Office 2013 Resource Kit

Published: July 16, 2012

Summary: Lets you know what's available in the Office 2013 Resource Kit.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

The documentation is intended for IT professionals who plan, implement, and maintain Office installations in their organizations. New and updated content s published regularly.

Office 2013 logo The following table provides links to major sections of content in the Office Resource Kit:

Office 2013 Office Resource Kit articles on TechNet

Section | Description
Newly published content for the Office 2013 Resource Kit | Contains a list of new and updated technical content for Office 2013.
What's new in Office 2013 | Contains a list of content that will help you explore the new features, resources, and tools that are available to you in Office 2013.
Compatibility in Office 2013 | Contains a list of new and updated content that will help you evaluate Office 2013 compatibility in your organization.
Plan and Deploy Office 2013 | Contains a list of content that includes how-to information for specific deployment tasks, such as customizing an installation, and installing Office 2013 on users' computers. It also provides information about the new licensing options for Office 2013, including instructions for configuring the infrastructure for volume licensing and activation.
Manage Office 2013 | Contains a list of content that provides information about how to change users' configurations after Office 2013 is installed in your organization.
Office Anywhere in Office 2013 | Contains a list of content that provides information about how to work with Office 2013 regardless of where people are or what devices they're using.
User Readiness for Office 2013 | Provides information about what's available to help you prepare users in your organization to work with Office 2013 and Office 365.
Office 2013 Glossary | Contains a list of Office terms and definitions that are either new or updated for Office 2013.
Downloadable content for the Office 2013 Resource Kit | Contains a list of content in the Office 2013 Resource Kit that is available as a download.
Note:

Versions of the Office Resource Kit that were published before the Office 2007 version included downloadable tools to make deployment easier. Beginning with the 2007 Microsoft Office system, these tools are included within the product; no separate download is required. To view the Office Resource Kit content for earlier versions of Office, see the "Other Resources" section in 2007 Office System Suites and Programs.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


Newly published content for the Office 2013 Resource Kit

Updated: June 25, 2013

Summary: Find new and updated content for Office 2013 articles for IT pros on TechNet.

Applies to: Office 2013 | Office 365 ProPlus

This article contains a list of new and updated content for Office 2013. It is updated regularly. For additional updated content, see the Office IT pro blog.

June 24, 2013 | June 17, 2013 | May 13, 2013 | May 6, 2013 | April 29, 2013 | April 15, 2013 | April 8, 2013 | March 18, 2013 | March 11, 2013 | March 4, 2013 | February 25, 2013 | February 18, 2013 | February 11, 2013 | February 4, 2013 | January 21, 2013 | January 14, 2013 | January 7, 2013 | December 17, 2012 | December 10, 2012 | December 3, 2012 | November 26, 2012 | November 12, 2012 | November 5, 2012

Published the week of June 24, 2013

Updated article

Overview of apps for Office 2013 Added a section about managing the performance of apps for Office.

Published the week of June 17, 2013

Updated article

Overview of Group Policy for Office 2013 Added a note that describes which editions of Office can be managed by using Group Policy, and added lync15.admx to the list of Office 2013 Administrative Templates.

Published the week of May 13, 2013

Updated article

Overview of Outlook 2013 planning Added a section that discusses what to consider for 32-bit Outlook applications when you upgrade to a 64-bit platform.

Published the week of May 6, 2013

Updated articles

Plan Information Rights Management in Office 2013 Added an alert that you can no longer apply IRM by using a Microsoft Account.

Changes in Office 2013 Added Security section with an entry about how you can no longer apply Information Rights Management by using a Microsoft Account.

Manage privacy settings in Telemetry Dashboard Updated and reorganized the appendix that describes the data that Telemetry Agent collects.

Published the week of April 29, 2013

New articles

Custom reporting and database schema reference for Telemetry Dashboard Describes how to create custom reports in Telemetry Dashboard, shows sample reports, and lists the tables and fields in the telemetry database.

Internet Protocol version 6 support for Office 2013 Provides Internet Protocol version 6 (IPv6) addressing information for Office 2013 applications, Project 2013, and SharePoint Designer 2013.

Published the week of April 15, 2013

Updated article

Deploy volume activation of Office 2013 Updated the example output of the slmgr.vbs /dlv command (near the end of the article) so that it shows the output for Office 2013.

Published the week of April 8, 2013

New articles

Content roadmap for Office 2013 identity, authentication, and authorization Provides a guide to identity and authorization content for IT Pros deploying Office 2013 and Office 365, including articles, blogs, and downloads.

Published the week of March 18, 2013

New articles

Identity, authentication, and authorization in Office 2013 Contains a list of articles that help you understand and plan for Information Rights Management and other identity and authentication requirements.

Protection settings for Office 2013 Contains articles that help you plan the protection settings you will need when you deploy Office 2013.

Trust Center settings for Office 2013 Contains articles that help you plan and configure the Trust Center settings for Office 2013.

Content roadmap for Office 2013 security Provides a guide to security-related articles, blogs, and downloads for IT pros deploying Office 2013.

Updated articles

Click-to-Run for Office 365 Setup architecture overview Added information about the ports, protocols, and URLs that Click-to-Run for Office 365 uses.

Deploy Telemetry Dashboard Added information about supported service packs for Windows clients that run Telemetry Agent. Also added information about Telemetry Agent licensing.

Published the week of March 11, 2013

Updated article

Compare security features in Office 365 and Office 2013 SKUs Updated some service descriptions and added some caveats.

Published the week of March 4, 2013

Updated article

Changes in Office 2013 Added a new section for PARC changes.

Published the week of February 25, 2013

Updated articles

Office Customization Tool (OCT) reference for Office 2013 Added information about a known issue about changing locations for Office 2013 applications and provided a link to a KB article.

Content roadmap for Office 2013 compatibility Added information about the Fix-it Center diagnostic tools that are linked from Telemetry Log.

Published the week of February 18, 2013

New articles

Plan and configure Trusted Publishers settings for Office 2013 Explains how to use the Trusted Publishers list in Office 2013 to designate content publishers that you trust.

Plan COM object categorization settings for Office 2013 Explains how to use COM object categorization to control the behavior of certain COM objects in Office 2013.

Plan cryptography and encryption settings for Office 2013 Explains the settings that you can use to encrypt data in Office 2013, and provides information about compatibility with previous versions of Office.

Plan password complexity settings for Office 2013 Explains how to use the Office 2013 password settings to enforce password requirements.

Plan privacy options for Office 2013 Explains how Office 2013 privacy settings let you control the disclosure of private information.

Published the week of February 11, 2013

Updated article

System requirements for Office 2013 Updated the information about operating system requirements and about Lync Server requirements.

Published the week of February 4, 2013

New articles

Troubleshoot volume activation for Office 2013 Explains how to troubleshoot common errors for volume activation of Office 2013.

Plan and configure Trusted Locations settings for Office 2013 Explains how to use the Trusted Locations feature in Office 2013 to differentiate safe files from potentially harmful files.

Plan file block settings for Office 2013 Provides information about the settings to block specific file format types for Excel 2013, PowerPoint 2013, and Word 2013 users.

Plan Office File Validation settings for Office 2013 Explains how Office File Validation settings can help prevent file format attacks in Office 2013.

Plan Protected View settings for Office 2013 Explains how to configure Protected View settings in Office 2013.

Plan security settings for ActiveX controls for Office 2013 Explains how to change settings to make Microsoft ActiveX controls safer in Office 2013 and how to Use Office 2013 Telemetry Dashboard to investigate ActiveX control warnings.

Plan security settings for add-ins for Office 2013 Explains how to control the way that add-ins behave in Office 2013, and how to prevent users from running add-ins.

Plan security settings for VBA macros for Office 2013 Explains how VBA and VBA macros settings control the way Visual Basic for Applications (VBA) and VBA macros behave in Office 2013.

Understand security threats and countermeasures for Office 2013 Explains how Office 2013 security features can mitigate risks and threats to your organization's Office assets, documents, and processes.

Monitor Office compatibility and deployments by using Telemetry Dashboard Explains how to view the stability of Office documents and solutions and the status of your Office deployments by using Telemetry Dashboard.

Updated article

Downloadable content for the Office 2013 Resource Kit Added links to and descriptions of the white paper, "Microsoft Office Web Apps Server Management Pack Guide for System Center Operations Manager" and the poster, "Telemetry in Office 2013: A new way to Assess Office Compatibility."

Published the week of January 21, 2013

New articles

Remove or reset file passwords in Office 2013 Explains how to use the Office 2013 DocRecrypt tool to unlock password protected OOXML formatted Word, Excel, and PowerPoint files.

Configure feature installation states for Office 2013 Explains how to use the Office Customization Tool (OCT) to specify how Office 2013 features are installed for Windows Installer-based Office 2013 installations.

Configure user settings for Office 2013 Explains how to use the Office Customization Tool (OCT) to configure user and computer default settings before you deploy Office 2013.

Use the OCT to customize Office 2013 Explains how to use the Office Customization Tool (OCT) to customize Windows Installer-based Office 2013 installations.

Updated articles

System requirements for Office 2013 Added information that, to use the Inquire add-in with Excel, you must have and .NET 4.0 or 4.5 installed.

Published the week of January 14, 2013

Updated articles

Changes in Office 2013 Added information about KB article 2792179 in the "Open Software Foundation" (OSF) table.

Plan and Deploy Office 2013 Added the "Outlook" section.

Published the week of January 7, 2013

New articles

Outlook 2013 features supported by different versions of Exchange Server Learn which Outlook 2013 features are supported by each version of Exchange Server.

Plan attachment settings in Outlook 2013 Provides information about how to use Group Policy to configure attachment security settings for Outlook 2013.

File format reference for Office 2013 Provides information about the file formats that are supported in Word 2013, Excel 2013, and PowerPoint 2013.

Group Policy and Office Customization Tool settings in Office 2013 for OpenDocument and Office Open XML formats Provides information about the Group Policy settings and the Office Customization Tool (OCT) settings that address OpenDocument Format and Open XML Formats in Office 2013.

XML file name extension reference for Office 2013 Provides information about XML file formats and their extensions that are used by Word 2013, Excel 2013, PowerPoint 2013, and Visio 2013.

Published the week of December 17, 2012

New articles

Compare security features in Office 365 and Office 2013 SKUs Provides information that makes it easy for IT professionals to see which security features are in which SKUs. The information applies to both Office 365 and Office 2013.

Distribute updates for Office 2013 products Explains the software updates process and how to deploy updates for Windows Installer-based Office 2013, Project 2013, and Visio 2013.

Published the week of December 10, 2012

New article

End user training resources for Office 2013 and Office 365 Provides links to resources to help users in an organization learn about Office 2013 applications and Office 365.

Updated article

Office 2013 Resource Kit Added "Office Anywhere" and "User Readiness" to the list of sections covered in the Office Resource Kit.

Published the week of December 3, 2012

New article

Content roadmap for Office 2013 compatibility Provides information about the articles, downloads, scripts, and videos that help IT professionals assess Office 2013 compatibility.

Updated articles

Deploy volume activation of Office 2013 Added a note that says you can set up an Office 2013 KMS host on the same computer that contains an Office 2010 KMS host if you are using any of the indicated operating systems.

Plan volume activation of Office 2013 Added a note that says you can set up an Office 2013 KMS host on the same computer that contains an Office 2010 KMS host if you are using any of the indicated operating systems.

Volume activation methods in Office 2013 Added two notes: One about side-by-side installations of Office 2010 and 2013 KMS hosts, and one about Office 2013 activation on Windows Server 2012.

System requirements for Office 2013 Updated to state that MSI and Click-to-Run installations of Office 2013 require that Task Scheduler be enabled on the client computers and that attempts to install Office 2013 will fail if Task Scheduler is disabled.

Published the week of November 26, 2012

New articles

Overview of Office Telemetry Provides information about Office Telemetry, the new compatibility monitoring framework that works with Office 2013, Office 2007, and Office 2003.

Configure and deploy Telemetry Dashboard Provides information about what's available to help you deploy and configure Telemetry Dashboard in your organization.

Updated articles

Changes in Office 2013 Added information to the Word table about changes in the Spelling error context menu.

Deploy Telemetry Dashboard Removed the section on Telemetry Dashboard worksheets and moved the content to new article, "Overview of Office Telemetry."

Published the week of November 12, 2012

New article

Plan for Telemetry Dashboard topology and hardware Provides information about sizing, topology, hardware, and bandwidth recommendations for Telemetry Dashboard deployments.

Updated articles

Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013 Added settings in the following categories: Apps for Office, Escrow Key, OneNote, Services for online Office 2013 features, and Subscription activation.

Changes in Office 2013 Added several changes for various Office products, including Access, Excel, PowerPoint, Visio, and others.

Published the week of November 5, 2012

New articles

Configure Information Rights Management in Office 2013 Provides information about how to turn on Information Rights Management (IRM), configure license caching, set email expiration, and deploy rights policy templates.

Configure security by using OCT or Group Policy for Office 2013 Provides information about how to configure Office security by using the Office Customization Tool (OCT), Administrative Templates and Group Policy, or the Trust Center.

Plan digital signature settings for Office 2013 Provides information about how to support XAdES digital signatures in Excel 2013, PowerPoint 2013, and Word 2013 documents.

Updated article

Office 2013 compatibility guide Added a short section that describes Office Telemetry and Telemetry Dashboard.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support

Change History

Date | Description
June 25, 2013 | One updated article for the week of June 24.
June 18, 2013 | One updated article for the week of June 17.
May 14, 2013 | One updated article for the week of May 13.
May 07, 2013 | Updated content for the week of May 6.
April 16, 2013 | Updated content for the week of April 15.
March 05, 2013 | Updated article for March 5.
February 26, 2013 | Updated articles for the week of February 25.
February 19, 2013 | New content for February 19, 2013.
July 16, 2012 | Initial publication


What's new in Office 2013

Published: July 16, 2012

Summary: Contains articles that will help you explore the new features, resources, and tools available to you in Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 provides features that help IT administrators configure, validate, deploy, and protect Office installations in their organizations.

Office 2013 logo The articles in the following table provide information about system requirements and new features and improvements in the Office 2013 suites that are relevant to IT professionals.

Exploring Office 2013 - articles on TechNet

Article | Description
System requirements for Office 2013 | Provides information about the standard system requirements for Office 2013 and the additional requirements of some Office 2013 applications.
What's new for IT professionals in Office 2013 | Describes new features that are found in Office 2013.
What's new in Outlook 2013 | Describes the new and changed features in Outlook 2013.
Changes in Office 2013 | Explains which features have been changed or removed since Office 2010 was released.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


System requirements for Office 2013

Updated: February 12, 2013

Summary: Provides information about the standard system requirements for Office 2013 and the additional requirements of some Office 2013 applications.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

This article outlines the system requirements for all versions of Office 2013, whether on-premises, Microsoft cloud hosted, or a hybrid of the two. If you are upgrading from earlier versions of Microsoft Office to Microsoft 2010, refer to the article System Requirements for Office 2010.

You may have to upgrade your hardware or operating system, or both, before you can use Office 2013. This article will help you determine whether you do have to do that.

Note:

Office 2013 is supported for both 32-bit (recommended) and 64-bit client applications. For more information, see 64-bit editions of Office 2013. You may also want to read Choose the 32- or 64-bit version of Microsoft Office, which will help you decide which version of Office to install.

We recommend that you install Silverlight together with Office 2013 to improve the online experience.

Important:

MSI and Click-to-Run installations of Office 2013 require that Task Scheduler be enabled on the client computers. If you have set up Group Policy to disable Task Scheduler, or if a single client computer has Task Scheduler disabled, attempts to install Office 2013 will fail.

In this article:

  • Office 2013 for personal computers - standard system requirements

  • Office 2013 applications - specific requirements

Office 2013 for personal computers - standard system requirements

Refer to the following table for a snapshot of the overall system requirements for Office 2013. The following suites are included:

  • Office Home and Student 2013

  • Office Professional Plus 2013

  • Office Standard 2013

  • Office Home and Business 2013

  • Office 365

  • Office 365 ProPlus

  • Office 365 Home Premium

  • Office 365 University

The information that follows this table outlines any additional requirements for specific components of Office 2013, including add-ons and tools.

When you choose a product suite or individual program to deploy, evaluate the computers before you deploy any software to make sure that they meet the minimum operating system requirements.

Standard system requirements for Office 2013

Component Office 2013 requirements

Computer and processor

1 gigahertz (GHz) or faster x86- or x64-bit processor with SSE2 instruction set

Memory (RAM)

1 gigabyte (GB) RAM (32-bit); 2 gigabytes (GB) RAM (64-bit)

Hard Disk

3.0 gigabytes (GB) available

Display

Graphics hardware acceleration requires a DirectX10 graphics card and a 1024 x 576 or higher resolution monitor

Operating System

Office 2013 runs on 32-bit and 64-bit versions of Microsoft Windows operating systems. When you run Office 2013 32-bit on a 64-bit version of a Windows operating system, the program runs in the 32-bit layer of the Windows operating system. For more information, see 64-bit editions of Office 2013. Here are supported Windows operating systems on which you can run Office 2013 32-bit and 64-bit programs.

Office 2013 32-bit products are supported on the following Windows operating systems:

  • Windows Server 2008 R2 (64-bit)*

  • Windows 7 (32-bit or 64-bit)

  • Windows Server 2012 (64-bit)**

  • Windows 8 (32-bit or 64-bit)

Office 2013 64-bit products are only supported on the following Windows operating systems:

  • Windows Server 2008 R2 (64-bit)*

  • Windows 7 (64-bit)

  • Windows Server 2012 (64-bit)**

  • Windows 8 (64-bit)

*Windows Server 2008 R2 is available only in 64-bit architecture

**Windows Server 2012 is available only in 64-bit architecture

Note:

No support is provided for side-by-side installations of 32-bit and 64-bit editions of Office. For example, there is no support for side-by-side installations of Office 2010 32-bit with Office 2013 64-bit, or for Excel 2010 64-bit and Visio 2013 32-bit.

Lync Server 2013 is available only in a 64-bit edition, which requires hardware and a 64-bit edition of the Windows Server operating system. A 32-bit edition of Lync Server 2013 is not available with this release.

Browser

Internet Explorer 8, 9, or 10; Mozilla Firefox 10.x or a later version; Apple Safari 5; or Google Chrome 17.x.

.NET version

3.5, 4.0, or 4.5

Multi-touch

A touch-enabled device is required to use any multi-touch functionality. But, all features and functionality are always available by using a keyboard, mouse, or other standard or accessible input device. Note that new touch features are optimized for use with Windows 8.

Additional requirements and considerations

Some functionality may vary, based on the system configuration. Some features may require additional or advanced hardware or server connectivity.

Note:

System requirements are rounded up to the nearest 0.5 GB, to be conservative. For example, if we measure an application's required hard disk space to be 1.99 GB, we recommend 2.5 GB of disk space. Our hard disk system requirements are intentionally larger than the actual disk space usage of the software.

A graphics processor helps increase the performance of certain features, such as drawing tables in Excel 2013 or transitions, animations, and video integration in PowerPoint 2013. Use of a graphics processor with Office 2013 requires a Microsoft DirectX 10-compliant graphics processor that has 64 MB of video memory. These processors were widely available in 2007. Most computers that are available today include a graphics processor that meets or exceeds this standard. But, if you or your users do not have a graphics processor, you can still run Office 2013.

Office 2013 applications - specific requirements

The standard Office 2013 system requirements that are listed in the Office 2013 for personal computers - standard system requirements table apply to each Office 2013 application. The following Office 2013 programs have some additional requirements:

  • Access 2013

  • Excel 2013

  • InfoPath 2013

  • Lync 2013

  • Lync Server 2013

  • Office Solution Management (Telemetry Dashboard)

  • OneNote 2013

  • Outlook 2013

  • Project Professional 2013

  • Word 2013

Access 2013

The information in this table outlines additional requirements for specific components of Access 2013.

Specific Access 2013 requirements

Component Requirement

Internet

  • Access 2013 Internet functionality requires an Internet connection and either Internet Explorer 8 or Internet Explorer 9.

  • Instant Search functionality requires Windows Search 4.0.

Excel 2013

The information in this table outlines additional requirements for specific components of Excel 2013.

Specific Excel 2013 requirements

Component Requirement

Internet

  • Excel 2013 Internet functionality requires an Internet connection and either Internet Explorer 8 or Internet Explorer 9.

  • Instant Search functionality requires Windows Search 4.0.

PowerPivot

To use PowerPivot, you must have .NET 3.5 or .NET 4.0 and at least 2 gigabytes (GB) of RAM.

PowerView add-in

To use Excel 2013 with the PowerView add-in, you must have Silverlight 5.0 installed and at least 2 gigabytes (GB) of RAM.

Inquire add-in

To use Excel 2013 with the Inquire add-in, you must have .NET 4.0 or 4.5 installed.

InfoPath 2013

The information in this table outlines additional requirements for specific components of InfoPath 2013.

Specific InfoPath 2013 requirements

Component Requirement

Internet

  • InfoPath 2013 Internet functionality requires an Internet connection and either Internet Explorer 8 or Internet Explorer 9.

  • Instant Search functionality requires Windows Search 4.0.

Programmability

Programmability scenarios require .NET 4.0.

Lync 2013

Lync 2013 has different hardware requirements from those that are listed in the system requirements Office 2013 for personal computers - standard system requirements table above. Refer to the following table for personal computer system requirements or recommendations that are specific to Lync 2013.

Specific Lync 2013 requirements

Component Requirement

Computer/ processor

Intel Pentium 4, AMD Athlon 64, or equivalent

Memory (RAM)

2 gigabytes (GB) RAM

Operating System

Windows 7 or Windows 8

Data and voice

Minimum 1.6 gigahertz (GHz) or faster processor. We recommend 2.0 gigahertz (32-bit or 64-bit).

Video

For VGA: Dual core 1.9 gigahertz (GHz) processor, or faster

For High Definition: Qual core 2.0 gigahertz (GHz) processor, or faster

Display resolution: 1024 x 768

Conferencing

  • Polycom CX5000 HD (Microsoft RoundTable) conferencing device

  • Minimum 2.0 gigahertz (GHz) or faster processor

Graphics Hardware

  • Support for Microsoft DirectX 9 application programming interface (API).

  • Minimum of 128 megabytes (MB) graphics memory

  • Windows Display Driver Model driver

  • 32 bits per pixel capable format

Telephony

Microphone and speakers, headset with microphone, or equivalent device(s). Recommended devices:

  • Phones with the "Optimized for Microsoft Lync" logo (see Phones and Devices Qualified for Microsoft Lync for a list)

  • Phones that run Microsoft Lync 2010 Phone Edition

  • A W15-certified (or equivalent) ADA-compliant phone

Video source

USB 2.0 video camera or Polycom CX5000 HD device (Microsoft RoundTable)

Lync Server 2013

The information in this table outlines additional requirements for specific components of Lync Server 2013.

Specific Lync Server 2013 requirements

Component Requirement

Computer/ processor

Intel Pentium 4, AMD Athlon 64, or equivalent

Memory (RAM)

32 gigabytes (GB) RAM

Operating System

Lync Server 2013 is available only in a 64-bit edition, which requires 64-bit hardware and a 64-bit edition of the Windows Server operating system. A 32-bit edition of Lync Server 2013 isn't available with this release.

Supports 64-bit editions of the following operating systems:

  • Windows Server 2008 R2 with Service Pack 1 (SP1) Standard operating system (required)

  • Windows Server 2008 R2 with Service Pack 1 (SP1) Enterprise operating system (required)

  • Windows Server 2008 R2 with Service Pack 1 (SP1) Datacenter operating system (required)

  • Windows Server 2012 Standard operating system

  • Windows Server 2012 Datacenter operating system

Does not support the following:

  • The Server Core installation option of Windows Server 2008 R2 or Windows Server 2012

  • The Windows Web Server 2008 R2 operating system or Windows Web Server 2012 operating system

  • Windows Server 2008 R2 HPC Edition or Windows Server 2012 HPC Edition

Video

Display with 1024 x 768 resolution

Graphics Hardware

  • Support for Microsoft DirectX 9 API

  • Minimum of 128 megabytes (MB) graphics memory

  • Windows Display Driver Model driver

  • 32 bits per pixel capable format

Office Solution Management (Telemetry Dashboard)

Telemetry Dashboard is installed with Office Professional Plus 2013 and Office 365 ProPlus editions of Office 2013. The information in this table outlines additional requirements for specific components of Office Solution Management Telemetry Dashboard server.

Specific requirements for Telemetry Dashboard

Component | Telemetry Dashboard Server Requirement
Database | SQL Server 2005, SQL Server 2008, or SQL Server 2012
Shared folders | For every 10,000+ users, 11 gigabytes of disk space to act as a temporary store for telemetry data.

OneNote 2013

The information in this table outlines additional requirements for specific components of OneNote 2013.

Specific requirements for OneNote 2013

Component Requirement

Internet

  • OneNote 2013 Internet functionality requires an Internet connection and Internet Explorer 8 or Internet Explorer 9.

  • Instant Search functionality requires Windows Search 4.0.

Outlook 2013

The information in this table outlines additional requirements for specific components of Outlook 2013.

Specific requirements for Outlook 2013

Component Requirement

Internet

  • Outlook 2013 Internet functionality requires an Internet connection and Internet Explorer 8 or Internet Explorer 9.

  • Instant Search requires Windows Search 4.0.

For integration with Exchange

Be sure to connect Outlook 2013 to the supported versions of Exchange: Exchange 2007, Exchange 2010, or Exchange Server 2013. Outlook 2013 is not supported on Exchange 2003.

For integration with Microsoft Exchange Server 2013 and Lync Server 2013 (optional)

Some features require Exchange Server 2013 and Lync Server 2013.

For a list of some new Outlook 2013 features that are enabled with Microsoft Exchange Server 2013 see What's new in Outlook 2013.

For integration with Microsoft Lync (optional)

Office Communicator 2007 R2, Microsoft Lync 2010 and Lync 2013 are supported with Outlook 2013. Office Communicator 2005 and Office Communicator 2007 are not supported.

Inking features

Certain inking features require Windows 7 or Windows 8.

Speech recognition

Speech recognition functionality requires a close-talk microphone and audio output device

IRM

Information Rights Management features require access to a computer that runs Windows Server 2003 with SP1, Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 and Windows Rights Management Services.

Dynamic Calendars

Dynamic calendars require server connectivity.

Advanced

Certain advanced functionality requires connectivity to Exchange Server 2010 or Exchange Server 2007, SharePoint Server 2007, SharePoint Server 2010, or Windows Server 2003 with SP1 running Windows SharePoint Services.

Microsoft ID

Certain features require a Microsoft ID (Windows Live ID).

Project Professional 2013

The information in this table outlines additional requirements for specific components of Project Professional 2013.

Specific requirements for Project Professional 2013

Component Requirement

Visual Reports

To use the Visual Reports feature one of the following versions of Excel must be installed on the computer:

  • Office Excel 2007

  • Excel 2010

  • Excel 2013

and one of the following versions of Microsoft Office Visio:

  • Visio Professional 2007

  • Visio 2010

  • Visio 2013

Import Outlook Tasks feature

To use the Import Outlook Tasks feature, one of the following versions of Outlook must be installed on the computer:

  • Outlook 2007

  • Office Outlook 2010

  • Outlook 2013

SkyDrive integration

Users must have a Windows Live ID.

Project Professional in an Enterprise

  • To enable enterprise Project, portfolio, and resource management capabilities, Project Server 2013 is required.

  • To import tasks to the Outlook calendar or Outlook Tasks list, Project Web App and Exchange Server 2013 are required.

  • To synchronize Project Server 2013 with a SharePoint Server 2013 or SharePoint Server 2010 task list, you must install either Access 2010 or Visio 2010.

  • To create a Project Site from Project Server 2013 you must use SharePoint Server 2013.

  • To use Lync integration, you must have Lync 2010.

Word 2013

The information in this table outlines additional requirements for specific components of Word 2013.

Specific requirements for Project Professional 2013

Component | Requirement
Co-authoring | Co-authoring requires SharePoint Foundation 2013 and a Windows Live ID account for SkyDrive. It might also require more memory than the amount listed in the Office 2013 for personal computers - standard system requirements table above.

Change History

Date | Description
February 12, 2013 | Updated information about operating system requirements and about Lync Server requirements.
July 16, 2012 | Initial publication


What's new for IT professionals in Office 2013
See also

Published: July 16, 2012

Summary: Discover the new features that are in Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 provides new features and improvements that help IT administrators configure, validate, deploy, and protect their Office installations. This article describes some changes in these areas.

In this article:

  • Active Directory-Based activation

  • Apps for Office

  • Click-to-Run

  • Click-to-Run customization

  • Co-Authoring

  • Access 2013: new application model

  • New Group Policy and OCT settings

  • Telemetry Dashboard and Telemetry Log

  • Office Web Apps

  • Office Web Apps Server

  • Security changes

  • Sign-in IDs

  • Downloadable proofing tool packages

  • Additional resources

Active Directory-Based activation

Volume activation establishes a relationship between the Volume License (VL) product key and a particular installation of the VL software on a device. Microsoft policy requires you to activate VL editions of Office 2010 and Office 2013 that run on both physical computers and virtual machines.

When Office 2013 runs on Windows 8 or Windows Server 2012, a new volume activation method is available: Active Directory-based activation.

Active Directory-Based activation uses your existing Active Directory infrastructure to activate all Office 2013 VL clients through their connection to the domain. To set up Active Directory-Based activation for Office 2013, configure Active Directory Domain Services (AD DS) from either a Windows 8 VL edition computer or a Windows Server 2012 computer. The Office 2013 VL clients can automatically activate against the domain as long as they are running on a Windows 8 or Windows Server 2012 client computer.

For more information about Active Directory-Based Activation, see Active Directory-Based Activation Overview.

Note:

The two volume activation methods that were introduced in Office 2010: Key Management Service (KMS) and Multiple Activation Key (MAK), are still valid for Office 2013.

Apps for Office

Developers use apps for Office to create engaging new consumer and enterprise experiences that run within supported Office 2013 applications by using the power of the web and standard web technologies such as HTML5, XML, CSS3, JavaScript, and REST APIs.

An app for Office is basically a webpage that is hosted inside an Office client application. You can use an app for Office to extend the functionality of a document, email message, or appointment. The apps in apps for Office can run in multiple environments and clients. These include rich Office desktop clients, Office Web Apps, mobile browsers, and also on-premises and in the cloud. Developers can publish apps for Office to the Office Store or to an onsite catalog, where they can be available to users from their Office 2013 applications. As the IT Administrator of your organization, you can control how the apps for Office become available to users.

For more information, see Overview of apps for Office 2013.

Click-to-Run

Office 2013 Click-to-Run is a technology that reduces the time that is required to download and use Office 2013 client products. Click-to-Run is based on core virtualization and streaming Microsoft Application Virtualization (App-V) technologies. The streaming technology lets you use a Click-to-Run program before the complete program is fully downloaded and installed on your computer.

Click-to-Run virtualization provides the following advantages:

  • Isolation of resources in a virtual environment allows for coexistence with earlier versions of Office, and improves cleanup and restore processes.

  • Extension points to the computer are published so Office is more integrated. This allows for add-ins to be written.

  • Streaming helps improve performance. The Office package is divided and is uncompressed over time, which optimizes network bandwidth and CPU usage.

For more information about Click-to-Run, see Click-to-Run overview (Office 2013) and Office 2013 Click-to-Run Setup architecture overview.

Click-to-Run customization

Administrators can customize Click-to-Run product installations. Click-to-Run for Office 365 provides a downloadable Office Deployment Tool for Click-to-Run that enables administrators to download Click-to-Run for Office 365 product and language sources to an on-premises location. This is useful in scenarios where administrators want to minimize the demand on the network or want to prevent users from installing from the Internet because of corporate security requirements.

You can download the Office Deployment Tool from the Microsoft Download Center site. The download includes a sample Configuration.xml configuration file. To customize an installation, administrators run the Office Deployment Tool and provide a customized Configuration.xml file. The Office Deployment Tool performs the tasks that are specified by using the optional properties in the Configuration.xml configuration file.

For more information about the Office Deployment Tool for Click-to-Run, see Office Deployment Tool for Click-to-Run, Click-to-Run Configuration.xml file in Office 365 ProPlus, Download Click to Run for Office 365 products by using the Office Deployment Tool, and Deploy Click-to-Run products by using the Office Deployment Tool.

Co-Authoring

Co-authoring simplifies collaboration by enabling multiple users to work productively on the same document without intruding on one another's work or locking out other users. This capability requires no additional server setup and is the default status for documents that are stored in SharePoint 2013 document libraries.

Here are some changes in co-authoring for Office 2013.

  • Co-authoring is now supported in Visio Professional 2013, Word Web App, and PowerPoint Web App.

  • Seeing other editors who join the document to co-author is faster in Word 2013, Excel 2013, PowerPoint 2013, and Visio Professional 2013.

  • Updates are faster when multiple users co-author in the same OneNote page.

Users who co-author also benefit from these changes in Office Web Apps, Office 2013, and SharePoint 2013.

  • Users can view, add, and reply to comments in Word Web App and PowerPoint Web App.

  • Users can open Word files that contain revision marks in Word Web App.

  • Users can easily set document permissions and send sharing notifications by using the Share with People feature in Office 2013 and SharePoint 2013.

For more information about Co-Authoring, see Office Web Apps overview (Used with SharePoint 2013 Products)

Access 2013: new application model

The on-premises version of Access 2013 provides a new application model that uses SharePoint 2013 for hosting and SQL Server for data storage.

Access as a SharePoint app

Access 2013 is now an app for SharePoint, which means that you create Access web apps that run in the browser, and can manage Access as you would any SharePoint app, controlling everything centrally by using SharePoint tools. No additional passwords or logins are required because security is controlled through the same SharePoint infrastructure. Users can discover and share Access apps through the public SharePoint App Store or a private App Catalogue. They can use your app as long as they have a web browser and an Internet connection. Access does not have to be installed on users' devices.

In addition, Access 2013 can open databases created in previous Access versions.

For more information about the new Access 2013 application model, see "New application model" in What's new for Access 2013 developers.

For more information about how to manage SharePoint 2013 apps, see Install and manage apps for SharePoint 2013.

SQL Server back end

If you create an app on a SharePoint Server that your company hosts on premises, Access creates the database in the SQL Server 2012 installation that is selected by the SharePoint administrator. This database stores all the objects and data that your application requires, such as tables, queries, macros, and forms. Whenever users visit the app, enter data, or change the design, they will be interacting with this database behind the scenes. The database created is specific to your app and is not shared with other apps.

SQL Server storage allows for speed, reliability, and scalability of the database long-term. In addition, advanced users can connect directly to the SQL Server database for advanced reporting and analysis with familiar tools such as Excel, Power View, and Crystal Reports.

For more information, see Access 2013 and SQL Server.

More new features

Although these new features are not necessarily targeted to IT Professionals, you should be aware of them.

Access in Office 365

Access 2013 is also available in Office 365. If your Office 365 plan includes SharePoint, Microsoft can host your Access 2013 databases in the cloud. When you create an Access app in Office 365, your data is stored in a SQL Azure database. For more information about Office 365, see Office 365 Small Business Premium or Office 365 Enterprise.

New user features

Access 2013 provides new features that will help users perform tasks faster, and with more efficiency and flexibility. For information about these features, see What's new in Access 2013.

New Group Policy and OCT settings

The Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool download package contains all Group Policy Administrative Template (ADMX/ADML) and Office Customization Tool (OPAX/OPAL) files for installations of Office 2013 (Windows installer-based) and Office 365 ProPlus (Click-to-Run).

For information about the settings that are new, see the related Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013 article.

For information about how to use Group Policy, see Overview of Group Policy for Office 2013.

For information about how to use the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Telemetry Dashboard and Telemetry Log

Office 2013 introduces a new application and document compatibility tool, known as Telemetry Dashboard. It replaces the Office 2010 compatibility tools Office Migration Planning Manager (OMPM), Office Code Compatibility Inspector (OCCI), and Office Environment Assessment Tool (OEAT). Telemetry Dashboard helps speed up Office 2013 deployments by reducing the overall time that is needed for migration planning and compatibility assessment. IT Professionals can use Telemetry Dashboard to identify typically used Office documents and solutions in their organizations and to view application events and crash data for select Office 2013 applications.

A companion tool for Telemetry Dashboard, known as Telemetry Log, is designed for developers and expert users who want to view event data for documents and solutions as they load, run, or raise errors in Office 2013. Telemetry Log shows local event data, whereas Telemetry Dashboard combines this event data for multiple client computers.

For more information, see the following articles:

  • Overview of Office Telemetry

  • Office 2013 compatibility guide

  • Troubleshooting Office files and custom solutions with the Office Telemetry Log

Office Web Apps

When used with SharePoint 2013 on-premises, Office Web Apps provides updated versions of Word Web App, Excel Web App, PowerPoint Web App, and OneNote Web App. Users can view and, depending on the current license, edit Office documents by using a supported web browser on computers and on different mobile devices, such as Windows Phones, iPhones, and iPads.

In addition to new features in Office Web Apps, the architecture and deployment methods have also changed. Office Web Apps is no longer tightly integrated with SharePoint. Instead, it is installed separately as part of Office Web Apps Server, a stand-alone Office server product. You no longer have to optimize the SharePoint infrastructure to support Office Web Apps, and you can apply updates to the servers that run Office Web Apps Server separately and at a different frequency than you update SharePoint.

For more information, see:

  • Office Web Apps overview (Used with SharePoint 2013 Products)

  • Plan Office Web Apps (Used with SharePoint 2013 Products)

Office Web Apps Server

Office Web Apps Server is an Office server product that provides browser-based file viewing and editing functionality for Office files. Office Web Apps Server works together with products and services that support WOPI, the Web app Open Platform Interface protocol. These products, known as hosts, include SharePoint 2013, Lync Server 2013, and Exchange Server 2013. Here are some features that Office Web Apps Server enables for these products:

  • SharePoint 2013 Users can access Office files from SharePoint document libraries by using Word Web App, Excel Web App, PowerPoint Web App, and OneNote Web App. There are many new features and capabilities, such as support for co-authoring in Word Web App and PowerPoint Web App.

  • Lync Server 2013 Users can broadcast PowerPoint presentations by using Lync 2013 and Lync Web App. Broadcasting is improved to support higher-resolution displays and a wider range of mobile devices than in earlier versions. Users who have the appropriate privileges can scroll through a PowerPoint presentation independent of the presentation itself.

  • Exchange Server 2013 In Outlook Web App, all attachments in an email message are displayed in a filmstrip that includes a thumbnail of each attachment. Users can preview attachments online in full fidelity.

An Office Web Apps Server farm can provide Office services to multiple on-premises hosts. You can scale out the farm from one server to multiple servers as your organization's needs grow. Although Office Web Apps Server requires dedicated servers that run no other server applications, you can install Office Web Apps Server on virtual machine instances.

Deploying and managing Office Web Apps Server across an organization is easier now that it is a stand-alone product. You can apply updates to the Office Web Apps Server farm separately and at a different frequency than you can when you update SharePoint Server, Exchange Server, or Lync Server. Having a stand-alone Office Web Apps Server farm also means that users can view or edit Office files that are stored outside SharePoint 2013, such as those in shared folders or in document management products that support WOPI.

For more information, see:

  • Office Web Apps Server overview

  • Plan Office Web Apps Server

Security changes

Several new security features make it easier for users and IT professionals to use and trust Office 2013 applications and documents. These include the following:

  • Authentication in Office The days are over for providing a password multiple times as users conduct normal business, opening multiple Office files from different locations. Now users create a profile, sign in one time, and can seamlessly work on and access local and cloud Office files and not be required to re-identify themselves. Users can connect multiple services such as an organization's SkyDrive or a user's personal SkyDrive account, to their Office profiles and have instant access to all files and their associated storage. Users authenticate one time for all Office applications, including SkyDrive. This is true regardless of the identity provider (Microsoft account and the user ID that you use to access Office 365) or the authentication protocol that is used by the application (for example, OAuth, forms based, claims based, or Windows Integrated Authentication). From a user perspective, it all just works. From the IT perspective, these connected services can easily be managed. For more information, see Overview of Office 365 ProPlus.

  • File password escrow key Office 2013 includes new functionality that lets admins unlock password-protected Office files when, for example, the file owner either forgets the password or leaves the organization. By using a new Escrow Key Admin Tool, IT personnel can easily assign a new password to the file, or no password, and can save the file to the same location or a new location. You can download the Escrow Key Admin Tool from the Connect site.

  • Digital signature Several digital signature improvements were made for documents that were created by using Office 2013 applications.

    • Users can now digitally "sign" Open Document Format (ODF v1.2) files by applying an invisible digital signature.

      Plus, Office 2013 will verify signatures on ODF files that were created by using other applications.

    • XAdES digital signatures in documents that are created by using Office 2013 applications are now easier to create. XAdES signed Office 2013 documents allow signers to add their addresses, titles, and to describe the intent of their signatures. Office 2013 will also evaluate -XL signatures by using the certificates and any revocation data that is contained in the file

  • Information Rights Management Office 2013 incorporates new Windows 2012 Active Directory Rights Management Services (AD RMS) features. Support for multiple user IDs for access to Office 365 and single sign-on means that choosing an identity and protecting content is much easier for users. Behind the scenes, this new functionality and automatic service discovery eliminate the need for registry configuration.

  • Enhancements to Office 2013 documents opened in "protected view" This is a feature that was introduced in Office 2010 and helps reduce exploits by opening files in a restricted sandboxed application container "lowbox" so that they can be examined before editing. New Windows 8 capabilities mean stronger process isolation and an application container that is blocked from network access.

For more information about security for Office 2013, see Overview of security in Office 2013 and Content roadmap for Office 2013 security.

Sign-in IDs

In Office 365, users can sign in by using either of two types of credentials: Personal (Microsoft account) or Organization (the Office 365 user ID that is assigned by the organization). The user supplies these credentials within the user interface (UI) or they can be picked up from the operating system in certain cases.

You can enable one of four sign-in states by using the Block sign-in to Office setting in the Registry. This setting controls whether users can provide credentials to Office 2013 by using either their Microsoft account or the Office 365 user ID assigned by the organization.

The Registry key for this setting is as follows:
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\SignIn\SignInOptions

If you enable this setting, you can specify a particular sign-in option by setting one of the following values:

  • 0 Both IDs allowed

  • 1 Live ID only

  • 2 Org ID only

  • 3 None allowed

The following table shows what users can do when you set a particular sign-in option:

Sign-in options and their effect

If you select this… | This is what a user can do…
Both IDs allowed | Sign in and access Office content by using either ID.
Live ID only | Sign in only by using a Microsoft account.
Org ID only | Sign in only by using the Office 365 user ID that is assigned by your organization.
None allowed | Can't sign in by using either ID.

If you disable, or do not configure, the Block sign-in to Office setting, the default setting is Both IDs allowed. Users can sign in by using either ID.

Office 2013 automatically bootstraps itself by using any Active Directory Domain Services (AD DS) account through which the user signed in to the operating system. If that Active Directory account is federated with Office 2013, the user automatically receives all benefits of signing into Office 2013 without having to perform any additional steps.

For more information about federating your domain by using Office 365, see Prepare for single sign-on.

Downloadable proofing tool packages

Beginning in Office 2013, free downloadable proofing tool packages in 52 languages are available to all customers who have purchased the on-premises (MSI-installed) version of Office 2013, whether or not they are volume license customers. You can download these proofing tool packages in 32-bit or 64-bit versions from Office Proofing Tools. For more information, see Downloadable proofing tool packages in Companion proofing languages for Office 2013.

Additional resources

For information about application-specific changes in Office 2013, see Changes in Office 2013.

See also

System requirements for Office 2013
Changes in Office 2013
What's new in Outlook 2013
Content roadmap for Office 2013 compatibility
Content roadmap for Office 2013 security

Content roadmap for Office 365 ProPlus


What's new in Outlook 2013

Published: October 11, 2012

Summary: Learn about the new and changed features in Outlook 2013.

Applies to: Office 2013 | Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

New features in Outlook 2013 and other changes since the release of Outlook 2010 may affect your migration considerations. This article lists some of the new features and migration considerations. If you are upgrading from Outlook 2007, see also Changes in Outlook 2010.

Important:

This article is provides content for administrators who configure and deploy Outlook for their organizations.

Are you looking for what's new in Outlook 2013 on your desktop? You may be looking for What's new in Outlook 2013 for information workers.

In this article:

  • What's new

  • What's changed

  • Migration considerations

What's new

The following table highlights new features in Outlook 2013.

Additions/Changes in Outlook 2013

Addition/change Description

Attachment Reminder

Before an email message is sent, Outlook 2013 can detect if an attachment was omitted from the message and notify the user. Users can turn off the Attachment Reminder in Outlook 2013 by selecting Don't show this message again in the Attachment Reminder dialog box or by going to File, Options, Mail and under Send messages, selecting Warn me when I send a message that may be missing an attachment.

Exchange ActiveSync (EAS)

Exchange ActiveSync is a protocol that lets Outlook 2013 connect to services such as Outlook.com to access email, calendar, contacts and tasks. For more information, see Exchange ActiveSync in Plan feature customizations in Outlook 2013 and Exchange Server 2013: Exchange ActiveSync.

Add-in resiliency

To make Outlook more resilient, by default, Outlook 2013 turns off any add-in that adversely affects performance, resiliency, or reliability of Outlook. Users can view and re-enable add-ins by going to File, View Disabled Add-ins in Outlook 2013. If you, as the IT Administrator, do not want Outlook 2013 to automatically disable an add-in when it affects performance, you can use the Outlook Group Policy template (Outlk15.admx) to set the Group Policy option: List of managed add-ins. You can find this setting under User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous. For more information, see Add-ins in Plan feature customizations in Outlook 2013.

Cached Exchange Mode Improvements

Sync Slider and Exchange Fast Access are two new features that are available with Cached Exchange Mode. By default, they are enabled when Cached Exchange Mode is enabled.

Sync Slider allows an Outlook 2013 user to limit the number of email messages that are synchronized locally in an Outlook data file (.ost). By default, if Cached Exchange Mode is enabled, Outlook 2013 will only cache email messages from the last 12 months and remove anything older than 12 months from the local cache. Users can view messages that were removed from the local cache by scrolling to the end of an email list in a folder and clicking the message Click here to view more on Microsoft Exchange. Users can also change how much email to keep offline. You, as the IT Administrator, can change the default age or enforce the age of email messages that are removed from the local cache by using Group Policy or the Office Customization Tool.

Exchange Fast Access marries the instant-access of Online Mode with the offline capabilities and syncing robustness of Cached Exchange Mode, specifically in scenarios when syncing data locally would take enough time to be noticed by the user (for example, initial sync, resume, returning from vacation). When you first start Outlook 2013, you will immediately see your most recent email messages and a completely up-to-date calendar. Outlook 2013 caches items in the background to prepare you for offline use without affecting the user's experience.

For more information, see Exchange Fast Access and Sync Slider and Plan a Cached Exchange Mode deployment in Outlook 2013.

IMAP improvements

In Outlook 2013, IMAP network operations occur in the background instead of the foreground. After Outlook opens, IMAP users can see existing mail in their Inboxes just as quickly as a Cached Exchange Mode user would. Similarly, when IMAP users choose to view another IMAP folder, they can also see existing mail as quickly as a Cached Exchange Mode user would.

In Outlook 2013, IMAP users are notified when a new IMAP email message is received. Also when a user creates IMAP as a primary account, the IMAP account folders are displayed much like Exchange accounts are displayed. Outlook 2013 does not create a separate node for the Outlook Data File. For special Outlook folders that do not roam (e.g. Calendar, Contacts, Tasks, Notes), users will see This computer only next to the folder name.

Outlook data file (.ost) compression

By default, when Outlook 2013 is installed, a new compressed version of the Outlook data file (.ost) is created. This new compressed version of the .ost is up to 40% smaller than the .ost files that were created by earlier versions of Outlook. For more information, see Migration considerations and Plan a Cached Exchange Mode deployment in Outlook 2013.

People Hub

The People Hub is the new default view for contacts in Outlook 2013. The People hub includes contacts in users' Outlook profiles and can include contacts from social networks. Also, the Contact Card now aggregates information about the same person from multiple contacts into a single view on the Contact Card. In addition to standard contact information, users can view a contact's social network updates from the social networks they've added if they are friends with that contact on a specific social network or if they have public social network updates.

As with Outlook 2010, IT administrators can manage the social networks that are available for users in Outlook 2013. For configuration information, see Plan feature customizations in Outlook 2013.

Performance improvements

Outlook 2013 starts and exits faster than Outlook 2010. Outlook 2013 performance is faster overall than it is in earlier versions of Outlook.

