.0 or higher). 0 is the default value for IMPORTREGFILE and will not import the settings.</p> </article> </main>
