Using Windows System Policies to Administer MS Office 97

The purpose of this paper is to provide a technical overview of how Microsoft Office 97 takes advantage of Windows system policies. All of the capabilities mentioned in this white paper are fully documented in the Microsoft Office 97 Resource Kit from Microsoft Press.

For more information about Windows system policies, see the Microsoft Windows 95 Resource Kit or the Microsoft Windows NT Workstation 4.0 Resource Kit.

On This Page

Additional Resources
The Complexity of Managing Corporate Desktops
Office 97 Administrative Tools
Technical Overview
Examples
Appendix

Additional Resources

Microsoft Windows 95 Resource Kit

Microsoft Windows NT Workstation 4.0 Resource Kit
Microsoft Office 97 Resource Kit
Microsoft Corporate Desktop Information Center Website
Microsoft Office 97 Migration

The Complexity of Managing Corporate Desktops

As the modern personal computer has grown both more powerful and more flexible, it has also had to become more complex. This increase in complexity has given rise to a broad set of challenges for system administrators. The flexibility of the Windows 32-bit operating system means it is highly customizable, allowing users to tailor their machines to their personal tastes. For the administrator, however, this flexibility can often mean a loss of control. Without the proper safeguards, novice users sometimes "get into trouble" by inadvertently adjusting a crucial machine setting. Restoring the machine to its proper working order may require a costly and time consuming technician visit to the affected machine.

Administrators must also maintain some degree of flexibility across the organization in order to accommodate a wide range of users, from the relative novice to the advanced "power user." Thus modern system administrators need a centralized, yet flexible, way to control the degree to which his/her users have access to the settings of their machines.

Office 97 Administrative Tools

Most large organizations have worked diligently to establish a network and computing paradigm that works well for their enterprise and desktop computing needs. These models vary widely between — and even within — organizations. Rather than providing solutions for the few common permutations, Microsoft has created flexible tools that allow administrators to customize Microsoft Office to an organization. Microsoft Office 97 incorporates several new features and enhancements directly into the products to simplify software management and facilitate a smooth transition:

• Enhanced Support for Windows System Policies

• Enhanced Network Installation Wizard

• The Office Upgrade Wizard

• Flexible Setup Options

• Support for Microsoft Systems Management Server

This white paper will discuss how Office 97 takes advantage of Windows system policies. By using the System Policy Editor, administrators can provide greater consistency among client computers, yet maintain the flexibility they need to support a wide range of users. They can now centrally control nearly all of the options settings for the Office applications, reducing administrative overhead during migration and maintenance.

Technical Overview

Modern desktop operating systems and applications have many options that users can customize to alter the user interface and behavior of their computer. As a network administrator, you can set many of these options remotely, for all the users in a workgroup, using Windows system policies. System policies allow you to provide greater consistency among client computers and to centralize support and maintenance efforts.

Windows System Policies

Introduced in the Windows 95 operating system, and now supported in Windows NT Workstation 4.0, System Policies give the administrator control over custom settings for both the operating system and the applications on end users' computers. System Policies can be enabled for any user who logs on to the network. Through System Polices, the administrator can determine operating system options such as the networking settings or the appearance of the Desktop and Start Menu.

On a stand-alone machine, operating systems options are set by the user, interacting with standard tools such as the Windows Control Panel. These user interface tools in turn manipulate the Windows registry, which stores all of the user settings. Many Windows based applications as well, store user preferences in a like manner in the Windows registry. A system policy represents an option that corresponds to one or more Windows registry keys.

Administrators use the Systems Policy editor to centrally create a Policy file (config.pol) which contains the standard registry settings for all users who log into the network.

How Does Windows Use System Policies?

When the user logs on, Windows checks the user's configuration information for the location of the policy file. Windows then downloads the policies and copies the information in the registry using the following process.

First, if user profiles are enabled, Windows checks for a user policy section that matches the user name and applies the user­specific policy. If Windows does not find a user policy section, it applies the Default User policies. If support for group policies is installed, Windows downloads group policies, starting with the lowest priority group and ending with the highest priority group. Group policies are processed for all groups to which the user belongs. Group policies are not applied if there are user policies defined for the user. These settings are copied into the USER.DAT portion of the registry.

Second, Windows applies computer­specific policies to the desktop environment. If a policy section for that computer name does not exist, Windows applies the Default Computer policies. These settings are copied into the SYSTEM.DAT portion of the registry.

By default, Windows automatically attempts to download computer and user policies from the file Config.pol in the Netlogon folder on a Windows NT server or the Public folder on a NetWare server. This default location can be overridden in a policy file setting. If no server is present, Windows uses the settings currently on the client computer.

The System Policy Editor

When you run System Policy Editor, Windows 95 opens the default policy template, which contains existing policies that you can enable or modify. A template is a listing of the possible policies that an administrator can set. The Office Resource Kit Tools and Utilities CD-ROM include the latest version of the System Policy Editor. This is the same version that is included with Windows NT Workstation 4.0, and you can use it with both Windows 95 and Windows NT Workstation 4.0.

Using the System Policy Editor, you can set user policies for all users, for a particular network group, or for a single user. User policies are system policies that represent application options relevant to the user currently logged on to Windows, and they are stored in the HKEY_USERS portion of the user's Windows registry.

You can also set computer policies for all client computers or for a single computer. Computer policies are system policies that represent options relevant to a particular computer, and they are stored in the HKEY_LOCAL_MACHINE portion of the Windows registry.