Weather bar

Weather information for the next 3 days is displayed on the Calendar in the Calendar module. When Outlook 2013 starts for the first time after installation, the weather location is the default city for the market version of Outlook that is installed. Users can change the weather location displayed by selecting Add Location from the drop-down menu next to the city name in the Calendar view. Users can also configure two other options in File, Options, Calendar, Weather:

  • Show weather on the Calendar

  • Show temperature in:Celsius or Fahrenheit

Weather settings are saved per user profile. If there are multiple Exchange accounts in a user profile, the weather location is based on the location that is specified in the user's primary Exchange account. All calendars in a user profile will display the same location for weather.

The following Weather settings can roam depending on the account type:

  • Weather On or Off

  • Celsius or Fahrenheit

  • Weather locations

  • Currently displayed weather location

If the user has the same Exchange account on multiple computers, the user sees the same weather location for all computers. If the user has multiple Exchange accounts, the user sees the weather location that is associated with the primary Exchange account. In this case, the settings associated with the primary Exchange account will roam. If the user does not have an Exchange account and has the same IMAP/POP account on multiple computers, the settings will not roam.

You, as an IT Administrator, can turn this off this feature or change the service the weather information is pulled from by using the Outlook Group Policy template (Outlk15.admx). You can find the settings under User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options. For information, see Weather bar in Plan feature customizations in Outlook 2013.

Exchange Server 2013

The following table describes the new and changed features that are available if you have Exchange Server 2013.

Available with Exchange Server 2013

Additions/changes Description

apps for Outlook

An app for Outlook is a cloud-enabled application that integrates rich, scenario-focused content and services together with Outlook 2013. You can obtain apps for Outlook from the Office Store. Exchange Administrators can make specific apps for Outlook available to their end-users if their Exchange accounts are on Exchange Server 2013.

Data Loss Prevention

Data loss prevention (DLP) is a new feature area in Exchange Server 2013. DLP capabilities help you protect sensitive data and inform users of internal compliance policies. DLP can also help keep your organization safe from users who mistakenly send sensitive information to unauthorized people. The new Exchange DLP features help you identify, monitor, and protect sensitive data by using deep content analysis.

Exchange Server 2013 offers built-in DLP policies that are based on regulatory standards such as personally identifiable information (PII) and payment card industry data security standards (PCI). DLP is extensible so that it can support other policies that are important to your business. Additionally, the new Policy Tips in Outlook inform users about policy violations before they send sensitive data.

For information about how to configure Data Loss Prevention and Policy Tips with Exchange Server 2013, see Data Loss Prevention and Policy Tips.

Site Mailboxes

Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint 2013 documents and Exchange email that use the same client interface. A site mailbox consists of SharePoint 2013 site membership (owners and members), shared storage through an Exchange Server 2013 mailbox for email messages and a SharePoint 2013 site for documents, and a management interface that addresses provisioning and life-cycle needs.

Site mailboxes require Exchange Server 2013 and SharePoint Server 2013 integration and configuration. For more information, see Configure site mailboxes in SharePoint Server 2013.

What's changed

For the list of what's changed in Outlook 2013, see Changes in Office 2013.

Migration considerations

Outlook data files (.pst and .ost)

By default, when Outlook 2013 is installed, a new compressed version of the Outlook data file (.ost) is created. This new compressed version of the .ost is up to 40% smaller than the size of the .ost files that were created in earlier versions of Outlook. If you must keep Outlook 2013 from creating a new compressed Outlook data file (.ost), use the Outlook Group Policy template (Outlk15.admx) to enable the Do not create new OST file on upgrade policy. You can find this setting under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange. For more information, see Plan a Cached Exchange Mode deployment in Outlook 2013.

Outlook profile file (.prf)

With the MSI version of Outlook 2013, you can continue to use the Outlook profile file (.prf) to provide options for specifying additional Outlook settings or MAPI services or deploying one or more personal Outlook data files (.pst). The Outlook 2013 .prf file format has changed but the Outlook 2010, Outlook 2007, and Office Outlook 2003 versions of the file will work with Outlook 2013. If you plan to update the .prf file for an Outlook 2013 deployment, we recommend that you re-create the .prf file by using the Office 2013 Office Customization Tool (OCT) for MSI installations, export the settings to a new .prf file, and use that file to specify the additional Outlook settings or MAPI services that you want.

Note that configuring new Outlook profiles by using .prf files may not be necessary because Outlook can automatically create a new Outlook profile by using the Account Auto Configuration process. For the most part, the only time that you would have to use a .prf file to create an Outlook profile is if you also have to deploy one or more .pst files together with the profile. Otherwise, you can use the OCT for MSI or Click-to-Run installations deploy the registry settings that are listed in Click-to-Run.

Outlook coexistence

You can install a Click-to-Run version of Outlook 2013 to run side-by-side with Outlook 2007 or Outlook 2010, but it is unsupported with earlier versions of Outlook such as Outlook 2003. Also, if you install a Click-to-Run version of Outlook 2013 side-by-side with Outlook 2007 or Outlook 2010, you cannot run them at the same time.

If you must install an older version of Office after you have installed the Click-to-Run version of Office 2013, you must uninstall Office 2013 first. Side-by-side Office versions are only supported when they are installed in ascending version order.

Microsoft does not support installation of the MSI version of Outlook 2013 side-by-side with an earlier version of Outlook.

Click-to-Run

The MSI and Click-to-Run versions of Office 2013 and Outlook 2013 have different configuration options and administration tools. For more information, see Office Customization Tool (OCT) reference for Office 2013 and Office Deployment Tool for Office 2013 Click-to-Run.

To configure Outlook profiles for Click-to-Run installations of Outlook 2013, you may have to deploy one or more of the registry settings that are listed in the following tables.

  • To have Outlook create a new Outlook profile that has the default settings and does not require user intervention, deploy the registry setting that is listed in the following table.

    Create new Outlook profile with default settings

    Root Data type Key Value name Value data

    HKEY_CURRENT_USER

    DWORD

    Software\Policies\Microsoft\Office\15.0\Outlook\Autodiscover

    ZeroConfigExchange

    1 = Create profile with default settings

  • If you have to configure Cached Exchange Mode setting for new profiles, you can also deploy the registry setting that is listed in the following table.

    Configure Cached Exchange Mode setting

    Root Data type Key Value name Value data

    HKEY_CURRENT_USER

    DWORD

    Software\Policies\Microsoft\Office\15.0\Outlook\Cached Mode

    Enable

    0 = Force Online Mode

    1 = Force Cached Exchange Mode

  • If you have to manage the location of the .ost file that is created for a new Cached Exchange Mode profile, you can deploy the registry setting that is listed in the following table.

    Specify location of .ost file

    Root Data type Key Value name Value data

    HKEY_CURRENT_USER

    Expandable String

    Software\Policies\Microsoft\Office\15.0\Outlook

    ForceOSTPath

    Type the full path of the location for the .ost file

If you want to configure the default settings but allow users to change them, you can set the same registry settings as listed above but make the changes under the key Software\Microsoft\Office\15.0\Outlook.

See also

Plan feature customizations in Outlook 2013
Plan a Cached Exchange Mode deployment in Outlook 2013
Changes in Office 2013
64-bit editions of Office 2013

Changes in Outlook 2007
Changes in Outlook 2010
What's new in Outlook 2013 for information workers


Changes in Office 2013

Updated: May 7, 2013

Summary: Find out which features have been changed or removed since Office 2010 was released.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

You can use the following tables to find Office features that are changed or removed in Office 2013.

Important:

Are you looking for information about new features in Office 2013? See What's new for IT professionals in Office 2013.

What's changed or removed

Each of the following tables describes the changed or removed features for a specific Office product.

N/A = Not Available

The following table contains information about what's changed in Access 2013.

Access

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Access Data Projects (ADP)

Access

Fully removing the functionality

Removing the ability to open Access Data Project files.

N/A

N/A

Access 2013 SQL-based databases will replace much of the benefit of ADPs.

There are three possible mitigations for ADPs:

  • Convert the ADP to an Access App solution.

  • Convert the ADP to a linked Access Desktop Database.

  • Convert the ADP to a full SQL-based solution.

    • Import objects into an ACCDE file and then create linked tables to the existing data by using an earlier version of Access.

Changes in Access 2013

Access support of Jet 3.x IISAM

Access

Removing support because the Jet 3.x IISAM driver is no longer available.

An Access 97 user can no longer open an Access 97 database in Access 2013. To upgrade, the user must open the file in Office 2010 or an earlier version, and then open it in Office 2013.

This change affects databases that are linked to Access 97 databases.

N/A

N/A

ACCDB is the recommended format for desktop databases.

Open the Access 97 database file in an earlier version of Access and convert it to a later version. Access 2013 supports Access 2000 and later versions through Access 2010.

N/A

PivotCharts and PivotTables

Access

PivotCharts and PivotTables are removed

There are no options to create PivotCharts and PivotTables in Access 2013.

Office Web components are no longer supported.

Better charting capabilities in Excel.

Use enhanced PivotChart and PivotTable capabilities in Excel.

Charts that are not PivotCharts and that use the MSGraph component are still available in Access 2013. Charts that are created by the Chart Wizard component are still supported.

For background on the Office Web components life cycle, see the following blog post: Office Web Components "Roadmap".

dBASE support removed from Access

Access

Fully removing the functionality

dBASE support is removed so that the user can no longer connect to an external data dBASE database.

Access Data Collection

Access

Fully removing the feature

Cannot create new Data Collection forms.

The data collection feature enabled customers to create data collection forms and send those forms as an e-mail message. When customers returned those e-mail messages, the data was processed and stored in an Access database. Access 2013 cannot create new forms. Access 2013 enables processing data collection forms that are created in earlier versions of Access.

N/A

N/A

N/A

Access 2003 toolbar and menus

Access

Fully removing the feature

You can no longer create Access 2003 toolbar and menus that display in Access 2013. Access 2003 toolbars and menus are displayed in Access 2007 and Access 2010 without the Ribbon. They will not display in Access 2013 but will appear in the Add-ins tab in Access 2013. Custom Ribbon commands are supported.

Removing legacy feature.

N/A

Toolbars display in the Add-ins tab on the Ribbon. Custom Ribbon commands are also supported.

N/A

Access Replication Options

Access

Fully removing the feature

When opening a .mdb file in Access 2010 or older, the Replication Options displays in the Ribbon Database Tools tab. This option is removed from Access 2013

Removing legacy feature.

N/A

N/A

N/A

Access Source Code Control

Access

Fully removing the feature

The Source Code Control add-in lets Microsoft Visual SourceSafe or other source code control systems integrate to allow check-in/check-out of queries, forms, reports, macros, modules, and data. The Developer Source Code Control is not available as an add-in for Access 2013.

Removing legacy feature.

N/A

N/A

N/A

Access Three-State Workflow

Access

Fully removing the feature

The entry points for workflow are no longer available. In UI Macros the Workflow commands are not available. If you open an existing Access 2010 database that has UI Macros with StartNewWorkFlow or Workflow tasks, Access displays a warning.

Removing legacy feature.

N/A

N/A

N/A

Access Upsizing Wizard

Access

Fully removing the feature

The Upsizing Wizard lets you scale up Access database tables to a new or existing Microsoft SQL Server database. This feature is removed for Access 2013

Removing legacy feature.

N/A

N/A

N/A

The following table contains information about what's changed in Assistance and Worldwide Services (AWS).

AWS

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Developer Reference Help | Office | Modifying the feature. | The developer reference Help files that were included with earlier versions of Office are removed from setup and are now available on the Microsoft Developer Network (MSDN). | Content usage is low. MSDN is the logical place for developer reference Help content. | International versions of the developer reference Help is now online. The developer reference Help can now be searched on the Web. The localization team will spend resources localizing more valuable content for customers. Click-to-Run users may notice benefits with the reduced size of the Setup image because many offline Help files are removed. | Developer reference Help is now on MSDN. | N/A

The following table contains information about what's changed in Enterprise Content Management (ECM).

ECM

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Web Analytics

SharePoint 2013 Products

A SharePoint Shared Service is being removed.

The SharePoint 2010 Web Analytics system is being removed and will no longer be available or upgraded. This service was not available for Office 365, and so this change affects only the on-premises SharePoint 2013 product.

N/A

Replaced by a new analytics system that is a subcomponent of the search system. Every click in SharePoint is still logged and still provides a hit count for every document in SharePoint, but user data is made anonymous early in the process and is made scalable to the service.

The data is used as follows:

  • Drive new item-to-item recommendation features.

  • Show view count embedded in various SharePoint and Search UIs.

  • Provide a report of the top items in a site and list.

  • Influence the relevancy algorithm of search.

N/A

N/A

CMIS Consumer Web Part

SharePoint 2013

Fully removing the feature

The Content Management Interoperability Services (CMIS) Consumer Web Part was included as part of the SharePoint Admin Toolkit after the SharePoint 2010 Products launch. This Web Part is not supported in SharePoint 2013. The SharePoint Admin Toolkit also included a CMIS Producer, which is supported and can be upgraded for SharePoint 2013.

CMIS is an open standard for interoperability among ECM repositories. Users would most likely want more than the simple Web Part that is provided in the SharePoint Admin Toolkit. For example, they would want to roll up from multiple repositories. Therefore, the CMIS Producer is what is being developed.

Clarifies the strategy and focus for CMIS.

N/A

About the CMIS Producer and CMIS Consumer Web Part

Document Conversion Services

SharePoint 2013

Fully removing the feature

Document Conversion Services is being removed. This includes the central farm administration UI for configuring and using the service and also the object model (OM). The OM includes the Microsoft.Office.HtmlTrans namespace, some document conversation methods on the SPFile object, and some interfaces within the SharePoint.Publishing namespace.

This service is for converting a document from one format to another, for example, .docx to .html. These conversion scenarios are better served by Word Automation Services and Office Web Apps.

Conversion services that provide better value.

N/A

N/A

Document Conversion Services

SharePoint 2013

Fully removing the feature

Document Conversion Services is being removed. This includes the central farm administration UI for configuring and using the service and also the object model (OM). The OM includes the Microsoft.Office.HtmlTrans namespace, some document conversation methods on the SPFile object, and some interfaces within the SharePoint.Publishing namespace.

This service is for converting a document from one format to another, for example, .docx to .html. These conversion scenarios are better served by Word Automation Services and Office Web Apps.

Conversion services that provide better value.

N/A

N/A

The following table contains information about what's changed in Excel.

Excel

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Application.EnableAnimations in Excel | Excel | disabling the feature | Application.EnableAnimations is being disabled. | This feature does not work with the new animations. Therefore, the ability to turn off animations is being disabled. | Prevent animations from being turned off accidentally. | N/A | N/A

The following table contains information about what's changed in Excel Services.

Excel Services

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Editing workbooks in a browser that has external data connections.

SharePoint eCal (Excel Services) with Office Web Apps Server is installed.

Architectural

Workbooks that have external data connections that require Windows Authentication cannot be edited in the browser. Users who attempt to open them are prompted to open the workbooks in the client.

Workbooks that have database credentials stored in the Secure Store or in the connection string can still be edited.

N/A

Users can get better scale-out and management by using Office Web Apps Server instead of Excel Services.

N/A

N/A

Excel Web App no longer remembers View mode when transitioning a file to Edit mode.

SharePoint eCal (Excel Services) with Office Web Apps Server is installed and is being upgraded to Office 2013.

Admins can configure workbooks to be viewed through Excel Services by using the SharePoint viewer, or through Excel Web App.

Applies only whenExcel Services uses the SharePoint viewer (view mode).

Architectural

If you sort, filter, slice, drill, and so on, in view mode, and then click Edit in Browser, view settings are not available.

N/A

N/A

No. You just have to reapply filters.

N/A

The following table contains information about what's changed in Graphics and Visualizations.

Graphics and Visualizations

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Insert a 3D Cone, Pyramid, or Cylinder Chart | Office | Modification | The user can no longer insert a 3D cone, pyramid, or cylinder chart. However, the user can insert a 3D rectangle and then change the shape type after it is inserted. | There are too many chart choices that are not actually different charts. This makes it difficult to choose a good chart to display data. | Makes it easier to choose a good chart to display data | N/A | N/A
Office 2007/Office 2010 Chart Styles | Office | Modification | The chart styles that were were included with Office 2007 and Office 2010 are no longer available in the UI and are replaced with a new set of styles. However, the chart styles that were included with Office 2007 and Office 2010 are available through the OM. | Refresh content | Refreshed content | N/A | N/A
WordArt conversion | Word only | Modification | The older WordArt objects are now converted to new WordArt objects when you convert legacy Word documents. This changes the way files are saved. | N/A | After conversion, users can take advantage of the additional styling functionality of the new WordArt objects. There is also better consistency between newly inserted WordArt objects and those that are converted from legacy documents. | Use new WordArt objects in converted documents. For Word documents that are not converted, legacy WordArt objects are still available in Word 2013 compatibility mode. | N/A
Chart Contextual Tab Rearranged on Ribbon | Office | Modification | The ribbon arrangement for the chart tools contextual tab is changed. | It was difficult to find commands on the ribbon. | Easier to find the relevant commands | No | N/A
Full Excel for creating a chart in Word and PowerPoint | Office | Modification | In older versions of Office when a user created or edited a chart in Wordor PowerPoint, a full Excel file would open for entering/editing data. In Office 2013, a version of Excel is displayed without the ribbon. The user can open full Excel if it is needed. | Based on user feedback, the old design was overwhelming and made it difficult to create a chart. | Lets the user more easily create a chart in Word or PowerPoint. | N/A | N/A
Microsoft Office Picture Manager | Office and SharePoint Server | Fully removing the feature | Removing the OIS.dll file from Office 2013. | Picture Manager was released with Office 2003. The feature has basically been replaced by Windows Live Photo Gallery. | Windows Live Photo Gallery contains better photo-editing software. | No | N/A

The following table contains information about what's changed in Input Method Editor (IME).

IME

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Removing IME core | IME loaded to any applications. | Modification of Office installation. | Office 2013 setup does not include IME core modules. | The major input scenario has shifted from authoring to casual typing. We prelease the next IME core only in Windows 8, and some Office 2013 integration add-on modules. Office 2013 users will be able to use the latest IME in Windows 8, and Office 2010 IME is provided to Office 2013 users who run Windows 7. | Office 2013 users can use IME for scenarios on Windows 8, and there is no degradation on Windows 7. | Windows 8 IME, and Office 2010 IME for Windows 7users. | N/A

The following table contains information about what's changed in Meetings.

Meetings

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

PowerPoint Broadcast hosted on SharePoint 2013

SharePoint 2013 and PowerPoint

Removing the feature

In Office 2010, the PowerPoint Broadcast feature can be configured to use a SharePoint 2013 site to host broadcasts, in addition to a free public service hosted on Windows Live. In Office 2013, the SharePoint 2013 capabilities are removed.

After a user upgrades to SharePoint 2013, PowerPoint client users will no longer be able to select a SharePoint 2013 site as a host for broadcasts.

Primarily to focus Enterprise offerings on Lync. The free public service hosted on Windows Live will still be available to Office customers.

Lync offers a fuller experience, for example, integrated audio, chat, telecommunications integration. Broadcast provides only a small portion of what is required in a remote collaboration scenario. In Office 2013, the broadcast technology is integrated into the Lync client so that the overall quality of document rendering is the same as in previous broadcasts, and also includes the Lync features.

Windows Live will still be available, and Lync serves as an Enterprise replacement for the scenarios previously covered by the feature. If a user cannot use Windows Live or Lync, there is no specific replacement.

N/A

The following table contains information about what's changed in Office.com.

Office.com

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Clip Organizer

Office

Fully removing the feature

The Clip Organizer feature is removed in Office 2013. This feature was previously available in three modes: a stand-alone application in the Office suite, Insert Clip Art task pane, and through a dialog box for inserting picture bullets, horizontal lines, and so on.

Office.com is no longer robust enough to provide the breadth and variety of media content to meet the needs of Office users. Users are increasingly storing their own images/videos online and also going to search engines or other Internet sites to find media content to include in their Office documents. In addition, enterprise users expect to use media content that is stored in their company's SharePoint Server site(s). The new Insert Media feature in Office 2013 is intended to streamline finding and using media content by making the content available directly within the client experience. The Clip Organizer client does not easily scale out to accommodate a growing set of online media sources. Therefore, to enable this richer set of online media, we are implementing a simpler and lighter-weight client.

With Office 2013, we are moving towards a new model for users to find and insert online media content. This model is not only from the Office.com Clip Art collection, but also from Bing Image/Video search, users' SkyDrive, Flickr, and so on.

In Office 2013, the Clip Organizer application is replaced by the Insert Media dialog box. This feature lets users find and insert content from the Office.com Clip Art collection and other online sources.

Use the Office 2010 stand-alone Clip Organizer application to open local clip collections. Install Clip Organizer by running Office 2010 setup and choosing to install only the Clip Organizer. You can then run Clip Organizer side-by-side with Office 2013.

N/A

New From Existing Option

Office

Modification

In the File > New menu selection in Office and older versions, there is the New from Existing option. In Office 2013, that feature is removed in favor of a shortcut menu option in Recent documents to Open from Copy which functions the same as the New from Existing option.

The New from Existing option was not widely used.

The new feature generally works the way that the old feature did. However, the new feature presents the functionality more as how the user would relate to this task.

Replaced by the Open from Copy option on the shortcut menu of Recent documents. The user discovers the option from the shortcut menu. The replacement is not exactly as the previous option, which enabled the user to browse the computer for the document to use.

This replacement lets the user browse only documents that are already opened, but another feature (accessing the shortcut menu for a document in Windows Explorer and choosing New instead of Open) does allow the old functionality to continue to be used.

Favorite files and folders can also be pinned to the File Open area by choosing the pin icon to the right of the file or folder or by choosing (right-clicking) the file or folder from the Pin to List short-cut menu

N/A

The following table contains information about what's changed in Office Business Intelligence (BI).

Office BI

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Creating SharePoint Server 2010 charts | SharePoint 2013 and Office 2013 | Fully removing the feature | The entry point to create new SharePoint Server 2010 charts is removed from Office 2013. SharePoint Server 2010 charts will still work and can be edited after you upgrade Office 2013, but no new charts can be added. | Investments were made to SharePoint Server 2010 charts to introduce users to BI by letting them create simple charts. These charts are not interactive. The BI strategy is to enable fewer entry points to create rich, interactive charts. Excel and PerformancePoint Services are tools that are available for users to create and publish charts to SharePoint 2013. | Use Excel and PerformancePoint Services, which are existing methods to create and publish charts. | N/A | N/A
Status Indicators List (formerly known as KPI List) | Office | For sites that already use the key performance indicators (KPI) List or Status Indicators List, The feature will continue with the same functionality. For new sites, the feature will no longer be available. | This change affects on-premises users. The Status Indicator List is removed from Office 2013. If the Status Indicator List was used in Office 2010, it will still work fine in Office 2013. The user will be able to create new lists. If the Status Indicator List was not used in Office 2010, the user will be unable to create new lists. | There are multiple options to create these lists, and this can cause confusion for users. To combine this capability into several lists that can be created in Excel, the Status Indicators List is being removed. | Fewer options will make it easier for users to decide which Microsoft BI tool to use. | N/A | N/A

The following table contains information about what's changed in Office Web Apps.

Office Web Apps

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Office Web Apps does not support SharePoint classic mode web applications | SharePoint and Office Web Apps | Functional | Office Web Apps rendering and editing does not work on SharePoint web applications that use classic mode authentication. If you are migrating SharePoint 2010 web applications that use classic-mode authentication to SharePoint 2013, you must convert the migrated SharePoint web applications to claims-based authentication so that they can work with Office Web Apps. | For Office 2013, Office Web Apps is moving to a stand-alone server model that supports only claims-based authentication. | N/A | N/A | Overview of Office Web Apps Server Plan Office Web Apps Server Migrate from classic-mode to claims-based authentication (SharePoint 2013 Preview)

The following table contains information about what's changed in Open Software Foundation (OSF).

OSF

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Add-in Designer

Office 32-bit only

Fully removing the functionality

The following classes will no longer be available. They are currently 32-bit only.

  • MSAddnDr.AddInInstance

  • MSAddnDr.AddInDesigner

The following associated interfaces are no longer registered:

  • IAddinDesignerIAddinInstance

Because VB6 support ended, this dynamic link library (.dll) was marked for removal in Office 2007 and Office 2010. However, it was still included in those Office releases. Office 2013 does not contain this .dll.

This unserviceable component no longer has to be included.

Any of the supported technologies can replace this feature.

If support is still required, re-install the VB6 solution for the add-in after you install the MSI version of Office 2013.

Microsoft Knowledge Base article 2792179: A custom add-in that uses interfaces in the Msaddndr.dll file does not work in Office 2013

The following table contains information about what's changed in Outlook 2013.

Outlook

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Outlook Meeting Workspaces

Outlook

Removing the feature

The Meeting workspaces feature is removed from Outlook. The entry point commands to create Meeting Workspaces is removed from both the Quick Access Toolbar and the Ribbon.

The feature was not widely used.

Allows for a simpler Ribbon experience.

N/A

For the feature description, see Use Meeting Workspaces to organize meetings

Outlook Exchange Classic offline

Outlook

Removing the feature

Offline mode is being removed from Outlook.

Offline mode is a legacy data access method for online mode connections to Exchange Server.

N/A

N/A

N/A

Remove /Cleanfreebusy switch and code

Outlook

Removing the feature

Users can no longer start Outlook by using the /cleanfreebusy switch. If they try this, they will receive the following message: "Cannot start Microsoft Outlook. The command line argument is not valid. Verify the switch you are using."

Because of the removal of the Public Folder Free/Busy feature, this switch is no longer needed.

N/A

N/A

N/A

Command Bars object model (OM)

Outlook

Modification

The Command Bars OM is being changed so that built-in Command Bar objects cannot be accessed through programming.

Command bars are not used in Outlook 2013. Therefore, add-ins that use the Command Bars OM are not required.

N/A

Use the IRibbonExtensibility interface in an Outlook 2013 add-in instead of command bars. You can't customize Inspector ribbons by using VBScript code behind forms.

Updating Earlier Code for CommandBars

For more information about how to use IRibbonExtensibility to customize the Outlook 2013 user interface programmatically, see Extending the User Interface in Outlook 2010.

Outlook Direct Booking

Outlook

Removing the feature

Direct booking of resources in the calendar no longer exists.

This functionality is outdated and is superseded by the Exchange Availability service and free/busy for resources.

More reliable service.

Mailboxes that are currently configured to use Outlook direct booking should be migrated to Exchange 2007 or Exchange Server 2010 resource mailboxes.

Exchange 2007 and Exchange Server 2010 resource mailboxes provide a better range of features. These mailboxes also provide server-side administration by using the Exchange Management Shell or the Exchange Management Console to simplify resource mailbox management.

N/A

Import/Export to Applications

Outlook

Removing specific file-format support from the Import/Export wizard in Outlook

The ability to import/export Outlook data to legacy file formats.

The following legacy formats were removed from the Import/Export Wizard: Internet Mail Account Settings, Internet Mail and Addresses, Comma Separated Values (DOS), Access 97-2003, Excel 97-2003, Tab Separated Values (DOS), Tab Separated Values (Windows), ACT!, Contact Manager, Lotus Organizer, Outlook Express/Windows Mail, Personal Address Book.

N/A

Import/Export to the PST and CSV formats is still a supported option.

Export Outlook items to an Outlook Data File (.pst)

Journal Module and Journaling

Outlook

Removing the feature

The Journal Module is being removed as a top-level module, and auto-journaling is also being removed.

N/A

Replacement is unnecessary.

N/A

N/A

Outlook Links Collection

Office

Removing the feature

Links Collection object model is removed.

Functionality is removed in the UI.

N/A

N/A

N/A

Notes and Journal customization

Outlook

Removing the feature

Notes are now only yellow and medium size.

Keeping the Notes module simple.

Simplifying how Notes are used.

N/A

N/A

Legacy Contact Linking

Outlook

Removing the feature

The capability to link arbitrary Outlook items to Outlook contacts. This contact linking existed only for displaying information in the Activities tab of the contact, which is a feature that is also removed for Outlook 2013.

Contact linking is replaced by the Outlook Social Connector and the New Person Card.

N/A

N/A

N/A

Outlook Activities tab

Outlook

Removing the feature

The Activities tab on contact forms is not available for Outlook 2013. The Activities tab used to aggregate all Outlook items (e-mail, meetings, tasks, and so on) associated with a contact.

N/A

Simplicity

The Activities tab is replaced by the Outlook Social Connector and displays in the People pane.

N/A

Outlook Mobile Service (OMS)

Outlook

Removing the feature

Support for the Outlook Mobile Service protocol, which is used for sending and receiving text messages from Outlook, is being removed.

Feature has low usage.

No user benefit.

N/A

N/A

Suggested Contacts

Outlook

Removing the feature

Suggested Contacts was used to automatically keep track of everyone the user sends a message to, but who isn't in Outlook contacts.

In a clean Outlook 2013 installation, Suggested Contacts is no longer available, the folder never is created, and no suggested contact items are created. In an upgrade to Outlook 2013, this folder is visible, and participates in linking, aggregation and search. However, no new suggested contact items are added to the folder. The folder displays in an upgrade scenario. However, it can now be deleted.

N/A

N/A

N/A

N/A

Outlook Pubcal: Calendar Publishing

Outlook

Removing the feature

Removing the ability to publish one's calendar to Office.com.

N/A

N/A

Users in Exchange Server environments can use Exchange Calendar Publishing.

Non-Exchange users can use a service such as Hotmail to share calendars.

Enable Internet Calendar Publishing

How to keep your family in sync with Hotmail Calendar

Outlook/Exchange Deliver to PST

Outlook

Removing the feature

Removing the ability for users to have Exchange accounts delivering into PST files.

N/A

N/A

N/A

N/A

Dialup/VPN Options

Outlook

Removing the feature

Removing application level dial-up options and VPN options.

Available as part of the operating system.

N/A

Follow operating system instructions for configuring VPN or dial-up networking connections,

For Windows Vista and Windows 7, see Set up an incoming VPN or dial-up connection.

For Windows 8, see Configure a Dial-Up Networking Connection Item.

Public Folder Free/Busy

Office

Removing the feature

Public Folder Free/Busy feature is replaced.

Replaced by the Exchange availability service

Free/Busy functionality is more reliable

Free busy information can be obtained through the Exchange Availability service

Understanding the Availability Service

ToDo Bar

Outlook

Removing the feature

A new functionality is implemented.

A new feature known as Pinned Peeks is implemented to achieve similar functionality.

Pinned Peeks feature

N/A

N/A

User Datagram Protocol (UDP)

Office

Removing the feature

UDP is removed. In earlier versions of Outlook the feature was used for new mail alert results and for folder updates.

The UDP functionality that was provided by UDP is replaced with an asynchronous notification method.

N/A

N/A

N/A

Preview unread messages

Office

Removing the feature

The Auto Preview feature to preview unread items is removed. It remains possible to configure Message Preview for one, two, and three lines.

N/A

N/A

N/A

N/A

Outlook categories quick click

Office

Removing the feature

Categories quick click from the message list is removed. Categories are displayed when they are applied in Office 2013 by right-clicking or using Ribbon buttons.

Low usage. This feature was used by around 1% of users.

Simplicity

Apply categories by choosing from the short-cut menus (right clicking) or by choosing Ribbon buttons.

N/A

Outlook Search through Windows Shell

Office and Windows

Removing the feature

In Office 2013, Outlook items do not display in Windows Shell searches (for example, searches from the Start Menu or by using Win+F). Perform Office searches within Office 2013.

N/A

N/A

Search Office items within the Office application.

N/A

The following table contains information about what's changed in PowerPoint.

PowerPoint

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Save As HTML | PowerPoint | Modification | Removing the ability to save PowerPoint presentations in HTML. | Low usage. | Allows room for features that are popular with users. | N/A | The options to save a presentation as a webpage are not available in the Save As dialog box in PowerPoint 2010

The following table contains information about what's changed in Project 2013.

Project

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Project - Backwards Compatibility Support | Project Professional and Project Server | Support change | In Project 2013, backward compatibility mode is not supported. This means that you cannot connect Project 2010 to Project Server 2013. | N/A | N/A | N/A | N/A
Resource substitution wizard | Project Professional | Feature removed | We removed the resource substitution wizard from the Project Professional client. | Low usage | Higher quality in other feature areas | Works in earlier versions of Project Professional but not Project Professional 2013. | N/A
Client Reports (legacy feature) | Project Standard and Project Professional | Feature removed | Removed the legacy Reports feature in the Project client. | Added a more robust Reports feature to Project | The new Reports feature lets users create charts and tables from data, update the reports to meet their needs, and then copy the reports to other applications so that they can share them with others. The old feature enabled only table printing. | The old Report feature is available only when you work with files in Project 2010 and earlier. The legacy reports cannot be accessed in Project 2013. However, they still remain within the file. | N/A
API | Project and Project Server | Feature removed | Because we removed certain features, we have also removed the corresponding API. | We removed features that had low usage or that we were replacing with new updated versions. | Where a feature is replaced by an updated version, the user experience is better because of greater functionality. | Some of the corresponding features were replaced, and some were removed. | N/A
Project Task Sync to Exchange Server | Project Server | Replacing the feature | Users can no longer request Project Server task sync to Exchange Server 2010 or older versions. The replacement feature is more easily discoverable, but works only when the user's mailbox is hosted on Exchange Server 2013. | The replacement feature is easier to use. | Being able to sync every user-assigned task anywhere in SharePoint Server. | N/A | N/A

The following table contains information about what's changed in Publisher.

Publisher

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Color Mode Removal | Publisher | Removing the feature | The ability to manage color modes in a publication has been removed. Files that use color modes are automatically converted to RGB mode. A dialog box notifies users of the change. | Low usage | The use of color modes in some publications sometimes caused certain features to work incorrectly. This change prevents that from happening. | N/A | Most commercial printers use PDF files for printing, so it's no longer necessary for Publisher to offer additional color modes. Publisher users can export files in PDF format.

The following table contains information about what's changed in Office Security.

Security

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Information Rights Management (IRM) - Backwards Compatibility Support | IRM creation support for Microsoft Accounts | Support change | An on-premises RMS server setup or Office 365 with RMS Online is now required to IRM-protect a document. | N/A | N/A | Office 365 | You can open IRM-protected content that was created with a Microsoft Account in previous versions of Office and edit those documents if you have permission. However, you are no longer able to create new protected documents by using a Microsoft Account. For more information, see Plan Information Rights Management in Office 2013.

The following table contains information about what's changed in SharePoint Designer 2013.

SharePoint Designer

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
SharePoint Designer - Removing Design and Split Views of Page editing | SharePoint Designer. SharePoint Server is affected in scenarios. | Functional | Earlier versions of SharePoint Designer had both code and design view for editing ASPX/HTML pages in SharePoint Server. In SharePoint Designer 2013, the design view is removed. | The design view technology is not as up-to-date as the current Internet Explorer. In addition, code view is much more widely used than design view. Design view cannot support the new tags in HTML5 and new cascading style sheets that are used in SharePoint 2013. | N/A | N/A | N/A
Group Approval | Office | Feature removed | Group Approval feature will be removed when the site is upgraded to Office 2013. | Low usage | N/A | N/A | N/A

The following table contains information about what's changed in SharePoint products.

SharePoint Experiences

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
Site Templates - Document Workspace | Office only | End of life | Removing the ability to create new Document Workspace sites. | There are too many site templates that are confusing to users who only want to create a new site. This scenario is covered by our regular team sites. | Reduces any confusion about which site template to use to create a new site. | N/A | N/A
Site Templates - Personalization | Office only | End of life | Removing the ability to create new Personalization sites. | There are too many site templates that are confusing to users who only want to create a new site. This scenario is covered by our regular team sites. | Reduces any confusion about which site template to use to create a new site. | N/A | N/A
Imaging Web Service | SharePoint Server | Fully removing the feature | Users will no longer be able to use the Imaging Web Service. | To reduce security concerns. | Simplifying the number of ways to connect to SharePoint 2013. | N/A | N/A
Site Templates - Groupwork | Office | Fully removing the feature | The Groupwork site template is being removed. | This feature is not widely used. | Simplifies the number of available site templates. | N/A | N/A
Site Templates - Meeting Workspaces | SharePoint Server and Outlook | Fully removing the feature | The Meeting Workspaces templates are removed. | The feature is being replaced by the new meetings features in OneNote 2013 and Outlook 2013. | A new meetings feature is developed for OneNote 2013 and Outlook 2013 | The new meetings features in OneNote 2013 and Outlook 2013. | N/A
Visual Upgrade | SharePoint products | Modification | Replaced by the deferred site collection preview upgrade. Upgrade of the site collection process cannot be reversed. | The main goal of visual upgrade was to allow users to preserve the legacy UI while still letting them update their infrastructure and databases. This gave users more time to review customizations they made to the UI and to roll out new material without blocking the actual infrastructural upgrade from one version of SharePoint products to another. The new Office 2013 deferred site collection upgrade can complete this goal much more holistically than the Office 2010 visual upgrade feature. | Whereas visual upgrade could make sites look only approximately the same as the legacy UI, deferred site collection upgrade can make sites appearance and behavior almost identical to Office 2010. This preserves user customizations much better than visual upgrade. | Deferred site collection upgrade. | N/A

The following table contains information about what's changed in SharePoint Workspace.

SharePoint Workspace

Title | Scope | Type of Change | Description | Reason for Change | Benefits | Replacement | Additional Information
SharePoint Workspace Peer-to-Peer Functionality | SharePoint Workspace | End of life | All functionality related to the peer-to-peer aspects of SharePoint Workspaces are removed. This includes the concept of Account. | The focus of the current product is SharePoint and social behavior. We are working to create a better client experience for SharePoint, both in the site client and in introducing SkyDrive Pro client for Windows. | N/A | We tested the side-by-side use of SharePoint Workspace with SkyDrive Pro client for Windows, because it uses some of the same underlying technology and the .exe file. | N/A
SharePoint Workspace Product | SharePoint Workspace | End of life | SharePoint Workspace is being removed from the Office product base. | We will release SkyDrive Pro client for Windows with Office 2013. | N/A | The replacement feature is SkyDrive Pro client for Windows, which is included with Office 2013. This lets users take doc libraries offline for SharePoint and sync them. | N/A
SharePoint Workspace Memberships | My Site | Fully removing the feature | For Office 2013, the Memberships feature is no longer available. Users will no longer see their memberships in their My Site profiles. | For Office 2013, Communities is replacing Memberships. | A simpler UI that encourages using Communities over distribution lists. | Communities | N/A

The following table contains information about what's changed in the Office user interface.

User interface

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

File > Exit

Office

Fully removing the feature

Removing the File > Exit command from the Backstage

The feature is not widely used. There is confusion with other related features such as Close file and Exit the backstage. The red "X" in the upper-right corner of the window is mainly used to close the window.

Reduces overall confusion for users especially when they scan the list of Backstage options (for example Print, Save).

The following are ways to exit Office applications:

  • Add Exit to the Quick Access Toolbar (QAT)

  • Choose the red "X" at the upper corner of the application window

  • Right-click the Windows taskbar and choose Close all windows

  • Type ALT+F+X

N/A

The following table contains information about what's changed in Visio 2013.

Visio

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Open Document Management API (ODMA) support for VSD

Visio

Feature removed

Visio 2013 will not support ODMA or be an ODMA compliant application. This means:

  • When Visio 2013 is started, it will not detect whether a document management system (DMS) is installed.

  • Calls (hooks) into the DMS by using ODMA integration will no longer be initiated.

Not cost-effective. Also, the ODMA 2.0 Specification was created in 1997. ODMA was superseded by other, more standard ways of interfacing.

N/A

N/A

N/A

Support for Visio Drawing Control in Excel, PowerPoint, and Word

Visio

Feature removed

The Visio ActiveX control (Visio Drawing Control) offers the full functionality of the Visio application through the rich Visio object model. You can drive the Visio Drawing Control programmatically by events or by code in your hosting application. In the past, we enabled the Visio Drawing Control to be embedded in Excel, PowerPoint, and Word. In Visio 2013, the Visio ActiveX control will not work in Excel, PowerPoint, and Word.

The Visio ActiveX control is not supported in the newer versions of these applications.

We are focusing our resources on more prominent features.

There is no replacement feature, although users can continue to use the Visio Drawing Control outside Excel, PowerPoint, and Word.

N/A

Save as Visio 2002 drawing

Visio

Feature removed

Visio 2013 does not support saving to the Visio 2002 format. This affects Visio 2002 drawings, stencils, and templates. Users are prompted to save as either a Visio 2013 file or as a Visio 2003, Visio 2007, or Visio 2010 file. Users are still able to open all Visio file formats.

Visio supports the current file format and one earlier version. In Visio 2013, introduces the VSDX format. As part of this change, the ability to save to the Visio 2002 format is removed.

Visio 2013 has a new XML based file format that can be natively parsed and understood by both Visio 2013 and SharePoint 2013. The file format has improved interoperability, is easier to work with programmatically, and provides the basis for supporting new features being developed for Visio 2013.

N/A

N/A

Save as XML Drawing (VDX)

Visio

Feature change

Visio 2013 does not support saving to the Visio 2003 XML format. This affects VDX, VSX, and VTX file formats. Users are prompted to save as either a Visio 2013 file or as a Visio 2003, Visio 2007, or Visio 2010 VSD. Users are still able to open all Visio file formats.

Visio 2013 introduces the VSDX format. As part of this change, the ability to save to the previous XML format is removed. There is less confusion if only one XML-based format is available.

Visio 2013 has a new XML based file format can be natively parsed and understood by both Visio 2013 and SharePoint 2013. The file format has improved interoperability, is easier to work with programmatically, and provides the basis for supporting new features being developed for Visio 2013

N/A

N/A

Save to SharePoint with required data columns

Visio

Feature change

In this scenario, the user is saving a Visio file to a SharePoint 2013 site where one or more columns is required. In Visio 2010, the user was prompted to fill in required data when they save the file. In Visio 2013, the file is saved without prompting the user to fill in required data. The file is uploaded without the required column data. However, it is forced into the CheckedOut state. The user must open SharePoint 2013, populate the data, and then check in the file.

It was decided to support the scenario in which a user wants to save a Visio file to a library that supports multiple content types.

Users can save files to a library that supports multiple content types.

N/A

N/A

Database model diagram

Visio

Feature change

In Visio 2013, a new database is being created that is not backed by a solution. The new database model contains a new template, and updated stencils and shapes.

Without the legacy Unified Modeling Language (UML)/DB solutions, users can view and print UML/DB diagrams from earlier versions in Visio 2013, but editing functionality is limited and changes in Visio 2013 might prevent the file from being editable in earlier versions (that is, the UML/DB solution smart shapes may become dumb shapes). A warning displays in the message bar when a legacy UML/DB diagram is opened in Visio 2013.

Both software and database models are heavyweight solutions that make it difficult for users to do things quickly and easily. IT Professionals and Developers have long used Visio for creating software and database model diagrams and for a long time wanted a Visio database that is up to the current industry standard.

In Visio 2013 there are new, updated shapes that are easy to use and provide more flexibility than the shapes and solutions in the earlier Visio products.

A new database model that contains a new template, and updated stencils and shapes.

N/A

UML model diagram

Visio

Feature change

In Visio 2013, the UML solution is being replaced by a new content-focused template that is quick and lightweight.

Without the legacy UML/DB solutions, users can view and print UML/DB diagrams from earlier versions in Visio 2013, but editing functionality is limited and changes in Visio 2013 might prevent the file from being editable in earlier versions (that is, the UML/DB solution smart shapes may become dumb shapes). A warning displays in the message bar when a legacy UML/DB diagram is opened in Visio 2013.

Both software and database models are heavyweight solutions that make it difficult for users to do things quickly and easily. IT Professionals and Developers have long used Visio for creating software and database model diagrams and for a long time wanted a Visio database that is up to the current industry standard.

In Visio 2013 there are new, updated shapes that are easy to use and provide more flexibility than the shapes and solution in the earlier Visio products.

A new database model that contains a new template, and updated stencils and shapes.

N/A

Commenting model

Visio

The feature is being replaced

In Visio 2013, we are changing the reviewing model to better align with the core Office applications. The new Visio commenting model removes the Reviewer and Annotation ShapeSheet sections and cells. Instead, Visio 2013 will provide a new API to access the comments programmatically.

In addition, Visio 2013 will not support comments on multiple layers by author and inking in comments. By default, the Markup commands, previously on the Review ribbon tab, are still available but are not on the ribbon. Users can access them by selecting File -> Options -> Customize Ribbon - > Commands Not in the Ribbon.

In Visio 2013, commenting will let users add meaningful comments to Visio diagrams collaboratively, either on a shared document through the Visio client, or through Visio Services on SharePoint 2013 and SharePoint Online in Office 365 by using their browser. Comments can be specific to on-canvas objects or simple document comments without a relationship to objects.

Commenting in Visio 2010 is not widely used, whereas in other Office applications comments are a valuable part of the workflow. The commenting experience, especially when it is combined with coauthoring, has proven to be a powerful tool for collaboration. The goal is to let users comment meaningfully in the client and on a Visio Services on SharePoint 2013 version of the diagram. Visio Services lets users comment across a wide group without requiring that each user have a copy of the client. This will give our core users better support for working on diagrams collaboratively, and will also expose the feature to many users who might not have Visio.

Comments entered in Visio 2013 will always use the new UI and will be converted only to legacy format through a file save to VSD format.

N/A

Visio 2003 Color Schemes add-on

Visio

The feature is being replaced

The color schemes add-on enabled Visio 2003 users to apply a set of colors to a document. It was replaced in Visio 2007 by a theming model, which is updated again in Visio 2013. In Visio 2013, users will no longer be able to select a color scheme using the "Color Schemes" dialog boxes. Users should use themes to update the look of their diagram.

This feature is not widely used. The new themes model is a much more comprehensive way to apply a look to a diagram.

The new theme model is available on the Design tab.

Users should use the new theme model to update the look of their diagram.

N/A

The following table contains information about what's changed in Word 2013.

Word

Title Scope Type of Change Description Reason for Change Benefits Replacement Additional Information

Custom XML Markup

Word

End of life

Feature removal - affects object model, file format, and the user interface.

Legal requirement

N/A

You may want to consider content controls as a solution.

For more information about how to use content controls, see the Word content controls resource center.

Microsoft Knowledge Base article 2445060: Custom XML mapping is removed when you open a document in Word 2010

Microsoft Knowledge Base article 2445062: Error Message when you try to open a document in Word: "The file contains custom XML elements which are no longer supported by Word."

Original: Show Markup View

Word

Moving a ribbon command to the command well

The track changes view "Original: Show Markup" is moving to the command well.

This feature has low usage.

Simplifies change tracking

Add the Original: Show Markup command to the Quick Access Toolbar.

N/A

Document Review OM

Word

Modification

Modifying the Comments and Revisions object model (OM)

The OM reflects the new UI used in Office 2013.

The OM reflects the new UI used in Office 2013.

Updated Comments and Revisions OM.

N/A

MDI Mode (Show all windows in the Taskbar)

Word and Excel

Fully removing the feature

Users will no longer be able to enter MDI Mode.

Low feature usage.

Simplifying the UI and removing a low-usage legacy feature.

N/A

N/A

Offline Arabic-English Bilingual Dictionary

Office

Fully removing the feature

The Research pane will no longer have access to the offline Arabic-English bilingual dictionaries.

N/A

N/A

To translate text between Arabic and English, use the online translation services that are available through the Research pane.

N/A

Printer Font Automatic Incorporation

Word

Fully removing the feature

The printer used to be queried in order to offer the user font choices that were not available in Word, but were available on the printer. This is now being disabled to increase performance.

Printer fonts were much more widely used when computers were more stationary. A user could expect to always be using the same printer and computer, and would be able to have wider font selection. As users have moved to portable computers, netbooks, and slates, the possibility of a computer being associated with a specific printer model is much lower. If the printer is not queried every time that Word is opened, startup time is saved, and fewer of the computers resources are used. This is especially important for netbooks and slates.

Users will have a product with fewer performance issues, and have more computer resources for their own purposes.

To re-enable fonts that are stored on the default printer, select the Advanced Word option "Use fonts that are stored on the printer" check box in the Show Document Content section.

N/A

Reading Mode Legacy OM

Word

Fully removing the feature

Some of the reading mode object model (OM) is being changed to reflect that the features no longer make sense in the context of the new reading mode.

The new reading mode is a very different experience than the old one. Therefore, specific OM properties do not translate well to the new model.

A first class reading view that will delight users of the product.

There is a full new reading mode with its own OM.

N/A

Unsupported Font Types

Word

Removing the feature

This change is due to a transition from the GDI rendering engine to the new D2D/DWrite rendering engine provided in Windows 7 and Windows 8.

Word will no longer support the following font types:

BitmapPrinterAdobe Type 1CFF/Type 2TTO.FON

We have switched our rendering engine to take advantage of the new engine that Windows is providing. This new engine doesn't support these font types (a choice made by Windows).

