PAGE

For IT professionals:Group Policy for Microsoft Office 2010

Microsoft Corporation

Published: January 2011

Author: Microsoft Office System and Servers Team (itspdocs@microsoft.com)

Abstract

This book contains information about how to use Group Policy to deploy and configure an installation of Microsoft Office 2010. The audience for this book includes IT generalists, IT operations, help desk anddeployment staff, IT messaging administrators, consultants, and other IT professionals.

The content in this book is a copy of selected content in the Office 2010 Resource Kit technical library (http://go.microsoft.com/fwlink/?LinkId=181453) as of the publication date. For the most current content, see the technical library on the Web.

This document is provided as-is. Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. You bear the risk of using it.

Some examples depicted herein are provided for illustration only and are fictitious. No real association or connection is intended or should be inferred.

This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.

2011 Microsoft Corporation. All rights reserved.

Microsoft, Access, Active Directory, Backstage, Excel, Groove, Hotmail, InfoPath, Internet Explorer, Outlook, PerformancePoint, PowerPoint, SharePoint, Silverlight, Windows, Windows Live, Windows Mobile, Windows PowerShell, WindowsServer, and WindowsVista are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.

Contents

1I. OVERVIEW OF GROUP POLICY AND OFFICE 2010

2Group Policy overview for Office 2010

2Local and Active Directory-based Group Policy

3Group Policy processing

4Policy inheritance

4Synchronous and asynchronous processing

4Fast Logon Optimization feature

4Slow links processing

5Group Policy refresh interval

5Triggering a Group Policy refresh

5Changing how Group Policy processes GPOs

6Change the link order

6Block inheritance

6Enforce a GPO link

6Disable a GPO link

6Use security filtering

7Use Windows Management Instrumentation filtering

7Use loopback processing

8Administrative Templates

8Administrative Template files

9Administrative Template files for Office 2010

10True policies vs. user preferences

10True policies

11Preferences

11Group Policy management tools

11Group Policy Management Console

12Group Policy Object Editor

12System requirements for GPMC and Group Policy Object Editor

13Office Customization Tool and Group Policy

15Planning for Group Policy in Office 2010

15Planning for Group Policy

15Define business objectives and security requirements

16Evaluate your current environment

17Design managed configurations based on business and security requirements

18Determine the scope of application

18Test and stage Group Policy deployments

19Involve key stakeholders

20FAQ: Group Policy (Office 2010)

20Q: When should I use Group Policy instead of Office Configuration Tool (OCT)?

20Q: Where can I find a list of Group Policies that are available for Office 2010?

20Q: What is the difference between the two workbooks Office2010GroupPolicyAndOCTSettings_Reference.xls and Office2010GroupPolicyAndOCTSettings.xls?

21Q: What is the difference between .adm, .admx, and .adml administrative template files?

21Q: Do the Office 2010 .admx template files work with the 2007 Office system? Or must I download the 2007 Office system template files separately?

21Q: How do I install the Office 2010 Group Policy templates?

22Q: How can I map a specific UI element in Office 2010 to a Group Policy setting?

22Q: How can I use Group Policy to disable commands and menu items?

23Q. Why does Microsoft not support the use of Group Policy Software Installation to deploy Office 2010?

23Q. What are the advantages and limitations of deploying Office 2010 using Group Policy computer startup scripts?

25Office 2010 Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool

25Overview of new and removed Group Policy and OCT settings

25Group Policy settings location

26New administrative templates

26OCT settings and availability

26Preventing conflicts with earlier versions of Group Policy settings

27Installing the settings

27Files included in this download

32II. PLAN FOR CUSTOMIZING OFFICE 2010 BY USING GROUP POLICY

33Plan for accessibility in Office 2010

33Increase the visibility of violations

33Control what the checker reports

34Group Policy settings for Excel 2010

35Group Policy settings for PowerPoint 2010

37Group Policy settings for Word 2010

40Plan for spelling checker settings in Office 2010

41Office 2010 general spelling checker settings

43InfoPath 2010 spelling checker settings

44OneNote 2010 spelling checker settings

44Outlook 2010 spelling checker settings

45PowerPoint 2010 spelling checker settings

45Publisher 2010 spelling checker settings

46Word 2010 spelling checker settings

48Plan for using compatibility mode in Office 2010

48Overview of Office document compatibility in Office 2010

49Is using compatibility mode right for your organization?

49Preparing Office 2010 users for using compatibility features

51Changing default file formats and other settings for Office 2010 documents

52Default file format

53Set default compatibility mode on file creation (Word 2010 only)

53Save As Open XML in compatibility mode (Word 2010 only)

53Planning security settings for binary files that are opened in Office 2010

54Office File Validation

54Office Protected View

56Group Policy and Office Customization Tool (OCT) settings that address OpenDocument Format (ODF) and Office Open XML (OOXML) file formats in Office 2010

56About the settings

57Excel 2010 settings

62PowerPoint 2010 settings

66Word 2010 settings

76III. PLAN FOR SECURITY BY USING GROUP POLICY

77Security policies and settings in Office 2010

78Plan COM object categorization for Office 2010

78About COM object categorization

78Configure Group Policy security settings for COM object categorization

79Add COM object categorization in registry

81Plan file block settings for Office 2010

81Blocking file format types by using Group Policy or the OCT

81Planning considerations for configuring file block settings

82Group Policy and OCT settings

82How to find the settings

83About the Set default file block behavior setting

83Excel 2010 settings

99PowerPoint 2010 settings

105Word 2010 settings

117Plan password complexity settings for Office 2010

117About planning password length and complexity settings

117Enforce password length and complexity

119Determine minimum password length requirement

119Determine the password rules level

120Determine domain time-out value

120Related password length and complexity settings

122Plan digital signature settings for Office 2010

122What is a digital signature?

122What digital signatures accomplish

123Requirements for digital signatures

123Digital signatures in the business environment

123Compatibility issues

124Digital certificate: Self-signed or issued by CAs

125Certificates created by using a corporate PKI

125Commercial certificates

126Using digital signatures

127Time stamp digital signatures

127Configure digital signatures

129Plan privacy options for Office 2010

129About planning privacy options

130Suppress the Welcome to Microsoft Office 2010 dialog box

131Configure privacy options

132Related privacy options

134Plan for Information Rights Management in Office 2010

134IRM overview

135How IRM works in Office 2010

135Using IRM with an RMS server

136Using IRM without a local RMS server

137Setting up IRM for Office 2010

137Setting up RMS server access

137Installing the Rights Management client software

137Defining and deploying permissions policies

138Permissions rights

139Predefined groups of permissions

139Advanced permissions

139Deploying rights policy templates

140Configuring IRM settings for Office 2010

140Office 2010 IRM settings

141Office 2010 IRM registry key options

143Configuring IRM settings for Outlook 2010

143Outlook 2010 IRM settings

144Outlook 2010 IRM registry key options

145IV. PLAN FOR OUTLOOK 2010 BY USING GROUP POLICY

146Determine which features to enable or customize in Outlook 2010

147AutoArchive

148Contac