Most of Office-related policies are configured under User ConfigurationAdministrative Templates as shown in Figure 10-3. Only a select few are configured under Computer ConfigurationAdministrative Templates.

Figure 10-3. Viewing the Office-related policies

Each policy represents an option or feature of an Office application. When working with these policies keep the following in mind:

Because there are so few per-computer policy settings for Office, you’ll primarily work with per-user policy settings.

The Office-related policies in both configuration areas are divided into two broad categories:

For general management of Office and its configuration, the global settings should be the first you examine and modify. Global settings are used to configure the standard options, tool bars and menus, language settings, messaging and collaboration features, and security settings that will be used in all Office applications. For example, you can use User Templates Path policy under User ConfigurationAdministrative TemplatesMicrosoft Office 2003Shared Paths to set a standard folder location for template files. If you specify a network share as the folder location, all users for which the current GPO applies would, use this location as the default path for template files.

When you want to fine-tune the configuration of a specific application, you’ll use the application-specific settings. Every Office application has a separate policy folder. Most also have Disable Items In User Interface policy as well, which you can use to disable specific command bar buttons and menu items.

Tip

Don’t overlook the power of Disable Items In User Interface to help you optimize your Office configurations and restrict use of features that might compromise security or cause problems in your environment. You can use Disable Items In User Interface policy to disable a predefined set of options and create your own custom sets of disabled options as well. For details, see "Preventing Users from Changing Office Configurations."

Unlike other administrative template files that you might encounter, the Office-related policy templates have a feature that can be confusing at first. Specifically, some policy items require you to select the state of the policy (Not Configured, Enabled, or Disabled) and then select an additional check box to enable the policy. Figure 10-4 shows one such policy.

Figure 10-4. Viewing an Office policy that requires confirmation to be enabled

To enable this policy, you need to select the Enabled state and the Check To Enforce Setting On; Uncheck To Enforce Setting Off" check box. If you do not select this check box, the policy will revert to a Disabled state when you apply it. Keep this in mind when you configure Office policies because this is different behavior than what you will find for normal Windows administrative templates.

When working with Office policy settings keep the following in mind as well:

Note

This behavior is specific to Office-related policy. For other policy settings, the behavior for the Enabled, Disabled, and Not Configured states is as described elsewhere in this book. See "Understanding Group Policy Settings and Options" in Chapter 1 for an overview.

If you deploy Office-related policies, you might notice that the policy settings you’ve specified are delivered as expected but it appears that the user can still change the settings to some other value. In other areas of policy, an option is usually dimmed when the user can’t change it. This is not the case with Office-related policies.

Sub EnumerateControls()
 Dim icbc As Integer
 Dim cbcs As CommandBarControls
 Set cbcs = Application.CommandBars("Menu Bar").Controls("Tools").Controls
 For icbc = 1 To cbcs.Count
  MsgBox cbcs(icbc).Caption & " = " & cbcs(icbc).ID
 Next icbc
End Sub

You’ll often want to control where users open and save Office documents. For example, in Terminal Server environments where Office is installed you might want not want users to store files on the Terminal Server itself. While this scenario is ultimately controlled using NTFS file system and share permissions, you can use Office Administrative Template policy to steer the user in the right direction. Each Office 2003 policy template includes options for specifying the default document location.

Say you want to ensure Excel 2003 workbooks are always opened and saved from a shared Excel folder on your network that is backed up nightly. You can configure the default file open and save location for Excel 2003 and then specify a path to the location where you want files to be stored. The default path is the user’s My Documents folder. You can also specify a drive letter mapped to a server share or a UNC path. The paths you provide can use environment variables as. For example, if you have defined home directories for your Active Directory user objects and you want to ensure that Excel files are always stored in a subfolder of the user’s home directory called Excel, you can enter a path such as this:

%homeshare%excel

This variable—%homeshare%—is resolved to the UNC path where the user’s home directory resides when you open or save a file in Excel. If you want to prevent user from changing that path, such as might be the case in Terminal Server environments, you might want to disable the related option in policy. In this case, you would disable the Tools, Options, General option in Excel, as described in the "Preventing Users from Changing Office Configurations" section in this chapter.