All the benefits of Word integrating with Windows 8 and future versions of Windows.

Replace unsupported fonts in files that are opened in Office 2013 as follows:

  1. On the File menu, choose Options > Advanced. In the Show Document Content section, choose the Font Substitution button.

    If all fonts in your document are supported, a dialog box will indicate that a font substitution is not required.

  2. If there are unsupported fonts in your document, the missing document font will display in the Missing Document font box. Choose a font that you want to substitute, and then choose either OK or the Convert Permanently button.

    Choosing the Convert Permanently button changes the document permanently.

N/A

Contents of spelling error context menu

Word and WordMail within Outlook

Modifying the feature

Auto-Correct and certain formatting tools are no longer available from the spelling error context menu.

To make Word 2013 cleaner and less cluttered, we removed AutoCorrect and certain formatting tools from the spelling error context menu. The features are still available in Word 2013 through other entry points within the Word user interface.

Less clutter in the spelling error context menu. This enables users to find popular commands more quickly. In addition, the spelling error context menu now fits better on the screen.

To change AutoCorrect options, do the following:

  1. Choose File -> Options -> Proofing

  2. Choose the AutoCorrect Options button.

N/A

Fax templates are no longer included in the box

Word, Outlook, Excel, and PowerPoint

Removing the feature from the box product. The feature is still available on the Internet.

Fax templates are no longer included when you install Office. This means that fax templates may not be available when you send a fax through the Internet Fax feature.

Inbox templates contribute significantly to the installation file size.

Reduces the size of the Office installation.

You can download fax templates from the templates section of Office.com or search within the Office application by choosing File -> New.

N/A

Original: Show Markup View

Word

Moving a ribbon command to the command well

Show Markup no longer appears in the ribbon.

Low usage

Simplifies Track Changes

N/A

If you want easy access to the command, you can add it to the Quick Access Toolbar (QAT).

Change History

Date | Description
May 07, 2013 | Added Security section with an entry about how you can no longer apply Information Rights Management by using a Microsoft Account.
March 05, 2013 | Added a new section for PARC changes.
October 11, 2012 | Initial publication


Compatibility in Office 2013

Updated: March 19, 2013

Summary: Contains articles that will help you evaluate Office 2013 compatibility in your organization.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The following table includes links to new Office 2013 compatibility tools and resources.

Office 2013 Compatibility resources on TechNet and MSDN

Article | Description
Content roadmap for Office 2013 compatibility | Provides information about the articles, downloads, scripts, and videos that help IT Professionals assess Office 2013 compatibility.
Changes in Office 2013 | Lists the changed and removed features since Office 2010 was released.
Office 2013 compatibility guide | Learn how to assess Office compatibility in your organization by using Telemetry Dashboard and the modern Office compatibility process.
Overview of Office Telemetry | Provides information about Office Telemetry, the new compatibility monitoring framework that works with Office 2013, Office 2007, and Office 2003.
Monitor Office compatibility and deployments by using Telemetry Dashboard | Explains how to view the stability of Office documents and solutions and the status of your Office deployments by using Telemetry Dashboard.
Configure and deploy Telemetry Dashboard | See what's available to help you deploy and configure Telemetry Dashboard in your organization.
Telemetry in Office 2013 | Download a visual representation of the Telemetry Dashboard components and how they work. This poster includes a description of all components, a list of what Office files are monitored, how data collection works, and more. Thumbnail image of the Office Telemetry poster
File format reference for Office 2013 | Provides information about the file formats that are supported in Word 2013, Excel 2013, and PowerPoint 2013.
XML file name extension reference for Office 2013 | Provides information about XML file formats and their extensions that are used by Word 2013, Excel 2013, PowerPoint 2013, and Visio 2013.
Group Policy and Office Customization Tool settings in Office 2013 for OpenDocument and Office Open XML formats | Describes Group Policy settings and Office Customization Tool (OCT) settings that address OpenDocument Format and Open XML Formats in Office 2013.
Compatibility articles on the Office IT Pro blog | Visit our blog for the latest news on Telemetry Dashboard and Office 2013 compatibility.
Compatibility issues in Office 2013 | Get more information about issues displayed in the Telemetry Log about possible compatibility issues in Excel 2013, Word 2013, and Outlook 2013.
Troubleshooting Office files and custom solutions with the Office Telemetry Log | Use the Telemetry Log to determine compatibility issues with Microsoft Office 2013 and solutions built for earlier versions of Microsoft Office.
Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum | If you have questions about how to use Telemetry Dashboard or its components, you can submit your questions in this TechNet forum.

The following video recordings about compatibility in Office 2013 are available to view online or to download.

Videos about compatibility in Office 2013

 | Content | Description
Video (play button) icon | Quick tips for Telemetry Dashboard navigation | This video demonstrates how to navigate within Telemetry Dashboard in Office 2013. These tips help you start the dashboard, hide and show data, and quickly go back to a previous worksheet
Video (play button) icon | Creating custom reports in Telemetry Dashboard | This video demonstrates how to create custom reports using PivotTable reports in Telemetry Dashboard.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support

Change History

Date | Description
March 19, 2013 | Added the article, "Group Policy and OCT settings for OpenDocument and Office Open XML formats."
July 16, 2012 | Initial publication


Content roadmap for Office 2013 compatibility

Updated: February 26, 2013

Summary: Provides a guide to the articles, downloads, scripts, and videos that help IT Professionals assess Office 2013 compatibility.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Content roadmap for IT professionals (banner image)

The following table describes resources that are available to IT Professionals who are assessing Office compatibility.

Office 2013 compatibility roadmap for IT Pros

Getting started

Start here

So you're planning an Office 2013 deployment and you're wondering what's new with compatibility. You may want to know all about the system requirements, changes in Office 2013, and what's new for IT Professionals. Visio 2013 has a new VSDX file format that you'll want to read about. If you're migrating from Office 2003 or Office 2007, you might also want to know what was new in Office 2010, because those features are also in Office 2013.

Thinking about deploying the 64-bit version of Office 2013? We recommend that you deploy the 32-bit version of Office 2013 for most users. If you deploy the 64-bit version, your users might encounter compatibility issues with ActiveX controls, third-party add-ins, and in-house solutions built for 32-bit versions of Office. Be sure to read the deployment considerations for the 64-bit version Office 2013 before you decide.

The compatibility tools are completely new for Office 2013. Say goodbye to OMPM, OEAT, and OCCI and say hello to Telemetry Dashboard and Telemetry Log. Our product team created a helpful blog series to introduce these new compatibility tools. OMPM users can read a comparison of OMPM and Telemetry Dashboard. You can see a high-level view of how the telemetry tools work in our Office Telemetry poster and in Overview of Office Telemetry. And you can see Telemetry Dashboard in action by watching this video on quick tips for Telemetry Dashboard navigation.

Finally, we introduced a new compatibility process that helps you speed up your Office deployments and get users up and running on the new version of Office. Check out the Office 2013 compatibility guide to learn more about the modern Office compatibility process.

Deploy icon

Deploy and configure Telemetry Dashboard

Before you can start to collect Office inventory and usage data, you must Deploy Telemetry Dashboard. Be sure to review our topology and hardware guidance before you roll out the telemetry components. If you're setting up a small or test environment, we have a script that will quickly set up Telemetry Dashboard on a single computer. You can deploy Telemetry Agents by using your preferred deployment method. This can include deploying Telemetry Agents by using System Center Configuration Manager.

Having trouble getting data into the dashboard? You can troubleshoot Telemetry Dashboard deployments.

If you are concerned about maintaining user privacy for the data that is collected, you can manage privacy settings and see the full list of data that is collected. If, for any reason, you must delete the local telemetry data on a client computer, you can do that, too.

To manage the telemetry database, download the Telemetry Dashboard Administration Tool (Tdadm). You can use this tool to clean up unused user, solution, and computer data, or to copy or move telemetry data to another database. Visit the Tdadm wiki for usage information.

123 steps

Use Telemetry Dashboard

This video about Telemetry Dashboard navigation will help you start Telemetry Dashboard, connect to the database, and view inventory and telemetry data. You can then use Telemetry Dashboard to monitor Office stability and deployment status. You can also use Telemetry Dashboard to manage add-ins in Office 2013. If you aren't sure what the data in a worksheet means, take a look at our reference guide, which describes each worksheet. Want to customize how data telemetry data is displayed in the dashboard? No problem! Creating custom reports in Telemetry Dashboard is easy. Watch this video to see custom reporting in action.

Is your dashboard empty? The agents can require to 4 hours to start transmitting data. You can speed up this process by triggering data collection manually. You might also want to troubleshoot Telemetry Dashboard deployments.

Troubleshoot icon

Troubleshoot Office 2013 documents and custom solutions

Ready to troubleshoot issues with Office documents and custom solutions? You'll want to use Telemetry Log to do this troubleshooting. Telemetry Logdisplays compatibility issues for Word 2013, Excel 2013, and Outlook 2013. To see how Telemetry Log works, you can download sample Office documents that trigger compatibility events in Telemetry Log.

Telemetry Log also provides a link to the Fix It Center Pro diagnostic tools that collect additional data about the Office application that you are troubleshooting. This data includes relevant log files, registry keys, network configuration, event logs, and other file details that help you troubleshoot Office issues. You can learn more about these diagnostic tools in the Microsoft Fix it Center Pro automated diagnostic portal.

Behind the scenes icon

Reference information

Here are links to tables and other types of reference information.

File formats and extensions

  • File format reference for Office 2013

  • XML file name extension reference for Office 2013

Telemetry Dashboard

  • Telemetry Dashboard worksheet reference

Telemetry Agent

  • Telemetry Agent registry settings and Group Policy settings

  • Data that Telemetry Agent collects

Telemetry Log and compatibility events

  • Types of Office files and solutions tracked in Telemetry Log

  • Types of events displayed in the Telemetry Log

  • Compatibility issues in Office 2013

    • Issues displayed in Telemetry Log about controls

    • Removed members in the object model

    • Behavior changes in the object model

    • Hidden members in the object model

Group Policy settings

  • Group Policy and Office Customization Tool settings in Office 2013 for OpenDocument and Office Open XML formats

Script icon

Scripts

Here are the scripts that can be used with Telemetry Dashboard:

  • Set up Telemetry Dashboard on a single computer This script automates all required configurations and provides an quick and easy setup of Telemetry Dashboard.

  • Create Group Policy Object for tags (labels) for Telemetry Dashboard Create-GroupPolicyObjectForTags.ps1 can be used for bulk Group Policy Object (GPO) generation to configure tags (labels) for Telemetry Dashboard. The script creates GPOs that are linked to a specified domain, site, or OU with or without security filtering by security groups.

  • Add tags (labels) for Telemetry Dashboard Add-Tags.vbs can be used to set tags (labels) for Telemetry Dashboard for Office 2013. The script retrieves properties of a user object from Active Directory and writes registry values for labels, which Telemetry Dashboard can use to filter data.

Downloads

Downloads

Here are the downloads that are related to Office compatibility:

  • Telemetry Dashboard Administration Tool download and wiki

  • Telemetry in Office 2013 (poster)

  • Sample Office documents that trigger compatibility events in Telemetry Log

  • Office Compatibility Pack for Word, Excel, and PowerPoint

  • Visio Viewer

  • Office 2013 Administrative Templates

Video (play button) icon

Videos

Here are the videos that are related to Office compatibility:

  • Quick tips for Telemetry Dashboard navigation

  • Creating custom reports in Telemetry Dashboard

Chat icon

Ask questions and provide feedback

If you have questions about how to use Telemetry Dashboard and Telemetry Log, you can submit your questions in the Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum on TechNet. You can also read blog posts about the telemetry tools and leave comments in the Office IT Pro blog.

See also

Content roadmap for Office 2013 identity, authentication, and authorization
Content roadmap for Office 2013 security

Content roadmap for Office 365 ProPlus

Change History

Date | Description
February 26, 2013 | Added information about the Fix-it Center diagnostic tools that are linked from Telemetry Log.
December 4, 2012 | Initial publication


Office 2013 compatibility guide

Published: October 16, 2012

Summary: Explains how to assess Office compatibility in your organization by using Telemetry Dashboard and the modern Office compatibility process.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Keeping an Office deployment project on track requires two key aspects: using the right process to assess Office compatibility, and using tools that help you understand the potential risks of an Office upgrade. Office 2013 helps you do both. We are introducing a new process to help you assess Office compatibility, a process that we call the modern Office compatibility process. When used with the new telemetry features and tools that are in Office 2013, this process helps you speed up your Office deployments and get users up and running on the new version of Office with minimal disruptions. In this article, you'll learn more about the modern Office compatibility process and how Office telemetry fits into this process.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

Are you looking for compatibility information about individual Office 2013 applications? You can find this information by searching for "2013 compatibility" on Office.com.

In this article:

  • Introducing Office Telemetry and the modern Office compatibility process

  • What's new with compatibility in Office 2013

  • Phase 1: Discover which Office documents and solutions are being used

  • Phase 2: Rationalize the inventory data to identify business-critical Office documents and solutions

  • Phase 3: Validate that Office files work

  • Phase 4: Manage Office

Introducing Office Telemetry and the modern Office compatibility process

Since the release of Office 2010, we have talked with many IT Pros and consultants about their Office 2010 deployments. They usually tell us that they use tools such as Office Migration Planning Manager (OMPM) and Office Environment Assessment Tool (OEAT) to identify and assess Office documents and Office solutions, such as add-ins and macros, that are located on every client computer, file server, and document repository in their organizations. And why wouldn't they use these tools? They are very good at finding Office documents and solutions. So good, in fact, that the resulting assessment data—often representing hundreds of solutions and millions of documents—can take 12 to 18 months to review before an Office deployment is even started.

Although it would seem that a year spent preparing to deploy Office would reduce risks, we have not found this to be the case. In fact, the delay in deployment is likely to be costlier than the risk of disrupting the business. For one thing, if users don't have the new version of Office, they can't take advantage of the new Office features that provide the business value that prompted the upgrade. All the time that is spent assessing compatibility means that the organization won't begin seeing a return on their Office investment for at least a year. And during that year, IT Pros often spend time testing documents and solutions that are not critical to the business. This prolonged and often repetitive testing can hinder the agility of an organization and make users and IT Pros less receptive to change.

When we began to plan the compatibility story for Office 2013, we started our work with two simple goals: Minimize the time that IT Pros have to spend assessing Office compatibility and reduce the risks of an Office upgrade. This is, of course, not easy. Compatibility challenges always exist in the complex and powerful environment that is Office. Business risks are real, and IT Pros are held accountable every day to make the best decisions for their organizations. Although we knew that Office 2013 would be compatible with existing Office documents and solutions, we also knew that IT Pros will still need tools to help them verify that the new Office will work with their users' documents and solutions. The challenge was to create tools that support, instead of drive, the compatibility assessment process.

As we defined the requirements for new compatibility tools, we studied the common issues that can make Office deployments difficult. We wanted to ease the fear of the unknown, speed up deployments, lay a foundation for future Office upgrades, and help put the IT pro back in control. The results of this work are a new telemetry-based compatibility infrastructure that's built into Office 2013 and a new approach to assessing Office compatibility. We call this approach the modern Office compatibility process, and it works as the following table describes:

Phases of the modern Office compatibility process

Icon for the Discover phase | Discover what is being used, by whom, and how often. Documents and solutions that are used frequently and by multiple users are likely candidates for compatibility testing.
Icon for the Rationalize phase | Partner with business groups to identify what's critical to the business. The data that you find during the discovery phase can help jumpstart this discussion. The goal is to identify the business-critical documents and solutions that have to be ready on the first day of your Office deployment.
Icon for the Validate phase | Start a pilot deployment where users test the documents and solutions that are required to run the business by using Office 2013. We call this user acceptance testing. Proactively troubleshoot any issues that occur for "Day 1" documents and solutions.
Icon for the Manage phase | Deploy Office and continue to monitor your documents and solutions. Watch for trends in Office 2013 performance and behavior as updated Office solutions are deployed. Use your Help Desk resources to troubleshoot issues as they occur for non-business-critical documents and solutions.

In this article, we'll discuss some changes in Office that are related to compatibility. Next, we'll discuss each phase of the modern Office compatibility process and describe how Office telemetry features can be used to support the process.

What's new with compatibility in Office 2013

Office Telemetry is one of many new features and changes that are related to compatibility in Office 2013. Other new features that were introduced in Office 2010 include Click-to-Run support and improved add-in management.

If your organization currently runs Office 2003 or Office 2007, you might also want to learn about new features that were introduced in Office 2007 and in Office 2010. You can learn more in these articles:

  • What's new for IT professionals in Office 2010

  • Product and feature changes introduced in the 2007 Office system

These sections describe the new compatibility features and changes in more detail.

Office telemetry and Telemetry Dashboard

Office Telemetry is a new compatibility monitoring framework that works with Office 2013, Office 2010, Office 2007, and Office 2003. Office Telemetry in Office 2013 works as follows: When an Office document or solution is loaded, used, closed, or raises an error in certain Office 2013 applications, the application adds a record about the event to a local data store. Each record includes a description of the problem and a link to more information. Inventory and usage data is also tracked.

Because Office Telemetry is new in Office 2013, it's not built into Office 2003, Office 2007, and Office 2010. For those clients, you deploy an agent that collects information about installed add-ins and the most recently used documents. You won't get application event data for these clients, but you'll get inventory and usage data that helps you discover what's being used and is likely important to your business.

You use Telemetry Dashboard, which is an Excel 2013 workbook, to review the Office Telemetry data that is collected throughout your organization. Procedures to deploy the dashboard components are described in Deploy Telemetry Dashboard. For a visual representation of the Telemetry Dashboard components and how they work, download the Telemetry in Office 2013 poster. This poster includes a description of all components, a list of what Office files are monitored, how data collection works, and more.

Thumbnail image of the Office Telemetry poster

Support for running Office 2013 side-by-side with existing Office installations

Click-to-Run is a Microsoft streaming and virtualization technology that reduces the time that is required to install Office. It also provides an isolated environment that allows users to run the latest version of Office side-by-side with an earlier version of Office on the same computer. When installed by using Click-to-Run, Office products can still run macros and interact with the other Office solutions that are installed on the computer. The Office Telemetry features also work with Office products that are installed by using Click-to-Run.

Click-to-Run plays an important role in the modern Office compatibility process by allowing users to pilot Office products without giving up their current environment. This safety net helps keep users productive while reducing their fear of change. Any time that a document or solution doesn't work correctly in an Office product, the user can open that file in the earlier version of Office and continue to work.

You can learn more about how to install Office products by using Click-to-Run in Click-to-Run overview. See Phase 3: Validate that Office files work to learn more about how Click-to-Run is used during the Validate phase in the modern Office compatibility process.

Improved add-in management in Office 2013

New Group Policy settings for Office 2013 allow you to create a list of managed add-ins for each Office 2013 application. From this list, you can specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. You can also block all add-ins that are not on the managed list of add-ins.

These Group Policy settings give you more control of how add-ins are used with Office in your organization. For example, if telemetry data shows that certain add-ins are causing frequent crashes, you can disable them. You can also disable add-ins that are revealed by telemetry data but that are not supported in your organization. Conversely, you can enforce the use of certain add-ins by configuring them as always enabled. When you enable or block an add-in, users cannot change the status of that add-in.

You can also manage these new Group Policy settings within Telemetry Dashboard. The Add-in management worksheet shows the success rate of Office 2013 add-ins, that is, the percentage of sessions that don't have critical errors. It also shows their load times, and the percentage of users who use add-ins that are either blocked or always enabled. You can use also Telemetry Dashboard to generate a GPO script that applies the new Group Policy settings.

You can learn more about these Group Policy settings in Phase 4: Manage Office. To see an overview of the add-in management process, see Let's manage add-ins using Telemetry Dashboard.

Feature changes and removals in Office 2013

Office 2013 has many product improvements and other changes that might affect compatibility with existing Office documents and solutions. Certain Office 2013 applications can log telemetry events when an Office document or solution encounters an error that is related to features that are changed, removed, or deprecated. These applications are Word 2013, Excel 2013, and Outlook 2013. You can monitor these events and see their frequency and affected users by using Telemetry Dashboard.

You can learn more about feature changes and removals in the following resources.

Changes in Office 2013

Compatibility issues in Office 2013

Phase 1: Discover which Office documents and solutions are being used

Let's get started with the modern Office compatibility process. Your goal for the Discover phase is to know what's being used the most and by whom. There are two approaches that you can take to start the discovery process.

  • The preferred approach is to start to deploy Telemetry Agent to help you discover usage within monitored groups, and then use those results to begin discussions with business groups.

  • Another option is to partner with your business groups and ask them for a list of their business-critical documents and solutions. If they have a disaster recovery plan, you can likely find this list in their plan. The downside to this approach is that their lists might not be up-to-date. You should plan to use telemetry data to help refine these lists if you choose this approach.

Whether or not you start with a blank list, there is no avoiding working with your business groups. The telemetry tools can't tell you what's important to the business. The tools can give you some leads on what's important based on usage, but only the business groups can tell you how dependent their business is on those documents and solutions. If you work only based on telemetry data, you might miss seasonally used solutions, such as year-end sales reports or annual performance review templates, or other documents that aren't being used at the time that you collect data.

Now it's time to start to make plans to deploy Telemetry Agent to the existing Office clients. Here are some considerations to think about before you deploy the agent. You can also find requirements to deploy the agent in Telemetry Agent. If you haven't yet deployed Telemetry Dashboard, see Deploy Telemetry Dashboard.

Choose which Office client computers to monitor

We recommend that you monitor about 20% of the client computers across your organization. This sample should include representative users from every business group so that you can identify line-of-business solutions that are used within pockets of the organization. Make sure to include expert users in that sample and users who express interest in piloting Office 2013. There might be cases in which monitoring a complete group or organizational unit (OU) is less restrictive or easier than selecting separate client computers to participate. Small organizations might also choose to monitor all client computers.

Identify privacy concerns with business group stakeholders

Some business groups, such as human resources, legal, and finance, might have concerns about exposing personal or sensitive files in the telemetry data. Telemetry Dashboard offers several ways to prevent exposing this data. For example, you can configure the Telemetry Agent to obfuscate file names and titles. You can also prevent data from certain applications from being reported. You can learn more about the privacy settings in Manage privacy settings in Telemetry Dashboard. Review the privacy options with the business groups and decide which kinds of Office data that you want to exclude from reporting in Telemetry Dashboard.

Decide how you want to categorize clients that are shown in Telemetry Dashboard

When you deploy Telemetry Agent to clients, you can specify up to four labels that describe the clients. These labels help you filter data in the dashboard so that you can focus on individual business groups, specific kinds of users, users in certain geographical locations, and so on. Develop this list as you work with business groups. You can learn more about how to configure labels in Enabling and configuring Telemetry Agent.

Phase 2: Rationalize the inventory data to identify business-critical Office documents and solutions

The goal of the Rationalize phase is to identify business-critical Office documents and solutions. We recommend that you collect data in Telemetry Dashboard for at least one day before you start to look for trends.

The sections that follow will help you interpret the data, work with business groups, and decide what to test.

Gain insights from data in Telemetry Dashboard

As data starts to populate in Telemetry Dashboard, you can start to look for usage trends. Here are some tips to get you started.

  • Look to see whether any departments or groups are not represented but should be. For example, if there are no finance solutions being used, you might have forgotten to enable monitoring for the finance group.

  • Look for documents and solutions that are used by more than 10% of users. These are candidates for additional evaluation.

  • Look for documents that are used by 3 or more users. Is there a trend for co-authoring? Are these templates? You might find that fewer documents are shared than solutions.

  • Jot down solutions that you know are very important that you will want to track in the future even if the user numbers are low.

  • Look to see where documents were opened from. This can help you differentiate between an attachment in an email message and a frequently edited document.

  • Look for multiple file sizes of the same solution or document. This could indicate that multiple versions are being used. These are candidates for future consolidation.

Work with business groups to decide what Office documents and solutions to test

At this point, you may have already worked with business groups to identify their critical documents and solutions. Compare the list they gave you with the usage data that's shown in Telemetry Dashboard. Does the usage data support the input from the business groups? If not, could there be a seasonal explanation? For example, are some solutions used more towards the end of the fiscal year? It's worth having another conversation with business groups about any differences you find so that you can adjust your plans for user acceptance testing.

If you haven't worked with business groups yet, this is the time to approach them. The initial usage data can help you create a list of documents and solutions that are candidates for testing and remediation. But instead of assigning priority levels, such as high, medium, or low, it's better to rank documents and solutions by the type of testing they will undergo. Ask your business groups to assign them to one of the choices in the following table:

Classifying Office documents and solutions to test

Documents and solutions that IT is accountable for and must keep functioning at all costs | Proactive testing for Day 1 readiness These documents and solutions are tested, fixed, and ready for use on the first day of the Office deployment.
Documents and solutions that IT will fix if somebody calls about them | Reactive testing These solutions are fixed only when a user reports an issue to your help desk.
Documents and solutions that nobody cares about | Don't test

When you approach business groups to classify their documents and solutions, you might meet some resistance from business groups that want everything tested for Day 1 readiness. One of our Office compatibility experts, Chris Jackson, wrote an article for TechNet Magazine that describes some costs behind Office compatibility testing. You can use this information to help justify reactive testing and ease the emotional fears that often affect Office migrations. Read more at Microsoft Office: The Mathematics of Office Compatibility.

Phase 3: Validate that Office files work

After the Discover and Rationalize phases, it's time to start to test Day 1 documents and solutions for compatibility with Office 2013. The goal of the Validate phase is to verify that the solutions and documents work in the environment that users need them to work in. This doesn't mean that the solution or document doesn't have bugs. It just means that the bugs don't prevent users from doing their work.

Unfortunately, there is no tool that will do this work for you. You have to ask users to test the documents and solutions by doing their work in Office 2013. We call this user acceptance testing, and it's unavoidable. The good news is that user acceptance testing is much easier now with Click-to-Run, which helps transform user acceptance testing into piloting. Encourage users to use their documents and solutions in the new version of Office, and advise them to use their earlier version of Office if they encounter issues.

Telemetry data is also a big help in this phase because it can tell you what is broken and how. Telemetry Dashboard shows positive and negative trends that can help you quickly see the stability of documents or solutions as they are updated.

Here are some guidelines to help you plan and monitor user acceptance testing.

Identify users for user acceptance testing

Owners of the business-critical documents and solutions are strong candidates for taking part in user acceptance testing. By looking at the list that you generated during discovery, each department can identify the owners. If not, telemetry data can help by showing you most active users.

You should also recruit technical users within each department, because they are likely to know the details of how the solution or document works. Also look for a diverse base of testers across job levels, roles, and locations.

Set up an environment for user acceptance testing

One important rule of user acceptance testing is that the test environment must be as similar to the production environment as possible. There are several ways to set up a test environment. We hear from some customers who set up a separate organizational unit (OU) within the production domain, and others who set up a completely separate test environment that is identical to the production environment. You want the test environment to be easy to set up and easy for users to access. The goal is to remove barriers to testing and to minimize complaints from users who say that there is no time to test. Your organization might already have a testing environment provisioned and centrally managed. If so, use it. If you don't have a test environment already, don't set one up. Use Click-to-Run instead.

Click-to-Run provides all the benefits of testing in production without all the risk. Installing Office 2013 by using Click-to-Run allows users to run their earlier versions of Office alongside Office 2013. If a problem or incompatibility arises, users can still do their work by using the earlier version of Office.

It is much easier to transform user acceptance testing into piloting when you use Click-to-Run. You deploy the new environment while keeping the previous one, and you can monitor the status of the Click-to-Run deployments of Office 2013 by using Telemetry Dashboard. You can see which builds are being used and the compatibility issues that are being reported. Monitoring user acceptance testing and piloting by using Telemetry Dashboard helps ease the fear of not knowing the impact of the new version. You can offer more information to business groups and Office solution owners beyond just status of the deployment.

Important:

We recommend that you use side-by-side installations of Office as a temporary solution for user acceptance testing and piloting, not as a long-term solution for production environments. Plan to phase out the earlier version of Office when your production deployments begin.

You can learn more about Click-to-Run in Click-to-Run overview.

Remediate Day 1 Office documents and solutions

By now you have identified the Day 1 solutions and users have tested them by using Office 2013. In addition to bug reports from users, data in Telemetry Dashboard will indicate how Word 2013, Excel 2013, and Outlook 2013 are performing when they are used with your existing Office documents and solutions. As you collect information about bugs and other issues that have to be fixed or mitigated, work with in-house developers and business group managers to create remediation plans. You'll have to decide whether to retire solutions or fix them (if they were developed in-house) and work with vendors to obtain updated versions (for third-party products).

Both Telemetry Dashboard and Telemetry Log can help you during this process. You can monitor the health of Word 2013, Excel 2013, and Outlook 2013 as you deploy incremental fixes or new versions of Office solutions. Developers can use the Office Telemetry Log to observe the compatibility events that occur on the local computer when Word 2013, Excel 2013, and Outlook 2013 are used with existing documents and solutions.

Your development teams might have automated testing tools that can help with the testing process. It is important that those tools are tuned in such a way that only deployment blockers are flagged and fixed for Day 1 readiness. It's probably not worth fixing bugs that don't affect the user's day-to-day work, at least not for Day 1. Those solutions can be fixed over time if it is necessary.

Note:

You may wonder whether it's a good idea to substitute vendor support statements with compatibility testing. Chris Jackson covers the cost pros and cons of researching vendor support in his article Microsoft Office: The Mathematics of Office Compatibility.

Phase 4: Manage Office

Your goals for the Manage phase are to use Telemetry Dashboard to monitor Office usage and add-ins and prepare users for the transition to Office 2013.

As you deploy Office 2013, you'll start to see Office health and usage trends that help you unlock the value of your Office investments and give you insight for future deployments. For example, knowing what ActiveX controls are being used can help with future Windows updates. Is Excel being used not just as a spreadsheet tool, but as a front-end application that uses a data connection? How do new Office solutions affect the environment? When the time comes to do another Office deployment, you might find that you can skip the discovery process completely because you'll know exactly what's being used and what's important.

These sections provide more guidance about the Manage phase.

Manage Office 2013 add-ins by using Telemetry Dashboard

As you monitor solutions that are used by Office 2013, you are likely to find add-ins that are slow to load or that crash frequently. You might also find add-ins that should not be used in your organization. As described earlier in Improved add-in management in Office 2013, there are new Group Policy settings that allow you to manage these add-ins when they are used with Office 2013.

The new add-in management policy settings can be used with the following Office 2013 applications:

  • Access 2013

  • Excel 2013

  • InfoPath 2013

  • Word 2013

  • Outlook 2013

  • OneNote 2013

  • PowerPoint 2013

  • Project 2013

  • Publisher 2013

  • Visio 2013

Telemetry Dashboard provides an interface for configuring these settings. On the Solutions worksheet, select the Add-in management link at the top of the page, which brings you to the Add-in management worksheet. On that worksheet, you can see telemetry data about each add-in and select a Group Policy setting to control each add-in. Use the instructions on the worksheet to generate a script that you can run to apply the GPO to an Active Directory organizational unit.

We're planning future content to help you use the add-in management settings. In the meantime, you can configure these settings in Telemetry Dashboard or download the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool.

There are individual add-in management settings for each supported Office 2013 application. They are located in the following paths:

  • User Configuration\Administrative Templates\Office 2013 application name\Miscellaneous\List of managed add-ins

  • User Configuration\Administrative Templates\Office 2013 application name\Miscellaneous\Block all unmanaged add-ins

You can read an overview of add-in management process in our blog post Let's manage add-ins using Telemetry Dashboard

Use compatibility mode in Office 2013

In Office 2013, compatibility mode is used automatically to open Word, Excel, and PowerPoint documents that were created in earlier versions of these applications. Compatibility mode makes sure that no new or improved features in Office 2013 are available while users work with a document so that people who use earlier versions of Office will have full editing capabilities. Compatibility mode also preserves the layout of the document.

Word 2013, Excel 2013, and PowerPoint 2013 use compatibility mode to open binary Office documents that were created in Office 2003 or earlier versions of Office. Word 2013 also uses compatibility mode to open OpenXML documents that were created in Word 2007 and Word 2010.

As part of your overall Office 2013 training plan, you should provide guidance to users about how compatibility mode works. You can find end-user topics about compatibility mode by searching for "2013 compatibility" on Office.com.

Set default compatibility mode on file creation (Word 2013 only)

You can use the Set default compatibility mode on file creation policy setting to manage the default compatibility mode that Word 2013 uses to create new Word documents. This might be necessary if you have add-ins or macros that use the layout functions that are used in Word 2007 or Word 2010. When you enable this policy setting, you can specify which versions of Word (2003, 2007, 2010, or 2013) that new Word documents are compatible with. Four configurations options are available for this setting:

  • Word 2003 This mode disables features in Word that are incompatible with Word 2003.

  • Word 2007 This mode disables features in Word that are incompatible with Word 2007.

  • Word 2010 This mode disables features in Word that are incompatible with Word 2010.

  • Full functionality mode This mode makes sure that all new features remain enabled. This is the default setting for Word 2013.

When you choose the Word 2003 option, Word is configured to create new Open XML files that have Word 2007, Word 2010, and Word 2013 features disabled. Doing so makes sure that the Open XML files do not contain content that Word 2003 users can't edit. However, users of Office 2003 must still have the Compatibility Pack installed before they can edit Word Open XML files that are compatible with Word 2003.

If you select Full functionality mode, there is no effect on the Word 2007 and Word 2010 users. They can open and edit Word 2013 documents. The only difference is that new features in Word 2013 are not available in Word 2007 or Word 2010.

You can download the Office 2013 Administrative Templates from the Microsoft Download Center. The Set default compatibility mode on file creation policy setting is located in the path Microsoft Word 2013\Word Options\Save.

Phase out earlier versions of Office

We recommend that you run Office 2013 with an older version of Office side-by-side only as a short-term compatibility solution during pilot testing. When your pilot phase ends and your production deployments begin, we recommend that you start to remove earlier versions of Office from production computers that run Office 2013. This avoids any widespread issues that can be caused by file type associations that might break after updates or repair operations.

Prepare help desk and users for change

Your Help Desk should be ramped up on Office 2013 and ready to support users. Here are some resources to help them get up to speed:

  • Self-paced Office training

  • End user training resources for Office 2013 and Office 365

See also

Content roadmap for Office 2013 compatibility
Deploy Telemetry Dashboard
Manage privacy settings in Telemetry Dashboard


Overview of Office Telemetry

Published: November 27, 2012

Summary: Learn about Office Telemetry, the new compatibility monitoring framework that works with Office 2013, Office 2007, and Office 2003.

Applies to: Office 365 ProPlus | Office 2013

Audience: IT Professionals

Office Telemetry is a new compatibility monitoring framework that can speed up Office deployments by helping you discover business-critical Office documents and solutions in your organization. In this article, you can learn more about the tools that work with Office Telemetry, the kinds of documents and solutions that are monitored, and how telemetry data is collected. You can also learn about navigating the dashboard and managing add-ins and privacy settings.

Many of the sections in this article are based on the Telemetry in Office 2013 poster, which you can view online or download from the Download Center.

Thumbnail image of the Office Telemetry poster
Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

Are you looking for compatibility information about individual Office 2013 applications? You can find this information by searching for "2013 compatibility" on Office.com.

In this article:

  • What is Office Telemetry?

  • Office Telemetry tools and components

  • Document and solution types that Office Telemetry monitors in Office 2013

  • How telemetry data is collected

  • Navigating in Telemetry Dashboard

  • Managing add-ins by using Telemetry Dashboard

  • Managing privacy settings in Telemetry Dashboard

What is Office Telemetry?

Office Telemetry is a new compatibility monitoring framework that replaces the Office 2010 compatibility tools Office Migration Planning Manager (OMPM), Office Code Compatibility Inspector (OCCI), and Office Environment Assessment Tool (OEAT). When you use Office Telemetry as part of the modern Office compatibility process, which is described in the Office 2013 compatibility guide, it helps you minimize the time that you spend assessing Office compatibility. It also reduces the risks of an Office upgrade.

Office Telemetry in Office 2013 works as follows: When an Office document or solution is loaded, used, closed, or raises an error in certain Office 2013 applications, the application adds a record about the event to a local data store. Each record includes a description of the problem and a link to more information. Inventory and usage data is also tracked.

How does Office Telemetry work in earlier versions of Office? Office Telemetry is new for Office 2013, so it's not built into Office 2003, Office 2007, and Office 2010. For those clients, you deploy an agent that collects information about the installed add-ins and the most recently used documents. You won't get application event data for these clients like you do with Office 2013 clients, but you'll get inventory and usage data that helps you discover what is being used and likely important to your business.

If you have questions about how to use Telemetry Dashboard, you can submit your questions in the Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum on TechNet. You can read blog posts about Telemetry Dashboard in the Office IT Pro blog.

Office Telemetry tools and components

You can view telemetry data by using two new tools: Telemetry Dashboard for Office 2013 and Telemetry Log for Office 2013. The following table describes these tools:

Office Telemetry tools

Tool Description
This icon represents the Telemetry Dashboard.

Telemetry Dashboard:

  • Shows IT Pros a combined view of inventory and telemetry data

  • Requires Excel 2013

  • Is installed with Office Professional Plus 2013 and Office 365 ProPlus

  • Connects to the telemetry database

  • Can be viewed by multiple IT Pros

This icon represents the Telemetry Log.

Telemetry Log:

  • Helps developers and experienced users diagnose compatibility issues that occur on an Office 2013 client

  • Requires Excel 2013

  • Is installed with Office Professional Plus 2013 and Office 365 ProPlus

  • Connects to the local data store on the client

The following table describes the components of Office Telemetry. The first two components shown below are required for both Telemetry Log and Telemetry Dashboard. The remaining components that are listed are applicable only to Telemetry Dashboard. These components collect telemetry data from across an organization so that you can view it by using Telemetry Dashboard. To learn how to deploy these components, see Deploy Telemetry Dashboard and Plan for Telemetry Dashboard topology and hardware.

Office Telemetry components

Component Description
This icon represents Telemetry Logging.

Telemetry logging:

  • Monitors events for (and is built into) Word 2013, Excel 2013, PowerPoint 2013, and Outlook 2013

  • Is disabled by default

  • Is enabled by using Group Policy, registry settings, or by selecting the Enable Logging button in Telemetry Log

  • The resulting telemetry data can be viewed on the local computer by using Telemetry Log

This icon represents the Telemetry Agent.

Telemetry Agent:

  • Reports usage and inventory data for all Office clients

  • Reports application event data for Office 2013 clients

  • Must be deployed to Office 2003, Office 2007, and Office 2010 clients

  • Is built into Office 2013 clients

  • Must be enabled using Group Policy or the registry

  • Runs as a scheduled task, except on Windows XP

  • Requires domain membership

  • Periodically uploads data to a shared folder

This icon represents Group Policy settings.

Group Policy settings:

  • Enable and configure the Telemetry Agent on each client

  • Are part of Office15.admx and Office15.adml

  • Are located under User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard

  • Can be downloaded from the Microsoft Download Center

This icon represents Shared Folders in Office Telemetry.

Shared folder:

  • Stores telemetry data that is uploaded by Telemetry Agents

  • Must be on premises (no cloud support)

  • Can be located on the same computer as other telemetry components

  • Is configured when you install the Telemetry Processor

This icon represents the Telemetry Processor.

Telemetry Processor:

  • Uploads data from the shared folder to the telemetry database

  • Runs as a Windows service named "Office Telemetry Processor"

  • Is supported on Windows Server 2008 and later versions

  • Can be run on Windows 7 and Windows 8 in test or small environments

  • Can be run on the same computer as other telemetry components

  • Can be installed on multiple computers for large deployments

  • Requires domain membership unless a workaround is used

This icon represents the Telemetry Database.

Telemetry database:

  • Provides a data source for Telemetry Dashboard

  • Requires SQL Server 2005, SQL Server 2008, SQL Server 2008 R2, or SQL Server 2012

  • Can be run on SQL Express editions in test or small environments

  • Can be run on the same computer as other telemetry components

Document and solution types that Office Telemetry monitors in Office 2013

The following table lists the document and solutions that Office Telemetry monitors in Office 2013.

Document and solution types that are monitored in Office 2013

Type Office Applications Description

Active Documents

Word 2013, PowerPoint 2013, Excel 2013

Active documents are any Office document files that are not included in the other solution types that are listed in this table. This can include the following:

  • Office binary format files (.doc, .ppt, .pps, .xls)

  • Office OpenXML format files (.docx, .pptx, .ppsx, .xlsx)

  • Macro-enabled files that contain VBA code (.docm, .dotm, .pptm, .potm, .xlsm, .xltm)

  • Files that contain ActiveX controls

  • Files that have External Data Connections

COM add-ins

Word 2013, PowerPoint 2013, Excel 2013, Outlook 2013

COM add-ins include Microsoft Office development tools in Microsoft Visual Studio 2010 application-level add-ins.

Excel Automation add-ins

Excel 2013

This solution type includes earlier versions of Excel-supported Automation add-ins, which are built upon COM add-ins. Functions in Automation add-ins can be called from formulas in Excel worksheets.

Excel XLL add-ins

Excel 2013

XLL add-ins (.xll) are specific to Excel and are built with any compiler that supports building DLLs (dynamic-link libraries). They do not have to be installed or registered. XLL add-ins also include DLLs that contain user-defined commands and functions.

Excel XLS RTD add-ins

Excel 2013

XLS real-time data (RTD) add-ins are Excel worksheets that use the RealTimeData worksheet function to call an Automation server to retrieve data in real-time.

Word WLL add-ins

Word 2013

WLL (.wll) add-ins are specific to Word and built with any compiler that supports building DLLs.

Application add-ins

Word 2013, PowerPoint 2013, Excel 2013

Application add-ins are application-specific files that contain VBA code. These include macro-enabled Word templates (.dotm), Excel add-ins (.xla, .xlam), and PowerPoint add-ins (.ppa, .ppam).

Templates

Word 2013

Templates include document (.dot, .dotx), worksheet (.xlt, .xltx), or presentation (.pot, .potx) templates that are attached to an Office file.

apps for Office

PowerPoint 2013 Excel 2013, Word 2013, Outlook 2013

These are apps for Office that are hosted in a task pane, content, or email within the client application. To learn more, see Overview of apps for Office 2013.

How telemetry data is collected

The following table describes and illustrates how data collection is triggered and the flow of data between the Telemetry Agents and Telemetry Dashboard. You can view a more detailed diagram in the Office Telemetry poster.

Steps in the data collection process

Step Description

Users log on and trigger the Telemetry Agent scheduled task

Users log on and trigger the agent.

Users log on and trigger the scheduled task that uploads telemetry data. The agent waits 10 minutes for logon processes to complete, and then the agent waits for a random number of minutes, up to 4 hours, before it starts the upload process.

After the initial upload, the agent uploads telemetry data every 8 hours. Mobile or offline clients upload data when users log on when the connection is restored.

To learn how to configure the upload interval for Telemetry Agents, see Enabling and configuring Telemetry Agent.

Telemetry Agents send data to the shared folder

Telemetry agents send data to the shared folder

In this image, Telemetry Agents for all versions of Office collect the following data to upload to the shared folder:

  • Most recently used documents

  • Registered add-ins

  • System and user information

Telemetry Agents for Office 2013 also collect the following data for certain Office 2013 applications:

  • Application events

  • Add-in performance

Here are the approximate data upload sizes (in KB) for Telemetry Agents. These sizes can vary.

  • Office 2003, Office 2007, and Office 2010: 50 KB per upload

  • Office 2013: 64 KB per upload

To learn more about the kinds of data that are uploaded and how to manage user privacy for this data, see Manage privacy settings in Telemetry Dashboard.

Telemetry data is processed to the database

Data is processed to the database

After the agents upload data to the shared folder, the Telemetry Processor imports the data to the telemetry database.

The shared folder, Telemetry Processor, and telemetry database can run on the same computer or on different computers. You can find more information in Plan for Telemetry Dashboard topology and hardware.

IT Pros access telemetry data by using Telemetry Dashboard

IT Pros access data by using Telemetry Dashboard

IT Pros who are granted permissions to the telemetry database can use Telemetry Dashboard to view the combined data. To learn more, see To grant other administrators permission to access the telemetry database.

Navigating in Telemetry Dashboard

After all components are deployed and you connect Telemetry Dashboard to the telemetry database, new worksheets are added to display telemetry information about documents, solutions, and other information. The navigation pane on the left side of the Telemetry Dashboard window is the primary way to navigate through the worksheets in the dashboard. You can also use the navigation pane to change the data range and label filters. The following video shows how to navigate in the dashboard.

Short video about Telemetry Dashboard navigation

Video (play button) icon

To learn more about the worksheets in Telemetry Dashboard, visit these resources:

  • Monitor Office compatibility and deployments by using Telemetry Dashboard tells you how to adjust filters, how to determine overall Office stability, and how to investigate unstable documents and solutions.

  • Telemetry Dashboard worksheet reference describes every worksheet in Telemetry Dashboard. This is helpful if you want more information about the columns and data shown in a worksheet.

  • Custom reporting and database schema reference for Telemetry Dashboard helps you create custom reports in Telemetry Dashboard using a PivotTable report. Custom reports can help you customize how telemetry data is displayed for different business purposes. For example, you can view all Warning errors for Excel in a certain business group, create a list of all solutions that use unregistered ActiveX controls, and more.

Managing add-ins by using Telemetry Dashboard

If an add-in is crashing or takes a long time to load, you can disable the add-in for all Office 2013 clients. Use the Add-in management worksheet to generate a Group Policy Object script that sets the configuration state of add-ins that are used with Office 2013. The following screen shot displays the Add-in Management worksheet.

User interface for managing add-ins in Telemetry Dashboard

This screenshot displays the Add-in Management worksheet from the Office Telemetry Dashboard.

By using the Group Policy Administrative Templates, you can also create lists of managed add-ins and optionally block any add-in that isn't on the list. Users can't override these settings unless you allow them to.

For more information about how to manage Office add-ins by using Telemetry Dashboard, see Let's manage add-ins using Telemetry Dashboard.

Managing privacy settings in Telemetry Dashboard

Telemetry Dashboard displays the file names and titles of documents in each user's Most Recently Used list, which might reveal personal or confidential information about the user or organization. The names of add-ins and other solutions that are used by Office are also displayed. In Manage privacy settings in Telemetry Dashboard, you can learn about Telemetry Dashboard settings that help you protect user privacy by disguising file names and titles or by preventing data for selected applications or solutions from being reported.

The following image provides a quick overview of the three methods that Telemetry Dashboard provides to help you protect user privacy.

Three ways to configure privacy settings in Telemetry Dashboard

This diagram illustrates the 3 methods offered by the Office Telemetry Dashboard to protect user privacy.

See also

Content roadmap for Office 2013 compatibility
Office 2013 compatibility guide
Deploy Telemetry Dashboard
Manage privacy settings in Telemetry Dashboard


Monitor Office compatibility and deployments by using Telemetry Dashboard

Published: February 5, 2013

Summary: Explains how to view the stability of Office documents and solutions and the status of your Office deployments by using Telemetry Dashboard.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

After you deploy the components of Telemetry Dashboard and Telemetry Agents have collected data, you can use Telemetry Dashboard to investigate stability issues for Office documents and Office solutions. You can also use Telemetry Dashboard to see the status of Office deployments. This article helps you navigate the worksheets in Telemetry Dashboard, use filters to adjust how data is displayed, and troubleshoot common error messages that are shown in Telemetry Dashboard.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • Open Telemetry Dashboard and connect to the telemetry database

  • Learn about the Telemetry Dashboard worksheets

  • Use filters to adjust what's shown in a Telemetry Dashboard worksheet

  • Determine the overall stability of Office 2013 documents and solutions throughout your organization

  • Drill down to investigate unstable documents or solutions that require your attention

  • View the progress of Office 2013 deployments in your organization

  • Troubleshoot error messages that are shown in Telemetry Dashboard

Open Telemetry Dashboard and connect to the telemetry database

After the Telemetry Dashboard components are deployed, you are ready to start Telemetry Dashboard and connect to the telemetry database.

To help you get started, view this short video called Quick tips for Telemetry Dashboard navigation.

Short video about Telemetry Dashboard navigation

Video (play button) icon

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

The way you start Telemetry Dashboard depends on the operating system you're using. The following table lists and describes the procedures for each supported operating system:

To start Telemetry Dashboard

Operating system | How to start Telemetry Dashboard
Windows 7, Windows Server 2008, or Windows Server 2008 R2 | From the Start menu, choose All Programs, Microsoft Office 2013, Office 2013 Tools, Telemetry Dashboard for Office 2013.
Windows 8 | On the Start screen, right-click the background or swipe in from the top or bottom to display the app bar, select All apps, and then select Telemetry Dashboard for Office 2013.
Windows Server 2012 | Swipe in from the right edge to show the charms and then select Search to see all the apps that are installed on the computer. Next, choose Telemetry Dashboard for Office 2013.