Using the Systems Policy Editor to set the default Assistant Character for Office 97

A system policy can have one of three settings in the Properties dialog box:

After you set the policy values you want, place the system policy file in the appropriate folder on the network server.

System Policy Templates

System policies that can be modified by the Systems Policy Editor are defined by a system policy template file that associates each policy with the registry keys used by the application for the option that the policy represents. The template also organizes the policies in a hierarchy to make them easier to find.

An example of a custom Systems Policy Template File.

Templates are actually ASCII text files that have been created following a strict syntax very much like a programming language. The syntax for creating these template files has been documented and published, making it possible for administrators to create their own custom template files. Creating your own template is helpful when you want to define a specific set of Registry settings in your system policies, including settings not definable by default through System Policy Editor.

For example, it might be helpful to have system policy settings for corporate-specific applications, such as an in-house database, custom front end, or electronic mail package. After a template has been customized, you can then load the template and use it to set values in the Registry.

Office 97 System Policy Template Files

Most users, however, would find it very difficult to create a Windows 95 or Windows NT Workstation 4.0 System Policy entry from scratch. What really makes System Policies useful are templates with the settings and appropriate options defined by the engineers that developed the software.

Because Microsoft Office 97 applications read and write to the Windows registry to store user-defined options, these settings can be centrally administered with Windows Systems Policies. The Microsoft Office 97 Resource Kit CD-ROM includes five Office template files that define all the system policies that can be set for Office 97 applications. They can be used with the Systems Policy Editor to check off options that the administrator wants to set. These template files are described in the following table.

The system policies in the Office policy template files are organized by application. Most policies correspond to options that users can set in the Options dialog box (Tools menu) of each Office application. For example, the Macro Virus Protection policy for Word is found under User\Word 97\Tools_Options\General\Macro Virus Protection.

Some policies do not correspond to settings that users can select; these are organized by application or under the general Office heading.

Examples

Here are two examples of how system policy support can reduce administrative headaches and costs during deployment and ongoing administration.

Using System Policies during Deployment and Migration

Upgrading desktop applications in large organizations is often a complex task that is completed not overnight, but rather in a gradual fashion. Once the deployment has begun, there is a transitional period where the organization must function in a mixed-version environment. Because this period can last for several months, it is essential that users retain the ability to share files with each other and collaborate.

A frequently requested feature from administrators is the ability to restrict users to saving in a particular file format. Since most large organizations do not upgrade everyone at one time, this is an effective intermediate solution for sharing files.

In the case of Office 97, the incorporation of new technologies into the suite required architectural modifications to the file formats of all the applications. While this seems to present a major obstacle to smooth deployment, we will see how the use of System Policies can greatly reduce administrative overhead during migration.

Configuring Default File Save As

Microsoft Word, Microsoft Excel and PowerPoint all support the new Default Save feature that only allows users to save documents in the file format of a previous version of the application.

Setting the default Save As file format to Word 6.0/95 with Word 97

A system administrator, however, can use the System Policy Editor to determine the default Save As... format for the entire network. For example, you might select the check box for the policy Default Save for Microsoft Word and assign the value Microsoft Word 6.0/95 format. When a user logs on to the network, the user's registry is modified to set the default file format in which to save Microsoft Word documents to this value.

Using the System Police Editor to configure the Word 97 Save As feature

If the policy has been set by an administrator, then it is implemented when the user logs on to the network. If this check box is cleared in the policy file, then the option in Microsoft Word is unavailable when the user logs on. If the policy is grayed, then Windows does not modify the user's registry and it retains its previous setting.

When the migration is finally complete and all users have upgraded to Office 97, the administrator can return to the Systems Policy Editor and — with the click of a mouse — switch the entire network over to the new file formats.

Using System Policies during Ongoing Administration

Support for systems policies can also help reduce ongoing administration costs. For example, system policies can prevent novice users from inadvertently disabling their system by adjusting a setting they don't understand.

In the case of Office 97, administrators can control several registry entries that can help reduce ongoing support costs, such as the settings of the Office Assistant, the location for online help, the workgroup templates location, and the location for future file converters.

Configuring Future File Format Converters

Microsoft's long­term goal is to develop file formats that do not need to change when new features are added. We realize, however, that we cannot possibly predict every technology advance that might affect file architecture in the future. Therefore, we have built intelligence into the new Office 97 applications that will allow them to automatically configure themselves in response to new situations without requiring administrative intervention.

For example, if an Office97 application encounters a file format it does not understand, such as one from a future version of Office, administrators can now point the application to a server location where a library of file converters can be stored. This setting is determined by a System Policy.

Word 97 System Policy which directs the application to a server to retrieve the appropriate converter. In this case, the path points to a site on the public Internet, but the Administrator could also choose to enter a path to a server on the private LAN.

The Office 97 application will simply locate the required converter, install it and load the document for the user. The administrator can even point the applications to a designated Office Administration Intranet web site upon encountering such a file, where users can be given not only the file filters they need, but additional information on Office they might find valuable.

Appendix

Client Computer Requirements for System Policies

• Windows 95 or Windows NT Workstation 4.0 must be installed. (Office 97 System Policies cannot be implemented on Macintosh computers.)

• If you want to set user policies, client computers must have user profiles enabled.

• If you want to set group policies, the group policy capability must be installed on each client computer.

• For automatic downloading of policies over Windows NT based networks, Client for Microsoft Networks must be specified as the primary network logon client, and the domain must be defined on the client computers.

• For automatic downloading of policies over NetWare networks, Microsoft Client for NetWare Networks must be specified as the primary network logon client, and a preferred server must be defined.