Managing Microsoft Office Settings with GPO Administrative Templates

To centrally manage the settings of Microsoft Office programs (Word, Excel. Outlook, Visio, PowerPoint, etc.) in a ActiveDirectory domain using Group Policies, there are special Office administrative (ADMX) templates. These administrative templates allow you to configure the same settings for MS Office apps on multiple domain computers.

By default, ADMX templates for MS Office are not installed when deploying an Active Directory domain or installing any of MS Office programs. Administrators must download and deploy the administrative template pack for Office manually.

Each MS Office version uses its own version of the administrative GPO templates. Here is the list of administrative template downloads for different Office versions:

• Group policy administrative templates for Office 2010 — https://www.microsoft.com/en-us/download/details.aspx?id=18968;
• GPO admx templates for Office 2013 — https://www.microsoft.com/en-us/download/details.aspx?id=35554;
• GPO administrative templates for Office 2016, Office 2019 & Office 365 https://www.microsoft.com/en-us/download/details.aspx?id=49030.

In this article we’ll show you how to install and use Group Policy administrative templates to manage Office 2016 app settings. These admx templates may be used to configure Office 365 ProPlus, Office 2019 and Office 2016 on Windows 10/8.1/7 and Windows Server 2012R2/2016/2019.

How to Install ADMX GPO Templates for Office 2016, 2019 & Office 365?

Go to the Office 2016 GPO ADMX templates  download webpage at the link above. Please note that you are offered to download both 32- and 64-bit versions of GPO ADMX templates for Office 2016. It does not mean that you have to download admintemplates_x86_4909-1000_en-us.exe if you have a 32-bit version of Office 2016, and admintemplates_x64 if you are using MS Office x64 edition. Both archives contain the same versions of ADMX and ADML files. The bitness refers only to the version of Office Customization Tool (OCT) that is used to configure MS Office apps prior to their deployment (this article doesn’t cover this feature). So you can download any version of the file.

Extract the downloaded file. The archive contains:

• The admin directory – it contains a set of OPAX/OPAL files to configure an Office 2016 distribution prior to its deployment using Office Customization Tool. In our case this folder is not used;
• The admx directory – contains a set of ADMX and ADML files for the Group Policy Editor;
• An office2016grouppolicyandoctsettings.xlsx file – it is an Excel file with the description of all Group Policies and matches between GPO settings and registry keys for Office products.

Please note the file structure in the admx directory. The catalogs with the locale names contain ADML files with the language settings for GPO administrative templates for different languages. For example, the de-de directory contains files with a description of policies in German.

The package contains separate ADMX template files to manage the settings of the following MS Office 2016 products:

• access16.admx — Access 2016
• excel16.admx — Excel 2016
• lync16.admx — Lync (Skype for Business) 2016
• office16.admx – general MS Office settings
• onent16.admx — OneNote 2016
• outlk16.admx – Outlook 2016
• ppt16.admx — PowerPoint 2016
• proj16.admx — Project 2016
• pub16.admx — Publisher 2016
• visio16.admx — Visio 2016
• word16.admx — Word 2016

You can use these template files to manage Office 365 ProPlus and Office 2019 settings as well, since these Office versions also use the parameters in the registry key HKCU(HKLM)\SOFTWARE\Policies\Microsoft\Office\16.0.

You can add these administrative templates to the Local Group Policy Editor (gpedit.msc) on a separate computer by copying the contents of the admx directory to the C:\Windows\PolicyDefinitions folder. You can copy the ADMX/ADML template files only for the Office apps you are using or all of them.

If you want to use the administrative Office policy templates to manage settings on domain computers, you need to copy policy files (with overwrite) to the folder \\contoso.com\SYSVOL\contoso.com\policies\PolicyDefinitions on the Active Directory domain controller (create the PolicyDefinitions folder manually if you have not got one). This catalog is the centralized repository of administrative templates in domain(Group Policy Central Store).

If you open the Local Group Policy Editor (gpedit.msc) or the Group Policy Management Console (gpmc.msc), you will see that new sections to manage Office 2016 products appear under User Configuration and Computer Configuration Administrative Template nodes of your GPO console.To install gpmc.msc on a workstation running Windows 10, you must install the Rsat.GroupPolicy.Management.Tools~~~~0.0.1.0 module from RSAT for Windows 10.

In the same way you can copy the administrative templates for Office 2010 and Office 2013 (if they are used on PCs in your domain) to PolicyDefinitions central store on the domain controller. The screenshot below shows that there are administrative templates for Office 2007, 2010, 2013 and 2016 in the GPO editor. All these templates are stored on the AD domain controllers (this is evidenced by the message Policy definitions (ADMX files) retrieved from the central store).

Managing Office 2016/2019 Program Settings via GPO

Suppose, we have to change the settings of some programs of the Office suite on all domain computers. If you don’t know, in which section of the GPO tree the specific setting of an Office app is configured, you can find it in the office2016grouppolicyandoctsettings.xlsx help file.

• Open the Group Policy Management Editor (GPMC.msc) and create a new GPO object;
• Edit the new GPO object;
• For example, let’s enable the following policy settings:
  1. Enable cached Exchange mode for Outlook 2016 – it is the policy Use Cached Exchange Mode for new and existing Outlook profiles in the User Configuration –> Policies –> Administrative Templates –> Microsoft Outlook 2016 –> Account Settings–> Exchange–> Cached Exchange Mode.
     
  2. Deny attachments preview in Outlook – the policy Do not allow attachment previewing in Outlook (User Configuration –> Policies –> Administrative Templates –> Microsoft Outlook 2016 –> Preferences –> E-Mail Options);
     
  1. Disable macros in Word 2016 –the policy VBA Macro Notification Settings with the value Disable All With Notification (… Microsoft Word 2016 –> Word Options –> Security –> Trust Center).
     
• Then assign this GPO to an OU containing user accounts (Link an Existing GPO) and after updating the policies on the clients, new settings will be applied to Outlook 2016 and Word 2016 apps.

So we have considered how to manage Word, Access, Excel, Outlook, etc. settings on the domain computers using Group Policy ADMX templates.