To connect to the telemetry database

  1. On the Getting started worksheet, choose Connect to Database.

  2. In the Data connection settings dialog box, enter the name of the SQL Server server and database where telemetry data is stored, and then choose OK.

After you connect Telemetry Dashboard to the telemetry database, new worksheets are added to display information about Office documents, solutions, and other information. If you haven't yet deployed Telemetry Dashboard components, or if data isn't populating the dashboard as expected, see Deploy Telemetry Dashboard.

Learn about the Telemetry Dashboard worksheets

The following table briefly describes the primary worksheets in Telemetry Dashboard. All Telemetry Dashboard worksheets, including descriptions of their columns, are described in Telemetry Dashboard worksheet reference.

Telemetry Dashboard worksheets

Worksheet name Purpose

Overview

Provides a quick view of the health of Office documents and solutions and a view of deployment trends. The links on this worksheet help you investigate Office compatibility and stability issues in your organization.

Documents

Helps you investigate which Office documents are the most heavily used and identify documents that are experiencing issues.

This worksheet shows Office documents that were detected in the Most Recently Used (MRU) files in the local registry of monitored clients that run Office 2013 and earlier supported versions of Office.

The list also contains load events for monitored clients that run Office 2013. Select any of the value links to open a worksheet that provides more detail. For example, in the Total Users column, you can select any number to view the users who have that file in their MRU list.

Solutions

Shows details about solutions, such as COM add-ins, that were detected on monitored computers. This worksheet also shows telemetry data about load events on monitored client computers that run Office 2013.

Check the Critical column for a count of the number of unique users who have hit critical errors that the solutions are causing on Office 2013 clients. By reviewing critical errors and the number of users affected, you can decide whether to forcibly block add-ins that are crashing for many users. To do so, choose the Add-in management mode link at the top of the worksheet.

You can also investigate performance issues that might be causing a solution to take a longer time to load than expected on some computers. The load time values that are displayed in this worksheet are statistical averages. Select on of the value links to see individual user load times for a particular document.

Telemetry Processor

Lists the servers that run Telemetry Processor, the number of users and computers that are monitored, and the date and time of the last update.

Deployments

Lists the versions of Office that are detected and other details, such as architecture type and number of unique instances of each version.

Custom report

Helps you to create a PivotTable report so that you can customize how you view the data in Telemetry Dashboard. Create a custom report if the Documents and Solutions worksheets don't display data in the way that you want to view it. To learn more, see Custom reporting and database schema reference for Telemetry Dashboard. You can also watch a video demo called Custom reporting in Telemetry Dashboard.

Getting started

Provides step-by-step guidance to deploy Telemetry Dashboard components.

Telemetry Dashboard guide

Provides a brief tutorial on Telemetry Dashboard concepts.

Use filters to adjust what's shown in a Telemetry Dashboard worksheet

In the navigation pane on the left side of the dashboard, there are filters called Label1, Label2, Label3, Label4, Date range, and View. You can use these filters to change the scope of the data that is shown in a worksheet. Any time that you change a filter, you must select the Refresh button An image of the button on the Office Telemetry Dashboard that refreshe the data in the content pane. to refresh the data in the content pane. The Refresh button is located in the upper-right corner of most worksheets. When you refresh the data, the sorting order is automatically reset. You can verify when the content pane was last updated by referring to the time stamp that is located below the Refresh button on the navigation pane.

The following table provides more information about the filters in Telemetry Dashboard.

Telemetry Dashboard filters

Filter Description

Label filters

An image of the label drop down box on the Office Telemetry dashboard's navigation pane.

Use the Label filters to filter data by department, location, or deployment group. These filters are available for most worksheets.

The Label filters are populated by data that is specified in the <TAG> fields when you deploy the Telemetry Agent on client computers. For more information on how to set these fields, see Telemetry Agent.

Date range filter

An image of the Date Range drop down box in the Office Telemetry dashboard's navigation pane

Use the Date range filter to choose the date range for the telemetry data that you want to view. This helps you watch trends over longer periods of time, or drill down and find more recent data for analysis.

The graphs on the Overview worksheet, such as Documents and Solutions stability and Office deployment trend, show data that extends back to four times the selected date range in the navigation pane. This provides better context when you graphically display the data and trends for analysis. For longer date ranges, there might be a small delay before the results are displayed in the content pane.

The Overview worksheet supports changing the date range to Last 7 days, Last 1 month, or Last 3 months. A snapshot of the telemetry database is taken every evening at midnight (local server time). It is used to compose the graphs and data that are shown on the Overview worksheet. Therefore, the Overview worksheet isn't real-time, but is, instead, based on nightly snapshots.

View filter

An image of the View drop down box on the Office Telemetry dashboard's navigation pane.

The View filter on the Documents and Solutions worksheets allows you to select pre-scoped views that help you analyze data. Here are the options that you can choose from:

  • Frequently used displays all documents or solutions that were used within the selected date range, sorted by total number of users.

  • Frequently used by Office 2013 displays all documents or solutions that were used by Office 2013 within the selected range, sorted by total number of users of Office 2013.

  • Attention items displays all documents or solutions that have critical issues that were found within the selected date range.

  • Stability - Top 400/100 displays the documents (up to 400) or solutions (up to 100) that have success rates that are less than the target threshold (95% for documents, 99.9% for solutions).

Determine the overall stability of Office 2013 documents and solutions throughout your organization

The Overview worksheet allows you to quickly understand how your critical documents and solutions (add-ins) are behaving on users' computers. Instead of browsing the Documents and Solutions worksheets, which show you item-by-item status, you can open and refresh the Overview worksheet to see a high-level view of document and solution stability.

The following screen shot shows the Overview worksheet.

The Overview worksheet in Telemetry Dashboard

An screenshot of the main Overview worksheet view on the Office Telemetry dashboard.

The four numbers that are highlighted at the top of the content pane show the number of stable and unstable documents and solutions. If you see a high unstable count, you should investigate to find out what is occurring.

The metrics for stable versus unstable are calculated by determining whether the documents or solutions have success rates that meet the following thresholds:

  • 95% for documents

  • 99.9% for solutions

If a document or solution meets these thresholds, they are considered stable. If they don't meet these thresholds, they are considered unstable. The success rate is determined by the percentage of sessions where the document or solution operated without encountering a critical issue. The critical issues that are tracked by Office Telemetry include application crashes, Office object model calls that would definitively fail for compatibility reasons, and more. A session is defined by the opening of a document or solution or an elapsed 24-hour period where the document is open.

You can use the filters in the navigation pane to focus on specific business groups in your organization or customized date ranges. For example, you might want to know how well the new Sales reporting solutions for Office 2013 are performing since their deployment last month. You can select the Last 1 month date range, and the appropriate Label for the Sales team's computers. After you select Refresh, the Overview worksheet view shows you a high-level view of document and solution stability for the Sales team's Office deployments. From there, you can decide your next steps.

In addition, the Overview worksheet view provides a summary of the top 400 frequently used documents and the top 100 frequently used solutions. Research indicates that these numbers represent the average number of documents and solutions in any given enterprise department that are frequently used.

Note:

Built-in documents and solutions that are provided by Microsoft aren't included in the top documents and solutions counts that are displayed on the Overview worksheet.

Drill down to investigate unstable documents or solutions that require your attention

After you know the number of unstable documents and solutions, you can drill into the details. On the Overview worksheet, select a value to see a detailed list of stable or unstable documents or solutions. The following graphic shows how to view the unstable documents by selecting the corresponding value (23) on the Overview worksheet.

How to choose a value on the Overview worksheet to see unstable documents

A screenshot of a drill down Overview worksheet showing stable and unstable document statistics.

After you click the link for unstable documents, the Documents worksheet appears. The worksheet is filtered to show the 23 unstable documents. The following screen shot shows an example of this filtered view. Although it isn't obvious in the screen shot, only 23 documents are listed, sorted by most unstable.

Unstable documents that are shown in the Documents worksheet

A screenshot of a 2nd level drill down Overview worksheet showing details for unstable documents.

Important:

Remember that when you select a link on the Overview worksheet to see details about documents or solutions, the contents pane displays a filtered view. Select the message bar at the top of the header pane to see the full list of all items for that worksheet.

Back on the Overview worksheet, under the stable and unstable counts, you can see the trend charts that show how these counts increased or decreased over past periods. If you see the trend line pointing down to indicate a decline in stability, this indicates that recent changes are triggering issues for your documents and solutions. As shown in the following screen shot, the date range that is displayed in the trend chart shows an expanded range that is four times longer than the selected date range. This provides better context to view the overall trend data.

How trend data is illustrated on the Overview worksheet

A screenshot of a drill down Overview worksheet on the Office Telemetry dashboard showing unstable vs. stable document summary over an extended period.

View the progress of Office 2013 deployments in your organization

You can track your overall Office 2013 deployment progress by looking at the chart at the lower part of the Overview worksheet. This shows the number of users who are running each Office version and how the Office deployments have changed over time. By using this chart, you can quickly check the deployment status and share progress with your stakeholders.

Note:

The date range that is displayed in the deployment trend chart shows an expanded range that is four times longer than the selected date range. This provides better context to view the overall trend data.

The following image shows an example of the Office deployment trend chart on the Overview worksheet.

Office deployment trend chart on the Overview worksheet

A screenshot of deployment trends as displayed on the Overview page in the Office Telemetry dashboard.

Troubleshoot error messages that are shown in Telemetry Dashboard

As you use Telemetry Dashboard, you might notice error messages that are shown in yellow banners at the top of the dashboard. The following sections describe common error messages.

You see the error message "The Telemetry Dashboard COM add-in is not enabled or installed."

When you view a worksheet in Telemetry Dashboard, you might see the following message:

COM add-in error message

A screenshot of the Telemetry Dashboard COM add-in error message.

To resolve this issue, enable the Telemetry Dashboard COM add-in that is available in Office Professional Plus 2013, Office Standard 2013, and Office 365 ProPlus.

To enable the Telemetry Dashboard COM add-in

  1. Start Telemetry Dashboard by choosing Telemetry Dashboard for Office 2013 in the All Apps page in Windows 8, or by choosing Telemetry Dashboard for Office 2013 from the Start menu under Office 2013 Tools in Windows 7.

  2. Select the Let's get started button.

  3. In the Getting Started worksheet, select the Click here to use saved copies of Telemetry Dashboard banner that is shown in the following screen shot.

    Message that enables saved copies of Telemetry Dashboard

    A screenshot of the Save Copies Info Message.

  4. Reopen the Telemetry DashboardExcel worksheet that had the error message.

You see the error message "Telemetry Processor service(s) have errors."

When you view a worksheet in Telemetry Dashboard, you might see the following message:

Telemetry processor error message

A screenshot of the Telemetry Processor services error message.

The Telemetry Processor error message is displayed when no agents have reported any data to the dashboard, or if the Telemetry Processor hasn't inserted any data to the database for a day.

For more information, see the log file (%windows%\ServiceProfiles\NetworkService\AppData\Local\Temp\dperrorlog.txt on the computer where Telemetry Processor is running).

In addition, do the following:

  • Verify the network connection between the Telemetry Processor and the Telemetry Dashboard.

  • In Service in Control Panel, verify that the Office Telemetry Processor service is running.

  • Verify that the SQL Server server is running correctly.

  • Verify that the data in the telemetry shared folder that was reported back from the agent was processed correctly. If there are many folders and files in the shared folder that weren't processed for more than 2 hours, the Telemetry Processor isn't working correctly.

For more information about how to troubleshoot Telemetry Processor, see Troubleshooting Telemetry Dashboard deployments.

See also

Content roadmap for Office 2013 compatibility
Overview of Office Telemetry
Deploy Telemetry Dashboard
Telemetry Dashboard worksheet reference
Office 2013 compatibility guide


Configure and deploy Telemetry Dashboard

Published: November 27, 2012

Summary: See what's available to help you deploy and configure Telemetry Dashboard in your organization.

Applies to: Office 365 ProPlus | Office 2013

Audience: IT Professionals

Office 2013 logo The following table includes links to resources that help you deploy and configure Telemetry Dashboard.

Resources to deploy and configure Telemetry Dashboard

Article | Description
Deploy Telemetry Dashboard | Telemetry Dashboard replaces the Office 2010 compatibility tools Office Migration Planning Manager (OMPM), Office Code Compatibility Inspector (OCCI), and Office Environment Assessment Tool (OEAT). This article describes prerequisites, deployment procedures, answers to frequently asked questions, database sizing, and troubleshooting for Telemetry Dashboard.
Manage privacy settings in Telemetry Dashboard | Learn about the data that Telemetry Agent collects and how to help protect user privacy by hiding file data in Telemetry Dashboard.
Plan for Telemetry Dashboard topology and hardware | Provides recommendations for sizing, topology, hardware, and bandwidth for Telemetry Dashboard deployments.
Telemetry in Office 2013 poster | Download or view a visual representation of the Telemetry Dashboard components and how they work. This poster includes a description of all components, a list of what Office files are monitored, how data collection works, and more. Thumbnail of the Office Telemetry poster Thumbnail image of the Office Telemetry poster
Telemetry Dashboard articles on the Office IT Pro blog | Visit our blog for the latest news on Telemetry Dashboard and Office 2013 compatibility.
Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum | If you have questions about how to use Telemetry Dashboard or its components, you can submit your questions in this TechNet forum.
Telemetry Dashboard worksheet reference | Find reference information about Telemetry Dashboard worksheets that helps you understand Office stability in your organization
Custom reporting and database schema reference for Telemetry Dashboard | Learn about custom reports in Telemetry Dashboard, view sample reports, and see lists of the tables and fields in the telemetry database.

The following video recordings about Telemetry Dashboard in Office 2013 are available to view online or to download.

Quick tips for Telemetry Dashboard navigation

Video (play button) icon

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


Plan for Telemetry Dashboard topology and hardware

Published: November 13, 2012

Summary: Learn about sizing, topology, hardware, and bandwidth recommendations for Telemetry Dashboard deployments.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

When you deploy Telemetry Dashboard components, you must consider several factors. These can include the location of the users to be monitored and the hardware specifications of the computer that runs the Telemetry Processor. It's also important to understand the supported limits for Telemetry Dashboard deployments, such as the maximum number of users who can be monitored. Use the guidance in this article to help you design a Telemetry Dashboard topology that is sized appropriately for your organization.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • Overview of topology planning for Telemetry Dashboard

  • Topology requirements for Telemetry Dashboard deployments

  • Supported limits for Telemetry Dashboard components

  • Topology and bandwidth recommendations for Telemetry Dashboard deployments

  • Scaling out Telemetry Dashboard deployments

  • Hardware recommendations for Telemetry Dashboard deployments

Overview of topology planning for Telemetry Dashboard

If you reviewed the Office 2013 compatibility guide and are familiar with the telemetry components that are described in Deploy Telemetry Dashboard and in the Office Telemetry poster, you are ready to design your Telemetry Dashboard topology.

As you review this article, be aware that the recommendations assume that the following statements are true for your organization:

  • Telemetry Agents upload data every 8 hours, which is the default setting.

  • Each user has a single computer that runs a Telemetry Agent.

If these statements are not true for your organization, plan to adjust your topology accordingly.

Topology requirements for Telemetry Dashboard deployments

At a minimum, Telemetry Dashboard requires one telemetry database and one Telemetry Processor and shared folder pair. These can be hosted on the same computer, as shown in the following figure. You can use the computer for other purposes besides hosting Telemetry Dashboard components.

Minimum topology requirements for Telemetry Dashboard

This image illustrates the minimum topology.

Two additional requirements apply to the Telemetry Processor and shared folder pairs:

  • A Telemetry Processor must always have a dedicated shared folder. A shared folder can't be used by multiple Telemetry Processors.

  • You can have multiple Telemetry Processor and shared folder pairs, but each pair must be stored on a separate computer. The next section, Supported limits for Telemetry Dashboard components, describes the numbers of pairs that you can create in a Telemetry Dashboard topology.

Supported limits for Telemetry Dashboard components

For best performance, we recommend that your Telemetry Dashboard topology does not exceed the limits that are described in the following table.

Supported limits for Telemetry Dashboard components

Supported limits for a telemetry database Supported limits for each Telemetry Processor and shared folder pair

  • Host telemetry data for up to 100,000 users.

  • Host up to ten Telemetry Processor and shared folder pairs.

  • Host up to 30 users of Telemetry Dashboard. Hosting of more than 30 users is supported but, when multiple users try to connect to the database at the same time, database performance may decrease temporarily.

  • Process data for up to 50,000 users.

Here is a figure that shows a production topology that is configured within the supported limits. Note that each Telemetry Processor and shared folder pair has fewer than 50,000 users and that this topology already has the maximum of 100,000 users for the telemetry database. Three computers host telemetry components in this example.

Production topology for Telemetry Dashboard

This image illustrates a production topology.

Topology and bandwidth recommendations for Telemetry Dashboard deployments

If your organization has users who are in multiple geographic locations, make sure that you follow these guidelines when you decide where you want to deploy the Telemetry Dashboard components.

  • We recommend that you host the Telemetry Dashboard components (the dashboard, telemetry database, Telemetry Processor, shared folder, and Telemetry Agents) on a network that has bandwidth of 1.5 Mbps (T1) or more, with latencies no greater than 150 ms.

  • Deploy each Telemetry Processor and shared folder pair as close as possible, ideally on the same computer.

  • If you only need one Telemetry Processor and shared folder pair, run the telemetry database, Telemetry Processor, and shared folder on the same computer to avoid any bottlenecks that are caused by transferring data over the network.

  • If you must have multiple Telemetry Processor and shared folder pairs, run one Telemetry Processor on the same computer as the telemetry database. Run other Telemetry Processors on separate computers.

For a telemetry database that hosts more than 10,000 users, consider the following recommendations, in addition to general performance recommendations for SQL Server:

  • For the best performance, deploy SQL Server on a dedicated computer that is not hosting databases for any other application.

  • For the best performance, place the tempdb, telemetry database, and SQL transaction logs on separate physical hard disks.

  • Ensure that the SQL I/O channels to the disks are not shared by other applications, such as the paging file and Internet Information Services (IIS) logs.

Scaling out Telemetry Dashboard deployments

We recommend that you start with a single dedicated computer that is running the telemetry database, Telemetry Processor and shared folder, and then scale out the topology by adding more computers that host Telemetry Processor and shared folder pairs. We recommend that you add a new Telemetry Processor and shared folder pair if you do either of the following:

  • Collect data from more than 50,000 users.

  • Collect data from remote sites. We recommend that you install the Telemetry Processor and shared folder pair as close to the agents as possible.

Hardware recommendations for Telemetry Dashboard deployments

The following table describes hardware recommendations for Telemetry Dashboard deployments.

Hardware recommendations for the computer that hosts the telemetry database

Monitored users and monitored duration* | RAM | Disk space | Processor
100 users for 3 months (evaluation) | 4 GB** | 81 MB | 1 Ghz or faster
10,000 users for 1 year | 8 GB** | 14 GB | 2 GHz or faster
100,000 users for 1 year | 32 GB** | 107 GB | 2 GHz or faster

*Includes inventory and events for earlier versions of Office and for Office 2013.

**The recommended RAM value is greater than the one recommended as the minimum values for SQL Server because of the distribution of data required for a Telemetry Dashboard environment.

The following table describes hardware recommendations for each computer that hosts a Telemetry Processor and shared folder pair.

Hardware recommendations for each computer that hosts a Telemetry Processor and shared folder pair

Monitored users and monitored duration* | RAM | Disk space | Processor
Any | 4 GB | 11 GB | 1 Ghz or faster

*Includes inventory and events for both earlier versions of Office and for Office 2013.

See also

Content roadmap for Office 2013 compatibility
Deploy Telemetry Dashboard
Compatibility in Office 2013


Deploy Telemetry Dashboard

Updated: March 19, 2013

Summary: Explains how to deploy Telemetry Processor, Telemetry Agent, and other components that are required by Telemetry Dashboard for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 introduces a new application and document compatibility tool, known as Telemetry Dashboard. It replaces the Office 2010 compatibility tools Office Migration Planning Manager (OMPM), Office Code Compatibility Inspector (OCCI), and Office Environment Assessment Tool (OEAT). This article describes prerequisites, deployment procedures, answers to frequently asked questions, and troubleshooting for Telemetry Dashboard.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • Introducing Telemetry Dashboard for Office 2013

  • Deploying Telemetry Dashboard components

  • Frequently asked questions about Telemetry Dashboard

  • Troubleshooting Telemetry Dashboard deployments

Introducing Telemetry Dashboard for Office 2013

Telemetry Dashboard is an Excel 2013 workbook that displays compatibility and inventory data about the Office files, Office add-ins, and Office solutions that are used in an organization. It is used as part of the modern Office compatibility process that is described in Office 2013 compatibility guide. For a visual representation of the Telemetry Dashboard components and how they work, see Telemetry in Office 2013. This poster includes a description of all components, a list of what Office files are monitored, how data collection works, and more.

Thumbnail image of the Office Telemetry poster

If you have questions about how to use Telemetry Dashboard or its components, you can submit your questions in the Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum on TechNet. You can read blog posts about Telemetry Dashboard in the Office IT Pro blog.

Deploying Telemetry Dashboard components

This article helps you deploy the 5 components of Telemetry Dashboard: the dashboard itself, the Telemetry Processor, the Telemetry Agent, the telemetry database, and a shared folder. Make sure that you review Plan for Telemetry Dashboard topology and hardware for topology, scalability, and hardware guidance before you deploy these components.

Important:

If the computers that run Telemetry Processor, the telemetry shared folder, and the SQL database aren't joined to a domain, you must install these components by using the script that is described in the blog post Quickly set up Office Telemetry Dashboard on a workgroup or domain-joined computer.

Telemetry Dashboard

Telemetry Dashboard is an Excel workbook that is configured to connect to a telemetry database. Telemetry Dashboard is installed together with Office Professional Plus 2013, Office Standard 2013, and Office 365 ProPlus editions of Office 2013. To view it, you must have Excel 2013 installed. You can download Office 2013 from the Evaluation Center.

After Office 2013 is installed, you can start Telemetry Dashboard by using one of the procedures in the following table:

How to start Telemetry Dashboard

Operating system | How to start Telemetry Dashboard
Windows 7, Windows Server 2008, or Windows Server 2008 R2 | From the Start menu, choose All Programs, then Microsoft Office 2013, then Office 2013 Tools, then Telemetry Dashboard for Office 2013.
Windows 8 | On the Start screen, right-click the background or swipe in from the top or bottom to display the app bar, choose All apps, and then choose Telemetry Dashboard for Office 2013.
Windows Server 2012 | Swipe in from the right edge to show the charms and then choose Search to see all the apps that are installed on the computer. Next, choose Telemetry Dashboard for Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

SQL Server

SQL Server must be deployed before you can configure Telemetry Dashboard. You don't have to have an existing database, but you do have to install or have access to one of these versions of SQL Server:

  • SQL Server 2005

  • SQL Server 2005 Express Edition

  • SQL Server 2008

  • SQL Server 2008 Express Edition

  • SQL Server 2008 R2

  • SQL Server 2008 R2 Express Edition

  • SQL Server 2012

  • SQL Server 2012 Express

The Getting started worksheet in Telemetry Dashboard provides a link to download SQL Server 2012 Express. If you don't have SQL Server already installed, follow the steps in To download and install SQL Server 2012 Express. Be sure to review the following guidelines before you install SQL Server 2012 Express.

  • Make sure that the computer meets the hardware and software requirements for SQL Server 2012. This is especially important if you are planning an all-in-one configuration for testing because SQL Server has additional requirements, such as installing Windows service packs that aren't required for Telemetry Dashboard. These requirements are described in Hardware and Software Requirements for Installing SQL Server 2012.

  • For local installations, you must run Setup as an administrator. If you install SQL Server from a remote shared folder, you must use a domain account that has read and execute permissions on the remote shared folder. For more information, see Install SQL Server 2012 from the Installation Wizard (Setup).

To download and install SQL Server 2012 Express

  1. In Telemetry Dashboard, on the Getting started worksheet, under 1. Set up prerequisites, choose the link to download and install SQL Server 2012 Express with Tools. Choose the 32-bit or 64-bit edition, as appropriate. Or use this link: Microsoft SQL Server 2012 Express.

  2. The setup process for SQL Server 2012 Express takes a while to download and extract files. Accept the various prompts and wait for the first page of SQL Server 2012 Express, which is named the SQL Server Installation Center, to appear after extraction is completed. Then, follow these steps:

    1. In the SQL Server Installation Center, choose New SQL Server stand-alone installation or add features to an existing installation.

    2. In the SQL Server 2012 Setup wizard, read the license terms, accept them, and then choose Next.

    3. On the Feature Selection page, accept the default settings. Choose Next.

    4. On the Instance Configuration page, create a named instance (for example, use the name "teledash"). Choose Next.

    5. On the Server Configuration page, accept default service accounts. Choose Next.

    6. On the Database Engine Configuration page, accept the default authentication mode (Windows authentication mode). Your user account is displayed as a SQL Server administrator. (Warning: Don't use Mixed Mode because Telemetry Dashboard doesn't support SQL Server authentication.) Choose Next.

    7. On the Error Reporting page, select the check box if you want to send error reports to Microsoft. Otherwise, just choose Next.

    8. Wait for the installation process to finish, and then exit the wizard and the SQL Server Installation Center.

Telemetry Processor

Telemetry Processor runs on one or more computers and collects inventory, usage, and telemetric data from the telemetry shared folder and imports the data to the telemetry database. Telemetry Processor is installed as a Windows service named "Telemetry Processor."

We recommend the following operating systems for computers that run Telemetry Processor:

For production environments For best performance, we recommend these operating systems:

  • Windows Server 2008

  • Windows Server 2008 R2

  • Windows Server 2012

For test or small production environments You can use computers that run Windows 7 and Windows 8 in test environments and in small production environments. There is a limit of 20 concurrent connections for client operating systems, but in small environments, the agent randomization setting should minimize any chances of more than 20 agents connecting at one time.

Make sure that you have the following available before you run the Telemetry Processor wizard.

  • SQL Server instance name. The example used earlier is "teledash."

  • SQL database. A new database will be created if you don't specify an existing database.

  • UNC path of a shared folder. You can create a shared folder as part of the wizard if one doesn't exist. If you specify an existing shared folder, any existing NTFS and shared folder permissions are overwritten with permissions set by the wizard.

  • At least 11 GB of hard disk space. This disk space is needed to temporarily store telemetry data that is collected from users.

You must run the Telemetry Processor Settings wizard as a domain account that has permission to create a new database or use an existing database on the SQL Server. If you have to create a shared folder within the wizard, you must also have permissions to create a new shared folder.

To install Telemetry Processor

  1. In Telemetry Dashboard, on the Getting started worksheet, choose the installation link under 2. Install Telemetry Processor.

    • Optionally, you can use the links in Telemetry Dashboard to save the .msi file to another computer and run the Setup program there. This step is required if you are installing Telemetry Processor on separate computers.

  2. Choose Next and then choose Yes to accept the User Account Control prompt to install the Telemetry Processor. Choose Finish, which starts the Telemetry Processor settings wizard.

  3. Choose Yes to accept the prompt, and then choose Next.

  4. Type the name of the SQL Server instance, and then choose Connect.

  5. Type the name of a new database, choose Create, and then choose Next.

  6. Choose Yes to create database permissions and the database role.

  7. Do one of the following on the Shared Folder page:

    • Specify the UNC path of an existing shared folder, and then choose Next. Choose Yes to allow the wizard to set the appropriate permissions.

    • To create a new shared folder on the local computer, choose Browse. Navigate to the location where you want to create the shared folder. open the shortcut menu for the parent folder (right-click it), point to New, and then choose Folder. Type the name of the new folder, make sure that you choose the folder again to select it, and then choose Select Folder. Choose Next, and then choose Yes to allow the wizard to share the folder and set the appropriate permissions.

  8. Accept the default option to sign up for the Customer Experience Improvement Program, or choose the option not to sign up for the program at this point, and then choose Next.

  9. Choose Finish to exit the wizard.

Note:

The Telemetry Processor generates error logs in a file that is named DPERRORLOG.txt. It is located in a hidden folder at %systemroot%\ServiceProfiles\NetworkService\AppData\Local\Temp.

Telemetry database

The telemetry database, which was created by the Telemetry Processor settings wizard, is ready to be configured and connected to Telemetry Dashboard.

To connect to the telemetry database

  1. In Telemetry Dashboard, on the Getting Started worksheet, under 5. Connect to the database to view telemetry data, choose Connect to Database.

  2. Specify the name of the SQL Server and SQL database that you specified during the installation of Telemetry Processor.

When the connection is established, many new worksheets are added to the workbook. They won't contain data until you deploy and enable Telemetry Agents.

To grant other administrators permission to access the telemetry database

  • You can use the Telemetry Dashboard Administration Tool (Tdadm) on the computer that is running SQL Server to allow other administrators to view data in Telemetry Dashboard. You don't have to run this for your own account if you created a database when you installed Telemetry Processor. Update the values for dbserver, dbname, and domain\user as needed.

    Copy code
    tdadm.exe -o permission -databaseserver dbserver -databasename dbname -add domain\user

For more information about Tdadm, see the Tdadm wiki.

For more information about how to configure the reporting threshold in the telemetry database to help protect user privacy, see Manage privacy settings in Telemetry Dashboard. If you have problems connecting to the database, see Troubleshooting Telemetry Dashboard deployments.

Note:

If your data (for example, file names, solution names, user names, computer names, or tag values) includes supplementary characters (surrogate pairs), use the following SC collations that are available in SQL Server to support better handling of the characters.

  • Version 90 Windows collations, such as Chinese_PRC_Stroke_90

  • Version 100 Windows collations, such as Latin1_General_100_CI_AS_SC

For more details about collation settings, see the documentation for the version of SQL Server that you are using.

Telemetry Agent

Telemetry Agent collects inventory, usage, and telemetry data and uploads it to a shared folder. To help you filter and organize this data when it is displayed in Telemetry Dashboard, you can assign up to four custom labels for each agent to describe the client computer's physical location, the user's business group, user role, or other identifier.

The following information and instructions will help you learn more about Telemetry Agent and how to deploy and enable it.

Planning labels for Telemetry Agents

You can assign as many as four labels to each user. This helps you analyze telemetry data for specific business groups, types of users, or any other designation that you choose. Use the following resources to help you plan the labels that you want to use before you deploy and enable the agents:

  • Deploying labels (tags) for better analysis in Telemetry Dashboard describes how labels appear in Telemetry Dashboard. The blog post also describes three methods for populating the labels:

    • Use Group Policy and set labels based on your Active Directory structure.

    • Use a Windows PowerShell script (Create-GroupPolicyObjectForTags.ps1) to generate Group Policy Objects filtered by security group.

    • Use a VBScript (Add-Tags.vbs) to set labels based on user information that is stored in Active Directory.

  • The video Custom reporting in Telemetry Dashboard demonstrates how labels are used in custom reports. This may give you some additional ideas on which labels to choose.

Deploying Telemetry Agent

Telemetry Agent is built into Office Professional Plus 2013 and Office 365 ProPlus editions of Office 2013 and doesn't have to be deployed separately. If your organization has any of the following versions of Office, you must deploy the agent to these clients.

  • Office 2003

  • Office 2007

  • Office 2010

  • Office Professional Plus (available as part of Microsoft Office 365)

Note:

An Office 2013 VL license allows you to install Telemetry Agent on all Office 2010, Office 2007, and Office 2003 client computers in your organization.

Telemetry Agent must run one of the following versions of Windows (either 32-bit or 64-bit):

  • Windows 8

  • Windows 7

  • Windows Vista with Service Pack 2

  • Windows XP with Service Pack 3

  • Windows Server 2012

  • Windows Server 2008 R2

  • Windows Server 2008

  • Windows Server 2003

Important:

Telemetry Agent might not work correctly on Windows service packs that are no longer supported by Microsoft. We recommend that you verify that your service pack is supported on the Microsoft Product Lifecycle Search website before you install the agent.

To deploy Telemetry Agent to Office 2003, Office 2007, and Office 2010 clients

  1. In Telemetry Dashboard, on the Getting started worksheet, under 3. Deploy Telemetry Agent, choose the appropriate link (x86 or x64) to save the Telemetry Agent .msi file to a specified location.

  2. Using your preferred method, deploy the .msi file to client computers that you want to monitor. Be sure to match the x86 or x64 version of Telemetry Agent to the architecture of the Windows operating system that is running on the client, not the Office client architecture.

    For client local installations, you must run the .msi file as an administrator. You can deploy the MSI package silently by using the /quiet parameter with the MSI. Refer to the MSI help for the full set of available parameters.

    For large-scale deployments, you can deploy Telemetry Agent by using System Center Configuration Manager.

Enabling and configuring Telemetry Agent

To configure and enable Telemetry Agent, you can edit the registry on each monitored client computer in small or test environments. For production environments that contain hundreds or thousands of client computers, you can use Group Policy administrative templates. Note that two settings, AgentInitWait and AgentRandomDelay, are configurable only in the registry.

  • Use the registry to enable and configure Telemetry Agent

  • Use Group Policy to enable and configure Telemetry Agent

Use the registry to enable and configure Telemetry Agent

The easiest way to update the registry on a single client is to run a .reg file that sets the registry values that enable Telemetry Agent to collect and upload data. You can create this .reg file by copying one of the following examples to a text file, updating the required fields, saving the file as agent.reg, and running it from an elevated command prompt. In the .reg file, make sure that you specify the UNC path of the shared folder to which the agent uploads the data. Optionally, you can update the <TAG> fields so you can easily identify the collected data in your organization, such as by department, location, or deployment group.

The following example sets the default settings that are needed to enable Telemetry Agent. AgentInitWait and AgentRandomDelay are set to their default values, which are appropriate for production deployments.

Copy code
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm]
"CommonFileShare"="\\\\<SERVERNAME>\\<SHARENAME>"
"Tag1"="<TAG1>"
"Tag2"="<TAG2>"
"Tag3"="<TAG3>"
"Tag4"="<TAG4>"
"AgentInitWait"=dword:00000258
"Enablelogging"=dword:00000001
"EnableUpload"=dword:00000001
"EnableFileObfuscation"=dword:00000000
"AgentRandomDelay"=dword:000000F0

The code in the following example enables Telemetry Dashboard to begin uploading data immediately by setting AgentInitWait and AgentRandomDelay to their smallest values. Use this example only in test deployments.

Copy code
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm]
"CommonFileShare"="\\\\<SERVERNAME>\\<SHARENAME>"
"Tag1"="<TAG1>"
"Tag2"="<TAG2>"
"Tag3"="<TAG3>"
"Tag4"="<TAG4>"
"AgentInitWait"=dword:00000001
"Enablelogging"=dword:00000001
"EnableUpload"=dword:00000001
"EnableFileObfuscation"=dword:00000000
"AgentRandomDelay"=dword:00000000

You can distribute registry updates to multiple client computers by putting a .reg file in a shared folder and instructing users to run the file, or you can add a command to the users' logon script to automatically import the .reg file when users log on. Use the syntax in the following example to start the .reg file from a logon script:

Copy code
%windir%\regedit.exe /s <PATH>\<NAME>.reg

For more information about how to use .reg files, see How to add, modify, or delete registry subkeys and values by using a registration entries (.reg) file.

The following tables describe each registry value.

Telemetry Agent registry settings under HKEY_CURRENT_USER\Software\ Policies\Microsoft\Office\15.0\OSM

Value name Type Value description and data Required or optional

enablelogging

REG_DWORD

Enables runtime telemetry and static scanning. This allows the agent to collect telemetry data.

Value:

1 = Enable logging and agent

0 = Disable logging and agent

Default = 0 (Disable logging & agent)

Required

enableupload

REG_DWORD

Turns on the data uploading feature in the Telemetry Agent so that the agent can periodically upload telemetric data to the shared folder that is specified in CommonFileShare.

Value:

0 = Do not upload

1 = Upload

Default = 0 (Do not upload)

Required

commonfileshare

REG_SZ

Specifies the UNC path of the shared folder for storing telemetry data.

Value:

\\server\share

Required

tag1

tag2

tag3

tag4

REG_SZ

Adds custom tags to the Office telemetric data that is sent by Telemetry Agent. If you enable this policy setting, the specified custom tags are shown in Telemetry Dashboard, where you can filter the collected data by the tag name. You can replace tag1, tag2, tag3, and tag4 with custom strings to categorize and filter the collected data (for example, replace tag1 with a department name, replace tag2 with the location of the users, and so on).

Value:

tag1

tag2

tag3

tag4

Optional

enablefileobfuscation

REG_DWORD

Configures the Telemetry Agent to disguise, or obfuscate, certain file properties that are reported in telemetric data. If you enable this policy setting, the Telemetry Agent obfuscates the file name, file path, and title of Office documents before uploading telemetric data to the shared folder. You can learn more about file obfuscation and other privacy settings for Telemetry Dashboard in Manage privacy settings in Telemetry Dashboard.

Value:

0 = Do not obfuscate

1 = Obfuscate

Default = 0 (No obfuscation)

Optional

AgentInitWait

REG_DWORD

Important:

To avoid affecting network or client performance, decrease this value in test environments only.

Adjusts the time that the agent waits before it scans a client and uploads data to the telemetry shared folder. If this value doesn't exist, the default wait time is 10 minutes (600 seconds). In test environments, you can specify 1 second to remove the delay for testing Windows 7 and earlier clients. We recommend that you set this to at least 60 seconds for computers that run Windows "8."

Value:

x = Wait time in seconds

Optional

AgentRandomDelay

REG_DWORD

Important:

To avoid affecting network or client performance, decrease this value in test environments only.

Adjusts the maximum random delay, in minutes. The agent randomly waits between 0 and AgentRandomDelay minutes, in addition to the AgentInitWait value, before it starts to scan or upload telemetry data. If this value doesn't exist, the agent waits between 0 minutes to 240 minutes. In test environments, you can specify 0 to remove the random delay for testing.

Value:

x = Random delay in minutes

Optional

Telemetry Agent registry settings under HKEY_CURRENT_USER\Software\ Policies\Microsoft\Office\15.0\OSM\preventedapplications

Value name | Value type | Value description and data | Required or optional
accesssolution olksolution onenotesolution pptsolution projectsolution publishersolution visiosolution wdsolution xlsolution | REG_DWORD | Prevents telemetric data for specific Office applications from being reported to Telemetry Dashboard. You can learn more about this registry setting in Manage privacy settings in Telemetry Dashboard. Value: 1 = Prevent reporting 0 = Allow reporting Default = 0 (Allow reporting) | Optional

Telemetry Agent registry settings under HKEY_CURRENT_USER\Software\ Policies\Microsoft\Office\15.0\OSM\preventedsolutiontypes

Value name | Value type | Value description and data | Required or optional
agave appaddins comaddins documentfiles templatefiles | REG_DWORD | Prevents telemetric data for specific solutions from being reported to Telemetry Dashboard. However, the solution type is still reported. You can learn more about this registry setting in Manage privacy settings in Telemetry Dashboard. Value: 1 = Prevent reporting 0 = Allow reporting Default = 0 (Allow reporting) | Optional

Use Group Policy to enable and configure Telemetry Agent

You can also use Group Policy to enable and configure Telemetry Agents. Download the Group Policy admininstrative template files from the Microsoft Download Center. The policy settings that are listed in the following table are available in the path User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard.

Telemetry Agent policy settings

Setting name Description Required or optional

Turn on telemetry data collection

Turns on the data collection features in Office that are used by Telemetry Dashboard and Telemetry Log. By default, data collection is disabled in Office 2013.

Required

Turn on data uploading for the Telemetry Agent

Turns on the data uploading feature in the Telemetry Agent so that the agent can periodically upload telemetric data to a shared folder. By default, data uploading is disabled.

Required

Specify the UNC path to store Office telemetry data

Specifies the Uniform Naming Convention (UNC) path of a shared folder to which the Telemetry Agent sends Office telemetric data.

Required

Specify custom tags for Office telemetry data

Adds custom tags to the Office telemetric data that is sent by the Telemetry Agent. If you enable this policy setting, the specified custom tags are shown in the Telemetry Dashboard, where you can filter the collected data by the tag name. You can specify any string that you want to categorize and filter the collected data (for example, department name, title of user, and so on).

Optional

Turn on privacy settings in Telemetry Agent

Configures the Telemetry Agent to disguise, or obfuscate, certain file properties that are reported in telemetric data. If you enable this policy setting, the Telemetry Agent obfuscates the file name, file path, and title of Office documents before uploading telemetric data to the shared folder.

You can learn more about file obfuscation and other privacy settings for Telemetry Dashboard in Manage privacy settings in Telemetry Dashboard.

Optional

Office applications to exclude from Telemetry Agent reporting

Prevents telemetric data for specific Office applications from being reported to the Telemetry Dashboard.

Optional

Office solutions to exclude from Telemetry Agent reporting

Prevents telemetric data for specific Office solutions from being reported to the Telemetry Dashboard.

Optional

Triggering data collection manually

When a user logs in to an Office client, the Telemetry Agent waits 10 minutes to allow other logon processes to be completed, and then waits a randomized number of minutes up to 4 hours (or the max delay that is set for the AgentRandomDelay registry value) to avoid client computers sending data to network at the same time. After this initial scan, the Telemetry Agent scans and collects data every 8 hours.

If you want to trigger the data collection manually and see data uploaded immediately to Telemetry Dashboard, set the following registry values as described in the earlier table:

For computers that run Windows 7 and earlier

  • AgentInitWait: 1

  • AgentRandomRelay: 0

For computers that run Windows 8

Because user logon is faster in Windows 8, we recommend setting AgentInitWait to at least 60 seconds to make sure that the network connection is ready after the user logs on.

  • AgentInitWait: 60

  • AgentRandomRelay: 0

To trigger a scan manually, use one of the following procedures.

To trigger scanning and data collection on Windows clients (except Windows XP)

  1. Make sure that the computer is connected to an AC power supply.

  2. In Task Scheduler on the client computer, expand Task Scheduler Library, expand Microsoft, and then choose Office.

  3. Open the shortcut menu for the OfficeInventoryAgentLogOn task (right-click it), and then choose Run.

To trigger scanning and data collection on clients that run Windows XP

  1. After installing the agent, log off and then log on again to the client computer.

Frequently asked questions about Telemetry Dashboard

Q: What happens if a client computer is disconnected for some time?

A: If a monitored client is disconnected, or if the telemetry shared folder is temporarily unavailable, data is still collected locally on the client. When the connection is restored, the backlog of information is delivered to the telemetry shared folder.

Q: How much data is transferred during each transfer?

A: The amount varies according to the number of files that are used and solutions installed. Here are estimates for how much data Telemetry Agent sends for different versions of Office:

  • Earlier versions of Office send approximately 50 KB for every upload.

  • Office 2013 sends approximately 64 KB of data for every upload.

The amount transferred can be larger when the interval is set to longer than the default or when the data sits idle on the local computer for long periods of time. Note that actual file content isn't transferred; only metadata about the files is transferred.

Q: What is the performance impact of Telemetry Agent?

A: The agent is transparent to the user and performs low-impact tasks, such as inspecting content from MRU and specific local registry settings. The agent doesn't actively scan files. The agent does account for monitor power state and network status to avoid affecting client performance.

Q: How can I re-initialize an agent?

A: Telemetry Agent is stored locally on the client computer at %localappdata%/Microsoft/Office/15.0/Telemetry/. (On computers that run Windows XP, the location is %userprofile%\Local Settings\Microsoft\Office\15.0\Telemetry). You can delete the contents of this folder to reinitialize the computer and start a fresh discovery. Note that this is a per-user data location.

Q: How frequently is data sent to the telemetry shared folder?

A: Data is transferred from the client to the telemetry shared folder when users log on and every 8 hours while the user is logged in. You can adjust this interval in Task Scheduler.

Q: What is the format of the collected data?

A: Collected data is stored and transferred in binary format to optimize the storage and data transfer requirements.

Troubleshooting Telemetry Dashboard deployments

The following table describes some symptoms that you might encounter after you deploy Telemetry Dashboard and its components.

Troubleshooting Telemetry Dashboard deployments

Issue Description Resolution

Telemetry Processor Settings wizard fails

The wizard fails with the message "The Telemetry Processor settings wizard can only run on computers that are joined to a domain. Join the computer to a domain and run the wizard again."

The computers that run the Telemetry Processor, shared folder, and SQL database must be joined to a domain so that the appropriate security settings can be configured. Make sure the computer or computers are in trusted domains.

You can install these components on a single workgroup computer or domain-joined computer by using the script that is described in the blog post Quickly set up Office Telemetry Dashboard on a workgroup or domain-joined computer.

Telemetry Processor Settings wizard fails

Telemetry Processor is using the wrong SQL Server instance.

If there are two or more instances of SQL Server, make sure that Telemetry Processor Setup points to the correct SQL Server instance by using the format Servername\SQLServerinstance.

Telemetry Dashboard shows no data

Telemetry Agent isn't uploading data and the Msoia.exe process isn't running in Task Manager.

Check the registry path and value for the CommonFileShare, EnableLogging, and EnableUpload registry values. These are described in Enabling and configuring Telemetry Agent, earlier in this article.

Telemetry Dashboard shows no data

Telemetry Agent isn't scanning or uploading data. The Msoia.exe process runs in Task Manager for a long time.

By default, Telemetry Agent has an initial wait timer and randomization feature to avoid uploading large amounts of data at the same time as other agents and affecting network bandwidth. Update the AgentInitWait and AgentRandomDelay registry values to remove this delay in test environments. Otherwise the upload process can be delayed for up to 4 hours and 10 minutes. These registry values are described in Enabling and configuring Telemetry Agent, earlier in this article. You can learn how to trigger scanning and uploading in Triggering data collection manually.

Telemetry Dashboard shows no data

Telemetry Agent doesn't upload data. The Msoia.exe process runs in Task Manager for a long time.

Verify the network connection between the Telemetry Agent and the telemetry shared folder.

Verify that the computer is joined to a domain. The shared folder is configured to allow access only to users who are authenticated within the domain.

The agent continues to try to upload data after the upload has failed. When using the default registry values, the agent continues to run as a process in Task Manager for up to 4 hours and 10 minutes (max). To adjust registry values, see Enabling and configuring Telemetry Agent, earlier in this article. You can learn how to trigger scanning and uploading in Triggering data collection manually.

Telemetry Dashboard shows no data

The Telemetry Agent task doesn't seem to be working.

Check the information in the Last Run Result column in Task Scheduler. If the operation succeeds, it shows return code 0. If the agent cannot upload data to the shared folder, the message "The network name cannot be found" appears in the Last Run Result column. This is the only error that the agent logs in the Last Run Result column. If other errors are listed, they were caused by other reasons or the scheduled task didn't run.

Telemetry Dashboard shows no data

Telemetry Processor isn't working. There are many folders and files in the telemetry shared folder.

Verify the network connection between the Telemetry Processor and the telemetry shared folder. Was the Telemetry Processor configured by the Telemetry Processor settings wizard? The permissions on the telemetry shared folder can vary, depending on the Telemetry Processor location and the telemetry database. Run the Telemetry Processor settings wizard again from the shortcut on the desktop.

Telemetry Dashboard shows no data

Telemetry Processor is working but there are many folders and files under in the Failed folder under the telemetry shared folder.

Telemetry Processor processes the files in the shared folder to the database one time per minute. If Telemetry Processor fails to process the files 3 times, it will move the failed files to the Failed folder. See the Telemetry Processor Log (%windows%\ServiceProfiles\NetworkService\AppData\Local\Temp\dperrorlog.txt) for more information.

Telemetry Dashboard shows no data

Telemetry Processor isn't working because of SQL Server authentication settings.

Check the authentication type for SQL Server.Telemetry Dashboard doesn't support SQL authentication. You must use Windows authentication.

Telemetry Dashboard shows no data

Telemetry Processor isn't working because of firewall issues betweenTelemetry Processor and the telemetry database.

If there is a firewall between Telemetry Dashboard and the telemetry database, check whether the SQL port is enabled in the firewall configuration. The default port for SQL Server is 1433. See Configure a Windows Firewall for Database Engine Access for more information.

Telemetry Dashboard shows no data

Telemetry Processor isn't working because of firewall issues between Telemetry Processor, the telemetry database, and SQL Express.

If there is a firewall between Telemetry Dashboard and the telemetry database, check whether the SQL port is enabled in the firewall configuration. The default port for SQL Express isn't a fixed value. Check the port number in the SQL Configuration Manager and add the port to the firewall configuration. See Configure a Windows Firewall for Database Engine Access for more information.

Telemetry Dashboard shows no data

Telemetry Processor isn't working.

See the Telemetry Processor Log (%windows%\ServiceProfiles\NetworkService\AppData\Local\Temp\dperrorlog.txt) for more information.

