Microsoft Office 2010: Manage Microsoft Office with Group Policy
You can use a variety of Group Policy settings to help you centrally manage and configure the entire Microsoft Office product family.
Brien M. Posey
Microsoft Office is one of the most commonly used sets of productivity applications in any environment or industry. Even considering its ubiquitous reach, centrally managing Office can be a challenge. Fortunately, Microsoft offers a set of administrative templates that helps you manage Office using Group Policy.
There are certain aspects of these administrative templates and Group Policy settings you should focus on to manage Office more efficiently. There are also separate sets of administrative templates for each version of Office. As such, you’ll need to download and install the version that corresponds to the version of Office you’re using in your environment.
Because the administrative templates are version-specific, you’ll have to jump through a few hoops when you upgrade to a new version of Office. For example, if you’re using the Office 2010 version of the administrative templates today and you upgrade to the next edition of Office, the Office-related settings you’re presently using won’t apply to the next version of Office. You’ll have to download a set of Office 2013 templates when they’re available, and create a whole new set of Group Policy settings.
When considering Group Policy lifecycle management, it’s important to keep your Group Policy settings as clean as possible. When a user logs in to a domain, that user’s effective policy is compiled from the various Group Policy elements applied to that user and the computer they’re using. The complexity of the Group Policy structure has a direct impact on the amount of time it takes to process the user’s login. That being the case, you should only enable necessary policy settings.
Furthermore, if you upgrade to a new version of Office at some point, it’s a good idea to go into the Group Policy editor and disable policy settings related to the old version of Office. That way you won’t have obsolete Group Policy settings slowing down user logins.
Deploy the Office Administrative Templates
It’s relatively easy to deploy the Office Administrative Template files. This discussion pertains to the Office 2010 version of the templates, but the majority of the techniques and Group Policy settings apply to earlier versions of the Administrative Templates as well.
The first thing to do is download the Office 2010 Administrative Template files. It’s worth noting that both 32- and 64-bit versions of the Administrative Template files are available. The reason for this is that the Office Customization Tool is also included. If you plan to use this tool, you’ll also need to match it to the edition of Office you’re customizing.
The download page also contains the Office 2010 Group Policy and Office Customization Tool Settings Reference spreadsheet. You can use this spreadsheet to locate specific Group Policy settings. With a little bit of work, you could also adapt this spreadsheet and use it to document the policy settings you’ve implemented (see Figure 1).
Figure 1 You can use the Office Customization Tool Settings Reference spreadsheet to help make sense of the Office Administrative Templates.
Once you’ve downloaded the Office Administrative Template files, double-click on the executable file. When you do, Windows will launch a wizard that will prompt you to accept a licensing agreement and then ask you to specify a folder in which to extract the contents. The extraction process creates a series of folders (see Figure 2).
Figure 2 Extract the Office Administrative Template files to create this file structure.
The AdminTemplates.exe file contains a number of different components including the actual Administrative Template files, the spreadsheet and the Office Customization Tool. The Administrative Templates themselves are stored in the ADM folder beneath the language-specific sub-folder.
Once you’ve extracted the Administrative Templates, the next step is to import them into the Group Policy Editor. There are a couple of ways to do this. The easiest method involves copying the XML-based administrative template files (ADMX files) to the domain controller’s central store. You can access the server’s central store by navigating to \\<your DC’s fully qualified domain name>\SYSVOL\<your domain name>\Policies\PolicyDefinitions (see Figure 3).
Figure 3 You can copy the ADMX files and the language sub-folders to your domain controller’s central store.
If you need to import templates for Office 2007 or an earlier version of Office, you’ll have to perform the import process a different way. For pre-2010 versions of Office, you must import the non-XML administrative templates directly into the Group Policy Editor. To do so, open the Group Policy Editor and then open the Group Policy Object (GPO) to which you want to add the templates. In many organizations, it has become a common practice to join Administrative Templates to the Default Domain Policy.
After loading the Group Policy, navigate through the console tree to User Configuration | Policies | Administrative Templates. Then right-click on the Administrative Templates folder and select the Add/Remove Templates command from the shortcut menu (see Figure 4).
Figure 4 Right-click on the Administrative Templates folder and select the Add/Remove Templates command from the shortcut menu.
At this point, you’ll be prompted to specify the Administrative Templates you want to install. Click the Add button and specify the location of the ADM files you extracted earlier. Select the template files you want to install (located in the EN-US or other language-specific folder), then click the Open button, followed by the Close button. You should now see the templates listed beneath the Administrative Templates folder (see Figure 5).
Figure 5 The Office Administrative Template files should be listed beneath the Administrative Templates folder.
Establish Group Policy
There are several Group Policy settings that are particularly important for configuring your Office applications for maximum efficiency and productivity.
Product-Specific Options For each of the Office products (Word, Excel, PowerPoint and so on), there is a unique collection of Group Policy settings. These options are listed within the Group Policy Editor under User Configuration | Administrative Templates | <product Name> | <product options>. For example, the options for Microsoft Word 2010 are located at User Configuration | Policies | Administrative Templates | Microsoft Word 2010 | Word Options (see Figure 6).
Figure 6 There are product-specific options for each of the Office products.
The actual Group Policy settings listed in this area vary from one product to the next. Typically, however, you’ll find customizations for items such as the toolbar or the proofing tools.
Customize Error Messages Some Group Policy settings are available for all (or most) of the Office products. One such setting is Customizable Error Messages. This setting is located at User Configuration | Administrative Templates | <product name> | Customizable Error Messages.
As the name implies, this collection of Group Policy settings lets you replace the standard Microsoft error messages with your own custom messages. Every Office error has a unique error code. Creating a Customizable Error Message involves defining a Group Policy setting that cross-references error codes with your customized text.
Disable UI Elements Another option available for most of the Office products is the ability to disable UI elements. You can disable both custom and predefined commands and shortcut keys. The option to disable UI elements is located at User Configuration | Policies | Administrative Templates | <product name> | Disable Items in User Interface.
In Office 2010, each menu item and shortcut key is assigned a unique ID. You can disable menu items and keyboard shortcuts by enabling Group Policy and specifying the menu item ID or keyboard shortcut you want to disable (see Figure 7). The Help section within the Group Policy Editor provides links to Web pages that list the various ID codes. These codes differ from one Office product to the next, so be sure to use the Web page for the Office product you want to customize.
Figure 7 The Help section lets you enable and disable different commands using specific command bar IDs.
Legacy Files A relatively obscure but occasionally lifesaving setting is well worth mentioning. It’s particularly helpful if you often use prerelease builds of various Microsoft products to test and learn how to use them before they’re released to manufacturing.
I recently needed to look at a budget spreadsheet I had created back in 2006 using a prerelease version of Excel 2007. When I opened the spreadsheet in Excel 2010, I received a message stating the spreadsheet could not be opened because it was created with a beta version of Excel that’s no longer supported (see Figure 8). Needless to say, finding an Excel 2007 beta six years after the fact is a tall order. Thankfully, the Office Administrative Template files contain a setting to help you get around this problem.
Figure 8 Excel 2010 doesn’t support opening files created with the Excel 2007 beta.
This setting is located at Classic Administrative Templates (ADM) | Microsoft Office Excel 2007 | Block File Formats | Open. The setting is called “Block opening of files created by pre-release versions of Excel 2007” (see Figure 9). Disabling this setting lets you open prerelease Excel files.
Figure 9 You can use Group Policy settings to let you open files created with beta releases.
These are some of the Office-related Group Policy settings you might find the most useful. Ultimately, however, the best way to truly get the most from the Office Administrative Templates is to dig into them and see what hidden gems you can find.