The best place to look for Office tools and information is the Office Web site (http://office.microsoft.com). You’ll find several important resource pages including:

Because the Office Web site is continually updated, it is sometimes hard to locate the resources you need. At the time of this writing, http://www.microsoft.com/downloads/details.aspx?FamilyID=4bb7cb10-a6e5-4334-8925-3bcf308cfbaf&DisplayLang=en is the best download location for the Office 2003 Resource Kit tools. While you are online you might want to download the additional updates for Office 2003 service packs from http://www.microsoft.com/downloads/details.aspx?FamilyID=ba8bc720-edc2-479b-b115-5abb70b3f490&DisplayLang=en. Additional resource tools and files for Visio 2003 and for Project 2003 can be obtained from http://www.microsoft.com/office/ork/2003/tools/BoxA19.htm.

After you download the necessary files, you should run the associated installers on a computer that is part of the domain with which you want to work or a development machine if you want to test prior to deploying the tools. With the Office 2003 Resource Kit tools, you will want to perform a Complete Install. A complete install uses 30 MB of disk space. The default local path for the install is %SystemDrive%Program FilesORKTOOLS. Once the install is complete, you’ll find a new tools menu under Start, Programs or All Programs, Microsoft Office, Microsoft Office Tools, Microsoft Office 2003 Resource Kit. Table 10-1 provides an overview of the standard tools.

The Office 2003 Service Pack updates to the resource kit include additions and corrections to policies for administrative support of Office 2003 as well as several spreadsheets that describe available policies. These updated template files will be stored in the folder you designate when installing the updates. With updates to the Office 2003 Resource Kit, like a service pack, you’ll need to roll out two types of updates. First, you’ll roll out the actual update or service pack for Office 2003 through policy as discussed in Chapter 9 under "Deploying Microsoft Office Through Policy." You’ll then need to check for Administrative Templates or other types of policy updates, such as the ones from http://www.microsoft.com/downloads/details.aspx?FamilyID=ba8bc720-edc2-479b-b115-5abb70b3f490&DisplayLang=en, and deploy any updated policy files as appropriate to the GPOs that use Office-related Administrative Templates. The steps you’ll need to follow are discussed in the next section.

You configure new installations of Office using the Custom Installation Wizard. When you run this wizard, it creates transform files you can distribute through policy when you deploy Office. You can use the wizard to:

Because there are several prerequisites, working with the Custom Installation Wizard isn’t as straightforward as you’d expect. Before you get started, you’ll need to create an administrative install of the Office .msi file. You’ll then need to use the Custom Installation Wizard to create the require .mst file. Once you have the transform file, you can deploy the Office configuration through policy. Keep in mind that you can add .mst files only when you are initially Assigning or Publishing an installer package.

You can modify existing installations of Office using the Custom Maintenance Wizard. When you run this wizard, it creates .cmw files, which you can distribute through policy to update an Office Installation. You can use the wizard to:

You work with the Custom Maintenance Wizard in much the same way as you work with the Custom Installation Wizard. Before you get started, you’ll need to know the location of the administrative install of Office’s .msi file. You’ll then need to use the Custom Maintenance Wizard to create the require .cmw file. Once you have the .cmw file, you can deploy Office configuration change through policy.

UNCpathmaintwiz.exe /c "ConfigFile"

\CorpSvr08appsOfficeupdatesmaintwiz.exe /c "EngOfficeUpdate.cmw"

\CorpSvr08appsOfficeupdatesmaintwiz.exe /c "EngOfficeUpdate.cmw" /q

The Office 2003 Resource Kit includes a set of Administrative Templates, which we’ll refer to as the Office 2003 Administrative Templates. These templates include policies settings for customizing the configuration of Office applications. Keep in mind that the Office 2003 Administrative Template files do not expose every user interface element in each Office application for configuration. Rather, they expose the most commonly used elements to allow you maximum control while minimizing the complexity of managing Office installations.

During installation of the Office 2003 Resource Kit, the Office 2003 Administrative Templates are copied to the %SystemRoot%Inf folder on the local computer. This location is the default location for policy templates. At this point, the policy templates are not available for use in your organization. If you examine the %SystemRoot%Inf folder, you will find a set of .adm files; each related to an individual Office application. Table 10-2 lists each file and the application to which it relates. If you downloaded the tools and files for Project and Visio, you’ll find two additional .adm files. These files are listed in the table as well.

You can deploy one or all of the Office 2003 Administrative Template files, depending on your configuration needs. To deploy a template within your Group Policy environment, you must first add the template file to the Group Policy Object (GPO) in which it will be used. There are two different recommended techniques, depending on whether you are deploying Office Administrative Templates files for the first time in your organization or updating Office-related policy due to availability of new files from an Office Service Pack or other Office update.

Note

Office 2003 Administrative Templates are deployed on a per-GPO basis. This deployment technique is different from the technique used for new operating system versions and operating system service packs. With new operating system versions and operating system service packs, you can update the entire Group Policy environment, meaning the updates will be applied to all GPOs.

Deploying Office Administrative Template Files for the First Time

To deploy Office-related policy templates for the first time to a GPO in your organization, follow these steps:

1. If you are deploying Office policy settings for the first time, and have updated policy files, such as those for Office 2003 Service Pack 1, you should copy the updated files to the %SystemRoot%Inf folder on the local computer before you continue.

2. Open the GPO you want to work with. Right-click Administrative Templates under User Configuration and choose Add/Remove Templates to view the currently loaded .adm files as shown in Figure 10-1.