Telemetry Dashboard can't connect to the telemetry database

Telemetry Dashboard shows an error message that states it can't connect to the database because of SQL Server permissions.

Check the permission role for Telemetry Dashboard. Add the user to the td_readonly role by using OSQL, SQLCMD, Enterprise Manager, or the Telemetry Dashboard Administration Tool (Tdadm). See Telemetry database earlier in this article for more information.

Telemetry Dashboard can't connect to the telemetry database

Telemetry Dashboard shows an error message that states it can't connect to the database.

If there are two or more instances of SQL Server, make sure that the Data connection settings dialog box in Telemetry Dashboard uses the correct SQL Server instance in the format Servername\SQLServerinstance.

Telemetry Dashboard can't connect to the telemetry database

Telemetry Dashboard shows an error message that states it can't connect to the database.

If the SQL Server is SQL Express, make sure that the SQL Server instance name is correct. The default instance name for SQL Express differs from SQL Server, for example: Servername\SQLExpress.

Telemetry Dashboard can't connect to the telemetry database

Telemetry Dashboard shows an error message that states it can't connect to the database.

If the SQL Server default collation is case-sensitive (for example, the Japanese version of SQL Server is case-sensitive by default), make sure that you entered a case-sensitive database name in the Data connection settings dialog box in Telemetry Dashboard.

See also

Content roadmap for Office 2013 compatibility
Plan for Telemetry Dashboard topology and hardware
Manage privacy settings in Telemetry Dashboard
Office 2013 compatibility guide
Compatibility in Office 2013

Change History

Date | Description
March 19, 2013 | Added information about supported service packs for Windows clients that run Telemetry Agent. Also added information about Telemetry Agent licensing.
July 16, 2012 | Initial publication


Manage privacy settings in Telemetry Dashboard

Updated: May 7, 2013

Summary: Learn about the data that Telemetry Agent collects and how to help protect user privacy in Telemetry Dashboard for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Telemetry Dashboard is an Excel 2013 workbook that displays compatibility and inventory data about the Office files, Office add-ins, and Office solutions that are used in an organization. Telemetry Dashboard displays the file names and titles of documents in each user's Most Recently Used list, which might reveal personal or confidential information about the user or organization. The names of add-ins and other solutions that are used by Office are also displayed. In this article, you can learn about settings in Telemetry Dashboard and Telemetry Agent that help you protect user privacy by disguising file names and titles or by preventing data for selected applications or solutions from being reported. You can also learn how to disable telemetry logging and delete telemetry information from a client computer. If you haven't deployed Telemetry Dashboard yet, see Deploy Telemetry Dashboard.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • Introduction to Telemetry Agent and the data it collects

  • How to configure privacy settings in Telemetry Dashboard

  • Disable data collection for Telemetry Agent

  • Delete telemetry and inventory data that is stored on client computers

  • Appendix: Data that Telemetry Agent collects

Introduction to Telemetry Agent and the data it collects

Data that is shown in Telemetry Dashboard is collected by a component known as Telemetry Agent. The agent collects inventory, usage, and telemetry data and uploads it to a shared folder, where it is processed by a service known as Telemetry Processor and inserted into an SQL database. This is the database that Telemetry Dashboard connects to so that it can show the usage of Office files, add-ins, and solutions.

Telemetry Agent is built into Office Professional Plus 2013 and Office 365 ProPlus editions of Office 2013 and is installed separately on computers that run Office 2003, Office 2007, and Office 2010. Regardless of whether it's built in or deployed separately, Telemetry Agent never generates or collects any telemetry or inventory data until you enable telemetry logging. You can do this by using either the registry or the Group Policy Administrative Templates as described in Deploy Telemetry Dashboard. After logging begins, telemetry data is stored on the local computer under %LocalAppData%\Microsoft\Office15.0\Telemetry\Microsoft\Office\15.0\Telemetry\ and is uploaded periodically to a shared folder.

For a visual representation of the Telemetry Dashboard components and how they work, see Telemetry in Office 2013. This poster includes a description of all components, a list of what Office files are monitored, how data collection works, and more.

Thumbnail image of the Office Telemetry poster

Office applications from which Telemetry Agents collect data

Telemetry Agent collects inventory-related data, hardware and software data, and user data in Office 2003, Office 2007, Office 2010, and Office 2013 for the following applications:

  • Access

  • Excel

  • OneNote

  • Outlook

  • PowerPoint

  • Project

  • Publisher

  • Visio

  • Word

For Office 2013 only, Telemetry Agent collects telemetry data for the following applications:

  • Excel

  • Outlook

  • PowerPoint

  • Word

Examples of data that is collected by Telemetry Agent

Here is a partial list of the data that Telemetry Agent collects. The full list is available in Appendix: Data that Telemetry Agent collects. We also recommend that you review the Privacy Statement for Microsoft Office.

  • The file names of Office files that are in the Most Recently Used list.

  • The names of add-ins and solutions that interact with Office.

  • System information such as user name and computer name.

Telemetry Agent also collects the following telemetry data for Excel 2013, Outlook 2013, PowerPoint 2013, and Word 2013:

  • Whether the document has specific metadata for a particular file, such VBA macros, data connections, or ActiveX controls.

  • Whether the document has encountered compatibility issues or critical errors while it is being used.

  • How Office files and solutions are used on a user's computer (Sessions).

Telemetry Agent doesn't collect any of the following kinds of information:

  • The contents of files.

  • Information about files that are not in the Most Recently Used list.

How to configure privacy settings in Telemetry Dashboard

There are several ways that you can configure the level of detail that is displayed for Office files, add-ins, and solutions in Telemetry Dashboard. Some methods, such as changing the reporting threshold, prevent certain information from being shown in Telemetry Dashboard. Other methods prevent Telemetry Agent from uploading data so that it is never added to the telemetry database.

Adjust the reporting threshold in the telemetry database to show only files that are used by multiple users

Telemetry Dashboard tracks the number of users who use an Office file that has the same name. Typically these are files that are shared and accessed by multiple users and might have greater business value than files that are used by a single user. As part of your compatibility planning, you might decide not to view inventory and compatibility events about files that are used by a single user and instead monitor files that are used throughout a department. Configuring Telemetry Dashboard to report files that are used by, say, three or more users also helps avoid displaying personal files, such as resumes.

To prevent Telemetry Dashboard from displaying files that have a single author, you run a script that adjusts the minimum reporting threshold in the telemetry database. Specifically, you use the Telemetry Dashboard Administration Tool (Tdadm) to filter out files that appear on two or fewer clients. To do this, set the Threshold value to 3 (or to a larger value, if you want) as shown in the following example.

Copy code
tdadm.exe -o settings -databaseserver dbserver -databasename dbname -threshold 3

For more information about Tdadm, see the Tdadm wiki.

Disguise or obscure user and file data that is shown in Telemetry Dashboard

It's common for users in an organization to save Office files by using file names that contain sensitive or confidential information. Although these files might have high business value that justifies monitoring them for compatibility issues, business groups such as legal and human resources might object to having their computers monitored to avoid revealing confidential file names to administrators who use Telemetry Dashboard.

To allow yourself and other administrators to identify the owners of Office files that have compatibility issues without revealing file names or specific locations, you can enable file obfuscation, which disguises Office file names, titles, and file paths. This setting is configured on the Telemetry Agent, which performs the obfuscation task before uploading data to the shared folder. The data that is stored on the local computer is not obfuscated.

The following table describes different ways in which file information is disguised.

Examples of obfuscated file names, file paths, and titles

 | File name | File path | Title
Actual file details on the monitored client computer | Resume_Contoso.xlsx | C:\Users\John\Documents | Resume_Contoso.docx
 | Merger_Contoso.docx | \\FileShare\Operations\FY2012 | Merger_Contoso.docx
 | FY2012_Layoff.xlsx | http:\\sharepoint\sites\HR\SharedDocuments | FY2012_Layoff.xlsx
 | 10 cures for diseases.pptx | Outlook:C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\1234ABCD | 10 cures for diseases
Data that is sent to the shared folder after you enable file obfuscation | Re********.xlsx | C:\******** | ********
 | Me********.docx | \\FileShare\******** | ********
 | FY********.xlsx | http://sharepoint/******** | ********
 | 10********.pptx | Outlook:******** | ********

To enable file obfuscation by using the registry

The following example enables file obfuscation in the registry of a client computer. Save this code sample as a .reg file and then run it on the monitored client computers.

Copy code
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm]
"EnableFileObfuscation"=dword:00000001

For more information about how to use .reg files, see How to add, modify, or delete registry subkeys and values by using a registration entries (.reg) file.

To enable file obfuscation by using Group Policy settings

The following table describes the name and path of the Group Policy setting that enables file obfuscation. You can download the Office 2013 Administrative Templates from the Microsoft Download Center.

Group policy setting that enables file obfuscation

Setting name | Path
Turn on privacy settings in Telemetry Agent | User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard

Prevent certain applications or solutions from being reported in Telemetry Dashboard

For business groups that employ lawyers, executives, or other employees who work with trade secrets or sensitive data, you can prevent information about specific Office applications or Office solution types from being collected and uploaded to the shared folder. For example, a business group might decide that Excel files are too sensitive for monitoring. Another group might decide that they care only about Access-related solutions and that they don't want to monitor other applications.

To configure exclusion settings by using the registry

The following table describes the registry values that prevent specific applications from being reported to Telemetry Dashboard.

Telemetry Agent registry settings under HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\OSM\preventedapplications

Value name | Value type | Value description and data
accesssolution olksolution onenotesolution pptsolution projectsolution publishersolution visiosolution wdsolution xlsolution | REG_DWORD | Prevents telemetric data for specific Office applications from being reported to Telemetry Dashboard. The agent won't report any data that interacts with the specified application. This includes document files that are used by the application and COM add-ins that are loaded the application. The value names correspond to Office applications as follows: accesssolution: Access solutions olksolution: Outlook solutions onenotesolution: OneNote solutions pptsolution: PowerPoint solutions projectsolution: Project solutions publishersolution: Publisher solutions visiosolution: Visio solutions wdsolution: Word solutions xlsolution: Excel solutions Value: 1 = Prevent reporting 0 = Allow reporting Default = 0 (Allow reporting)

The following table describes the registry values that prevent specific solution types from being reported to Telemetry Dashboard.

Telemetry Agent registry settings under HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\OSM\preventedsolutiontypes

Value name Value type Value description and data

agave

appaddins

comaddins

documentfiles

templatefiles

REG_DWORD

Prevents telemetric data for specific solutions from being reported to Telemetry Dashboard. The value names correspond to Office solution types as follows:

agave: apps for Office

appaddins: Application-specific add-ins. These include Excel add-ins such as .xla and xlam, Word add-ins such as .dotm, and PowerPoint add-ins such as .ppa and .ppam.

comaddins: COM add-ins

documentfiles: Office document files

templatefiles: Office template files

Value:

1 = Prevent reporting

0 = Allow reporting

Default = 0 (Allow reporting)

The following example disables reporting for all solution and application types. Save this sample as a .reg file and then remove any applications or solutions that you want to allow reporting for. Otherwise they will all be disabled because their value will be set to 00000001.

Copy code
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\microsoft\office\15.0\osm\preventedapplications]
"accesssolution"=dword:00000001
"olksolution"=dword:00000001
"onenotesolution"=dword:00000001
"pptsolution"=dword:00000001
"projectsolution"=dword:00000001
"publishersolution"=dword:00000001
"visiosolution"=dword:00000001
"wdsolution"=dword:00000001
"xlsolution"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\microsoft\office\15.0\osm\preventedsolutiontypes]
"agave"=dword:00000001
"appaddins"=dword:00000001
"comaddins"=dword:00000001
"documentfiles"=dword:00000001
"templatefiles"=dword:00000001

For more information about how to use .reg files, see How to add, modify, or delete registry subkeys and values by using a registration entries (.reg) file.

To configure exclusion settings by using Group Policy settings

The following table describes the name and path of the Group Policy settings that exclude reporting for selected Office applications and solutions. You can download the Office 2013 Administrative Templates from the Microsoft Download Center.

Exclusion policy settings under Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard

Setting | Description
Office applications to exclude from Telemetry Agent reporting | Prevents telemetric data for specific Office applications from being reported to the Telemetry Dashboard.
Office solutions to exclude from Telemetry Agent reporting | Prevents telemetric data for specific Office solutions from being reported to the Telemetry Dashboard.

Disable data collection for Telemetry Agent

To stop collecting data on the local computer, update the registry or set Group Policy settings as follows.

To stop telemetry logging by using the registry

The following example stops logging and uploading by Telemetry Agent. Save the example as a .reg file and run it on the client computer.

Copy code
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm]
"Enablelogging"=dword:00000000
"EnableUpload"=dword:00000000

For more information about how to use .reg files, see How to add, modify, or delete registry subkeys and values by using a registration entries (.reg) file.

To stop telemetry logging by using the Group Policy settings

The policy settings that are listed in the following table are available in the path User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard. Set these policy settings to Disabled to turn off data collection and uploading for Telemetry Agent. You can download the Office 2013 Administrative Templates from the Microsoft Download Center.

Telemetry Agent policy settings that disable telemetry logging

Setting |
Turn on telemetry data collection | Set this setting to Disabled to turn off data collection.
Turn on data uploading for the Telemetry Agent | Set this setting to Disabled to stop uploading data to the shared folder.

Delete telemetry and inventory data that is stored on client computers

Disabling logging does not delete the data that has already been collected. To delete this data on the local client computer, delete the files evt.tbl, sln.tbl, user.tbl that are located under %LocalAppData%\Microsoft\Office15.0\Telemetry\Microsoft\Office\15.0\Telemetry\.

Appendix: Data that Telemetry Agent collects

Earlier in this article, in Introduction to Telemetry Agent and the data it collects , we described a partial list of data that Telemetry Agent collects. Here is the full list.

Inventory data that is collected by Telemetry Agent

Telemetry Agent collects the following data for all computers that it monitors. You can find the list of Office versions and operating systems that Telemetry Agent supports in Telemetry Agent.

Data about recently opened Office documents and templates

Telemetry Agent collects the following data about recently opened Office documents and templates. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

Documents worksheet:

  • File name

  • File format (extension)

  • Total users

  • Number of Office 2013

Document details worksheet:

  • User name

  • Computer name

  • Location

  • Size (KB)

  • Author

  • Last loaded

  • Title

  • Office version

Note:

  • For OneNote, Telemetry Agent collects only Notebook name and location.

  • For Outlook, Telemetry Agent doesn't collect any inventory data of document files.

  • For files that are stored in a network share or SharePoint site, Telemetry Agent collects only the file name and location.

  • If the list of most recently used documents is disabled on a user's computer (by Group Policy or the user disabled it by themselves), Telemetry Agent doesn't collect inventory data for document files and templates.

Data about recently loaded add-ins and apps for Office

Telemetry Agent collects the following data about recently loaded add-ins and apps for Office. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

Solutions worksheet:

  • Solution name

  • Total users

  • Number of Office 2013 users

Solution details worksheet:

  • User name

  • Computer name

  • Solution version

  • Architecture (CPU architectures: x86/x64/ARM)

  • Load time

  • Description

  • Size (KB)

  • Location (.dll/manifest file path)

User data

Telemetry Agent collects the following user data. This data appears in the Agents worksheet.

  • User name

  • Level (Telemetry Agent status)

  • Computer

  • Last updated

  • Label (1-4)

  • Version of the agent

Data about hardware and software

Telemetry Agent collects the following data about hardware and software. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

Telemetry Processor worksheet:

  • Computer name

  • Level (Telemetry Processor status)

  • Users

  • Computers

  • Last updated (date and time)

Deployments worksheet:

  • Office versions

  • Number of 32-bit deployments

  • Number of 64-bit deployments

  • Number of ARM deployments

Telemetry data that is collected for Office 2013 only

Telemetry Agent also collects the following telemetry data for Excel 2013, and Outlook 2013, PowerPoint 2013, and Word 2013. This data is sorted by the worksheet where it appears in Telemetry Dashboard.

Documents worksheet:

  • Success (%)

  • Sessions

  • Critical compatibility issue or crash

  • Informative compatibility issue or load failure

Document details worksheet:

  • Last loaded date and time

  • Has VBA? (true/false)

  • Has OLE? (true/false)

  • Has external data connection? (true/false)

  • Has assembly reference? (true/false)

Note:

VBA, OLE, external data connection, ActiveX control, and assembly reference information are logged starting from the second time that the user opens the document. This information won't be collected if the user opens the document only one time.

Document sessions worksheet:

  • Date and time that the critical or informative event happened

Solutions worksheet:

  • Success (%)

  • Sessions

  • Critical compatibility issue or crash

  • Informative compatibility issue or load failure

  • Load time (time taken to load add-ins or apps for Office)

Solution issues worksheet:

  • Event ID

  • Title

  • Explanation

  • More info

  • Users

  • Sessions

Note:

Telemetry data is collected during application run time. If the inventory data was collected by Telemetry Agent, but the application hasn't started collecting telemetry data, then some data, such as Success (%) and Load time, won't be shown in the dashboard until the user opens documents or loads solutions during application run time.

See also

Content roadmap for Office 2013 compatibility
Deploy Telemetry Dashboard
Compatibility in Office 2013
Office 2013 compatibility guide

Change History

Date | Description
May 07, 2013 | Updated and reorganized the appendix that describes the data that Telemetry Agent collects.
August 7, 2012 | Initial publication


Telemetry Dashboard worksheet reference

Published: February 5, 2013

Summary: Find reference information about Telemetry Dashboard worksheets that helps you understand Office stability in your organization.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

As you use Telemetry Dashboard to investigate stability issues for Office documents and Office solutions, you might need more information about the data that is displayed in the worksheets. Use this article as a reference guide to help understand the data that is shown in Telemetry Dashboard. This data helps you identify stability issues for Office documents and solutions and helps you track Office deployments. You can also use this data to identify problems with the Telemetry Agents and Telemetry Processors.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • Overview worksheet

  • Documents worksheet

    • Document details worksheet

    • Document issues worksheet

    • Document sessions worksheet

  • Solutions worksheet

    • Solution details worksheet

    • Solution issues worksheet

    • Solution sessions worksheet

  • Telemetry Processor worksheet

  • Agents worksheet

  • Deployments worksheet

  • Custom report worksheet

Overview worksheet

The Overview worksheet provides a big picture view of both the stability and deployment status of Office within your organization. By using this worksheet, you can quickly understand how your critical documents and solutions are behaving on users' computers. Instead of browsing the Documents and Solutions worksheets, which show you item-by-item status, you can open and refresh the Overview worksheet to see a high-level view of document and solution stability. The following screen shot shows the Overview worksheet:

Overview worksheet in Telemetry Dashboard

An screenshot of the main Overview worksheet view on the Office Telemetry dashboard.

There are three primary tasks that you can perform on the Overview worksheet. These correspond to sections that appear in this article.

  • Determine the overall stability of Office 2013 documents and solutions throughout your organization

  • Drill down to investigate unstable documents or solutions that require your attention

  • View the progress of Office 2013 deployments in your organization

Documents worksheet

The Documents worksheet in Telemetry Dashboard displays the list of documents that was collected by telemetry logging and by Telemetry Agent scans. In this worksheet, you can find frequently used documents and telemetry data about them.

The following screen shot shows the Documents worksheet.

Documents worksheet in Telemetry Dashboard

A screenshot of the main Document worksheet view in the Office Telemetry dashboard.

There are two main sections on the Documents worksheet:

  • Office usage

  • Office 2013 telemetry data

The columns under the Office usage section display usage data that is collected by the Telemetry Agent. You can select the link for the number of users of a document to see who is using the document. This information is displayed in the Document details worksheet.

The columns under the Office 2013 telemetry data section display telemetry data that is collected by telemetry logging. You can select the link for the number of users who hit critical or informative issues to see more details. This information is displayed in the Document issues worksheet.

The following table describes each column in the Documents worksheet.

Note:

By default, some columns are collapsed and not visible. Select the [+] symbols on the top row to expand the columns.

Column descriptions for the Documents worksheet in Telemetry Dashboard

Section | Column | Description
Office usage | File name | Shows the file name of each document.
 | Total users | Shows the number of users who opened each document by using Office 2003, Office 2007, Office 2010, and Office 2013
 | Office 2003 | Shows the number of users who opened each document by using Office 2003.
 | Office 2007 | Shows the number of users who opened each document by using Office 2007.
 | Office 2010 | Shows the number of users who opened each document by using Office 2010.
 | Office 2013 | Shows the number of users who opened each document by using Office 2013.
 | Total computers | Shows the total number of computers on which users opened each document by using Office 2003, Office 2007, Office 2010, and Office 2013.
 | Office 2003 (computers) | Shows the number of computers on which users opened each document by using Office 2003
 | Office 2007 (computers) | Shows the number of computers on which users opened each document by using Office 2007.
 | Office 2010 (computers) | Shows the number of computers on which users opened each document by using Office 2010.
 | Office 2013 (computers) | Shows the number of computers on which users opened each document by using Office 2013.
Office 2013 telemetry data | Success (%) | Shows the percentage of successfully opened documents (no critical errors occurred) out of the total number of sessions.
 | Sessions | Shows the total number of sessions. A session refers to all selected file open events.
 | Trend | Shows the trend of changes that occurred between the current week and a week within the selected period. You can change the period by using the Date range filter in the navigation pane. For example, if you select 1 year from the Date range, the column shows a trend that compares the current week to a week from one year prior.
 | Critical | Shows the number of users who encountered critical issues.
 | Critical issues | Shows the number of unique critical issues.
 | Informative | Shows the number of users who encountered informative issues.
 | Informative issues | Shows the number of unique informative issues.
 | Application | Shows the name of the application that was used to open each document.
 | Extension | Shows the file name extensions that were used to open each document.
 | Built-in | Indicates whether each document is included with Office or has a default file name that is used for Office documents. You can use the filter for this column to hide built-in documents so that you can see the unique documents in your organization.

The following sections describe worksheets that help you drill down into specific issues. These worksheets appear after you select links within the Documents worksheet.

Document details worksheet

The Document details worksheet appears after you select a link under Office usage on the Documents worksheet. The Document details worksheet helps you see which users are frequently using a document.

The following screen shot shows the Documents details worksheet.

Document details worksheet in Telemetry Dashboard

A screenshot of the Document details worksheet in the Office Telemetry dashboard.

The following table describes each column in the Document details worksheet.

Column descriptions for the Documents details worksheet in Telemetry Dashboard

Column | Description
User name | Displays the name of the user who used the document.
User domain | Displays the domain name for this user.
Computer name | Displays the computer name that was used to open the document.
Computer domain | Shows the computer's domain name.
Location | Shows the file path of the document. Only one file path is kept per user and computer. If the same user opens the document from a different file path on the same computer, Office Telemetry keeps only the most recent file path.
Size (KB) | Shows the file size of the document.
Author | Shows the author name of the document.
VBA | Indicates whether the document contains VBA code.
OLE | Indicates whether the document contains OLE objects.
External data connection | Indicates whether the document has an external data connection.
ActiveX control | Indicates whether the document contains ActiveX controls.
Assembly reference | Indicates whether the document contains VSTO document-level customizations.
Last loaded | Indicates when the document was most recently loaded.
Title | Shows the title of the document.
Office version | Shows the version of Office that was used to open the document.

Document issues worksheet

The Document issues worksheet appears after you select a link under Office 2013 telemetry data on the Documents worksheet. The Document issues worksheet helps you find details about unique events that were found for a document.

The following screen shot shows the Document issues worksheet.

Document issues worksheet in Telemetry Dashboard

A screenshot of the Document issues worksheet from the Office Telemetry dashboard.

The following table describes each column in the Document issues worksheet.

Column descriptions for the Documents issues worksheet in Telemetry Dashboard

Column | Description
Event ID | Displays the Event ID. For more information about the event IDs, see "Table 2. Types of events displayed in the Telemetry Log" in Troubleshooting Office files and custom solutions with the Office Telemetry Log.
Title | Shows the title of the issue.
Explanation | Describes the issue.
More info | Provides a link to more information.
Users | Shows total number of users who encountered the issue.
Sessions | Shows total number of sessions that encountered the issue.

Document sessions worksheet

The Document sessions worksheet shows the sessions during which an issue occurred. You can open this worksheet by selecting a link in the Sessions column of the Document issues worksheet.

The following screen shot shows the Documents sessions worksheet.

Document sessions worksheet in Telemetry Dashboard

A screenshot of the Document sessions worksheet from the Office Telemetry dashboard.

The following table describes each column in the Document sessions worksheet.

Column descriptions for the Documents sessions worksheet in Telemetry Dashboard

Column | Description
Event ID | Displays the Event ID. For more information about the event IDs, see "Table 2. Types of events displayed in the Telemetry Log" in Troubleshooting Office files and custom solutions with the Office Telemetry Log.
Event date | Shows the date and time when the issue occurred.
User name | Shows the names of users who were using the document that encountered the issue.
User domain | Shows the domain name for the user.
Computer name | Shows the name of the computer where the document encountered the issue.
Computer domain | Shows the computer's domain name.
Location | Shows the file path where the selected document was opened. Only one file path is kept per user and computer. If the same user opens the document from a different file path on the same computer, Office Telemetry keeps only the most recent file path.
Office version | Shows the version of Office that was used to open this document.
Documents loaded | Shows the list of documents that were being used when the issue occurred.
Size (KB) | Shows the size of the document.
Author | Shows the name of the author of the document.
VBA | Indicates whether the document contains VBA code.
OLE | Indicates whether the document contains OLE objects.
External data connection | Indicates whether the document has an external data connection.
ActiveX control | Indicates whether the document contains ActiveX controls.
Assembly reference | Indicate whether the document contains VSTO document-level customization.
Title | Shows the title of the document.

Solutions worksheet

The Solutions worksheet displays the list of solutions that was collected by telemetry logging and Telemetry Agent scans. In this worksheet, you can find frequently used solutions and telemetry data about them. The kinds of solutions that are shown include COM add-ins, application-specific add-ins, and apps for Office.

The following screen shot shows the Solutions worksheet.

Solutions worksheet in Telemetry Dashboard

A screenshot of the main Solutions worksheet from the Office Telemetry dashboard.

After telemetry data is collected, you can manage Office add-ins by using the Add-in management mode link on the Solutions worksheet. For more information, see Let's manage add-ins using Telemetry Dashboard.

There are two main sections on the Solutions worksheet:

  • Office usage

  • Office 2013 telemetry data

The columns under the Office usage section display the usage data that is collected by the Telemetry Agent. You can select the link for the number of users of a solution to see who is using the solution. This information is displayed on the Solution details worksheet.

The columns under the Office 2013 telemetry data section display telemetry data that is collected by telemetry logging. You can select the link for the number of users who hit critical or informative issues to see more details. This information is displayed on the Solution issues worksheet.

The following table describes each column in the Solutions worksheet.

Note:

By default, some columns are collapsed and not visible. Select the [+] symbols on the top row to expand the columns.

Column descriptions for the Solutions worksheet in Telemetry Dashboard

Section | Column | Description
Office usage | Total users | Shows the number of users who use the solution in Office 2003, Office 2007, Office 2010, and Office 2013.
 | Office 2003 | Shows the number of users who use the solution in Office 2003.
 | Office 2007 | Shows the number of users who use the solution in Office 2007.
 | Office 2010 | Shows the number of users who use the solution in Office 2010.
 | Office 2013 | Shows the number of users who use the solution in Office 2013.
 | Total computers | Shows the number of computers where the solution was opened by using Office 2003, Office 2007, Office 2010, and Office 2013.
 | Office 2003 (computers) | Shows the number of computers where the solution was opened by using Office 2003.
 | Office 2007 (computers) | Shows the number of computers where the solution was opened by using Office 2007.
 | Office 2010 (computers) | Shows the number of computers where the solution was opened by using Office 2010.
 | Office 2013 (computers) | Shows the number of computers where the solution was opened by using Office 2013.
Office 2013 telemetry data | Success (%) | Shows the percentage of successfully opened solutions (no critical error occurred) out of total sessions.
 | Sessions | Shows the total number of sessions. A session refers to all selected file open events.
 | Trend | Shows the trend of changes that occurred between this week and a week within the selected period. You can change the period by using the Date range filter in the navigation pane. For example, if you select 1 year from the Date range, the column shows a trend that compares this week to a week from one year prior.
 | Critical | Shows the number of users who encountered critical issues
 | Critical issues | Shows the number of unique critical issues.
 | Informative | Shows the number of users who encountered informative issues.
 | Informative issues | Shows the number of unique informative issues.
 | Load time | Shows the average load time of the solution.
 | Application | Shows the application name that was used to open the selected solution.
 | Type | Shows the solution type.
 | File | Shows the file name of the solution.
 | Extension | Shows the file name extensions of the solution.
 | Publisher | Shows the publisher of the solution.
 | Built-in | Indicates whether this solution is included with Office. You can use the filter for this column to hide built-in solutions so that you can see the unique solutions in your organization.

The following sections describe worksheets that help you drill down into specific issues. These worksheets appear after you select links within the Solutions worksheet.

Solution details worksheet

The Solution details worksheet appears after you select a link under Office usage on the Solutions worksheet. The Solution details worksheet helps you see which users are frequently using a solution.

The following screen shot shows the Solution details worksheet.

Solution details worksheet in Telemetry Dashboard

A screenshot of the Document details worksheet in the Office Telemetry dashboard.

The following table describes each column in the Solution details worksheet.

Column description for the Solution details worksheet

Column Description

User name

Shows the name of user who used the solution.

User domain

Shows the domain name for this user.

Computer name

Shows the name of the computer where the solution was opened.

Computer domain

Shows the computer's domain name.

Solution version

Shows the version of the solution.

Architecture

Shows the architecture of the solution.

Load time

Shows how long the solution took to load.

Last loaded

Shows the last time that the solution was loaded.

Load behavior

Shows the load behavior of COM add-ins as follows:

  • 0 Do not load automatically (Unloaded)

  • 1 Do not load automatically (Loaded)

  • 2 Load at startup (Unloaded)

  • 3 Load at startup (Loaded)

  • 8 Load on demand (Unloaded)

  • 9 Load on demand (Loaded)

  • 16 Load first time, then load on demand (Loaded)

For more information, see Load behavior values.

Policy setting

Shows the policy setting.

Office version

Shows the Office version that was used to open the solution.

Publisher

Shows the publisher of the solution.

Author

Shows the author name of the solution.

Friendly name

Shows the friendly name of the solution.

Description

Shows the description of the solution.

Size (KB)

Shows the size of the solution.

Location

Shows the file path of the solution.Only one file path is kept per user and computer. If the same user opens the solution from different file path on the same computer, Office Telemetry keeps only the most recent file path.

Solution issues worksheet

The Solution issues worksheet appears after you select a link under Office 2013 telemetry data on the Solutions worksheet. The Solution issues worksheet helps you find details about the unique events that were found for a solution.

The following screen shot shows the Solution issues worksheet.

Solution issues worksheet in Telemetry Dashboard

A screenshot of the Solutions issues worksheet from the Office Telemetry dashboard.

The following table describes each column in the Solution issues worksheet.

Column descriptions for the Solution issues worksheet in Telemetry Dashboard

Column | Description
Event ID | Displays the Event ID. For more information about the event IDs, see "Table 2. Types of events displayed in the Telemetry Log" in Troubleshooting Office files and custom solutions with the Office Telemetry Log.
Title | Shows the title of the issue.
Explanation | Describes the issue.
More info | Provides a link to more information.
Users | Shows the number of users who encountered the issue.
Sessions | Shows the number of sessions that encountered the issue.

Solution sessions worksheet

The Solution sessions worksheet shows the sessions during which the issue occurred. You can open this worksheet by selecting a link in the Sessions column of the Solution issues worksheet.

The following screen shot shows the Solution sessions worksheet.

Solution sessions worksheet in Telemetry Dashboard

A screenshot of the Solutions sessions worksheet from the Office Telemetry dashboard.

The following table describes each column in the Solution sessions worksheet.

Column descriptions for the Solution sessions worksheet in Telemetry Dashboard

Column Description

Event ID

Displays the Event ID. For more information about the event IDs, see "Table 2. Types of events displayed in the Telemetry Log" in Troubleshooting Office files and custom solutions with the Office Telemetry Log.

Event date

Shows the date and time when the issue occurred.

User name

Shows the names of users who were using the solution that encountered the issue.

User domain

Shows the domain name for the user.

Computer name

Shows the name of the computer where the solution encountered the issue.

Computer domain

Shows the computer's domain name.

Solution version

Shows the version of the solution.

Architecture

Shows the architecture of the solution.

Office version

Shows the Office version with build numbers that used this solution.

Load time

Shows how long the solution took to load.

Load behavior

Shows the load behavior of COM add-ins as follows:

  • 0 Do not load automatically (Unloaded)

  • 1 Do not load automatically (Loaded)

  • 2 Load at startup (Unloaded)

  • 3 Load at startup (Loaded)

  • 8 Load on demand (Unloaded)

  • 9 Load on demand (Loaded)

  • 16 Load first time, then load on demand (Loaded)

For more information, see Load behavior values.

Policy setting

Shows the policy setting.

Document loaded

Shows the documents that were open when the issue occurred.

Publisher

Shows the publisher of the solution.

Author

Shows the author name of the solution.

Friendly name

Shows the friendly name of the solution.

Description

Shows the description of the solution.

Size (KB)

Shows the size of the solution.

Location

Shows the file path of the solution.

Only one file path is kept per user and computer. If the same user opens the solution from a different file path on the same computer, Office Telemetry keeps only the most recent file path.

Telemetry Processor worksheet

The Telemetry Processor worksheet displays information about the health of the Office Telemetry infrastructure. You can monitor whether Telemetry Processors are running correctly, and you can check whether users' computers are sending telemetry data correctly.

The following screen shot shows the Telemetry Processor worksheet:

Telemetry Processor worksheet in Telemetry Dashboard

A screenshot of the main Telemetry Processor worksheet from the Office Telemetry dashboard.

The following table describes each column in the Telemetry Processor worksheet.

Column descriptions for the Telemetry Processor worksheet in Telemetry Dashboard

Column | Description
Computer name | Lists the names of computers that are running Telemetry Processor. You can select the computer name to see the users whose computers are sending telemetry data to each Telemetry Processor. For more information about this feature, see the Agents worksheet later in this article.
Level | Shows the status of the Telemetry Processor. Depending on the status, you might want to investigate if the Telemetry Processor is running correctly or if the agents on users' computers are configured correctly and uploading data. The levels are described in the next table.
Users | Shows the number of users whose computers are connected to each Telemetry Processor.
Computers | Shows the number of computers that connected to each Telemetry Processor.
Last updated | Shows the last date and time when the Telemetry Processor inserted data into the database.

The following table describes the status that is represented by the symbols that are displayed in the Level column.

Icon descriptions for the Level column in the Telemetry Processor worksheet

Symbol | Status description
An image of the status icon indicating that the last update date/time for the Telemetry Processor is less than a day ago. | The last updated date and time for the Telemetry Processor is less than a day ago.
An image of the status icon indicating that 5% or more of the users for this Telemetry Processor are not uploading data for the last 14 days. | 5% or more of the users for this Telemetry Processor have not uploaded data for the last 14 days. Select the Telemetry Processor name to open the Agents worksheet so that you can view which users' computers are not sending telemetry data.
An image of the status icon indicating that the last updated date/time for the Telemetry Processor is older than a day. | The last updated date and time for the Telemetry Processor is older than a day. When you see this status, you should investigate whether the Telemetry Processor is running correctly on the computer. You find information about how to troubleshoot Telemetry Processor in Troubleshooting Telemetry Dashboard deployments.
(No symbol) | The last updated date and time for the Telemetry Processor was more than 14 days ago.

Note:

A Telemetry Processor is deleted from the Telemetry Processors worksheet if the Last updated value for the Telemetry Processor is 90 or more days ago.

Agents worksheet

The Agents worksheet displays information about the users whose computers who are uploading data to each Telemetry Processor. You can open the Agents worksheet by selecting a link for a computer name on the Telemetry Processor worksheet. Use this worksheet to monitor the upload status of each computer.

The following screen shot shows the Agents worksheet.

Agents worksheet in Telemetry Dashboard

A screenshot of the Agents worksheet which is a drill down worksheet from the Telemetry Processor page on the Office Telemetry dashboard.

The following table describes each column in the Agents worksheet.

Column descriptions for the Agents worksheet in Telemetry Dashboard

Column name | Description
User name | Lists the names of users whose computers upload telemetry data to the Telemetry Processor.
Level | Indicates how recently the agent uploaded data. The levels are described in the next table.
Computer | Lists the names of the computers that upload telemetry data.
Last updated | Shows the last date and time when the user's computer uploaded data.
Label 1 - 4 | Shows the tag values that are assigned to each user.
Version | Shows the major and minor version of Telemetry Agent that runs on the user's computer.

The following table describes the status that is represented by the symbols that are displayed in the Level column.

Symbol Status description
An image of the status icon indicating that the last update date/time for the Telemetry Processor is less than a day ago.

The last updated date and time for the user is less than a day ago.

An image of the status icon indicating that 5% or more of the users for this Telemetry Processor are not uploading data for the last 14 days.

The last updated date and time for the user is between 2 and 14 days ago. Occasionally, you will see this icon when the user's computer has not uploaded data for more than a day (for example, Monday morning after the weekend).

An image of the status icon indicating that the last updated date/time for the Telemetry Processor is older than a day.

The last updated date and time for the user is between 15 and 30 days ago. When you see this status, you should investigate whether the Telemetry Agent on this user's computer is configured correctly.

You find information about how to troubleshoot Telemetry Agents in Troubleshooting Telemetry Dashboard deployments.

(No symbol)

The last updated date and time for the Telemetry Processor was 31 or more days ago.

Note:

A user is deleted from the Agents worksheet if the Last updated value for the user was 90 or more days ago.

Deployments worksheet

The Deployments worksheet provides a tabular view of the number of Office clients that are deployed in your organization. This worksheet provides additional information for the deployment trend chart that is shown in the Overview worksheet. This information can help you plan for future Office deployments.

In the following screen shot of the Deployments worksheet, you can see how many Office clients are deployed. The list is organized by Office version and CPU architecture. For example, you can see how many users are running 32-bit versions of Office Office 2013.

Deployments worksheet in Telemetry Dashboard

A screenshot of the main Deployments worksheet from the Office Telemetry dashboard.

You can see that there are still 32-bit computers that are running Office 2003. You may want to contact these users to understand if they have any concerns about how to upgrade to Office 2013. You can also create a custom report to show more information about these users, such as their computer hardware.

Also, you should be aware that Windows 8 is now supported on ARM-based architectures. If your organization has users who have Office 2013 on these computers, you can now keep track of that information in the Deployments worksheet. You can create custom reports to obtain richer information about who is using these computers, what issues they may be experiencing, and so on.

Custom report worksheet

When you select the Create custom report button on the Custom report worksheet, Telemetry Dashboard connects to multiple tables and creates relationships for you to use in a PivotTable. If you have never used a PivotTable before, you can learn more in Tutorial: PivotTable data analysis using a Data Model in Excel 2013.

See also

Content roadmap for Office 2013 compatibility
Overview of Office Telemetry
Monitor Office compatibility and deployments by using Telemetry Dashboard


Custom reporting and database schema reference for Telemetry Dashboard

Published: April 30, 2013

Summary: Describes how to create custom reports in Telemetry Dashboard, shows sample reports, and lists the tables and fields in the telemetry database.

Applies to: Office 365 ProPlus | Office 2013

Audience: IT Professionals

The built-in worksheets in Telemetry Dashboard display lots of useful data, but sometimes you want more control over how the data is displayed. To do this, you can use the custom reporting feature in Telemetry Dashboard. This feature uses PivotTable reports to help give you a deeper view into how Office is being used in your organization. In this article, you can learn how to create custom reports, and you can find information about the telemetry database tables and fields that are used in custom reports.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • Overview of custom reports in Telemetry Dashboard

  • Sample custom reports for compatibility scenarios

  • Default tables and fields in Telemetry Dashboard custom reports

  • Hidden tables in Telemetry Dashboard custom reports

  • Default data relationships in Telemetry Dashboard custom reports

Overview of custom reports in Telemetry Dashboard

The built-in worksheets in Telemetry Dashboard show you a relevant subset of the data that is collected by Telemetry Agents. However, the built-in worksheets are not customizable, and you might want to see a combined view of data that appears on different worksheets. This is where custom reporting can help you use PivotTable reports to view telemetry data in meaningful ways.

For example, the following screen shot shows a custom report that lists the unregistered ActiveX controls that are detected on monitored clients. You can see that we've added fields to display the solution name, user name, and business group (as configured for Label 2 when the agents were deployed). This report helps us identify the solutions that use unregistered ActiveX controls and who is using them. In contrast, the Documents worksheet lists these solutions but doesn't have a column to indicate whether unregistered ActiveX controls are detected. You have to view the Document sessions worksheet for each document to see whether ActiveX controls are being used.

Custom report that shows unregistered ActiveX solutions

Illustrates a custom report that shows unregistered ActiveX controls

Important:

To use labels in custom reports, you have to configure them when you deploy Telemetry Agents. If you haven't already done this, we recommend that you carefully plan labels that support the types of custom reporting that you'll do. For example, setting labels to identify business groups, locations, and job roles can help you find trends and issues for specific groups or types of users. Enabling and configuring Telemetry Agent will help you configure labels (known as tags in the Group Policy settings and registry settings for Telemetry Agent).

As another example, the following screen shot shows the list of Office client computers as displayed in the Deployments worksheet. This shows a high-level summary of Office deployments. But it doesn't give you a breakdown of how Office is deployed across business groups.

The Deployments worksheet

Shows the Office deployments that are tracked by Telemetry Dashboard in the Deployments worksheet

You can get a more detailed view of Office clients by using a custom report. In the following illustration, the Office clients are grouped by business groups (as configured for Label 2) so that you can see the breakdown of Office deployments across each group. You can also create a PivotChart to help show the data. This custom report uses a hidden table, System_details, that you have to manually add before you can add Office versions to your report. You can learn how to do this in Hidden tables in Telemetry Dashboard custom reports.

Custom report showing Office deployments by business group

Displays an example of a custom report that shows Office deployments by business group

Create custom reports in Telemetry Dashboard

You can create a single custom report on the Custom report worksheet. This automatically loads the default tables and creates a basic custom report that you can use as a starting point. Then, you can add and remove fields to design a report that meets your business needs. For performance reasons, not all tables are loaded automatically when you create a custom report. You can add tables by using the procedure in Hidden tables in Telemetry Dashboard custom reports. The most common reason to add hidden tables is to gain access to Office builds, which are available in the System_details table.

In this video demo, you can see custom reporting in action. We compare data that is shown in the Solutions worksheet to similar data that is shown in a custom report. This video will also help you learn how to add and move fields in a PivotTable report.

Custom reporting in Telemetry Dashboard

Video (play button) icon

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To create a custom report, you have to first start Telemetry Dashboard. The following table describes how to start the dashboard in different versions of Windows.

To start Telemetry Dashboard

If you have this operating system | Follow these steps to start Telemetry Dashboard
Windows 7, Windows Server 2008, or Windows Server 2008 R2 | From the Start menu, choose All Programs, then Microsoft Office 2013, then Office 2013 Tools, then Telemetry Dashboard for Office 2013.
Windows 8 | On the Start screen, right-click the background or swipe in from the top or bottom to display the app bar, choose All apps, and then choose Telemetry Dashboard for Office 2013.
Windows Server 2012 | Swipe in from the right edge to show the charm bar, and then choose Search to see all the apps that are installed on the computer. Next, choose Telemetry Dashboard for Office 2013.

To create a custom report, follow these steps.

To create a custom report

  1. In Telemetry Dashboard, on the Getting Started worksheet, choose Connect to Database.

  2. In the Data connection settings dialog box, type the names of the computer running SQL Server and the SQL database that you specified when you installed Telemetry Processor.

  3. In the navigation pane, choose Custom report.

  4. On the Custom report worksheet, choose Create custom report.

To help you get started, the following tables provide procedures for creating different kinds of custom reports.

Sample custom reports in Telemetry Dashboard

Custom report steps Illustration

To create a custom report that shows solution stability, do the following:

  1. From the Lookup_solutions table, drag Solution name to the FILTERS well.

  2. After the Solution name field is added to the custom report, use the filter button (next to the Solution name) to choose the solution.

  3. From the Inventory table, drag Solution version to the ROWS well.

Custom report that shows solution stability

Illustrates a custom report that shows solution stability. The report includes the solution name, the versions of the solution, and the number of events for each version.

To create a custom report that shows Excel warnings, do the following:

  1. From the Lookup_issue_definitions table, drag Severity to the FILTERS well.

  2. After the Severity field is added to the custom report, use the filter button (next to Severity) to choose Warning.

  3. From the Lookup_solutions table, drag Application to the FILTERS well, and then adjust the filter to select Excel.

  4. From the Lookup_solutions table, drag File name to the ROWS well.

Custom report that shows Excel warnings

Illustrates how a custom report shows Excel issues that have the Warning severity. One column shows the file name, and the other column shows the number of Warning events.

Default tables and fields in Telemetry Dashboard custom reports

The following tables describe the six tables and their related fields that are shown by default in the PivotTable Fields list when you create custom reports.

Default tables

Table name | Description
Events | Contains issue events for the past three months.
Inventory | Contains unique instance data, such as load time and solution version, about the Office documents and solutions that are monitored.
Lookup_computers | Contains information about the computers that are monitored. This includes computer name, domain, hardware information, and Windows version.
Lookup_issue_definitions | Contains information about the issues that were detected, such as issue type, issue title, severity, and explanation.
Lookup_solutions | Contains information about solutions that were detected, such as solution type, name, and publisher.
Lookup_users | Contains information about the users who use monitored client computers, such as their user name, domain, and label settings.

The following table lists the fields in the Events table.

Fields in the Events table

Field name Type Description

Event ID

Number

The primary key for this table.

Issue ID

Number

Connects to the Lookup_issue_definitions table.

You can view these definitions in the following articles:

  • Compatibility issues in Office 2013

  • Troubleshooting Office files and custom solutions with the Office Telemetry Log (scroll down to Table 2. Types of events displayed in the Telemetry Log)

Inventory ID

String

Connects to the Inventory table.

Solution ID

Number

Connects to the Lookup_solutions table.

User ID

Number

Connects to the Lookup_users table.

Computer ID

Number

Connects to the Lookup_computers table.

Event date

Date/time

Shows the date and time of the event.

Application version (detail)

String

Shows the version of the Office application that triggered the event.

The following table lists the fields in the Inventory table.

Fields in the Inventory table

Field name | Type | Description
Inventory ID | Strings | The primary key for this table.
Solution ID | Numbers | Connects to the Lookup_solutions table.
User ID | Numbers | Connects to the Lookup_users table.
Computer ID | Numbers | Connects to the Lookup_computers table.
Friendly name | Strings | Shows the friendly name of the solution.
Location | Strings | Shows the file location of the file.
Load time (seconds) | Numbers | Shows the load time of the solution in seconds.
Title | Strings | Shows the title of the document.
Author | Strings | Shows the author of the document.
CPU architecture | Strings | Shows the CPU architecture.
Solution version | Strings | Shows the solution version.
Load behavior | Numbers | Shows the load behavior of the COM add-ins as follows:. 0 - Do not load automatically (Unloaded) 1 - Do not load automatically (Loaded) 2 - Load at startup (Unloaded) 3 - Load at startup (Loaded) 8 - Load on demand (Unloaded) 9 - Load on demand (Loaded) 16 - Load first time, and then load on demand (Loaded)
File size (bytes) | Numbers | Shows the file size in bytes.
Has VBA | Boolean | Shows 1 if the document has VBA.
Has OLE | Boolean | Shows 1 if the document has OLE objects.
Has external data connection | Boolean | Shows 1 if the document has an external data connection.
Has ActiveX control | Boolean | Shows 1 if the document has an ActiveX control.
Has assembly reference | Boolean | Shows 1 if the document has an assembly reference.
Has XML schema | Boolean | Shows 1 if the document has an XML schema.
Has XML expansion pack | Boolean | Shows 1 if the document has an XML expansion pack.
Last loaded | Date/time | Shows the last date and time that the solution was loaded.
Last scanned | Date/time | Shows the last date and time that the computer was scanned by the agent.

The following table shows the fields in the Lookup_computers table.