Setting Default Folder Locations for OneNote 2003

To set the default My Notebook folder location for OneNote 2003, follow these steps:

1. Double-click Location Of The My Notebook Folder under User ConfigurationAdministrative TemplatesMicrosoft Office OneNote 2003Tools | OptionsOpen And Save.

2. Select Enabled and then enter the default path to use in the Location Of The My Notebook Folder field.

3. Click OK.

Note

You can also set default locations for e-mailed Notes, side notes, and backup folders. The related policies are in the User ConfigurationAdministrative TemplatesMicrosoft Office OneNote 2003Tools | OptionsOpen And Save policy folder.

Setting Default Folder Locations for Word 2003

To set the default document location for Word 2003, follow these steps:

1. Double-click Documents under User ConfigurationAdministrative TemplatesMicrosoft Office Word 2003Tools | Options...File Locations.

2. Select Enabled and then enter the default publication path in the Documents field.

3. Click OK.

Note

You can also set default locations for clipart and AutoRecover file saves. The related policies are in the User ConfigurationAdministrative TemplatesMicrosoft Office Word 2003Tools | Options...File Locations. policy folder.

Because e-mail is prone to containing content that might be harmful to your environment, it’s important that the e-mail applications your users run are secured from the most common types of problems. The first and most important step you can take is to prevent your users from modifying Outlook attachment security, which controls which attachments types are visible. You can enforce this setting by enabling Prevent Users From Customizing Attachment Security Settings under User ConfigurationAdministrative TemplatesMicrosoft Office Outlook 2003Tools | OptionsSecurity. In addition, you can prevent users from creating exceptions to the list of extensions that are covered by Outlook attachment security by disabling Allow Access To E-mail Attachments under User ConfigurationAdministrative TemplatesMicrosoft Office Outlook 2003Tools | Options...Security.

You might also want to disable access to Tools, OptionsSecurity in the Outlook interface. To do this, you will need to create a custom disable policy as shown here:

If you support a worldwide environment with users running many different language versions of Windows and Office, it might be useful to be able to control which language Office applications start in, depending on where the user is located. For example, you could create a site-linked GPO that sets one language when the user is in the United States and another when she is visiting France. Assuming the user has the appropriate language packs for Office installed on her computer, she will get the appropriate language version as she moves around.

You can set global language settings for Office by completing the following steps:

In most cases, if you’ve configured Office-related policy in a GPO and linked the GPO appropriately, the settings usually are delivered to and process by clients as expected. If you find that Office isn’t configured as expected, you can troubleshoot to try to determine where the breakdown is occurring.

Follow these general troubleshooting steps:

Note

Certain policy options that appear in the Office 2003 Administrative Template files don’t always work as expected. This is primarily due to changes in the way features are implemented in Office applications from version to version and the Administrative Template files not keeping up with those changes. For example, there is an Outlook policy to prevent a user’s signature from being included in new messages as well as replies and forwards. This policy is found under User ConfigurationAdministrative TemplatesMicrosoft Office Outlook 2003Tools | Options...Mail FormatSignature. However, in Office 2003 signatures are stored per e-mail account, and if you set this policy, Outlook simply ignores it because the value is now stored in a different location in the registry. These kinds of issues are often found in the Microsoft Knowledge Base (http://support.microsoft.com). You can save yourself a lot of time by searching there first if you discover a situation like this.

Tip

If everything seems to be configured correctly, you can check the Registry to confirm that the related registry value is set as expected. If it’s a per-user policy, changes are made to the HKEY_CURRENT_USER hive of the registry; otherwise, computer policies are made to HKEY_LOCAL_MACHINE. One way you can find out which key and value a particular policy is setting by looking at the Office 2003 Group Policies spreadsheet included in the Office 2003 Resource Kit Service Pack 1. If a value is not being set, there might be problems with registry permissions. Or if it’s in a user’s profile (HKEY_CURRENT_USER), corruption issues might be preventing proper writing of those values. In this case, creating a new temporary profile for the user can confirm whether this is the problem.