   

   Figure 10-1. Viewing the Add/Remove Templates dialog box within the Group Policy Object Editor

3. Click Add to open the Policy Templates dialog box. The default folder location opened is %SystemRoot%Inf.

4. Choose the template file or files to load. To select multiple files at once, hold the Shift or Ctrl keys as appropriate.

5. Click Open and then click Close. The Administrative Templates namespace changes to include new nodes representing the policy settings you’ve just added as shown in Figure 10-2.

   

   Figure 10-2. Viewing the Group Policy namespace after the adding Office 2003 Administrative Template files

6. Repeat this procedure for each GPO that should use Office-related policy.

Note

The files you’ve added are copied to the SYSVOL portion of that GPO and are replicated to all domain controllers in the domain. (See Chapter 13, for more information about Group Policy storage.)

To save yourself a lot of work, you should carefully plan your Office configuration roll out. You might be tempted to add Office policy to existing site, domain or OU GPOs. However, you will probably want to use separate Office configuration GPOs and then link them to the appropriate sites, domains or OUs in your organization. This approach will give you increased flexibility and make it easier to manage your Office installations.

To see why, consider the following deployment scenarios:

As you can see, the way you deploy Office configurations can have a significant impact on the amount of work you have to do. In creating your Office configuration GPOs, you also consider who will receive a particular configuration. By default, the policy will apply to all users or computers within the site, domain or OU to which you’ve linked the GPO. As this might not be the ideal behavior, you might need to filter the policy application. For example, if you configure security filtering on an Office configuration GPO so that only members of the Temp Sales security group have the policy applied, only members of the Temp Sales group will have this Office configuration.

The choice to deploy a particular version of Office isn’t an all or nothing decision. You’ll often find that you have different groups of users running different versions of Office. For example, the Sales and Accounting departments might be running Office XP while the rest of the company is using Office 2003. This mixed environment is okay and you can manage both installations of Office through policy.

As discussed previously, the policy files for Office are distributed with the Office Resource Kit. If you have users running both Office 2003 and Office XP, you will need to install the Office 2003 Resource Kit and the Office XP Resource Kit. In the Office 2003 Resource Kit, you’ll find the policy files you’ll use to manage Office 2003 configurations. In the Office XP Resource Kit, you’ll find the policy files you’ll use to manage Office XP configurations.

As of this writing, the Office XP Resource Kit Tools can be downloaded from http://www.microsoft.com/downloads/details.aspx?FamilyID=25b30c79-b248-4eb9-8057-be0043f5b881&DisplayLang=en. the Office XP Resource Kit includes an Administrative Template file for each Office XP application. You install and work with these administrative templates using the techniques discussed previously. As shown in Table 10-3, the Office XP policy files are named different than other Office versions. Not only does this ensure that you won’t accidentally overwriting existing Office policy configurations, it also is used to manage various Office policy versions separately from each other. You will, in fact, have separate policy nodes for each Office version and their associated applications.

As of this writing, the Administrative Template files for managing Office 2000 installations are part of the Office 2000 Resource Kit, available at http://www.microsoft.com/downloads/details.aspx?FamilyID=982348b3-0005-4792-a15c-34f738b3c328&DisplayLang=en. As with Office XP, Office 2000 Administrative Template settings can coexist with settings for other Office versions in a single GPO.

It is important to point out that because different versions of Office have different features, each version of the Office Administrative Template files supports a slightly different set of policies. This means you will not be able to have a complete one-to-one mapping of policy settings as you move from version to version. But in general, the settings are similar from version to version.

It is also important to point out that different Office versions are managed separately in the Windows Registry. For example, Office XP Administrative Template policies make changes to the HKEY_CURRENT_USERSoftwarePoliciesMicrosoftOffice10.0key, while the Office 2003 policies make changes to the HKEY_CURRENT_USERSoftwarePoliciesMicrosoftOffice11.0 key. This means that the Office XP and Office 2003 policy settings can coexist for a given user. It also means that you can have a GPO that contains both Office XP and Office 2003 Administrative Template files if you choose.

An example of when you might want both Office XP and Office 2003 Administrative Template settings in a single GPO is when that GPO is linked to an OU where users are running both versions of Office. In this case, having all of your Office configuration settings in a single GPO would make it easier to keep track of which settings you are using and let you quickly compare Office XP settings and their counterpart settings in Office 2003.

You could also implement each version of Office Administrative Template files within separate GPOs. You might want to do this to prevent groups of users from processing one or the other set of policies. In this case, you could split the Office policy settings into separate GPOs by version and then using security filtering to control which group of users receives which policy. Within the Marketing OU, for example, members of the Marketing Support security group might use Office XP and the Marketing Main security group might use Office 2003. If so, you could create Office XP Users and Office 2003 Users GPOs and use security group filtering to ensure policy is only applied to users who are using the respective version of Office.

An alternative that is easier to implement in some cases is to use a WMI filter to detect which version of Office is installed on a given computer. For example, a simple WMI filter, linked to a GPO, that detects the presence of Office 2003 looks like this:

RootcimV2;Select * FROM Win32_Product WHERE Caption="Microsoft Office
Professional Edition 2003"

Similarly, you can have a WMI filter linked to the Office XP GPO that searches for the Office XP string within the caption property of the Win32_Product class. Keep in mind, however, that if a computer has a large number of applications installed on it, this WMI query might take some time to execute, slowing Group Policy processing. Be sure to test this in your environment before rolling out into production.