Fields in the Lookup_computers table

Field name | Type | Description
Computer ID | Number | The primary key for this table.
Computer name | String | Shows the computer name.
Computer domain | String | Shows the domain name that is registered for this computer.
Telemetry Agent version | String | Shows the Telemetry Agent version that uploads the data to the telemetry database.
Computer processor name | String | Shows the processor name of the computer.
Number of processors (logical) | Number | Shows the number of logical processors in the computer.
Number of processors (physical) | Number | Shows the number of physical processors in the computer.
System type | String | Shows the architecture type (32-bit or 64-bit) of the computer.
Computer installed memory | Number | Shows amount of memory (in megabytes) that is installed in this computer.
Display resolution | String | Shows this computer's screen resolution (for example, 1280 x 780).
Display resolution (width) | Number | Shows the screen resolution width.
Display resolution (height) | Number | Shows the screen resolution height.
Windows version | String | Shows the Windows version of the computer.
Windows version (detail) | String | Shows Windows version in detail.
Windows system locale | String | Shows the system locale setting for Windows.
Windows system display language | String | Shows system display language for Windows.
IE version | String | Shows the Internet Explorer version.
IE version (detail) | String | Shows the Internet Explorer version in detail.

The following table shows the fields in the Lookup_solutions table.

Fields in the Lookup_solutions table

Field name | Type | Description
Solution ID | Number | The primary key for this table.
Solution type | String | Shows the solution or document type.
Application | String | Shows the application that used this solution or document.
Solution name | String | Shows the solution name.
File name | String | Shows the solution or document file name.
ProgID | String | Shows the solution ProgID.
Publisher | String | Shows the solution or document publisher name.

The following table shows the fields in the Lookup_users table.

Fields in the Lookup_users table

Field name | Type | Description
User ID | Number | The primary key for this table.
User name | String | Shows the user name.
User domain | String | Shows the domain name for this user.
Label 1 | String | Shows the Label 1 setting.
Label 2 | String | Shows the Label 2 setting.
Label 3 | String | Shows the Label 3 setting.
Label 4 | String | Shows the Label 4 setting.

The following table shows the fields in the Lookup_issue_definitions table.

Fields in the Lookup_issue_definitions table

Field name | Type | Description
Issue ID | Number | The primary key for this table.
Severity | String | Shows the severity of issue.
Issue type | String | Shows the issue type.
Issue title | String | Shows the issue title.
Explanation | String | Shows the issue explanation.
More info | String | Shows the URL where you can get more information.

Hidden tables in Telemetry Dashboard custom reports

Not all tables are loaded when you create a custom report. If you want to access additional data for your custom report, you can load the Usage_summary, Issue_summary, and System_details tables. Follow these steps to add these hidden tables to Telemetry Dashboard.

To add hidden tables to Telemetry Dashboard

  1. Follow the steps in Create custom reports in Telemetry Dashboard to start Telemetry Dashboard, connect to the database, and create a custom report.

  2. After you create the custom report, select any area in the custom report. This makes the ANALYZE tab available on the ribbon.

  3. On the ANALYZE tab (under PIVOTTABLE TOOLS) on the ribbon, in the Data group, select Change Data Source, and then select Connection Properties.

  4. In the Workbook Connections for Custom report dialog box, select Telemetry Dashboard - Custom report, select Properties, and then select the Definition tab.

  5. In the Command text box, add the following additional text (do not delete or overwrite the existing text): ,"Usage_summary", "Issue_summary", "System_details"

  6. Choose OK, and on each dialog box, select Close.

  7. In the PivotTable Fields list, Choose ALL, and then scroll down to see the newly added tables for Usage_summary, Issue_summary, and System_details.

  8. Right-click each new table, and choose Show in Active Tab. The new tables are added to the Active list under PivotTable Fields in the right column for easier access.

The following tables list the hidden tables that you have to manually add to Telemetry Dashboard and describe the fields in the hidden tables.

Hidden tables in Telemetry Dashboard custom reports

Table name Comments

Usage_summary

Shows Office 2013 telemetry data for seven days, one month, and three months. You can use this table to create a relationship to the following tables to see more details:

  • Lookup_computers

  • Lookup_issue_definitions

  • Lookup_solutions

  • Lookup_users

Issue_summary

Shows the issues that have occurred in the last seven days, one month, and three months. You can use this table to create a relationship to following tables to see more details:

  • Lookup_computers

  • Lookup_issue_definitions

  • Lookup_solutions

  • Lookup_users

System_details

Shows user and computer information.

The following table describes the fields in the Usage_summary table.

Fields in the Usage_summary table

Field name | Type | Description
Inventory ID | String | Connects to the Inventory table to gain access to more details in the PivotTable report.
Solution ID | Number | Connects to the Lookup_solutions table to obtain more details in PivotTable report if there is no relationship between the Inventory and Lookup_solutions tables.
User ID | Number | Connects to the Lookup_users table to obtain more details in the PivotTable report if there is no relationship between the Inventory and Lookup_users tables.
Computer ID | Number | Connects to the Lookup_computers table to obtain more details in PivotTable report if there is no relationship between the Inventory and Lookup_computers tables.
Total session (last 7 days) | Number | Shows the total number of sessions in the last seven days.
Total session (last 1 month) | Number | Shows the total number of sessions in the last one month.
Total session (last 3 months) | Number | Shows the total number of sessions in the last three months.
Failed session (last 7 days) | Number | Shows the total number of sessions that had an issue in last the seven days.
Failed session (last 1 month) | Number | Shows the total number of sessions that had an issue in the last one month.
Failed session (last 3 months) | Number | Shows the total number of sessions that had an issue in the last three months.

The following table describes the fields in the Issue_summary table.

Fields in the Issue_summary table

Field name | Type | Description
Issue ID | Number | Connects to the Lookup_issue_definitions table to obtain more details in the PivotTable report.
Inventory ID | String | Connects to the Inventory table to obtain more details in the PivotTable report.
Solution ID | Number | Connects to the Lookup_solutions table to obtain more details in the PivotTable report if there is no relationship between the Inventory and Lookup_solutions tables.
User ID | Number | Connects to the Lookup_users table to obtain more details in the PivotTable report if there is no relationship between the Inventory and Lookup_users tables.
Computer ID | Number | Connects to the Lookup_computers table to obtain more details in the PivotTable report if there is no relationship between the Inventory and Lookup_computers tables.
Number of instances (last 7 days) | Number | Shows the number of issue events in the last seven days.
Number of instances (last 1 month) | Number | Shows the number of issue events in the last one month.
Number of instances (last 3 months) | Number | Shows the number of issue events in the last three months.

The following table describes the fields in the System_details table.

Fields in the System_details table

Field name | Type | Description
Computer name | String | Shows the computer name.
Computer domain | String | Shows the domain name that is registered for this computer.
User name | String | Shows the user name.
User domain | String | Shows the domain name for this user.
Label 1 | String | Shows the Label 1 setting.
Label 2 | String | Shows the Label 2 setting.
Label 3 | String | Shows the Label 3 setting.
Label 4 | String | Shows the Label 4 setting.
Telemetry Agent version | String | Shows the version of Telemetry Agent that collected this data.
Telemetry Processor (file share) | String | Shows the file share for the Telemetry Processor that uploaded data to the telemetry database.
Telemetry Processor (computer) | String | Shows the computer name for the Telemetry Processor that uploaded data to the telemetry database.
Computer processor name | String | Shows the processor name of the computer.
Number of processors (logical) | Number | Shows the number of logical processors in the computer.
Number of processors (physical) | Number | Shows the number of physical processors in the computer.
System type | String | Shows the system type of the computer.
Computer installed memory | Number | Shows amount of memory (in megabytes) that is installed in this computer.
Display resolution | String | Shows this computer's screen resolution (for example, 1280 x 780).
Display resolution (width) | Number | Shows the screen resolution width.
Display resolution (height) | Number | Shows the screen resolution height.
Windows version | String | Shows the Windows version of the computer.
Windows version (detail) | String | Shows Windows version details.
Windows system locale | String | Shows the system locale setting for Windows.
Windows system display language | String | Shows the system display language setting for Windows.
IE version | String | Shows the Internet Explorer version.
IE version (details) | String | Shows the Internet Explorer version in detail.
Windows system local (user) | String | Shows the Windows system local setting (user setting).
Windows display language (user) | String | Shows the Windows system display language (user setting).
Last scanned | Date/time | Shows the Telemetry Agent scanned date/time.
Office 2003 | String | Shows Office 2003 version details, if it is installed.
Office 2007 | String | Shows Office 2007 version details, if it is installed.
Office 2010 | String | Shows Office 2010 version details, if it is installed.
Office 15 | String | Shows Office 2013 version details, if it is installed.

Default data relationships in Telemetry Dashboard custom reports

The following illustrations show the relationships between tables in the telemetry database.

Default relationships between tables in the telemetry database

Shows the primary keys and relationships between tables in the telemetry database

The Usage_summary table and its relationships

Shows the Usage_Summary table and its relationship to other tables in the telemetry database

The Issue_summary table and its relationships

Shows the Issue_Summary table and its relationships to other tables in the telemetry database

See also

Content roadmap for Office 2013 compatibility
Telemetry Dashboard worksheet reference
Monitor Office compatibility and deployments by using Telemetry Dashboard


File format reference for Office 2013

Published: January 8, 2013

Summary: Learn about the file formats that are supported in Word 2013, Excel 2013, and PowerPoint 2013.

Applies to: Office 365 ProPlus | Office 2013

Audience: IT Professionals

Supported and unsupported file formats and their extensions are listed in the following tables for Word 2013, Excel 2013, and PowerPoint 2013. This article also provides information about other kinds of supported and unsupported file formats.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

Are you looking for information about opening and saving Office documents in different file formats? You can find this information by searching for "2013 file format" on Office.com.

In this article:

  • File formats that are supported in Word 2013

  • File formats that are supported in Excel 2013

  • File formats that are supported in PowerPoint 2013

  • Additional file format information

File formats that are supported in Word 2013

The following table describes the file formats that are supported in Word 2013, alphabetized by extension.

Extension Name of file format Description

.doc

Word 97-2003 Document

The binary file format for Word 97-Word 2003.

.docm

Word Macro-Enabled Document

The XML-based and macro-enabled file format for Word 2013, Word 2010 and Office Word 2007. Stores Visual Basic for Applications (VBA) macro code.

.docx

Word Document

The default XML-based file format for Word 2013, Word 2010 and Office Word 2007.

.docx

Strict Open XML Document

Conforms to the Strict profile of the Open XML standard (ISO/IEC 29500). This profile of Open XML doesn't allow a set of features that were that are designed specifically for backward-compatibility with existing binary documents, as specified in Part 4 of ISO/IEC 29500.

.dot

Word 97-2003 Template

Template for Word 97-Word 2003 files.

.dotm

Word Macro-Enabled Template

Template for creating new Word 2013, Word 2010 and Office Word 2007 files that contain macros. Users who want to include UI customizations or macros in the template should use this file format.

.dotx

Word Template

Template for creating new Word 2013, Word 2010 and Office Word 2007 files that do not contain macros.

.htm, .html

Web Page

A web page that is saved as a folder that contains an .htm file and all supporting files, such as images, sound files, cascading style sheets, scripts, and more. Good for posting on a site or editing with Microsoft Office FrontPage or another HTML editor.

.htm, .html

Web Page, Filtered

Saving in the Web Page, Filtered file format removes Microsoft Office-specific tags. If users save in filtered HTML and then re-open the file in an Office application, text and general appearance are preserved. However, some features might work differently.

.mht; .mhtml

Single File Web Page

A web page as a single file that includes an .htm file and all supporting files, such as images, sound files, cascading style sheets, scripts, and more.

.odt

OpenDocument Text

A file format for saving Word 2013 files so that they can be opened in document applications that use the OpenDocument format. Users can also open documents in the .odt format in Word 2013. Formatting might be lost when users save and open .odt files.

.pdf

PDF

Portable Document Format (PDF), a PostScript-based electronic file format that was developed by Adobe Systems. It preserves document formatting and enables file sharing.

Files that use the PDF file format can be saved and opened by using Word 2013.

Important:

PDF files that are opened in Word 2013 might not have a perfect page-to-page correspondence with the original. For example, the pages might break at different locations.

.rtf

Rich Text Format

RTF controls the representation and formatting of a document, both on the screen and in print. When they use the .rtf file format, documents created under different operating systems and with different software applications can be transferred between those operating systems and applications.

.txt

Plain Text

When users save a Word 2013 document as a .txt file, the document loses all formatting.

.wps

Works 6-9 Document

This is the default file format of Microsoft Works, versions 6.0 through 9.0.

.xml

Word 2003 XML Document

The XML format supported in Office Word 2003.

.xml

Word XML Document

The XML file format supported in Word 2013, Word 2010, and Office Word 2007 (Open XML).

.xps

XPS Document

XML Paper Specification, a file format that preserves document formatting and enables file sharing. When the XPS file is viewed online or printed, it keeps exactly the format that users intended, and the data in the file cannot be easily changed.

You can use Word 2013 to save documents in the XPS Document file format, but you can't open them by using Word 2013.

File formats that are supported in Excel 2013

The following tables describe the file formats that are supported in Excel 2013.

Extension | Name of file format | Description
.csv | CSV (Comma delimited) | Saves a workbook as a comma-delimited text file for use on another Windows operating system, and makes sure that tab characters, line breaks, and other characters are interpreted correctly. Saves only the active sheet.
.csv | CSV (Macintosh) | Saves a workbook as a comma-delimited text file for use on the Macintosh operating system, and makes sure that tab characters, line breaks, and other characters are interpreted correctly. Saves only the active sheet.
.csv | CSV (MS-DOS) | Saves a workbook as a comma-delimited text file for use on the MS-DOS operating system, and makes sure that tab characters, line breaks, and other characters are interpreted correctly. Saves only the active sheet.
.dbf | DBF 3, DBF 4 | dBase III and IV. Users can open these files formats in Excel, but, users can't save an Excel file to dBase format.
.dif | DIF (Data Interchange Format) | Saves only the active sheet.
.htm, .html | Web Page | A web page that is saved as a folder that contains an .htm file and all supporting files, such as images, sound files, scripts, and more.
.mht, .mhtml | Single File Web Page | A web page that is saved as a single file that includes an .htm file and all supporting files, such as images, sound files, scripts, and more.
.ods | OpenDocument Spreadsheet | A file format for saving Excel 2013 files so that they can be opened in spreadsheet applications that use the OpenDocument Spreadsheet format, such as Google Docs and OpenOffice.org Calc. Users can also open spreadsheets in the .ods format in Excel 2013. When users save and open .ods files, they might lose formatting.
.pdf | PDF | Portable Document Format, a format that preserves document formatting and enables file sharing. When the PDF format file is viewed online or printed, it keeps the format that users intended. Data in the file cannot be easily changed. The PDF format is also useful for documents that will be reproduced by using commercial printing methods.
.prn | Formatted Text (Space delimited) | Lotus space-delimited format. Saves only the active sheet.
.slk | SYLK (Symbolic Link Format) | Saves only the active sheet.
.txt | Text (Tab delimited) | Saves a workbook as a tab-delimited text file for use on another Windows operating system, and makes sure that tab characters, line breaks, and other characters are interpreted correctly. Saves only the active sheet.
.txt | Text (Macintosh) | Saves a workbook as a tab-delimited text file for use on the Macintosh operating system, and makes sure that tab characters, line breaks, and other characters are interpreted correctly. Saves only the active sheet.
.txt | Text (MS-DOS) | Saves a workbook as a tab-delimited text file for use on the MS-DOS operating system, and makes sure that tab characters, line breaks, and other characters are interpreted correctly. Saves only the active sheet.
.txt | Unicode Text | Saves a workbook as Unicode text, a character encoding standard that was developed by the Unicode Consortium. Saves only the active sheet.
.xla | Excel 97-2003 Add-In | The Excel 97-2003 Add-In, a supplemental program that runs additional code and supports VBA projects.
.xlam | Excel Add-In | The XML-based and macro-enabled Add-In format for Excel 2013 and Office Excel 2007. An Add-In is a supplemental program that runs additional code. Supports VBA projects and Excel 4.0 macro sheets (.xlm).
.xls | Excel 97-Excel 2003 Workbook | The Excel 97-Excel 2003 Binary file format.
.xls | Microsoft Excel 5.0/95 Workbook | The Excel 5.0/95 Binary file format.
.xlsb | Excel Binary Workbook | The binary file format for Excel 2013, Excel 2010 and Office Excel 2007. This is a fast load-and-save file format for users who need the fastest way possible to load a data file. Supports VBA projects, Excel 4.0 macro sheets, and all the new features that are used in Excel 2007, Excel 2010 and Excel 2013. But, this is not an XML file format and is therefore not optimal for accessing and manipulating content without using Excel 2013, Excel 2010 or Excel 2007 and the object model.
.xlsm | Excel Macro-Enabled Workbook | The XML-based and macro-enabled file format for Excel 2013, Excel 2010 and Office Excel 2007. Stores VBA macro code or Excel 4.0 macro sheets (.xlm).
.xlsx | Excel Workbook | The default XML-based file format for Excel 2013, Excel 2010, and Office Excel 2007. Can't store VBA macro code or Microsoft Excel 4.0 macro sheets (.xlm).
.xlsx | Strict Open XML Spreadsheet | An ISO strict version of the Excel Workbook file format (.xlsx).
.xlt | Excel 97 - Excel 2003 Template | The Excel 97 - Excel 2003 Binary file format for an Excel template.
.xltm | Excel Macro-Enabled Template | The macro-enabled file format for an Excel template for Excel 2013, Excel 2010, and Office Excel 2007. Stores VBA macro code or Excel 4.0 macro sheets (.xlm).
.xltx | Excel Template | The default file format for an Excel template for Excel 2013, Excel 2010, and Office Excel 2007. Can't store VBA macro code or Excel 4.0 macro sheets (.xlm).
.xlw | Excel 4.0 Workbook | An Excel 4.0 file format that saves only worksheets, chart sheets, and macro sheets. Users can open a workbook in this file format in Excel 2013. But, users can't save an Excel file to this file format.
.xml | XML Spreadsheet 2003 | XML Spreadsheet 2003 file format.
.xml | XML Data | XML Data format.
.xps | XPS Document | XML Paper Specification, a file format that preserves document formatting and enables file sharing. When the XPS file is viewed online or printed, it maintains exactly the format that users intended, and the data in the file cannot be easily changed.
Note:

Excel 2013 does not support the following:

  • Excel Chart (Excel 2.0, 3.0, and 2.x file formats) (.xlc)

  • Lotus 1-2-3 file formats (all versions) (.wk1, .wk2, .wk3, .wk4, .wks)

  • Microsoft Works (all versions) (.wks)

  • DBASE II file format (.dbf)

  • Quattro Pro for MS-DOS file format (.wq1)

  • Quattro Pro 5.0 and 7.0 for Windows (.wb1, .wb3)

File formats that are supported in PowerPoint 2013

The following tables describe the file formats that are supported in PowerPoint 2013.

Extension | Name of file format | Description
.bmp | Device Independent Bitmap | A slide that is saved as a graphic for use on web pages.
.emf | Enhanced Windows Metafile | A slide that is saved as a 32-bit graphic (for use with Microsoft Windows 95 and later versions).
.gif | GIF Graphics Interchange Format | A slide that is saved as a graphic for use on web pages.
.jpg | JPEG File Interchange Format | A slide that is saved as a graphic for use on web pages.
.mp4 | MPEG-4 Video | A presentation that is saved as a video.
.odp | OpenDocument Presentation | A format that can be opened in presentation applications that use the OpenDocument Presentation format, such as Google Docs and OpenOffice.org Impress. Users can also open presentations in the .odp format in PowerPoint 2013. Some information might be lost when users save and open .odp files.
.pdf | PDF | Portable Document Format, a PostScript-based electronic file format that was developed by Adobe Systems. It preserves document formatting and enables file sharing.
.png | PNG Portable Network Graphics Format | A slide that is saved as a graphic for use on web pages.
.pot | PowerPoint 97-2003 Template | A template for PowerPoint 97 to Office PowerPoint 2003 presentations.
.potm | PowerPoint Macro-Enabled Template | A template for PowerPoint 2013, PowerPoint 2010, and Office PowerPoint 2007 presentations that contain macros.
.potx | PowerPoint Template | A template for creating new PowerPoint 2013, PowerPoint 2010, and Office PowerPoint 2007 presentations.
.ppa | PowerPoint 97-2003 Add-In | A PowerPoint 97 to Office PowerPoint 2003 add-in.
.ppam | PowerPoint Add-In | An add-in that stores custom commands, Visual Basic for Applications (VBA) code, and specialized features.
.pps | PowerPoint 97-2003 show | A presentation that always opens in Slide Show view instead of in Normal view.
.ppsm | PowerPoint Macro-Enabled Show | A slide show that includes macros.
.ppsx | PowerPoint Show | A presentation that always opens in Slide Show view instead of in Normal view.
.ppt | PowerPoint 97-2003 Presentation | The default PowerPoint 97 to Office PowerPoint 2003 format.
.pptm | PowerPoint Macro-Enabled Presentation | A presentation that contains Visual Basic for Applications (VBA) code.
.pptx | PowerPoint Presentation | The default PowerPoint 2013, PowerPoint 2010, and Office PowerPoint 2007 XML-based file format.
.pptx | PowerPoint Picture Presentation | A PowerPoint 2013, PowerPoint 2010 or PowerPoint 2007 presentation where each slide is converted into a picture. Saving a file as a PowerPoint Picture presentation reduces the file size, but some information is lost.
.pptx | Strict Open XML Presentation | An ISO strict version of the PowerPoint Presentation file format (.pptx).
.rtf | Outline/RTF | A presentation outline that is saved as a text-only document that provides smaller file sizes and the ability to share macro-free files with other users who might not have the same version of PowerPoint or the operating system. Any text in the notes pane is not saved with this file format.
.thmx | Office Theme | A style sheet that includes definitions of a color theme, font theme, and effect theme.
.tif | TIFF Tag Image File Format | A slide that is saved as a graphic for use on web pages.
.wmf | Windows Metafile | A slide that is saved as a 16-bit graphic (for use with Microsoft Windows 3.x and later versions).
.wmv | Windows Media Video | A presentation that is saved as a video. PowerPoint 2013 presentations can be saved at High Quality (1024 x 768, 30 frames per second); Medium Quality (640 x 480, 24 frames per sec); and Low Quality (320 X 240, 15 frames per second). The WMV file format plays on many media players, such as Windows Media Player.
.xml | PowerPoint XML Presentation | The XML format that is supported in PowerPoint 2013, PowerPoint 2010, and Office PowerPoint 2007.
.xps | XPS Document | XML Paper Specification (XPS), an electronic paper format for exchanging documents in their final form.
Note:

PowerPoint 2013 does not support the following:

  • Opening or saving to PowerPoint 95 (or earlier) file formats

  • Pack and Go Wizard (.ppz) files.

  • Web Page (.htm, .html) files

Additional file format information

This section provides additional file formats and whether they are supported in the applications in Office 2013.

Microsoft Office Clipboard file formats

Users can paste data from the Office Clipboard into Word 2013, Excel 2013, and PowerPoint 2013 if the Office Clipboard data is in one of the formats shown in the following table.

File format Extension Description

Picture

.wmf or .emf

Pictures in Windows Metafile Format (WMF) or Windows Enhanced Metafile Format (EMF).

Note:

If users copy a Windows metafile picture from another program, Excel pastes the picture as an enhanced metafile.

Bitmap

.bmp

Pictures stored in Bitmap format (BMP).

Excel file formats

.xls

Binary file formats for Excel versions 5.0/95, Excel 97-2003, and Excel 2013.

SYLK

.slk

Symbolic Link Format.

DIF

.dif

Data Interchange Format.

Text (tab-delimited)

.txt

Tab-separated text format.

CSV (Comma-delimited)

.csv

Comma-separated values format.

Formatted text (Space-delimited)

.rtf

Rich Text Format (RTF). Only from Excel.

Embedded object

.gif, .jpg, .doc, .xls, or .bmp

Excel objects, objects from correctly registered programs that support OLE 2.0 (OwnerLink), and Picture or another presentation format.

Linked object

.gif, .jpg, .doc, .xls, or .bmp

OwnerLink, ObjectLink, Link, Picture, or other format.

Office drawing object

.emf

Office drawing object format or Picture (Windows enhanced metafile format, EMF).

Text

.txt

Display Text, OEM Text.

HTML

.htm, .html

Hypertext Markup Language.

Note:

When users copy text from another program, Excel pastes the text in HTML format, regardless of the format of the original text.

Single File Web Page

mht, .mhtml

This file format integrates inline graphics, applets, linked documents, and other supporting items referenced in the document.

Opening or viewing unsupported file formats

If the file format that users want to use is not supported in Word 2013, Excel 2013, or PowerPoint 2013, they can try the following methods to open the file.

  • Search the Internet for a company that makes file format converters for file formats that are not supported in the application.

  • Save to a file format that another program supports. For example, users might want to import their Word, Excel, or PowerPoint file into another program that does not support the Word, Excel, or PowerPoint. However, the other program might support importing another supported file format, such as a text file format. In this case, users can save their work in text file format, and then from the other program, import the text file.

See also

Content roadmap for Office 2013 compatibility
XML file name extension reference for Office 2013


XML file name extension reference for Office 2013

Published: January 8, 2013

Summary: Learn about the XML file formats and their extensions that are used by Word 2013, Excel 2013, PowerPoint 2013, and Visio 2013.

Applies to: Office 365 ProPlus | Office 2013

Audience: IT Professionals

XML file formats and their extensions are listed in the following tables for Word 2013, Excel 2013, PowerPoint 2013, and Visio 2013.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

Are you looking for information about opening and saving Office documents in different file formats? You can find this information by searching for "2013 file format" on Office.com.

In this article:

  • XML file types for Word 2013

  • XML file types for Excel 2013

  • XML file types for PowerPoint 2013

  • XML file types for Visio 2013

XML file types for Word 2013

The following table describes the file type, extension, and description for Word XML file formats.

XML file types for Word 2013

Word 2013 file type | Extension | Description
Word Document | .docx | The default Word file format. Can't store VBA macro code.
Strict Open XML document | .docx | Conforms to the Strict profile of the Open XML standard (ISO/IEC 29500). This profile of Open XML doesn't allow a set of features that were designed specifically for backward-compatibility with existing binary documents, as specified in Part 4 of ISO/IEC 29500.
Word Macro-Enabled Document | .docm | Uses the same basic XML format as the Word document format, but can store VBA macro code. This file type is created when VBA macro code is present in the file.
Word Template | .dotx | The default format for a Word template. Created when document styles and formatting are saved. Can't store VBA macro code.
Word Macro-Enabled Template | .dotm | Stores macro code for use with other Word documents. Does not always contain macro code, but is configured to support the storage of macro code. Word documents created from a macro-enabled template do not inherit the VBAProject part of the template. By default, documents are saved as .docx files even when they are created from a Word macro-enabled template.

XML file types for Excel 2013

The following table describes the file type, extension, and description for Excel XML file formats.

XML file types for Excel 2013

Excel 2013 file type | Extension | Description
Excel Workbook | .xlsx | The default Excel file format. Can't store VBA macro code or Microsoft Excel 4.0 macro sheets (.xlm files in Excel 4.0).
Strict Open XML Spreadsheet | .xlsx | An ISO strict version of the Excel Workbook file format (.xlsx).
Excel Macro-Enabled Workbook | .xlsm | Uses the same basic XML format as the Excel Workbook, but can store VBA macro code. Users who save an Excel workbook that has VBA code or Excel 4.0 macro sheets (.xlm files in Excel 4.0) are prompted to use this file format.
Excel Template | .xltx | The default file format for an Excel template. Can't store VBA macro code or Excel 4.0 macro sheets (.xlm files in Excel 4.0).
Excel Macro-Enabled Template | .xltm | Can contain a VBAProject part or Excel 4.0 macro sheets (.xlm files in Excel 4.0). Workbooks created from this template inherit the VBAProject part or Excel 4.0 macro sheets that exist in the template.
Excel Add-In | .xlam | A supplemental program that runs additional code. Excel add-ins use the Open XML file format to store data, and they support using VBA projects and Excel 4.0 macro sheets.

XML file types for PowerPoint 2013

The following table describes the file type, extension, and description for PowerPoint XML file formats.

XML file types for PowerPoint 2013

PowerPoint 2013 file type | Extension | Description
PowerPoint Presentation | .pptx | The default PowerPoint XML format. Can't contain a VBAProject part (the part that stores VBA macro code) or Action settings.
Strict Open XML Presentation | .pptx | An ISO strict version of the PowerPoint Presentation file format (.pptx).
PowerPoint Macro-Enabled Presentation | .pptm | The same basic XML format as the PowerPoint XML presentation format, but can store VBA macro code. Users who save a PowerPoint XML presentation file that contains VBA macro code are prompted to use this file type.
PowerPoint Template | .potx | An XML-based PowerPoint template. Created when a presentation does not have a VBAProject part and does not use Action settings.
PowerPoint Macro-Enabled Template | .potm | Users who save a PowerPoint XML template that contains VBA macro code are prompted to use this file type. Presentations created from this template do not inherit the VBAProject part or Action settings.
PowerPoint Add-In | .ppam | PowerPoint presentation designed to be run as a supplemental program. All PowerPoint add-ins are macro-enabled.
PowerPoint Show | .ppsx | An XML-based PowerPoint auto-running slide show. Can't contain a VBAProject part.
PowerPoint Macro-Enabled Show | .ppsm | An XML-based PowerPoint slide show file that contains a VBAProject part. Created when the auto-running slide show includes VBA macro code.

XML file types for Visio 2013

The following table describes the file type, extension, and description for Visio XML file formats.

Note:

Visio 2013 uses the XML file format package that is defined by the Open Packaging Conventions (ISO/IEC 29500-2:2008) standard. The XML content is based on the existing Visio XML Drawing (VDX) format.

XML file types for Visio 2013

Visio 2013 file type | Extension | Description
Visio Drawing | .vsdx | The default Visio 2013 file format. Can't store VBA macro code.
Visio Macro-Enabled Drawing | .vsdm | Uses the same basic XML format as the Visio drawing format (.vsdx), but can store VBA macro code. This file type must be used when VBA macro code is present in the file.
Visio Stencil | .vssx | The default format for a Visio 2013 stencil. Can't store VBA macro code.
Visio Macro-Enabled Stencil | .vssm | Uses the same basic XML format as the Visio Stencil (.vssx) format, but can store VBA macro code. Does not always contain macro code, but is configured to support the storage of macro code.
Visio Template | .vstx | The default format for a Visio 2013 template. Can't store VBA macro code.
Visio Macro-Enabled Template | .vstm | Uses the same basic XML format as the Visio Template (.vstx) format, but can store VBA macro code. Does not always contain macro code, but is configured to support the storage of macro code. Visio Drawings that are created from this template inherit the VBAProject part that exists in the template. However, by default, drawings are saved as .vsdx files even when they are created from a Visio macro-enabled template and will drop the VBAProject part.

See also

Content roadmap for Office 2013 compatibility
File format reference for Office 2013


Group Policy and Office Customization Tool settings in Office 2013 for OpenDocument and Office Open XML formats

Published: January 8, 2013

Summary: Describes Group Policy settings and Office Customization Tool (OCT) settings that address OpenDocument Format and Open XML Formats in Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

To configure OpenDocument Format and Open XML Formats in Office 2013, you can use the Group Policy and Office Customization Tool (OCT) settings that are described in this article. These settings apply to Excel 2013, PowerPoint 2013, and Word 2013.

Important:

This article is part of the Content roadmap for Office 2013 compatibility. Use the roadmap as a starting point for articles, downloads, scripts, and videos that help you assess Office 2013 compatibility.

In this article:

  • About the settings

  • Excel 2013 settings

  • PowerPoint 2013 settings

  • Word 2013 settings

About the settings

Before you can use the settings that are discussed in this article, you must install the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool download package, which contains new and updated Group Policy administrative template files and OCT files.

For each setting, the following information is provided:

  • The application to which the setting applies

  • The setting name

  • What the setting does

  • The default configuration for the setting

  • Where to find the setting in the Group Policy Management Console

    • Unless otherwise noted, you'll find Group Policy settings under the User Configuration/Administrative Templates node of the Group Policy Management Console when you edit a local or domain-based Group Policy object (GPO).

  • Where to find the setting in the Office Customization Tool (OCT)

    • Unless otherwise noted, you'll find OCT settings on the Modify user settings page of the OCT when you configure a setup customization file.

    Note:

    If the geographic location of the computer on which you are running the OCT is set to a European location, when you create a Setup customization .msp file, or open an existing customization .msp file for which file format settings are not configured for Excel 2013, PowerPoint 2013, or Word 2013, you might be prompted to choose a default file format for users. You can choose to keep the current settings for the Setup customization file, or choose either Office Open XML Formats (which support all the features of Office 2013), or OpenDocument formats. For more information about these file formats, click Learn more to access OCT help.

Excel 2013 settings

The following table lists the Group Policy settings and the OCT settings that address OpenDocument Format and Open XML Formats for Excel 2013.

Group Policy and OCT settings for Excel

Setting name What it does Default configuration Group Policy Management Console location OCT location

Default file format

Specifies the default file format for new files that users create in Excel. This includes the OpenDocument spreadsheet (.ods) file format.

Files are created in the Excel file format. Users may override this default setting and specify another file format.

Microsoft Excel 2013\Excel Options\Save

Microsoft Excel 2013\Excel Options\Save

Suppress file format compatibility dialog box for OpenDocument Spreadsheet format

Allows you to enable use of the file format compatibility warning, or to disable it from appearing when users save a file as an OpenDocument spreadsheet (*.ods) file in Excel.

The file format compatibility warning appears when users save as an OpenDocument Spreadsheet file in Excel.

Microsoft Excel 2013\Excel Options\Save

Microsoft Excel 2013\Excel Options\Save

OpenDocument Spreadsheet files

Determines whether users can open, view, edit, or save Excel files in OpenDocument Spreadsheet (*.ods) file format.

Users can open, view, edit, or save Excel files in *.ods file format.

Microsoft Excel 2013\Excel Options\Security\Trust Center\File Block Settings

Microsoft Excel 2013\Excel Options\Security\Trust Center\File Block Settings

Microsoft Office Open XML converters for Excel

Determines whether users can open, view, edit, or save Excel files in Open XML file format.

Users can open, view, edit, or save Excel files in Open XML file format.

Microsoft Excel 2013\Excel Options\Security\Trust Center\File Block Settings

Microsoft Excel 2013\Excel Options\Security\Trust Center\File Block Settings

Scan encrypted macros in Excel Open XML workbooks

Controls whether encrypted macros in Open XML documents are required to be scanned by using antivirus software before they are opened.

Note:

The behavior depends on whether the antivirus software uses the Microsoft Antivirus API.

Encrypted macros are disabled unless antivirus software is installed. Encrypted macros are scanned by your antivirus software when you attempt to open an encrypted workbook that contains macros.

Note:

If the antivirus software does not use the Microsoft Antivirus API, macros will always be blocked.

Microsoft Excel 2013\Excel Options\Security

Microsoft Excel 2013\Excel Options\Security

Protect document metadata for rights managed Office Open XML Files

Determines whether metadata is encrypted in Office Open XML files that are protected by Information Rights Management (IRM).

When Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata that is associated with the document is not encrypted.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Protect document metadata for password protected files

Determines whether metadata is encrypted when an Office Open XML file is password protected.

When an Open XML document is protected with a password and saved, any metadata that is associated with the document is encrypted together with the rest of the document's contents. If this configuration is changed, potentially sensitive information such as the document author and hyperlink references could be exposed to unauthorized people.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Encryption type for password protected Office Open XML files

Allows you to specify an encryption type for Office Open XML files.

The default cryptographic service provider (CSP) is used. On computers that run Windows Vista, the default CSP is Microsoft Enhanced RSA and AES Cryptographic Provider, AES-128, 128-bit. On computers that run Windows XP, the default CSP is Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), AES-128, 128-bit. Note: This policy setting will not take effect unless the registry key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\<Office application name>\Security\Crypto\CompatMode is set to 0. By default, the CompatMode registry key is set to 1.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Block opening of pre-release versions of file formats new to Excel 2013 through the Compatibility Pack for Office 2013 and Excel 2013 Converter

Controls whether users who have the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2013 File Formats installed can open Office Open XML files that were saved with pre-release versions of Excel 2013. Excel Open XML files usually have the following extensions: .xlsx, .xlsm, .xltx, .xltm, .xlam.

Users of the compatibility pack will be unable to open Office Open XML files that were created in pre-release versions of Excel 2013.

Microsoft Office 2013\Office 2013 Converters

Microsoft Office 2013\Office 2013 Converters

Disable Package Repair

Allows you to disable the option to repair Open XML documents.

When an Office 2013 application detects that an Open XML document is corrupted, the user is given the option of repairing the corrupted document.

This setting cannot be configured by using Group Policy.

Microsoft Office 2013 (Machine)\Security Settings

PowerPoint 2013 settings

The following table lists the Group Policy settings and the OCT settings that address OpenDocument Format and Open XML Formats for PowerPoint 2013.

Group Policy and OCT settings for PowerPoint

Setting name What it does Default configuration Group Policy Management Console location OCT location

Suppress file format compatibility dialog box for OpenDocument Presentation format

Allows you to enable use of the file format compatibility warning message or to disable it when you save a file as an OpenDocument presentation file in PowerPoint.

The file format compatibility warning does not appear when you save as an OpenDocument presentation file in PowerPoint.

Microsoft PowerPoint 2013\PowerPoint Options\Save

Microsoft PowerPoint 2013\PowerPoint Options\Save

OpenDocument Presentation files

Allows you to determine whether users can open, view, edit, or save PowerPoint files with the OpenDocument presentation (*.odp) file format.

OpenDocument presentation files are not blocked.

Microsoft PowerPoint 2013\PowerPoint Options\Security\Trust Center\File Block Settings

Microsoft PowerPoint 2013\PowerPoint Options\Security\Trust Center\File Block Settings

Microsoft Office Open XML converters for PowerPoint

Allows you to determine whether users can open, view, edit, or save PowerPoint files using Open XML file format converters.

PowerPoint files using Open XML file format converters are not blocked.

Microsoft PowerPoint 2013\PowerPoint Options\Security\Trust Center\File Block Settings

Microsoft PowerPoint 2013\PowerPoint Options\Security\Trust Center\File Block Settings

Scan encrypted macros in PowerPoint Open XML presentations

Controls whether encrypted macros in Open XML presentations are required to be scanned by using antivirus software before they are opened.

Encrypted macros are disabled unless antivirus software is installed. If antivirus software is installed, encrypted macros are scanned by users' antivirus software when they attempt to open an encrypted presentation that contains macros. If no vulnerabilities are detected, the macros can run.

Note:

If the antivirus software does not use the Microsoft Antivirus API, macros will always be blocked.

Microsoft PowerPoint 2013\PowerPoint Options\Security

Microsoft PowerPoint 2013\PowerPoint Options\Security

Turn on an external converter as the default for a file name extension

Allows you to enable an external file format converter as the default for a particular file name extension on a computer. To set this policy, you must specify the file name extension (for example, ''odp'') for Value Name and the external file format converter via the converter's classname (for example, ''TestConverter'') for Value.

Microsoft PowerPoint processes files in an application-defined manner.

This setting cannot be configured by using Group Policy.

Microsoft PowerPoint 2013 (Machine)\Converters

Protect document metadata for rights managed Office Open XML Files

Determines whether metadata is encrypted in Office Open XML files that are protected by Information Rights Management (IRM).

When Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata that is associated with the document is not encrypted.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Protect document metadata for password protected files

Determines whether metadata is encrypted when an Office Open XML file is password protected.

When an Open XML document is protected with a password and saved, any metadata that is associated with the document is encrypted together with the rest of the document's contents. If this configuration is changed, potentially sensitive information such as the document author and hyperlink references could be exposed to unauthorized people.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Encryption type for password protected Office Open XML files

Allows you to specify an encryption type for Office Open XML files.

The default cryptographic service provider (CSP) is used. On computers that run Windows Vista, the default CSP is Microsoft Enhanced RSA and AES Cryptographic Provider, AES-128, 128-bit. On computers that run Windows XP, the default CSP is Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), AES-128, 128-bit. Note: This policy setting will not take effect unless the registry key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\<Office application name>\Security\Crypto\CompatMode is set to 0. By default, the CompatMode registry key is set to 1.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Block opening of pre-release versions of file formats new to PowerPoint 2013 through the Compatibility Pack for Office 2013 and PowerPoint 2013 Converter

Controls whether users who have the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2013 File Formats installed can open Office Open XML files that were saved with pre-release versions of PowerPoint 2013. PowerPoint Open XML files usually have the following extensions: .pptx, .pptm, .potx, .potm, .ppsx, .ppsm, .ppam, .thmx, .xml.

Users of the compatibility pack will be unable to open Office Open XML files that were created in pre-release versions of PowerPoint 2013.

Microsoft Office 2013\Office 2013 Converters

Microsoft Office 2013\Office 2013 Converters

Disable Package Repair

Allows you to disable the option to repair Open XML documents.

When an Office 2013 application detects that an Open XML document is corrupted, the user is given the option of repairing the corrupted document.

This setting cannot be configured by using Group Policy.

Microsoft Office 2013 (Machine)\Security Settings

Word 2013 settings

The following table lists the Group Policy settings and the OCT settings that address OpenDocument Format and Open XML Formats for Word 2013.

Group Policy and OCT settings for Word

Setting name What it does Default configuration Group Policy Management Console location OCT location

Save As Open XML in Compatibility Mode

Allows you to hide the ''Maintain compatibility with previous versions of Word'' check box that appears in the Save As dialog when users save a file as an Open XML file format. This check box lets users preserve the fidelity of documents that open in compatibility mode when they save those documents to any of the Open XML file formats. Checking this box will prevent conversion to the version of Word that is saving the file. Conversion maximizes fidelity with the version of Word that is saving the file. We recommend it for users who want their Word documents to be compatible with this version of Word. However, conversion might affect the fidelity and compatibility of some features when the file is opened by an earlier version of Word.

The ''Maintain compatibility with previous versions of Word'' check box appears in the Save As dialog when users save a file in an Open XML file format.

Microsoft Word 2013\Word Options\Save

Microsoft Word 2013\Word Options\Save

Do not display file format compatibility dialog box for OpenDocument text format

Allows you to enable the file format compatibility warning that appears when users save a file as an OpenDocument text file in Word or to disable it.

The file format compatibility warning appears when users save as an OpenDocument text file in Word.

Microsoft Word 2013\Word Options\Save

Microsoft Word 2013\Word Options\Save

Set default compatibility mode on file creation

Allows you to specify the default compatibility mode for users when they create new files in Word 2013: Word 2003, Word 2007,Word 2010, or full functionality mode (this mode makes sure that all new features remain enabled). Note: Open XML file formats such as .docx and .dotx, support all four modes.

Full functionality mode is the default compatibility mode for users when they create new files in Word 2013.

Microsoft Word 2013\Word Options\Save

Microsoft Word 2013\Word Options\Save

Default file format

Allows you to determine the default file format for saving files in Word. This includes the OpenDocument text (.odt), and Open XML file formats. This policy setting is often set in combination with the ''Save As Open XML in Compatibility Mode'' policy setting.

Word saves new files in the Office Open XML format (*.docx).

Microsoft Word 2013\Word Options\Save

Microsoft Word 2013\Word Options\Save

OpenDocument Text files

Allows you to determine whether users can open, view, edit, or save Word files that use the OpenDocument text (*.odt) file format.

Users can open, view, edit, or save *.odt files in Word 2010.

Microsoft Word 2013\Word Options\Security\Trust Center\File Block Settings

Microsoft Word 2013\Word Options\Security\Trust Center\File Block Settings

OfficeOffice Open XML converters for Word

Allows you to determine whether users can open, view, edit, or save Word files that use Open XML file format converters.

Word files that use Open XML file format converters are not blocked.

Microsoft Word 2013\Word Options\Security\Trust Center\File Block Settings

Microsoft Word 2013\Word Options\Security\Trust Center\File Block Settings

Scan encrypted macros in Word Open XML documents

Controls whether encrypted macros in Open XML Word documents are required to be scanned by using antivirus software before they are opened.

Encrypted macros are disabled unless antivirus software is installed. If antivirus software is installed, encrypted macros are scanned by users' antivirus software when they attempt to open an encrypted document that contains macros. If no vulnerabilities are detected, the macros can run.

Note:

If the antivirus software does not use the Microsoft Antivirus API, macros will always be blocked.

Microsoft Word 2013\Word Options\Security\Trust Center

Microsoft Word 2013\Word Options\Security\Trust Center

Protect document metadata for rights managed Office Open XML Files

Determines whether metadata is encrypted in Office Open XML files that are protected by Information Rights Management (IRM).

When Information Rights Management (IRM) is used to restrict access to an Office Open XML document, any metadata that is associated with the document is not encrypted.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Protect document metadata for password protected files

Determines whether metadata is encrypted when an Office Open XML file is password protected.

When an Open XML document is protected with a password and saved, any metadata that is associated with the document is encrypted together with the rest of the document's contents. If this configuration is changed, potentially sensitive information such as the document author and hyperlink references could be exposed to unauthorized people.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Encryption type for password protected Office Open XML files

Allows you to specify an encryption type for Office Open XML files.

The default cryptographic service provider (CSP) is used. On computers that run Windows Vista, the default CSP is Microsoft Enhanced RSA and AES Cryptographic Provider, AES-128, 128-bit. On computers that run Windows XP, the default CSP is Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype), AES-128, 128-bit. Note: This policy setting will not take effect unless the registry key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\<Office application name>\Security\Crypto\CompatMode is set to 0. By default, the CompatMode registry key is set to 1.

Microsoft Office 2013\Security Settings

Microsoft Office 2013\Security Settings

Disable Package Repair

Allows you to disable the option to repair Open XML documents.

When an Office 2013 application detects that an Open XML document is corrupted, the user is given the option of repairing the corrupted document.

This setting cannot be configured by using Group Policy.

Microsoft Office 2013 (Machine)\Security Settings

See also

Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013
Office Customization Tool (OCT) reference for Office 2013

Ecma Office Open XML File Formats overview
Enforce settings by using Group Policy in Office 2010
Differences between the OpenDocument Spreadsheet (.ods) format and the Excel (.xlsx) format
Differences between the OpenDocument Presentation (.odp) format and the PowerPoint (.pptx) format
Differences between the OpenDocument Text (.odt) format and the Word (.docx) format


Plan and Deploy Office 2013

Published: July 16, 2012

Summary: Contains articles that will help you configure, customize, and deploy Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The following table includes links to articles that will help you learn how to configure and deploy volume activation, customize an installation, and deploy Office 2013 in your organization.

Deployment articles for Office 2013 on TechNet

Article Description

System requirements for Office 2013

Contains detailed information about the system requirements for Office 2013.

64-bit editions of Office 2013

Provides information about 64-bit editions of Office 2013, supported operating systems, deployment, and installation recommendations.

Volume activation of Office 2013

Contains links to articles that provide information about how to plan and deploy volume activation for Office 2013.

Customize installations of Office 2013

Contains links to articles about how to customize a client installation of Office 2013.

Roll out Office 2013

Contains links to articles about deployment scenarios, step-by-step installation instructions, and methods of rolling out Office 2013.

Plan an Outlook 2013 deployment

Contains links to and descriptions of articles that will help you to:

  • Plan an Outlook 2013 deployment

  • Configure Outlook Anywhere, Cached Exchange Mode, and security and protection features

  • Customize Outlook profiles

Language in Office 2013

Contains links to articles that will help you plan which languages to install and how to configure Office 2013 for different languages.

Identity, authentication, and authorization in Office 2013

Contains a list of articles that will help you understand and plan for Information Rights Management and other identity and authentication requirements.

Secure Office 2013

Contains a list of articles about planning, deploying, and managing security in Office 2013.

Group Policy for Office 2013

Contains a list of articles about using Group Policy together with Office 2013.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


64-bit editions of Office 2013

Published: July 16, 2012

Summary: Provides information about 64-bit editions of Office 2013, supported operating systems, deployment, and installation recommendations.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Processors that are 64-bit are becoming the standard for systems that range from servers to desktop computers. The 64-bit systems can use more virtual and physical memory than 32-bit systems. This lets users work with much larger data sets than they could previously, and to analyze and solve large computational problems. Office 2010 introduced native 64-bit versions of Office products to take advantage of this larger capacity. For example, this additional capacity is needed only by those Excel users who require Excel spreadsheets to access more than 2 gigabytes (GB) of addressable memory. The 32-bit version of Office 2013 provides the same functionality as the 64-bit version and is also compatible with 32-bit add-ins. Therefore, the 32-bit version of Office 2013 is installed by default.

Office 2013 also provides support for 32-bit Office 2013 applications that run on 64-bit Windows operating systems by using Windows-32-on-Windows-64 (WOW64). WOW64 is the x86 emulator that enables 32-bit Windows-based applications to run seamlessly on 64-bit Windows systems. Office 2013 lets users continue to use existing Microsoft ActiveX Controls, Component Object Model (COM) add-ins, which are primarily 32-bit because no 64-bit versions are available yet for many add-ins. In some cases, 64-bit Visual Basic for Applications (VBA) solutions may have to be modified to interface with system APIs and other imports. Supporting 32-bit Office 2013 applications that run on 64-bit operating systems allows for better compatibility with controls, add-ins, and VBA.

Important:

Are you trying to decide which version of Office 2013 to install? You may also want to read this article Choose the 32- or 64-bit version of Microsoft Office which will help you decide which version of Office to install.

The recommendations for which edition of Office 2013 to install are as follows:

  • If users in your organization depend on existing extensions to Office, such as ActiveX controls, third-party add-ins, in-house solutions built on earlier versions of Office, or 32-bit versions of programs that interface directly with Office, we recommend that you install 32-bit Office 2013 (the default installation) on computers that are running both 32-bit and 64-bit supported Windows operating systems.

  • If some users in your organization are Excel expert users who work with complex Excel spreadsheets, they can install the 64-bit edition of Office 2013 to move beyond the 2 GB addressable memory boundary that is imposed on 32-bit editions. Note that this boundary differs from the physical (on disk) size of the spreadsheet on your computer's hard disk drive. It is possible to have an Excel file whose size on disk is smaller than 2 GB, but which when it is opened contains enough data to occupy 2 GB or more of addressable memory.

    In addition, if you have in-house solution developers, we recommend that those developers have access to the 64-bit edition of Office 2013 so that they can test and update your in-house solutions on the 64-bit edition of Office 2013.

In this article:

  • Supported Windows operating systems

  • Architecture-specific folders and customization tools

  • Supported scenarios

  • Deployment considerations

  • Setup process

  • Assessing your current environment for application compatibility

Supported Windows operating systems

The supported Windows operating system editions for 64-bit Office 2013 client include the following:

  • 64-bit editions of Windows 7 and Windows 8

    Note:

    Office 2013 client does not support Windows XP or Windows Vista.

  • Windows Server 2008 R2

  • Windows Server 2012

The following statements apply:

  • The 64-bit Office client can be installed only on 64-bit editions of Windows 7, Windows 8, Windows Server 2008 R2, and Windows Server 2012

  • The 32-bit Office client is supported as a WOW64 installation. This is the default installation on 64-bit Windows operating systems. The 32-bit Windows-based applications run on 64-bit Windows, which allows for compatibility with 32-bit Office applications and add-ins.

  • Office 2013 server products (SharePoint Server 2013, SharePoint Foundation 2013, and Project Server 2013) support the 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, Data Center, or Web Server, and Windows Server 2012 with the .NET Framework 4.0.

  • For Click-to-Run scenarios, the supported version is Office 2013 32-bit (WOW64) on computers that run the supported 64-bit editions of Windows operating systems.

Architecture-specific folders and customization tools

Office 2013 includes architecture-specific folders: one for 32-bit and one for 64-bit.

For Windows Installer-based Office 2013 products, each folder contains the following:

  • A separate Config.xml file and Updates folder.

  • An architecture-specific Office Customization Tool (OCT). The OCT files are located in the Admin folder for the x86 (32-bit) and x64 (64-bit) folders. The Admin folder is included in volume licensed versions of the product, such as Office Professional Plus 2013.

    The 64-bit version of the OCT provides the same user interface, capabilities, and configurable settings as the 32-bit version. Office 2013 uses XML versions of OPA files: OPAX files (.opax) for non-language specific resources and OPAL files (.opal) for language-specific resources.

    The OCT provides support for importing Setup customization files (.msp files) as follows:

    • 64-bit Setup customization files can be imported into 32-bit OCT and can then be used to customize 32-bit Office products.

    • 32-bit Setup customization files can be imported into 64-bit OCT and can then be used to customize 64-bit Office products.

      A 32-bit Setup customization file that is imported to 64-bit OCT is converted to 64-bit, and a 64-bit customization file that is imported to 32-bit OCT is converted to 32-bit.

If you have included Outlook 2013 in your Office 2013 installation, Outlook sets a registry key named Bitness of type REG_SZ on the computer on which it is installed. The Bitness registry key indicates whether the Outlook 2013 installation is 32-bit or 64-bit. This might be useful to administrators who are interested in auditing computers to determine the installed versions of Office 2013 in their organization.

  • Registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\15.0\Outlook

  • Registry key: Bitness

  • Value: either x86 or x64

Supported scenarios

The Office 2013 64-bit client supports the following scenarios:

  • Enterprise In enterprise environments, the default is to install Office 2013 32-bit on computers that run either 32-bit or 64-bit editions of Windows operating systems.  We recommend this option.

    An alternate approach in enterprise environments is for administrators to do the following:

    • Install Office 2013 32-bit on computers that run 32-bit editions of Windows.

    • Install Office 2013 64-bit on computers that run 64-bit editions of Windows to take advantage of additional memory on the 64-bit computers.

  • Retail For users who install Office 2013 onto computers that run a supported 64-bit Windows operating system, the installation is, by default, the 32-bit version of Office 2013 (WOW64).

    Retail users who run 64-bit Windows operating systems and do not have 32-bit Office products installed can install the native 64-bit version of Office 2013 from the x64 folder.

  • Side-by-side installations No support is provided for side-by-side installations of 64-bit and 32-bit editions of Office. For example, there is no support for side-by-side installations of Office 2007 32-bit or Office 2010 32-bit with Office 2013 64-bit, or for Access 2013 64-bit and Excel 2013 32-bit.

    Note:

    Outlook 2013 Click-to-Run can be installed side-by-side with Outlook 2010 Windows Installer-based (MSI-based) and Outlook 2007 (MSI), provided both products are of the same bitness (both 32-bit or both 64-bit). No support is provided for side-by-side installations of 64-bit and 32-bit editions of Outlook.

    Windows Installer-based (MSI-based) Outlook 2013 does not support side-by-side installations. For example, you cannot install Outlook 2013 MSI with Outlook 2010 MSI.

    No support is provided for installation of Outlook 2003 side-by-side with Outlook 2013 Click-to-Run.

    The following table summarizes the supported coexistence scenarios. The information applies to both Windows Installer- (MSI) and Click-to-Run-based Office clients.

    Supported coexistence scenarios for 64-bit installations

    Previous Office version Office 2013 edition Scenario

    Office 2007 32-bit

    32-bit

    Supported

    Office 2010 32-bit (x86)

    32-bit

    Supported

    Office 2010 32-bit

    64-bit

    Blocked

    Office 2010 64-bit (x64)

    64-bit

    Supported

    Office 2010 64-bit

    32-bit

    Blocked

  • Upgrades The Office client upgrade for Windows Installer-based scenarios are as follows:

    • A 2007 Office system 32-bit or an Office 2010 32-bit installation on a computer that runs a 32-bit Windows operating system can be upgraded to an Office 2013 32-bit version.

    • A 2007 Office system 32-bit or an Office 2010 32-bit installation on a computer that runs a 64-bit Windows operating system can be upgraded to an Office 2013 32-bit (WOW64).

    • An Office 2010 64-bit installation on a computer that runs a 64-bit Windows operating system can be upgraded to an Office 2013 64-bit version.

      Important:

      Office can only be upgraded to the same architecture. For example, Office 2010 32-bit can be upgraded to Office 2013 32-bit, and Office 2010 64-bit can be updated to Office 2013 64-bit.

      There are no upgrade scenarios for Click-to-Run Office 2013. Click-to-Run supports side-by-side installation as noted in the Supported coexistence scenarios for 64-bit installations table.

Deployment considerations

Before you deploy 64-bit editions of Office 2013, you must evaluate the advantages and disadvantages and determine whether it is an appropriate deployment option for your specific environment. The following sections

  • Highlight benefits and issues that might affect compatibility

  • Describe Outlook considerations

  • List the applications that block a 64-bit Office 2013 installation

A key consideration is that you cannot install native 64-bit Office 2013 on computers that have 32-bit Office applications and third-party add-ins installed. You must uninstall the 32-bit Office applications and add-ins before you can install 64-bit Office 2013. If you have 32-bit third-party Office applications and add-ins that are required for users, you can install the default option, which is 32-bit Office 2013 (WOW64 installation) on computers that run supported 64-bit editions of Windows. A list of applications that block a 64-bit Office 2013 is provided in Applications that block a 64-bit Office 2013 installation.

In this section:

  • Advantages

  • Disadvantages

  • General feature deprecations

  • Considerations for Outlook applications

  • Applications that block a 64-bit Office 2013 installation

Advantages

Running Office 2013 64-bit provides the following advantages:

  • Ability to use additional memory.

  • Excel 2013 can load much larger workbooks. Excel 2013 made updates to use 64-bit memory addressing to move beyond the 2-GB addressable memory boundary that limits 32-bit applications.

  • Project 2013 provides improved capacity, especially when you are dealing with many subprojects to a large project.

  • Enhanced default security protections through Hardware Data Execution Prevention (DEP).

Disadvantages

The following issues might affect compatibility:

  • Microsoft Access MDE/ADE/ACCDE files Databases that have had their source code removed (such as .mde, .ade, and .accde files) cannot be moved between 32-bit and 64-bit editions of Office 2013. Such databases that are created by using 32-bit Office (any version) can be used only with 32-bit Office.A database that is created on 64-bit Office can be used only on 64-bit Office.

  • ActiveX controls and COM add-ins ActiveX controls and add-in (COM) DLLs (dynamic link libraries) that were written for 32-bit Office will not work in a 64-bit process. As a result, Office 2013 64-bit solutions that try to load 32-bit ActiveX controls or DLLs will not work. Installations of 64-bit Office 2013 will run only 64-bit controls. Computers can have 64-bit and 32-bit controls installed, and Office 2013 64-bit can only run the 64-bit versions of the controls. The workaround for resolving these issues is to obtain 64-bit compatible controls and add-ins or to install Office 2013 32-bit (WOW).

    In addition to controls that load into Office applications, there are web-based solutions that use ActiveX controls in Microsoft Internet Explorer. Office 2013 Datasheet views that are created by using a SharePoint Server 2013 work on any platform and in browsers other than Internet Explorer. The SharePoint Server 2013 Edit in Datasheet view does not require a client-side control. For example, if a user has Office 2010 64-bit or Office 2013, Edit in Datasheet will work correctly on SharePoint Server 2013.

    Note:

    For SharePoint Server 2010, 64-bit editions install some Office 32-bit client-side controls for supporting solutions in a 32-bit browser (the default browser on current 64-bit Windows systems). The Edit in Datasheet view functionality in SharePoint Server 2010 is not supported if you install 64-bit Office 2013 client. The Edit in Datasheet functionality is available if you install 32-bit Office 2013 client.

  • In-place activation The following issues might occur if there is no match between the bitness of Office 2013 and registered applications:

    • An OLE server might not instantiate in-place and might fail to open if the application registered is not the same bitness as the version of Office installed. This can occur, for example, if the OLE Server application is 32-bit and the version of Office installed is 64-bit.

    • An object inserted into an Office 2013 application document might fail in cross-bitness scenarios. This can occur, for example, if you insert a 32-bit object in a 64-bit Office 2013 application document.

  • Graphics rendering There are differences between the 32-bit and 64-bit Graphics Device Interface (GDI) that might have performance implications because of the lack of MMX support on 64-bit. Intel's MMX technology is an extension of the Intel architecture (IA) instruction set. The technology uses a single-instruction, multiple-data (SIMD) technique to speed up multimedia and communications software by processing data elements in parallel.

  • Visual Basic for Applications (VBA) Beginning with Office 2010, VBA code that uses the Declare statement to access the Windows application programming interface (API) or other DLL entry points will see differences between 32-bit and 64-bit versions:

    • The Declare statement must be updated with the PtrSafe attribute after inputs and outputs to the API were reviewed and updated.

    • Declare statements do not work in 64-bit VBA without the PtrSafe attribute.

    • Two new data types were added to 64-bit Office 2010 VBA: LongLong and LongPtr.

    To learn about the Microsoft Visual Basic for Applications (VBA) changes that were introduced in Office 2010, see 64-Bit Visual Basic for Applications Overview in the MSDN Library.

  • Windows Mobile Device Center (WMDC) synchronization WMDC does not synchronize with Outlook 2013 if you use the 64-bit version of Outlook 2013. In such cases, an error message states that there is no default mail client or the current mail client cannot fulfill the messaging. WMDC synchronizes correctly with the 32-bit version of Outlook 2013. To synchronize a Windows Phone with Outlook 2013 by using Windows Mobile Device Center, uninstall Outlook 2013 64-bit. Then, to install Outlook 2013 32-bit, use the original installer that you used to obtain Outlook 2013 64-bit. Outlook 2013 32-bit is the default option.

General feature deprecations

The following feature deprecations might affect compatibility:

  • Microsoft Access The Replication Conflict Viewer was removed from both the 32-bit and 64-bit installations of Office 2013. The ReplicationConflictFunction was removed from Access 2013.

  • Publisher In Office 2010, the Microsoft Works database converter (wdbimp.dll) was removed from both 32-bit and 64-bit installations of Office 2010. In versions earlier than Office 2010, this converter was used in the Mail Merge functionality to connect to a data source that was created in Microsoft Works.

  • Word Microsoft Office Document Imaging (MODI) and all its components were removed from Office 2010. The legacy Equation Editor is not supported on 64-bit Office 2013, but is supported for 32-bit Office 2013 installations (WOW64). However, the equation builder feature in Word 2013 works on all platforms.

    WLL (Word Add-in libraries) WLL files are available for 32-bit Office 2013 and are not supported in 64-bit Office 2013.

Considerations for Outlook applications

If you developed 32-bit Messaging Application Programming Interface (MAPI) applications, add-ins, or macros for Outlook, there are actions that you should take to change and rebuild the 32-bit applications to run on a 64-bit platform.

Starting with Office 2010, Outlook is available as a 32-bit application and a 64-bit application. The version (bitness) of Outlook that you choose depends on the edition of the Windows operating system (32-bit or 64-bit) and the edition of Office 2013 (32- or 64-bit) that is installed on the computer, if Office is already installed on that computer.

Factors that determine the feasibility of installing a 32-bit or a 64-bit version of Outlook include the following:

  • You can install 32-bit Office 2013 and 32-bit Outlook 2013 on a supported 32-bit or 64-bit edition of the Windows operating system. You can install the 64-bit version of Office 2013 and 64-bit Outlook 2013 only on a supported 64-bit operating system.

  • The default installation of Office 2013 on a 64-bit edition of the Windows operating system is 32-bit Office 2013.

  • The bitness of an installed version of Outlook is always the same as the bitness of Office 2013, if Office is installed on the same computer. That is, a 32-bit version of Outlook 2013 cannot be installed on the same computer on which 64-bit versions of other Office 2013 applications are already installed, such as 64-bit Word 2013 or 64-bit Excel 2013. Similarly, a 64-bit version of Outlook 2013 cannot be installed on the same computer on which 32-bit versions of other Office applications are already installed.

MAPI applications include stand-alone applications such as Lync, Microsoft Office Communicator, and MFCMAPI, and service providers such as address book, store, and transport providers. For MAPI method and function calls to work in a MAPI application (except for one Simple MAPI function, MAPISendMail), the bitness of the MAPI application must be the same as the bitness of the MAPI subsystem on the computer on which the application is targeted to run. The bitness of the MAPI subsystem, in turn, is determined by and is always the same as the bitness of the installed version of Outlook. For information about how to prepare Outlook applications for 32-bit and 64-bit platforms, see the Outlook 2013 MAPI Reference in Microsoft Office Development in the MSDN Library.

Applications that block a 64-bit Office 2013 installation

By default, if 32-bit Office applications are installed on a computer, a 64-bit Office 2013 installation is blocked. The following applications block a 64-bit Office 2013 installation:

  • Microsoft Office Excel Viewer

  • Access database engine of Access 2013

  • Office 2013 (Click-to-Run) 32-bit

  • Compatibility Pack for the 2007 Office system

For additional information about applications and components that block 64-bit Office 2013, see KB 2269468: You receive the error message "You cannot install the 64-bit version of Office 2010 because you have 32-bit Office products installed".

Setup process

The Setup sequence for a 64-bit Office client installation is the same as for a standard 32-bit Office client installation, with the addition of specific checks that are performed for 64-bit Office 2013.

The following figure shows the checks that Setup performs for 64-bit installations.

Office 2013 64-bit Setup checks

Office 2013 64-bit Setup checks

Setup tasks are performed in the following sequence:

  1. Setup checks for 64-bit Office 2013 prerequisites.

    When you run Setup.exe from the x64 folder, Setup determines whether 32-bit Office applications are installed. If Setup detects 32-bit Office applications, it displays an error message that informs users that they must first uninstall all 32-bit Office applications if they want to continue with the installation of Office 2013 64-bit. The error message lists the installed 32-bit Office applications. If Setup does not detect 32-bit Office applications, it installs the 64-bit edition of Office 2013.

    Note:

    When you run Setup.exe from the x86 folder, Setup determines whether there are 64-bit Office 2013 applications installed. If Setup detects 64-bit Office 2013, an error message is displayed and Setup is blocked. If Setup does not detect 64-bit Office 2013, it installs the 32-bit edition of Office 2013.

    Office Professional 2013 will also be available as a combination release (DVD media) that includes both the 32-bit and 64-bit editions of Office 2013. If Setup is run from the root folder of the Office 2013 DVD that contains both 32-bit and 64-bit Office 2013, Setup performs the installation as follows:

    • On a computer that runs a supported 32-bit edition of Windows, Setup installs the 32-bit edition of Office 2013.

    • On a computer that runs a supported 64-bit edition of Windows, Setup checks for installed 64-bit Office applications, and then continues as follows:

      • If no 64-bit Office applications are installed on the computer, Setup installs Office 2013 32-bit. Office 2013 32-bit is the default installation on a 64-bit Windows operating system (uses WOW). This also applies if the administrator upgrades an existing 32-bit Office installation.

      • If 64-bit Office applications are installed, Setup installs Office 2013 64-bit.

  2. Setup reads XML data. Setup installs Office 2013, or streams the product if you are downloading Office 2013Click-to-Run.

  3. If the installation is a Windows Installer-based installation and you created customizations with the OCT, Setup applies the 64-bit OCT customization .msp file that you specify.

  4. If the installation is a Windows Installer-based installation and you want to apply product updates (such as Service Packs and hotfixes), Setup can apply the updates as part of the initial installation. You can place the Office 2013 product updates in the Updates folder, and Setup applies the software updates that you specify.

Assessing your current environment for application compatibility

Office 2013 introduces a new application and document compatibility tool named "Telemetry Dashboard" to help IT professionals evaluate application and file compatibility issues. This tool replaces the Office 2010 compatibility tools: Office Migration Planning Manager (OMPM), Office Code Compatibility Inspector (OCCI), and Office Environment Assessment Tool (OEAT). For more information about Telemetry Dashboard, see Deploy Telemetry Dashboard.

See also

Office 2013 Resource Kit

Content roadmap for Office 365 ProPlus
Compatibility Between the 32-bit and 64-bit Versions of Office 2010


Volume activation of Office 2013

Published: July 16, 2012

Summary: Lists articles that provide information about how to plan and deploy volume activation for Office 2013.

Applies to: Office 2013

Audience: IT Professionals

Microsoft policy requires the activation of all editions of Office 2013 client software, including Volume License editions. For Office 2013, volume activation occurs through Office Activation Technologies, which are based on the Software Protection Platform (SPP) that is used in Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription.

Office 2013 logo The following table lists and describes articles about volume activation for Office 2013.

Articles about volume activation for Office 2013

Article | Description
Plan volume activation of Office 2013 | Explains how to plan which methods to use for activating volume-licensed (VL) editions of Office 2013.
Volume activation methods in Office 2013 | Learn about the methods that are available for activating volume-licensed editions of Office 2013.
Deploy volume activation of Office 2013 | Describes how to prepare and configure the Office 2013 client and the Office KMS host for volume activation.
Configure client computers for volume activation in Office 2013 | Provides details about the Office Software Protection Platform script (ospp.vbs) and describes the Volume Activation Management Tool (VAMT) for Windows Installer-based (MSI-based) versions of Office 2013.
Troubleshoot volume activation for Office 2013 | Explains how to troubleshoot common errors for volume activation of Office 2013


Plan volume activation of Office 2013

Published: July 16, 2012

Summary: Explains how to plan which methods to use for activating volume-licensed (VL) editions of Office 2013.

Applies to: Office 2013

Audience: IT Professionals

You can plan the deployment of Office Activation Technologies for volume activation of Office 2013 in several steps. Before you read this article, we recommend that you read Volume activation methods in Office 2013. We also highly recommend that you read the Windows Volume Activation Planning Guide.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription.

In this article:

  • Plan a deployment

  • Review activation methods

  • Volume Activation Management Tool (VAMT) 3.0

  • Plan for KMS activation

  • Plan for Active Directory-Based activation

  • Plan for MAK activation

Plan a deployment

If you are planning a Windows deployment of Windows 7, Windows Server 2008 R2, Windows 8, or Windows Server 2012, you probably have the same considerations for Windows as for Office 2013. To help determine which activation method to use for Windows, see the Windows Volume Activation Planning Guide. Most likely, Office 2013 will use the same method.

A volume activation deployment includes the following steps:

  1. Learn about product activation.

  2. Review available activation models.

  3. Evaluate client connectivity.

  4. Map the physical computer or virtual machine to an activation method.

  5. Determine product key needs.

  6. Determine monitoring and reporting needs.

Most of the information about these steps is covered in the Windows Volume Activation Planning Guide. This article describes an overview of the technology.

When you plan for Office Activation Technologies, think about the following information:

  • The KMS activation threshold for Office 2013 is five computers. This means that Office 2013 client computers will be activated only after five or more client computers have requested activation.

  • You do not have to enter a product key for Office 2013 KMS clients. You only have to enter a KMS host key on your KMS host computer.

  • If you decide to use MAK, enter the product key either through the Office Customization Tool (OCT) or the Config.xml file. After Office 2013 installation, you can change the product key by using the Volume Activation Management Tool (VAMT) or the Office Software Protection Platform script (ospp.vbs). For more information about ospp.vbs, see Configure client computers for volume activation in Office 2013.

Note:

The latest version of VAMT is 3.0. For information about VAMT 3.0, see Volume Activation Management Tool (VAMT) 3.0.

Review activation methods

Office Activation Technologies provides three activation methods for Office 2013 (KMS, MAK, and Active Directory-Based activation).

  • Key Management Service (KMS) A server-client model in which a computer serves as the KMS host. A KMS host key must be installed and activated. This establishes a local activation service in your environment. Office 2013 client computers connect to the local Office 2013 KMS host for activation.

  • Multiple Activation Key (MAK) If you use a MAK key, Office 2013 client computers are activated online by using the Microsoft hosted activation servers or by telephone.

  • Active Directory-Based activation Available only for Office 2013 on Windows 8 and Windows Server 2012. Active Directory-Based activation can activate all Office 2013 volume license clients throughout a domain. Active Directory-Based activation is set up through Active Directory Domain Services (AD DS) from either a Windows 8 volume license edition computer or a Windows Server 2012 computer,

The kind of key that is installed determines the activation method. All Office 2013 volume license editions have the KMS client key pre-installed. You do not have to enter a product key if you are deploying KMS clients. If you want to use MAK activation, you have to enter the correct MAK key.

You can also use a combination of KMS and MAK. For example, Office 2013 running on desktops has the KMS client key installed, whereas Office 2013 running on portable computers has the MAK key installed.

The model that you choose depends on the size, network infrastructure, connectivity, and security requirements. You can choose to use only one or a combination of these activation models. Typically, the same activation method for a particular instance of Windows would also be used for Office. For more information about how to decide which activation method to use, see the Windows Volume Activation Planning Guide.

Key Management Service (KMS)

KMS is a server-client model in which a computer serves as the KMS host. KMS activation requires TCP/IP connectivity. By default, KMS hosts use DNS to publish the KMS service. Client computers connect to the KMS host for activation by using anonymous remote procedure calls (RPCs) through TCP communications port 1688, which is the default port number when you enable the firewall on a KMS host. You can either use the default settings, which require little or no administrative action, or manually configure KMS hosts and clients based on network configuration and security requirements.

To be licensed, the KMS client must be activated. The following table describes the license state of the Office 2013 KMS client with respect to activation.

License state of the Office 2013 KMS client

License state Description

Licensed

By default, the KMS client tries activation with the KMS host one time every seven days. (The number of days is configurable.) This design allows the maximum possible time for the client to be in the licensed state.

After the KMS client is successfully activated, it remains in the licensed state for 180 days. When in the licensed state, users do not see any notification dialog boxes prompting them to activate the client. After 180 days, the activation attempt process resumes. If activation is continually successful, the whole activation experience is transparent to the end-user.

Out-of-tolerance

If activation does not occur during the 180-day period, Office 2013 goes into the out-of-tolerance state for 30 days. Users then see notifications that request activation.

Unlicensed notification

If activation does not occur during the out-of tolerance state, Office 2013 goes into the unlicensed notification state. Users then see notifications that request activation and a red title bar.

You must install the KMS host by using a KMS host key and then activate the host before it can accept activation requests from KMS clients. For information about how to set up a KMS host, see Prepare and configure the KMS host in Deploy volume activation of Office 2013.

Important:

The KMS host key for Office 2013 is not specific to a particular operating system. It is designed to be used on any of the operating systems supported as an Office 2013 KMS host, including both 32-bit and 64-bit editions:

  • Volume License editions of Windows 7

  • Volume License editions of Windows 8

  • Windows Server 2012

  • Windows Server 2008 R2

Publication of the KMS service

The KMS service uses service (SRV) resource records (RRs) in DNS to store and communicate the locations of KMS hosts. KMS hosts use dynamic updates, if available, to publish the KMS SRV RRs. If dynamic updates are not available, or if the KMS host does not have permissions to publish the RRs, you must publish the DNS records manually or configure client computers to connect to specific KMS hosts. This might require changing permissions on DNS to let more than one KMS host publish SRV records.

Note:

DNS changes might take time to propagate to all DNS hosts, depending on the complexity and topology of the network.

Client discovery of KMS

The first time that a KMS client queries DNS for KMS information, it randomly selects a KMS host from the list of SRV RRs that DNS returns. The address of a DNS server that contains the SRV RRs can be listed as a suffixed entry on KMS clients. This enables advertisement of SRV RRs for KMS in one DNS server and KMS clients that have other primary DNS servers to find it.

You can add priority and weight parameters to the DnsDomainPublishList registry value for KMS hosts on Volume License editions of Windows 7 or Windows Server 2008 R2. Doing so enables you to establish KMS host priority groupings and weighting within each group, which specifies the order in which to use KMS hosts and balances traffic among multiple KMS hosts. If you are using priority and weight parameters, we recommend that KMS caching be disabled on the client. This allows the client to query DNS every time that activation is tried, which will honor the priority and weight parameters, instead of directly contacting the cached KMS host that last resulted in successful activation.

If the KMS host that a client selects does not respond, the KMS client removes that KMS host from its list of SRV RRs and randomly selects another KMS host from the list. If the priority and weight parameters are set, the KMS client will use them while finding another KMS host. Otherwise, KMS hosts are selected randomly. After a KMS host responds, the KMS client caches the name of the KMS host and, if caching is enabled, uses it for successive activation and renewal attempts. If the cached KMS host does not respond on a later renewal, the KMS client discovers a new KMS host by querying DNS for KMS SRV RRs.

KMS activation thresholds

The minimum requirement for Office 2013 KMS activation is a KMS host and at least five KMS clients in a network environment. Five or more computers that are running Office 2013 volume editions must contact the KMS host within 30 days for their activation requests to succeed. When five clients have connected to a KMS host, clients that later connect to the KMS host receive responses that allow the clients to be activated. Due to the re-activation schedule, the original five clients also become activated when they request activation from the KMS host again.

After initializing KMS, the KMS activation infrastructure is self-maintaining. The KMS service can be co-hosted with other services. A single KMS host can support hundreds of thousands of KMS clients. Most organizations can deploy merely two KMS hosts for their whole infrastructure (one main KMS host and one backup host for redundancy).

KMS activation renewal

KMS activations are valid for 180 days. This is called the activation validity interval. To remain activated, KMS clients must renew their activation by connecting to the KMS host at least one time every 180 days. By default, KMS client computers attempt to renew their activation every seven days. After a client's activation is renewed, the activation validity interval begins again.

Use KMS for computers that run Windows and Office 2013 client products

When you use KMS to activate computers that run both Windows and Office 2013, you have the following options for Office 2013:

  • Use the same KMS host on a computer that runs Windows Server 2003 (Standard, Enterprise, and Datacenter editions [32-bit and 64-bit] only), Volume License editions of Windows 7 or Windows Server 2008 R2. We recommend this option.

  • Use separate KMS hosts for computers that run Windows and Office 2013.

Important:

If you already have a KMS host that is set up to activate Windows products, you still have to install the Office 2013 KMS host license files, enter the Office 2013 KMS host key, and activate the key. To do this, go to the Microsoft Office 2013 Volume License Pack website, and then download and run KeyManagementServiceHost.exe.

The following operating systems are supported as an Office 2013 KMS host:

  • Volume License editions of Windows 7

  • Volume License editions of Windows 8

  • Windows Server 2012

  • Windows Server 2008 R2

If you already use a computer that runs as your Windows KMS host and you want to co-host the Office 2013 KMS host, follow the steps in Prepare and configure the KMS host in Deploy volume activation of Office 2013.

Multiple Activation Key (MAK)

A MAK key is used for one-time activation with the Microsoft hosted activation services. Each MAK key has a predetermined number of allowed activations. This number is based on Volume Licensing agreements and may not match the organization's exact license count. Each activation that uses a MAK key with the Microsoft hosted activation service counts toward the activation limit. After Office 2013 is activated, no re-activation is required unless the hardware changes significantly.

There are two ways to activate computers by using a MAK key:

  • MAK Independent Activation MAK independent activation requires that each computer independently connect and be activated with Microsoft, either over the Internet or by telephone. MAK independent activation is best suited for computers in an organization that does not maintain a connection to the corporate network.

  • MAK Proxy Activation by using VAMT This enables a centralized activation request on behalf of multiple computers that have one connection to Microsoft. MAK Proxy activation is configured by using VAMT. MAK Proxy activation is appropriate for environments in which security concerns might restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that do not have this connectivity.

    Note:

    The latest version of VAMT is 3.0. For information about VAMT 3.0, see Volume Activation Management Tool (VAMT) 3.0.

MAK architecture

MAK activation requires that a MAK key is installed on a client computer and instructs that computer to activate itself against Microsoft hosted activation servers over the Internet. In MAK Proxy activation, a MAK key must be installed on the client computer by any of the methods previously described. VAMT obtains the installation ID (IID) from the target computer, sends the IID to Microsoft on behalf of the client, and obtains a confirmation ID (CID). The tool then activates the client by installing the CID. The CID is saved and can be used later, for example, to activate test computers that were re-imaged after 90 days.

Active Directory-Based activation

On the Windows 8 platform, starting with Office 2013, a third volume activation method is available: Active Directory-Based activation.

As with KMS, Active Directory-Based activation can activate all Office 2013 VL clients within the domain. To use Active Directory-Based activation, you set up Active Directory Domain Services (AD DS) from either a Windows 8 VL edition computer or a Windows Server 2012 computer to support the activation of all Office 2013 VL clients within the domain. The Office 2013 VL clients can run on any Windows 8 or Windows Server 2012 client computer.

Active Directory-Based activation uses the same GVLK/KMS host key pair that KMS activation uses. When you use Active Directory-Based activation, the Software Protection Platform Services (SPPSvc) periodically attempts to activate the GVLK against either an Activation Object (AO) in AD DS or a discoverable KMS host if the Active Directory-Based activation attempt fails. A successful Active Directory-Based activation grants a license to the Office 2013 client for 180 days.

For more information about Active Directory-Based activation, see Active Directory-Based Activation Overview.

Volume Activation Management Tool (VAMT) 3.0

The latest update to the Volume Activation Management Tool (VAMT) is version 3.0. VAMT 3.0 is designed to manage volume activations for Windows Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Office 2010, and Office 2013. In addition, VAMT 3.0 supports Active Directory-Based activation.

The following features are either new, or updated, in VAMT 3.0:

  • User interface. The updated user interface makes volume activation and license management an easy, one-console process.

  • Data storage. Data storage in a SQL Server database provides greater scalability and speed.

  • Licensing reports. Five new Volume Licensing reports provide instant views of the licensing status of every computer in the database:

    • At Risk Products Report

    • Duplicate Computer Management ID (CMID) Report

    • MAK Usage Report

    • Unlicensed Products Report

    • Volume Activation by Authority Report

  • PowerShell commandlets (cmdlet). A PowerShell module for VAMT replaces the vamt.exe command line interface.

  • Support for Proxy Authentication. If you are on a network that requires a user name and password to reach the Internet, VAMT enables you to log on and perform proxy activation.

  • Active Directory-Based activation. VAMT can online or proxy-activate an Active Directory-Based activation object. When Active Directory-Based activation is deployed, any new qualifying computers that are joined to the domain are automatically activated.

The following features that existed in previously released versions of VAMT are deprecated or removed in VAMT 3.0:

  • Data storage in Computer Information Files (CIL). Data is no longer stored in Computer Information Files (CIL), but is instead stored in a SQL Server database. You can import data that is currently stored in CIL files into VAMT. Data that is exported from VAMT is saved in a CILX file.

  • The vamt.exe command-line interface.The vamt.exe command-line interface is no longer available. It is replaced by a Windows PowerShell module.

For detailed information about VAMT 3.0, see Volume Activation Management Tool Technical Reference.

Plan for KMS activation

The KMS service does not require a dedicated server. The KMS service can be co-hosted on a server that also hosts KMS for Windows. Specifically, you can configure a computer that runs Windows 7 VL edition, Windows Server 2008 R2, Windows 8 VL edition, or Windows Server 2012 to act as a single KMS host that responds to both Windows and Office 2013 KMS client activation requests. This works as long as the appropriate Office 2013 KMS host licenses are installed and a valid KMS host key is installed, and the key is activated against Microsoft hosted activation servers. You can install Office 2013 KMS host licenses by running the Microsoft Office 2013 Volume License Pack.

Note:

You can set up an Office 2013 KMS host on the same computer that contains an Office 2010 KMS host if you are using any of the following operating systems:

  • Volume License editions of Windows 7

  • Volume License editions of Windows 8

  • Windows Server 2012

  • Windows Server 2008 R2

Plan DNS server configuration

The default KMS auto-publishing feature requires SRV RR and dynamic update support. Microsoft DNS or any other DNS server that supports SRV RRs, as documented in Internet Engineering Task Force (IETF) Request for Comments (RFC) 2782, and dynamic updates, as documented in RFC 2136 can support KMS client default behavior and KMS SRV RR publishing. Berkeley Internet Domain Name (BIND) versions 8.x and 9.x support both SRV records and dynamic update, for example.

The KMS host must be configured so that it has the necessary credentials to create and update SRV, A (IPv4), and AAAA (IPv6) RRs on the dynamic update servers, or the records must be created manually. To give the KMS host the necessary credentials, we recommend that you create a security group in AD DS and add all KMS hosts to that group. For Microsoft DNS, make sure that that this security group is given full control over the _VLMCS._TCP record on each DNS domain that will contain the KMS SRV RRs.

Activate the KMS host

The KMS host must be activated with Microsoft hosted activation servers through the Internet or by telephone. After the KMS host is activated, it does not communicate any additional information to Microsoft. For more information, see Prepare and configure the KMS host in Deploy volume activation of Office 2013.

Prepare KMS clients

By default, Volume License editions of Office 2013 are preinstalled with the KMS client key. This makes them KMS clients. No additional configuration is required. KMS clients can locate a KMS host automatically by querying DNS for SRV RRs that publish the KMS service. If the network environment does not use SRV RRs, you can manually assign a KMS client to use a specific KMS host by configuring the following registry key:

HKLM\Software\Microsoft\OfficeSoftwareProtectionPlatform

The KMS host name is specified by KeyManagementServiceName (REG_SZ), and the port is specified by KeyManagementServicePort (REG_SZ). These registry keys can also be set through the ospp.vbs script. For more information about ospp.vbs, see Configure client computers for volume activation in Office 2013.

Activate as a standard user

Office 2013 does not require administrator permissions for KMS activation. However, volume editions require administrator permissions for MAK activation. Administrators can enable users who do not have administrator permissions to activate with MAK by setting the appropriate registry key in the deployments or in the master image:

HKEY_LOCAL_MACHINE\Software\Microsoft\OfficeSoftwareProtectionPlatform\UserOperations = 1

This registry key can also be set through the ospp.vbs script. For more information about ospp.vbs, see Configure client computers for volume activation in Office 2013.

Plan for Active Directory-Based activation

Similar to KMS activation, which activates all Office VL clients that are connected to a KMS host, Active Directory-Based Activation activates all Office VL clients in an Active Directory domain. For more information about Active Directory-Based Activation, see Active Directory-Based Activation Overview.

Plan for MAK activation

We recommend MAK for computers that rarely or never connect to the corporate network and for environments in which fewer than five physical computers need activation (the Office 2013 KMS activation threshold is five computers. You can use MAK for individual computers or with an image that can be installed by using Microsoft or third-party deployment solutions. You can also use MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment.

For more information about how to install a MAK key, see Deploy volume activation of Office 2013.

No authenticated proxy server support

Activation over the Internet will be blocked if the proxy server requires user authentication. In Microsoft Internet Security and Acceleration (ISA) Server, this setting is named basic authentication. Because activation requests do not present the user's credentials to the proxy server, we recommend that you do not use basic authentication with ISA Server or other proxy servers. For more information, see Microsoft Knowledge Base article 921471: Activation fails when you try to activate Windows Vista or Windows Server 2008 over the Internet.

See also

Deploy volume activation of Office 2013
Volume activation methods in Office 2013
Configure client computers for volume activation in Office 2013
Internet Protocol version 6 support for Office 2013

KMS activation
MAK independent activation
MAK proxy activation
Active Directory-Based Activation Overview
Volume Activation Management Tool Technical Reference


Internet Protocol version 6 support for Office 2013

Published: April 30, 2013

Summary: Provides Internet Protocol version 6 (IPv6) addressing information for Office 2013 applications, Project 2013, and SharePoint Designer 2013.

Applies to: Office 2013

Audience: IT Professionals

Office 2013 applications:

  • Access 2013

  • Excel 2013

  • InfoPath 2013

  • OneNote 2013

  • Outlook 2013

  • PowerPoint 2013

  • Publisher 2013

  • Visio 2013

  • Word 2013

Other Microsoft 2013 applications:

  • Project 2013

  • SharePoint Designer 2013

In this article:

  • Internet Protocol supported environments

  • User scenarios

Internet Protocol supported environments

Office 2013 applications that run on Windows XP Service Pack 3 (SP3), Windows Vista, Windows 7, or Windows 8 support the following environments:

  • Pure Internet Protocol version 4 (IPv4)

  • Mixed IPv4 and IPv6

  • Pure IPv6

In a Windows environment, "mixed" can be defined as one of the following likely scenarios (but there might be other scenarios):

  • Both IPv4 and IPv6 protocols are running in your environment.

  • Some client computers are using IPv4 and some are using IPv6.

  • Client computers are using IPv4. However, the computer that is running SQL Server 2005 is using IPv6.

In addition, user interfaces (UIs) for Office 2013 applications support display of both IPv4 and IPv6 addresses.

User scenarios

Office 2013 applications support IPv6 addressing to match support in Windows operating systems. In IPv6 environments and in IPv4 or mixed IP environments, users can browse network locations; open, save, publish, and insert objects, pictures, and files; open data sources; access shared workspaces; get document updates from network paths; and other tasks that use any of the following:

  • Universal naming convention (UNC)

  • Server name, where Domain Name System (DNS) uses an IPv6 address (for example, \\server\share)

  • Hypertext Transfer Protocol (HTTP)

  • Hypertext Transfer Protocol over Secure Sockets Layer (HTTPS)

  • File Transfer Protocol (FTP)

  • Literal address

For more information about IPv6 support for specific scenarios and applications, see the following resources:

  • For information about how to use literal addresses, see IP Version 6 Support.

  • For information about IPv6 support for Microsoft SharePoint Products and Technologies, see Internet Protocol Support in SharePoint Products and Technologies (Office SharePoint Server).

  • For information about IPv6, such as compatibility, installation, and addressing, see IPv6 for Microsoft Windows: Frequently Asked Questions.

See also

IPv6


Volume activation methods in Office 2013

Published: July 16, 2012

Summary: Describes the methods that are available for activating volume-licensed editions of Office 2013.

Applies to: Office 2013 | Visio 2013 | Project 2013

Audience: IT Professionals

Three volume activation (VA) methods are available for Office 2013:

  • Key Management Service (KMS)

  • Multiple Activation Key (MAK)

  • Active Directory-Based activation

KMS and MAK are supported on Windows 7 and Windows 8. Active Directory-Based activation is supported only on Windows 8 and Windows Server 2012.

Note:

The activation components and the activation process that are described in this article also apply to Project 2013 and Visio 2013.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription.

KMS and MAK activation

The KMS and MAK activation processes for Office 2013 are basically the same as they were for Office 2010, except that the Office 2013 KMS host is not supported on Windows Server 2003. The Office 2013 KMS host is supported on Windows Server 2008 R2, Windows 7 VL edition, Windows 8 VL edition, and Windows Server 2012.

Office 2013 can be activated by using KMS on the following platforms:

KMS host platforms for Office 2013 activation

If Office 2013 runs on… It can activate against a KMS host that runs on…

Windows 7 or Windows 8

Volume License editions of Windows 7 (see Important note)
Windows Server 2008 R2 (see Important note)
Volume License editions of Windows 8
Windows Server 2012

Important:

If you are setting up a KMS host on Windows 7 VL edition or Windows Server 2008 R2, you must first install the patch as described in Microsoft Knowledge Base article 2757817: An update that adds support for Windows 8 and for Windows Server 2012 to Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 KMS hosts is available. This patch allows the KMS host to activate Office 2013 clients that run Windows 8.

For Office 2013, the KMS Host License Pack is named the Microsoft Office 2013 Volume License Pack. You can use this license pack to set up KMS hosts on all supported platforms.

  • If you install the Microsoft Office 2013 Volume License Pack on Windows 7 The KMS host installer prompts you to install and activate the KMS host key. For more information, see Deploy volume activation of Office 2013.

  • If you install the Microsoft Office 2013 Volume License Pack on Windows Server 2012 The Microsoft Office 2013 Volume Activation Tools wizard starts when the Office 2013 Volume License Pack is installed. For details, see Activating Office 2013 by using the Microsoft Office 2013 Volume License Pack later in this article.

  • If you install the Microsoft Office 2013 Volume License Pack on Windows 8 If you click Yes, the RSAT download page opens.

    • When the application opens, the dialog box in the following figure appears. Either click Yes to install the Remote Server Administration Tools (RSAT) for Windows, or click No to run slmgr.vbs to set up a KMS host or Active Directory-Based activation. We recommend that you install RSAT.

    Figure: Office 2013 Volume License Pack dialog box

    A dialog box that lets you install the Office 2013 Volume Licensing Pack

    Important:

    If you set up an Office 2013 KMS host on Windows 8: Although the Office 2013 Volume License Pack dialog box indicates that you can either use the Volume Activation (VA) server role or run slmgr.vbs, the VA server role requires that there you have a Windows Server 2012 installed on your network to load the server role against. Instead, you can run the Volume Activation Tools wizard from the Tools menu in Server Manager. You can download the wizard as part of RSAT.

    For details about the VA server role, see Activating Office 2013 by using the Microsoft Office 2013 Volume License Pack later in this article.

    If you choose to use slmgr.vbs, you must run the following commands in the listed order to install and activate the KMS host key:

    1. cscript slmgr.vbs /ipk [HostProductKey]

    2. cscript slmgr.vbs /ato 2E28138A-847F-42BC-9752-61B03FFF33CD

Note:

You can set up an Office 2013 KMS host on the same computer that contains an Office 2010 KMS host if you are using any of the following operating systems:

  • Volume License editions of Windows 7

  • Windows Server 2008 R2

  • Volume License editions of Windows 8

  • Windows Server 2012

By default, Office 2013 VL editions install a Generic Volume License Key (GVLK). The GVLK enables Office 2013 to automatically discover and activate against your KMS host or Active Directory infrastructure. The following GVLKs are installed:

Generic Volume License Keys (GVLKs) for Office 2013

Product | GVLK
Office 2013 Professional Plus | YC7DK-G2NP3-2QQC3-J6H88-GVGXT
Office 2013 Standard | KBKQT-2NMXY-JJWGP-M62JB-92CD4
Project 2013 Professional | FN8TT-7WMH6-2D4X9-M337T-2342K
Project 2013 Standard | 6NTH3-CW976-3G3Y2-JK3TX-8QHTT
Visio 2013 Professional | C2FG9-N6J68-H8BTJ-BW3QX-RM3B3
Visio 2013 Standard | J484Y-4NKBF-W2HMG-DBMJC-PGWR7
Access 2013 | NG2JY-H4JBT-HQXYP-78QH9-4JM2D
Excel 2013 | VGPNG-Y7HQW-9RHP7-TKPV3-BG7GB
InfoPath 2013 | DKT8B-N7VXH-D963P-Q4PHY-F8894
Lync 2013 | 2MG3G-3BNTT-3MFW9-KDQW3-TCK7R
OneNote 2013 | TGN6P-8MMBC-37P2F-XHXXK-P34VW
Outlook 2013 | QPN8Q-BJBTJ-334K3-93TGY-2PMBT
PowerPoint 2013 | 4NT99-8RJFH-Q2VDH-KYG2C-4RD4F
Publisher 2013 | PN2WF-29XG2-T9HJ7-JQPJR-FCXK4
Word 2013 | 6Q7VD-NX8JD-WJ2VH-88V73-4GBJ7

For more information about KMS and MAK, see Plan volume activation of Office 2013 and Deploy volume activation of Office 2013.

Active Directory-Based activation

A third volume activation method is available on the Windows 8 and Windows Server 2012 platforms: Active Directory-Based activation.

Active Directory-Based activation uses your existing Active Directory infrastructure to activate all Office 2013 VL clients through their connection to the domain. To set up Active Directory-Based activation for Office 2013, configure Active Directory Domain Services (AD DS) from either a Windows 8 VL edition computer or a Windows Server 2012 computer. The Office 2013 VL clients can automatically activate against the domain as long as they are running on a Windows 8 or Windows Server 2012 client computer.

Active Directory-Based activation uses the same GVLK/KMS host key pair that KMS activation uses. By using Active Directory-Based activation, the Software Protection Platform Service (SPPSvc) periodically attempts to activate the GVLK against either an Activation Object (AO) in AD DS or a discoverable KMS host if the Active Directory-Based activation attempt fails. A successful Active Directory-Based activation grants a license to the Office 2013 client for 180 days.

For more information about Active Directory-Based activation, see Active Directory-Based Activation Overview.

Activating Office 2013 by using the Microsoft Office 2013 Volume License Pack

KMS activation. You can set up an Office 2013 KMS host on Windows Server 2012 through the VA (volume activation) server role. When you run the Microsoft Office 2013 Volume License Pack on Windows Server 2012, the VA server role is automatically loaded and the Volume Activation Tools wizard is started. Running the wizard enables you to set up an Office 2013 KMS host on Windows Server 2012.

Active Directory-Based activation. You can use the Microsoft Office 2013 Volume License Pack to set up Active Directory-Based activation. After the forest is activated, each Office 2013 VL client that is joined to the domain will automatically be activated. An Active Directory-Based activation lasts for 180 days, at which time the Office 2013 VL client must be reactivated for an additional 180 days in order to stay activated.

Important:

If you use the Volume Activation Tools wizard on Windows Server 2012, and you try to activate Office 2013 by using either KMS or Active Directory-based activation, you might receive the following error message:
"Invalid product key or license mismatch. Please confirm this product key is entered correctly and is valid for this application or Windows edition."
This message means that you have added the Volume Activation Tools role to Windows Server 2012 but have not yet run the Microsoft Office 2013 Volume License Pack.

Volume Activation Management Tool (VAMT) 3.0

Volume Activation Management Tool (VAMT) 3.0 is the latest version. VAMT 3.0 is designed to manage volume activations for Windows Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Office 2010, and Office 2013. In addition, VAMT 3.0 supports Active Directory-Based activation.

For more information about VAMT 3.0, see Plan volume activation of Office 2013.

See also

Plan volume activation of Office 2013
Deploy volume activation of Office 2013
Configure client computers for volume activation in Office 2013

Active Directory-Based Activation Overview
Volume Activation Management Tool Technical Reference
Plan KMS activation of Office 2010
Plan MAK independent activation of Office 2010
Plan MAK proxy activation of Office 2010


Deploy volume activation of Office 2013

Updated: April 9, 2013

Summary: Describes how to prepare and configure the Office 2013 client and the Office KMS host for volume activation.

Applies to: Office 2013

Audience: IT Professionals

You can use various methods to deploy Office Activation Technologies, depending on the requirements of your organization. Before you read this article, we recommend that you read Plan volume activation of Office 2013 and Volume activation methods in Office 2013. For additional planning resources, see "Evaluate Client Connectivity" in Volume Activation Planning Guide.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to Office 365 ProPlus. Office 365 ProPlus is licensed through a subscription. For more information see Office 365 ProPlus.

In this article:

  • Prepare and configure the Office KMS host

  • Configure DNS

  • Prepare and configure the Office 2013 client

Prepare and configure the Office KMS host

Before you deploy Office 2013, you must first decide the activation method for each computer in your organization. These methods include the following:

  • Key Management Service (KMS).

  • Active Directory-Based activation, see Active Directory-Based Activation Overview.

  • Multiple Activation Key (MAK). See

This section contains information about how to prepare and configure the Office 2013 KMS host to enable Office 2013 clients to activate through KMS.

Important:

At minimum, membership in the Administrators group of the KMS host server is required to prepare and configure the KMS host.

Set up and activate the Office KMS host

Only the following operating systems can serve as the Office 2013 KMS host:

  • Volume license editions of Windows 7

  • Volume license editions of Windows 8

  • Windows Server 2012

  • Windows Server 2008 R2

Important:

The KMS host key for Office 2013 is not specific to a particular operating system. It can be used on any of the operating systems that were mentioned earlier. This includes both 32-bit and 64-bit editions.

Note:

You can set up an Office 2013 KMS host on the same computer that contains an Office 2010 KMS host if you are using any of the following operating systems:

The following operating systems are not supported as the Office 2013 KMS host:

  • Windows Vista

  • Windows Server 2008

Co-hosting with a Windows KMS host

If you currently have a Windows KMS host running on an operating system that supports an Office KMS host, we recommend that you use the same computer that you use for your Office KMS host. You must still run the steps in the following sections to install and activate an Office 2013 KMS host key. For more information, see Plan volume activation of Office 2013.

To activate the Office KMS host

  1. On the Microsoft Office 2013 Volume License Pack website, download and run office2013volumelicensepack_en-us_x86.exe.

    Then, follow the steps in the Instructions section on the website.

  2. If your KMS host does not have an Internet connection, see To activate an Office KMS host by telephone later in this article.

  3. If you have a firewall enabled, follow these steps to enable KMS through the firewall:

    1. In Control Panel, select System and Security, and then select Windows Firewall.

    2. Select the Allow a program or feature through Windows Firewall link.

    3. Select Change Settings.

    4. Select the Key Management Service check box, and then select OK.

Note:

When you enable the firewall on a KMS host, the default TCP communications port number is 1688.

Activating an Office KMS host by telephone

If your KMS host does not have an Internet connection, you can activate the KMS host by telephone.

To activate an Office KMS host by telephone

  1. Run the following command under C:\Windows\system32. The result is the installation ID for Office 2013. You will type this installation ID number into the telephone in step 3.

    cscript slmgr.vbs /dti 2E28138A-847F-42BC-9752-61B03FFF33CD

    Note:

    The 2E28138A-847F-42BC-9752-61B03FFF33CD value is the Office 2013 activation ID. Paste this value exactly as shown. We recommend pasting this number into Notepad, and then breaking up the number into six groups of six numbers.

  2. Run slui.exe 4, and then call the telephone number displayed.

    Note:

    Ignore the displayed installation ID. This is for Windows.

  3. At each prompt, enter a group of six numbers. This is the installation ID for Office 2013 that you obtained in step 1.

  4. When you hear the response, note the numbers.

  5. Run cscript slmgr.vbs /atp xxxxxxxxxxxx 2E28138A-847F-42BC-9752-61B03FFF33CD, where xxxxxxxxxxxx is the confirmation ID that you receive by telephone (there should be 48 numbers).

    Note:

    The 2E28138A-847F-42BC-9752-61B03FFF33CD value is the Office 2013 activation ID. Therefore, paste this value exactly as shown.

  6. You should see a message that the confirmation ID was successfully deposited.

Sppsvc state stopped error

Because the KMS host service automatically stops, you might encounter the following error when you run KeyManagementServiceHost.exe.

Error: The Software Protection Platform service is not running: sppsvc State: Stopped

If you receive this error, perform the following:

  1. At the command prompt, type the following command, and then press ENTER:

    net start sppsvc

  2. Re-run KeyManagementServiceHost.exe.

Alternately, you can perform the following:

  1. On the Computer short-cut menu, select Manage. The Microsoft Management Console appears.

  2. Under Services and Applications, select Services.

  3. In the services list, locate Software Protection. On the Software Protection short-cut menu, select Start, and then select OK to start the service.

  4. Re-run KeyManagementServiceHost.exe.

Manually install the Office 2013 KMS host key and activate

KeyManagementServiceHost.exe installs the Office 2013 KMS host license files on your KMS host. KeyManagementServiceHost.exe also prompts you for an Office 2013 KMS host key and tries to activate the KMS host. If you did not enter the Office 2013 KMS host key correctly, run KeyManagementServiceHost.exe again.

The slmgr.vbs script

If you want to manually enter the Office 2013 KMS host key and activate it, use the slmgr.vbs script. For more information, see Configure the Office 2013 KMS host later in this article. Open an elevated command prompt, and then run the following commands:

slmgr.vbs /ipk <Office 2013 KMS host key>

slmgr.vbs /ato <Office 2013 activation ID>

The Office 2013 activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD.

Configure the Office 2013 KMS host

The Software License Manager (slmgr.vbs) script is used to configure and retrieve volume activation information for the Office 2013 KMS host, and the Windows host. For more information, see Configuring KMS Hosts.

The script can be run locally on the target computer or remotely from another computer. If a standard user runs slmgr.vbs, some license data might be missing or incorrect, and many operations are prohibited.

The slmgr.vbs script can use wscript.exe or cscript.exe, and administrators can specify which script engine to use. If no script engine is specified, slmgr.vbs runs by using the default script engine, wscript.exe. The cscript.exe script engine is recommended.

The Software Licensing Service must be restarted for any changes to take effect. To restart the Software Licensing Service, use the Microsoft Management Console (MMC) Services snap-in or run the following command:

net stop sppsvc && net start sppsvc

The slmgr.vbs script requires at least one parameter. If the script is run that has no parameters, it displays Help information. The following table lists slmgr.vbs command-line options, and a description of each. Most of the parameters in the table configure the KMS host. However, the parameters /sai and /sri are passed to KMS clients after the KMS clients contact the KMS host. The general syntax of slmgr.vbs is as follows (assuming cscript.exe is the script engine that you are using):

cscript slmgr.vbs /parameter

cscript slmgr.vbs [ComputerName] [User] [Password] [Option]

ComputerName Name of remote computer. If a computer name is not passed, a local computer is used.

User Account with required permission on remote computer.

Password Password for the account. If a user account and password are not passed, current credentials are used.

Option Options are shown in the following table.

The following table shows the command options for the slmgr.vbs command.

Slmgr.vbs command options - standard

Option Description

/ipk [ProductKey]

Installs the product key for Windows (default) or other application identified by the product key.

/ato [ActivationID]

Activates the KMS host for Windows (default), or the application that is identified when its Activation ID is provided. The Office 2013 Activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD.

/dti [ActivationID]

Displays the Installation ID that is used for telephone activation of the KMS host for Windows (default) or the application that is identified when its Activation ID is provided. The Office 2013 Activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD. You enter the Installation ID into the telephone to receive the Confirmation ID, which is used for activating the KMS host by using the /atp parameter.

/atp [ConfirmationID][ActivationID]

After the Confirmation ID is received, activates the KMS host for Windows (default) or the application that is identified when its Activation ID is provided. The Office 2013 Activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD.

/dlv [ActivationID]

Displays detailed license information for Windows (default), or the application that is identified when its Activation ID is provided. The Office 2013 Activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD.

/dli [ActivationID]

Displays license information for Windows (default), or the application that is identified when its Activation ID is provided. The Office 2013 Activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD.

/upk [ActivationID]

Uninstalls the product key for Windows (default) or the application that is identified when its Activation ID is provided. The Office 2013 Activation ID is 2E28138A-847F-42BC-9752-61B03FFF33CD.

Caution:

If you intend to uninstall the product key for Office 2013, for example, and forget to enter the Activation ID, all installed product keys are uninstalled. This includes the product key for Windows.

/xpr [ActivationID]

Displays the expiration date for the current license state.

/sprt [PortNumber]

Sets the TCP communications port on a KMS host. It replaces PortNumber with the TCP port number to use. The default setting is 1688.

/cdns

Disables automatic DNS publishing by a KMS host.

/sdns

Enables automatic DNS publishing by the KMS host.

/cpri

Lowers the priority of KMS host processes.

/sai [ActivationInterval]

Changes how often a KMS client attempts to activate itself when it cannot find a KMS host. It replaces ActivationInterval with a value expressed in minutes. The default setting is 120.

/sri [RenewalInterval]

Changes how often a KMS client attempts to renew its activation by contacting a KMS host. It replaces RenewalInterval with a value expressed in minutes. The default setting is 10080 (7 days). This setting overrides the local KMS client settings.

The following table shows the command options for activating and Active Directory forest by using Active Directory-Based activation.

Slmgr.vbs command options - Active Directory -based activation

Option | Description
/ad-activation-online [ProductKey] | Activates an Active Directory forest through the user-provided product key.
/ad-activation-apply-get-iid [ProductKey] | Displays installation ID for Active Directory forest.
/ad-activation-apply-cid [ProductKey][ConfirmationID] | Activates an Active Directory forest through the user-provided product key and the Confirmation ID.

Verify successful activation of the Office KMS host

To verify that the Office 2013 KMS host key is successfully installed and activated, use the slmgr.vbs script. Open an elevated command prompt on the KMS host, type the following command, and then press ENTER:

cscript slmgr.vbs /dlv all

To view information only for Office 2013, specify the Activation ID after the /dlv parameter:

cscript slmgr.vbs /dlv 2E28138A-847F-42BC-9752-61B03FFF33CD

The output should resemble the following example.

Copy code
Name: Office 15, OfficeKMSHostVL_KMS_Host edition
Description: Office 15, VOLUME_KMS channel
Activation ID: 2e28138a-847f-42bc-9752-61b03fff33cd
Application ID: 0ff1ce15-a989-479d-af46-f275c6370663
Extended PID: 05426-00206-234-001162-03-1033-9200.0000-0992013
Installation ID: 020650770493837252929082195773527024195725809211989214
Use License URL: https://activation.sls.microsoft.com/SLActivateProduct/SLActiva
teProduct.asmx?configextension=o14
Validation URL: http://go.microsoft.com/fwlink/?LinkID=187557
Partial Product Key: KDQ2G
License Status: Licensed
Remaining Windows rearm count: 1000
Trusted time: 4/9/2013 9:58:33 AM

Key Management Service is enabled on this machine
    Current count: 0
    Listening on Port: 1688
    DNS publishing enabled
    KMS priority: Normal

Key Management Service cumulative requests received from clients
    Total requests received: 0
    Failed requests received: 0
    Requests with License Status Unlicensed: 0
    Requests with License Status Licensed: 0
    Requests with License Status Initial grace period: 0
    Requests with License Status License expired or Hardware out of tolerance: 0

    Requests with License Status Non-genuine grace period: 0
    Requests with License Status Notification: 0

If the output shows "License Status: Licensed," the Office 2013 KMS host key is successfully installed and activated.

After KMS clients send requests for activation, the current count is incremented. The current count must be 5 or larger before KMS clients are activated. The maximum current count is double the activation threshold, or 10. Administrators can also check the KMS log that is in the Applications and Services Logs folder for event ID 12290, the ID for KMS-related activity. The KMS log records activation requests from KMS clients. Each event displays the name of the computer and the time stamp of each activation request.

Configure DNS

To activate Office 2013 by using KMS, the Office KMS host must be discoverable. KMS hosts automatically publish their existence by creating service (SRV) resource records (RRs) on the DNS server. If there is only one KMS host and dynamic update, no action is required for the KMS host to create the SRV RR that publishes the KMS service location.

If there is more than one KMS host, only the first KMS host can create an SRV RR. Subsequent KMS hosts cannot change or update SRV RRs unless the default permissions on the DNS server are changed.

Changing the default permissions on the DNS server requires administrative rights in the domain, and the KMS hosts must all belong to the same Active Directory Domain Services (AD DS) domain. Create a global security group in AD DS for your KMS hosts. Add each KMS host to the new security group, and set the permissions on the DNS server to enable updates by members of the newly created security group.

Prepare and configure the Office 2013 client

On the client computer, you must make sure that the appropriate product key for your specific activation method is installed. This section describes how to check whether the correct product key is installed, and how to install a different product key if it is required.

Important:

If you deploy an image or create a virtual machine, you must rearm the installation of Office 2013 before you capture the image or create the virtual machine. For information about capturing an image, see Configure Office 2013 for capturing an image. For more information about rearming an Office 2013 installation, see Rearm the Office installation later in this article.

Activate KMS clients

All volume license editions of Office 2013 have a KMS client key preinstalled.

For the Office 2013 KMS host, you install and enable only one key to activate all volume license editions of Office 2013 KMS clients. If the Office 2013 KMS host is installed and configured, KMS activation occurs transparently to the user when an Office 2013 client is first installed.

For additional configuration options, such as how to specify the KMS host name on the KMS client, see Configure client computers for volume activation in Office 2013.

Activate Active Directory-Based activation clients

Active Directory-Based activation of Office applies only for Office 2013 clients that run on Windows 8 or Windows Server 2012. Active Directory-Based activation uses the same client product key and host key that are used by KMS. By using Active Directory-Based activation, the Software Protection Platform Service (SPPSvc) periodically attempts to activate the product key against either an Activation Object (AO) in AD DS or a discoverable KMS host if the Active Directory-Based activation attempt fails.

For more information about Active Directory-Based activation, see Active Directory-Based Activation Overview.

Activate MAK clients

If you use Multiple Activation Key (MAK), you must enter the MAK key by using one of the following supported methods:

  • Before you deploy Office 2013

    • Use Office Customization Tool (OCT) to activate n MAK client

    • Config.xml file

  • After you deploy Office 2013

    • Volume Activation Management Tool

    • The Backstage view

    • The ospp.vbs script

Important:

Because different products require different MAK keys, you should first verify that the MAK key for the product is correct.

Use Office Customization Tool (OCT) to activate n MAK client

To enter a MAK by using the OCT, follow these steps:

  1. In the Type a valid 25-character volume license key with no spaces field, enter the MAK key (five sets of five numbers or characters), and then press ENTER.

  2. After making any other necessary changes in the OCT, save the .msp file and place the file in the Updates folder.

Note:

When you use a MAK key in the OCT, you can activate Office 2013 while you install the MAK key by setting the AUTO_ACTIVATE property value to 1. For more information, see Licensing and user interface in Office Customization Tool (OCT) reference for Office 2013.

Remember that you do not have to enter a product key in the OCT if you are using KMS activation. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Config.xml file

To enter a MAK by using the Config.xml file, follow these steps:

  1. Add the following line to the Config.xml file:

    <PIDKEY Value="AAAAABBBBBCCCCCDDDDDEEEEE" />

    Where AAAAABBBBBCCCCCDDDDDEEEEE is the 25-character product key.

  2. To apply the settings in Config.xml, at a command prompt, type the following command, and then press ENTER:

    Setup.exe /config <path of Config.xml file>

Note:

You can activate Office 2013 while you install the MAK key by setting the AUTO_ACTIVATE property value to 1. For more information, see Setting element in Config.xml file reference for Office 2013.

You do not have to enter the MAK key in the Config.xml file if you are using KMS activation. For more information about how to use the Config.xml file, see Config.xml file reference for Office 2013.

Volume Activation Management Tool

If you have to change the product key on Office 2013 clients after installation, we recommend that you use Volume Activation Management Tool (VAMT) 3.0. For more information about VAMT 3.0, see Volume Activation Management Tool (VAMT) 3.0 and Volume Activation Management Tool Technical Reference

The Backstage view

This method lets you change the product key on one computer at a time. If you want to change multiple computers, follow these steps:

  1. Open an Office 2013 application.

  2. Choose the File tab.

  3. Choose Help.

  4. Choose Change Product Key and enter the product key.

Note:

An administrator can create a registry key that allows a standard user (a user who is not an administrator) to apply a MAK key and activate an Office 2013 application. This means that a standard user can switch a KMS client to MAK activation, manually activate a computer, and, if it is necessary, replace an existing MAK with a new MAK key. By default, all volume license editions of Office 2013 disable this behavior. To enable this behavior, add the following line to the Config.xml file:

<Setting Id="USEROPERATIONS" Value="1" />

Or, you can set the following registry key to enable or disable standard user (a user who is not an administrator) activation:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform]

Enable Standard User Activation: "UserOperations"=dword:00000001
Disable Standard User Activation: "UserOperations"=dword:00000000 (Office 2013 volume license products default setting)

The ospp.vbs script

For information about how to enter a product key by using the ospp.vbs script, see Configure client computers for volume activation in Office 2013.

Rearm the Office installation

There is a 25-day grace period from the time of installation of KMS clients before notifications to activate are displayed to the user. If you want to deploy an image, you must rearm your Office 2013 installation before you capture the image. If you do not rearm, users see notification dialog boxes at the time that the image is deployed, instead of 25-days after deployment. The 25-day grace period gives ample time for a KMS host to be found and activation to succeed. If activation is successful, users do not see notifications to activate.

Rearming is important for these reasons:

  • The grace timer is reset to 30 days of grace.

  • The grace timer is frozen until either an Office application is run, or the ospp.vbs script is run.

  • The client machine ID (CMID) is reset.

    • The KMS host uses the CMID to determine the number of unique clients.

    • To check the CMID, use the command ospp.vbs /dcmid.

Rearm is also recommended for MAK deployment. If you are deploying Office 2013 that is configured for MAK activation, and you do not remotely activate for end-users through VAMT or ospp.vbs, users see an activation dialog box the first time that an Office 2013 application starts. The activation dialog box is slightly different 25 days after installation. Also, users might immediately see a red title bar if Office 2013 was not rearmed before image capture.

To rearm your Office installation

  1. Make sure all Office 2013 applications are closed.

  2. Open command prompt with administrative permissions.

  3. Go to %installdir%\%Program Files%\Microsoft Office\Office15. If you installed the 32-bit edition of Office 2013 on a 64-bit operating system, %Program Files% is the Program Files (x86) folder.

  4. At the command prompt, type ospprearm.exe. If the rearm succeeds, the following message displays: "Microsoft Office rearm successful."

    Note:

    You can rearm 5 times, unless you activate Office by using a KMS host. If you run out of rearms, activating by using a KMS host lets you rearm one time.

  5. Capture the image or save the virtual machine. For more information about how to capture the image, see Configure Office 2013 for a hard disk image.

    Important:

    Do not open an Office application or run ospp.vbs, or anything related to Office 2013 while the image is being captured. Otherwise, the grace timer starts.

See also

Volume Activation Management Tool (VAMT) 3.0

Plan volume activation of Office 2013
Volume activation methods in Office 2013
Configure client computers for volume activation in Office 2013
Office Customization Tool (OCT) reference for Office 2013
Customize Setup before installing Office 2013
Config.xml file reference for Office 2013

Active Directory-Based Activation Overview
Volume Activation Management Tool Technical Reference
Configure Office 2013 for a hard disk image
Configure Office 2013 for capturing an image
Volume Activation Planning Guide
Windows Volume Activation Deployment Guide

Change History

Date | Description
April 09, 2013 | Updated the example output of the slmgr.vbs /dlv command (near the end of the article) so that it shows the output for Office 2013.
August 28, 2012 | Initial publication


Configure client computers for volume activation in Office 2013

Published: October 16, 2012

Summary: Details the Office Software Protection Platform script (ospp.vbs) and describes the Volume Activation Management Tool (VAMT) for Windows Installer-based (MSI-based) versions of Office 2013.

Applies to: Office 2013

Audience: IT Professionals

The Office Software Protection Platform script (ospp.vbs) and the Volume Activation Management Tool (VAMT) tools can help you configure and test Volume License editions of Office 2013. Before you read this article, we recommend that you read Volume activation methods in Office 2013, Plan volume activation of Office 2013, and Deploy volume activation of Office 2013.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription.

In this article:

  • Tips for configuring KMS clients and hosts

  • The ospp.vbs script

  • Volume Activation Management Tool (VAMT)

Tips for configuring KMS clients and hosts

Generally, you do not have to configure Office KMS clients if the Office KMS host was correctly set up and configured. The KMS client automatically searches for the KMS host by using DNS and then attempts activation. The KMS service uses service (SRV) resource records (RR) in DNS to store and communicate the locations of KMS hosts.

By default, KMS hosts automatically publish the information that KMS clients need to find and connect to them by using DNS dynamic update protocol. By default, KMS clients query the DNS server for KMS service information.

You can manually configure KMS hosts and clients, depending on the network configuration and security requirements. For example, if the network environment does not use SRV records, you can manually configure a KMS client to use a specific KMS host. For more information about how to configure the KMS client, see The ospp.vbs script later in this article and Prepare and configure the Office 2013 client in Deploy volume activation of Office 2013. For more information about how to configure the KMS host, see Prepare and configure the KMS host in Deploy volume activation of Office 2013.

The ospp.vbs script

The Office Software Protection Platform script (ospp.vbs) enables you to configure volume editions of Office 2013 client products. You must open a command prompt by using administrator permissions and navigate to the folder that contains the script. The script is located in the %installdir%\Program Files\Microsoft Office\Office15 folder. If you are running 32-bit Office 2013 on a 64-bit operating system, the script is located in the %installdir%\Program Files (x86)\Microsoft Office\Office15 folder.

Running ospp.vbs requires the cscript.exe script engine. To see the Help file, type the following command, and then press ENTER:

cscript ospp.vbs /?

The general syntax is as follows:

cscript ospp.vbs [Option:Value] [ComputerName] [User] [Password]

Option Specifies the option and value to use to activate a product, install or uninstall a product key, install and display license information, set Key Management Service (KMS) host name and port, and remove KMS host. The options and values are listed in the tables in this section.

ComputerName Name of the remote computer. If a computer name is not provided, the local computer is used.

User Account that has the required permission on the remote computer.

Password Password for the account. If a user account and password are not provided, the current credentials are used.

Important:

Before you run ospp.vbs, be sure that:

  • The Windows firewall allows Windows Management Instrumentation (WMI) traffic on the remote computer.

  • You have credentials that have the required permissions on the remote computer, or you can pass credentials that have the required permissions to the remote computer.

  • The cmd.exe command is elevated. On the cmd.exe interface short-cut menu (right-click), choose Run as administrator.

The following table describes the ospp.vbs global options.

Global options for ospp.vbs

Global option | Description
/act | Activates installed Office 2013 product keys.
/inpkey:value | Installs a product key (replaces existing key) with user-provided product key. Value option is required.
/unpkey:value | Uninstalls an installed product key with the last five digits of the product key to uninstall (as displayed by the /dstatus option). Value parameter is required.
/inslic:value | Installs a license with user-provided path of the .xrm-ms license. Value parameter is required.
/dstatus | Displays license information for installed product keys.
/dstatusall | Displays license information for all installed licenses.
/dhistoryacterr | Displays the failure history for MAK/Retail activation.
/dinstid | Displays Installation ID for offline activation.
/actcid:value | Activates product with user-provided Confirmation ID. Value parameter is required.
/rearm | Resets the licensing status for all installed Office 2013 product keys.
/rearm:value | Resets the licensing status for an Office 2013 license with a user-provided SKUID value. Value parameter is required. Use this option with the SKUID value specified by using the /dstatus option if you have run out of rearms and have activated Office through KMS or AD-based activation to gain an additional rearm.
/ddescr:value | Displays the description for a user-provided error code. Value parameter is required.

The following table describes the ospp.vbs options for configuring the KMS client.

KMS client options for ospp.vbs

KMS client option | Description
/dhistorykms | Displays KMS client activation history.
/dcmid | Displays KMS client machine ID (CMID).
/sethst:value | Sets a KMS host name with a user-provided host name. Value parameter is required. This sets HKLM\Software\Microsoft\OfficeSoftwareProtectionPlatform\KeyManagementServiceName (REG_SZ).
/setprt:value | Sets a KMS port with a user-provided port number. Value parameter is required. This sets HKLM\Software\Microsoft\OfficeSoftwareProtectionPlatform\KeyManagementServicePort (REG_SZ).
/remhst | Removes KMS host name (sets port to default).
/cachst:value | Allows or denies KMS host caching. Value parameter is required (TRUE or FALSE).
/actype:value | (Windows 8 and newer versions only) Sets volume activation type. Value parameter is required. Values: 1 (for Active Directory-Based), 2 (for KMS). 0 (for both).
/skms-domain:value | (Windows 8 and newer versions only) Sets the specific DNS domain in which all KMS SRV records can be found. This setting has no effect if the specific single KMS host is set by the /sethst option. Value parameter is the Fully Qualified Domain Name (FQDN) and is required.
/ckms-domain | (Windows 8 and newer versions only) Clears the specific DNS domain in which all KMS SRV records can be found. The specific KMS host is used if it is set by the /sethst option. Otherwise, auto-discovery of the KMS host is used.

Scenarios that use ospp.vbs

The following scenarios assume that you are running ospp.vbs in an elevated command prompt.

Note:

Any changes that you make affect only the Office 2013 client products. You have to configure the Windows client separately by using the slmgr.vbs script. For more information about how to use slmgr.vbs, see Deploy volume activation of Office 2013.

To change the product key to a MAK key on a remote computer

  1. If the remote computer is named contoso1, run the following command to enter the product key. This assumes that you have administrator credentials on the remote computer. If your credentials on the remote computer differ from your logon name and password, you must type your logon name and password at the command line, and then press ENTER:

    cscript ospp.vbs /inpkey:xxxxx-xxxxx-xxxxx-xxxxx-xxxxx contoso1

  2. To activate the remote computer, type the following command, and then press ENTER:

    cscript ospp.vbs /act contoso1

To diagnose KMS activation errors

  1. If the computer has the KMS client key installed, check the licensing status. To do this, type the following command, and then press ENTER:

    cscript ospp.vbs /dstatusall

  2. To check the KMS activation history, type the following command, and then press ENTER:

    cscript ospp.vbs /dhistorykms

  3. To trigger activation, type the following command, and then press ENTER:

    cscript ospp.vbs /act

  4. Check the error message for error code 0xC004F042. If in the notification dialog boxes, you see an error code that is shown to users, you can also use that code to check the error message. To do this, type the following command, and then press ENTER:

    cscript ospp.vbs /ddescr:0xC004F042

To set test KMS host name, and then set to auto-discovery

  1. If you are testing a KMS host named kmstest.contoso.com, and you want to specify it in the KMS client, type the following command, and then press ENTER:

    cscript ospp.vbs /sethst:kmstest.contoso.com

    Note:

    If you change the default port on the KMS host, you must run ospp.vbs with the /setprt option.

    For example: cscript ospp.vbs /setprt:1750

  2. To trigger activation, type the following command, and then press ENTER:

    cscript ospp.vbs /act

  3. To check the KMS activation history to see whether the host was successfully contacted, type the following command, and then press ENTER:

    cscript ospp.vbs /dhistorykms

  4. Now you want this KMS client to use Domain Name System (DNS) for auto-discovery of the production KMS host. To remove the KMS host name, type the following command, and then press ENTER:

    cscript ospp.vbs /remhst

Volume Activation Management Tool (VAMT)

Volume Activation Management Tool (VAMT) 2.0 and VAMT 3.0 provide a graphical user interface to manage volume activation. In addition to the operating systems under which VAMT 2.0 runs, VAMT 3.0 can run under Windows 8 and Windows Server 2012. For more information about VAMT 2.0, see Volume Activation Management Tool (VAMT) 2.0 and the Help file that is included with VAMT 2.0. For more information about VAMT 3.0, see Volume Activation Management Tool (VAMT) 3.0 and Volume Activation Management Tool Technical Reference.

See also

Volume Activation Management Tool (VAMT) 3.0

Volume activation methods in Office 2013
Plan volume activation of Office 2013
Deploy volume activation of Office 2013

Volume Activation Management Tool Technical Reference
Volume Activation Management Tool (VAMT) 2.0


Troubleshoot volume activation for Office 2013

Published: February 5, 2013

Summary: Explains how to troubleshoot common errors for KMS, MAK, or Active Directory-based activation of Office 2013.

Applies to: Office 2013

Audience: IT Professionals

You can learn to troubleshoot issues that you might encounter when you activate Office 2013. Before you read this article, we recommend that you first read Volume activation methods in Office 2013, Plan volume activation of Office 2013, Deploy volume activation of Office 2013, and Configure client computers for volume activation in Office 2013. In addition, for a good understanding of volume activation, we recommend that you read Volume Activation Overview.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription.

In this article:

  • KMS activation issues

    • The client activation request count on the Office 2013 KMS host is not high enough for client computers to activate

    • The Office 2013 KMS client does not activate

    • The KMS host is not activated

    • The KMS host cannot be reached

  • MAK activation issues

    • The Office 2013 client does not activate when it is connected to the network through an authenticated proxy

  • Activation error codes

  • General activation issues

    • Users see notifications to activate

    • Office 2013 Volume License Pack installation incorrectly says you've installed Preview

    • Licensing information is not updated in the Backstage view

    • Generic Volume License Keys (GVLKs) for Office 2013

KMS activation issues

The client activation request count on the Office 2013 KMS host is not high enough for client computers to activate

Relevant error code: 0xC004F038

The Office 2013 KMS host must receive activation requests from at least five Office 2013 KMS clients before KMS clients on that network can be activated. If the KMS host doesn't receive more than five requests, KMS clients won't be activated. If you deploy Office 2013 to more than five computers, their initial activation requests will be used to build up the count. If activation fails, the computers will try to activate Office two hours later. At that time, if the KMS host has a sufficient count, activation will be successful. To trigger activation manually on the KMS client, run ospp.vbs /act. For more information about the ospp.vbs script, see Configure client computers for volume activation in Office 2013.

To determine the current count on the KMS host, at the command prompt (with administrator permissions), run the following command:

cscript slmgr.vbs /dlv 2E28138A-847F-42BC-9752-61B03FFF33CD

After Office 2013 is installed, the Office Software Protection Platform (OSPP) service automatically sends activation requests to the KMS host every two hours until activation occurs, regardless of whether Office 2013 is running. Once five of these KMS clients connect to the corporate network and successfully request activation against the KMS host, the KMS clients are activated. Clients that later connect to the corporate network are also activated. KMS clients that aren't on the corporate network (at home, for example) become activated as soon as they connect to the network.

The Office 2013 KMS client does not activate

There might be several reasons why the Office 2013 Key Management Service (KMS) client isn't activated. This section describes issues and how to resolve them.

The KMS host is not activated

Relevant error code: 0xC004F041

The KMS host must be activated first, and then you can activate the KMS clients. For more information, see Prepare and configure the KMS host in Deploy volume activation of Office 2013. On the Microsoft Office 2013 Volume License Pack website, download and run office2013volumelicensepack_en-us_x86.exe. Then, follow the steps in the Instructions section on the website.

Note:

When you enable the firewall on a KMS host, the default TCP communications port number is 1688.

If you use slmgr.vbs, you must activate the KMS host within the command and include the following Office 2013 activation ID:

cscript slmgr.vbs /ato 2E28138A-847F-42BC-9752-61B03FFF33CD

The KMS host cannot be reached

Relevant error code: 0xC004F041

If you want the KMS clients to use auto-discovery of the KMS host, review the Windows Volume Activation Deployment Guide to make sure that the DNS configuration is correct. Ensure that the KMS host has network connectivity, and that it is reachable by the KMS clients.

As a test on the KMS client, you might want to use ospp.vbs /sethst to specify the KMS host computer name. Then, run ospp.vbs /act to send an activation request directly to the KMS host. If this is successful, KMS host auto-discovery might be the issue. Remember to use ospp.vbs /remhst to remove the KMS host name after the test is completed.

MAK activation issues

The Office 2013 client does not activate when it is connected to the network through an authenticated proxy

Independent MAK activation requires an Internet connection. If the Office 2013 client is connected to the Internet through an authenticated proxy, you must activate the client over the telephone. For more information about how to resolve this issue, see Knowledge Base article 921471: Activation fails when you try to activate Windows over the Internet.

Activation error codes

Error codes help you troubleshoot activation issues. If a user sees a dialog box that contains an activation notification, an error code might be displayed at the lower corner of the dialog box. Another way to obtain an error code is to run ospp.vbs /act on the client computer to try to activate Office. If activation fails, an error code is reported. Use ospp.vbs /ddescr together with the appropriate error code to receive the error message. For more information about the ospp.vbs script, see Configure client computers for volume activation in Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

General activation issues

The following are general activation issues and their solutions.

Office 2013 Volume License Pack installation incorrectly says you've installed Preview

When you first install the Microsoft Office 2013 Volume License Pack, you may see a dialog box that is labeled Microsoft Office 2013 Volume License Pack Preview. "Preview" is incorrect: the final release Office 2013 version is installed correctly, and functionality isn't affected. A workaround isn't required.

Users see notifications to activate

An activation notification dialog box usually appears when a copy of Office 2013 isn't yet activated. An error code is displayed on the lower corner of the dialog box to help you troubleshoot activation issues. No dialog box is shown until 25 days after installation, at which time the user sees a notification dialog box. If Office 2013 has not been activated 30 days after installation, the notification dialog box contains a red title bar.

When you install Office 2013, you must activate it by using either a Multiple Activation Key (MAK) or a Key Management System (KMS) key that is connected to a KMS host on the intranet.

If you install a MAK key, you must activate Office 2013 online.

The Office 2013 client software includes an embedded KMS client key. After the Office 2013 KMS client automatically discovers the Office 2013 KMS host on the intranet, and at least five Office 2013 KMS clients have already requested activation from the KMS host, the KMS client is automatically activated.

Licensing information is not updated in the Backstage view

To display licensing information, on the File menu, choose Account. You must restart the Office 2013 applications for the licensing information to be updated. For example, if you open Word 2013 and then choose Account on the File menu, you might see that product activation is required. If you activate by using ospp.vbs /act or Volume Activation Management Tool (VAMT), you must restart Word 2013 to see that the product is activated, even though Office 2013 is in the licensed state. For more information about the ospp.vbs script, see Configure client computers for volume activation in Office 2013.

Generic Volume License Keys (GVLKs) for Office 2013

All Office 2013 volume products have a Generic Volume License Key (GVLK) preinstalled to activate against an Office 2013 KMS host. If you entered a MAK key for a product and you want to change the activation method back to KMS, use the appropriate the KMS client key that is shown in the table later in this article. The recommended way to enter the key is by using VAMT. You can also use ospp.vbs /inpkey to enter the key. For more information about the ospp.vbs script, see Configure client computers for volume activation in Office 2013.

For Office 2013 suites, only one key is required for all the products in the suite. For example, if you use Office Professional Plus, you must enter only the Office Professional Plus 2013 key for the complete suite.

The following table shows the KMS client keys for the Office 2013 suites and stand-alone products.

Suites |  |
 | Office 2013 Professional Plus | YC7DK-G2NP3-2QQC3-J6H88-GVGXT
 | Office 2013 Standard | KBKQT-2NMXY-JJWGP-M62JB-92CD4
Stand-alone products |  |
 | Access 2013 | NG2JY-H4JBT-HQXYP-78QH9-4JM2D
 | Excel 2013 | VGPNG-Y7HQW-9RHP7-TKPV3-BG7GB
 | InfoPath 2013 | DKT8B-N7VXH-D963P-Q4PHY-F8894
 | Lync 2013 | 2MG3G-3BNTT-3MFW9-KDQW3-TCK7R
 | OneNote 2013 | TGN6P-8MMBC-37P2F-XHXXK-P34VW
 | Outlook 2013 | QPN8Q-BJBTJ-334K3-93TGY-2PMBT
 | PowerPoint 2013 | 4NT99-8RJFH-Q2VDH-KYG2C-4RD4F
 | Project 2013 Professional | FN8TT-7WMH6-2D4X9-M337T-2342K
 | Project 2013 Standard | 6NTH3-CW976-3G3Y2-JK3TX-8QHTT
 | Publisher 2013 | PN2WF-29XG2-T9HJ7-JQPJR-FCXK4
 | Visio 2013 Professional | C2FG9-N6J68-H8BTJ-BW3QX-RM3B3
 | Visio 2013 Standard | J484Y-4NKBF-W2HMG-DBMJC-PGWR7
 | Word 2013 | 6Q7VD-NX8JD-WJ2VH-88V73-4GBJ7

See also

Volume activation methods in Office 2013
Plan volume activation of Office 2013
Deploy volume activation of Office 2013
Configure client computers for volume activation in Office 2013

Volume Activation Overview


Customize installations of Office 2013

Published: July 16, 2012

Summary: Find articles that will help you learn how to customize a client installation of Office 2013.

Applies to: Office 2013

Audience: IT Professionals

Office 2013 logo The following table includes links to articles about the customization process and about how to customize specific installations of Office 2013.

Articles about how to customize Office 2013

Article | Description
Use the OCT to customize Office 2013 | Explains how to use the Office Customization Tool (OCT) to customize Windows Installer-based Office 2013 installations.
Customize Setup before installing Office 2013 | Provides information about how to use the Office Customization Tool (OCT) to customize a Windows Installer-based installation of Office 2013.
Configure feature installation states for Office 2013 | Explains how to use the Office Customization Tool (OCT) to specify how Office 2013 features are installed for Windows Installer-based Office 2013 installations.
Configure user settings for Office 2013 | Explains how to use the Office Customization Tool (OCT) to configure user and computer default settings before you deploy Office 2013.
Configure a silent installation of Office 2013 | Provides information about how to configure a silent installation of Windows Installer-based (MSI) Office 2013.
Create custom configurations of Office 2013 | Provides information about how to customize an Office 2013 Windows Installer-based (MSI) installation by using the Office Customization Tool (OCT) and the Config.xml file.
Office Customization Tool (OCT) reference for Office 2013 | Provides information about how to use the Office Customization Tool to customize Windows Installer-based Office 2013 installations.
Config.xml file reference for Office 2013 | Provides information about how to use the Config.xml file to customize Windows Installer-based Office 2013 installations.
Setup command-line options reference for Office 2013 | Provides information about Setup.exe command lines for Windows Installer-based Office 2013.
Setup properties reference for Office 2013 | Provides information about the Windows Installer properties that are available for Windows Installer-based Office 2013 installations.
Overview of Setup architecture for Office 2013 | Provides information about the Windows Installer-based Office 2013 Setup architecture.
Customize the Accessibility Checker for Office 2013 | Provides information about how to use Group Policy settings to control what the Accessibility Checker checks for when it runs on Office 2013 files.


Overview of Setup architecture for Office 2013

Published: July 16, 2012

Summary: Provides information about the Windows Installer-based Office 2013 Setup architecture.

Applies to: Office 2013

Audience: IT Professionals

The Setup architecture in Office 2013, introduced in Microsoft Office 2007, streamlines all aspects of installing, customizing, and maintaining Office.

The Setup program unifies and manages the complete installation process. This includes customizing users' Office configuration, deploying multiple languages at the same time, and applying software updates to new installations. This article provides an overview of the Setup architecture, Setup sequence of events, language-neutral design and deployment of multiple languages, customization methods, required local installation source, and updates process.

The Setup architecture helps administrators manage tasks such as the following more efficiently:

  • Deployment process so that Office is installed in the most efficient way for their environment.

  • Customization of Office so that users get optimal configuration on their computers.

  • Deployment of language-specific features for users who are located in offices around the world.

  • Deployment of Office in a way that makes future maintenance, such as software updates, as efficient as possible.

In versions of Office earlier than Office 2007, a single Office product such as Microsoft Office Standard was contained in a single Windows Installer (MSI) file. An MSI file is a relational database that Windows Installer uses to install a product. As with the Office 2007 and Office 2010, the Office 2013 products consist of multiple MSI files, and no single MSI file represents a complete product. A language-neutral core package (MSI file) is combined with one or more language-specific packages to make a complete product. For example, an Office product such as Office Professional Plus 2013 consists of the core package plus one or more language-specific packages. Setup assembles the individual packages, orchestrates a seamless installation, and handles customization and maintenance tasks during and after installation of Office on users' computers.

Office 2010 introduced native 64-bit versions of Office products to support 64-bit processors, which are becoming the standard for systems ranging from servers to desktop computers. Office 2013 also provides support for 32-bit Office 2013 applications that run on 64-bit Windows operating systems by using Windows-32-on-Windows-64 (WOW64). WOW64 is the x86 emulator that enables 32-bit Windows-based applications to run seamlessly on 64-bit Windows. Office 2013 lets users continue to use existing third-party Office add-ons, which are primarily 32-bit because no 64-bit versions are available yet for many add-ons. Providing support for 32-bit Office 2013 that runs on 64-bit operating systems prevents the 32-bit add-ons from being blocked. For more information about 64-bit editions of Office 2013, see 64-bit editions of Office 2013.

In this article:

  • Setup process

  • Language-neutral design

  • Streamlined customization model

  • Required local installation source

  • Consolidated update process

Setup process

Typically, the first step in a corporate installation of Office is to create a network installation point, a task as easy as copying all files and folders from the Office product CD to a shared network location. At a minimum, the network installation point contains the language-neutral core package plus language-specific folders for one language. This installation point serves as the initial source for all users who install Office.

In the simplest scenario, you deploy an Office product from the network installation point with one language version and a single set of customizations for all users. Setup handles this scenario automatically. If you deploy multiple products or languages, you can add them to the same network installation point and specify exactly which products and languages to include in the installation. In all these scenarios, Setup performs the same tasks to assemble the correct set of MSI files and complete the installation.

Note:

The Office 2013 does not let you create an administrative installation point by running Setup with the /a command-line option to extract compressed source files, as was possible with Office versions earlier than the 2007 Office system. All installations now occur from the compressed source.

Setup sequence of events

The basic Setup sequence of events is as follows and occurs in the same order in every deployment scenario:

  1. Run Setup.

  2. Check prerequisites.

  3. Read XML data.

  4. Build the feature tree.

  5. Create a local installation source on the user's computer.

  6. Install Office.

  7. Apply the customization file.

  8. Apply software updates.

Run Setup

Setup.exe is the program that begins all the mechanisms of the installation process. It is located at the root of the network installation point. You run Setup one time for each Office product that you install. When it runs, Setup searches the network installation point for an Office product to install. If the installation point contains more than one Office product, Setup gives the user a choice of products to install.

You can circumvent the selection process and determine which Office product is installed by pointing Setup.exe to the Config.xml file in a core product folder. For example, if you want to install Office Professional Plus 2013, you can use the following command line:

\\server\share\Office15ProPlus\setup.exe /config \\server\share \Office15ProPlus\Pro.WW\Config.xml

where Office15ProPlus is the root of the network installation point.

In versions of Office earlier than Office 2007, Setup.exe called Windows Installer (Msiexec.exe) to install Office. Although Setup still uses Windows Installer, Setup bypasses the Windows Installer executable program. The Msiexec.exe command line cannot be used to install the Office 2013 (or Office 2007 or Office 2010).

Note:

This version of Setup.exe recognizes only a few command-line options.

Check prerequisites

When Setup starts, it checks for several installation prerequisites. This includes minimum operating system requirements and administrative permissions. A user must be an administrator of the client computer to install Office, or you must use a tool such as Microsoft System Center 2012 Configuration Manager to run the installation by using elevated permissions.

When you run Setup.exe from the x64 folder, Setup determines whether there are 32-bit Office applications installed. If Setup detects 32-bit Office applications, it displays an error message that informs users that they must first uninstall all 32-bit Office applications if they want to continue with the installation of Office 2013 64-bit. The error lists the installed 32-bit Office applications. If Setup does not detect 32-bit Office applications, it installs the 64-bit edition of Office 2013.

When you run Setup.exe from the x32 folder, Setup determines whether there are 64-bit Office 2013 applications installed. If Setup detects 64-bit Office 2013, an error message is displayed and Setup is blocked. If Setup does not detect 64-bit Office 2013, it installs the 32-bit edition of Office 2013. For more information, see Setup process in 64-bit editions of Office 2013.

Note:

To install Office on computers where users lack administrative permissions, you must run Setup in a context that provides it with administrative permissions. After Office is installed, users who do not have administrative permissions can run all installed features. This includes installing features on demand.

For example, in organizations where users are not the administrators of their computers, administrators can use the following methods of providing Office Setup with the appropriate permissions:

  • Log on to the computer as an administrator and install Office 2013.

  • Use a software management tool, such as Microsoft Systems Management Server or System Center 2012 Configuration Manager.

  • Deploy Office 2013 to computers by using Group Policy computer startup scripts.

Read XML data

Setup collects information about each package on the installation point, collects default settings for the installation, and incorporates customizations that you specify. Setup collects all this information in the form of XML data from several sources:

  • Setup.xml and Package.xml files for each package Each folder on the installation point — both the folder for the language-neutral core package and the folder for each language-specific package — contains a Setup.xml and a Package.xml file (for example, ProPlusWW.xml for Office Professional Plus 2013). Information in these files enables Setup to do the following:

    • Identify a product and the available languages for that product.

    • Match language-neutral and language-specific elements to create complete features.

    • Build a consolidated feature tree.

    • Collect the set of MSI files that are required for the installation.

    Note:

    The Setup.xml and Package.xml files are signed and cannot be changed. Altering these files causes Setup to fail.

  • Setup customization file Early in the installation process, Setup determines whether you have specified a Setup customization file (.msp file) for the product that is being installed. A Setup customization .msp file is created when administrators use the Office Customization Tool (OCT) to customize an installation of Office 2013. The OCT is part of the Setup program and is the recommended tool for most customizations. The customization file contains all the modifications that you specify for an installation. This includes customizations that control the installation process.

    The OCT is available in volume licensed versions of Office 2013, Office 2010, and Office 2007. To determine whether your Office 2013 installation is a volume licensed version, check the Office 2013 installation disk to see whether it contains a folder that is named Admin. If the Admin folder exists, the disk is a volume license edition; otherwise, the disk is a retail edition.

    If no customization file is specified on the command line or in the Config.xml file, Setup searches the Updates folder on the installation point for a customization file that is specific to the product that is being installed. By default, the Updates folder is included on the installation point. In most cases, it is the recommended location in which to store both a Setup customization .msp file and software updates for all the Office products included on the installation point.

    Important:

    If you plan to deploy multiple Setup customization files (.msp files), you can place only one customization .msp file in the Updates folder for each Office 2013 product that you are installing during the initial installation. Only one Setup customization .msp file (patch) for each Office 2013 product that you are installing is supported in the Updates folder. You must deploy the rest of the customization .msp files for a product after the first Office installation is completed.

    If you are deploying multiple Office 2013 products, such as Office Professional Plus 2013 and Visio Professional 2013, you can include one customization .msp file for Office Professional Plus 2013 and one customization .msp file for Visio Professional 2013 in the Updates folder. The customization .msp files that you place in the Updates folder will be deployed first. Therefore, they must include any Setup customizations that cannot be changed after the installation, for example, the installation location.

    If you are deploying an initial installation of Office 2013 and you also want to deploy Office 2013 software updates, such as service packs and hotfixes, Setup can apply the product updates as part of the installation process. You can place the Office 2013 product updates in the Updates folder. In scenarios such as this where the Updates folder includes both one Setup customization .msp file and product updates, Setup applies only the Setup customization .msp file during the initial installation The product updates are applied after the installation is complete.

    Setup uses XML data that is appended to the customization file to determine how to install the product. For example, it determines whether to run quietly and which features to display in the feature tree. Settings in a customization file overwrite default settings contained in the Setup.xml and Package.xml files.

    For more information about Setup customization files, see Streamlined customization model. For information about how to use the OCT, see Office Customization Tool (OCT) reference for Office 2013.

  • Config.xml file Each core product folder contains a Config.xml file that directs Setup to install that product. You can edit Config.xml to customize the installation process. For example, you can use elements in Config.xml to specify which products or languages to include in the installation. Settings in Config.xml take precedence over settings in a customization file and default settings that are contained in the Setup.xml and Package.xml files.

    For more information about how and when to edit Config.xml, see Config.xml file reference for Office 2013.

Build the feature tree

Setup uses the information that is contained in the XML files to create a single feature tree that includes all available applications and features in the product. You view the feature tree and specify which applications and features to install on users' computers by using the Office Customization Tool. If you let users run Setup interactively, they view the feature tree, which includes your modifications, in the Setup user interface.

Create a local installation source on the user's computer

Setup calls a program named Office Source Engine (Ose.exe) to create a required local installation source (LIS) on the user's computer. To create the local installation source, Setup copies files from the installation point to a hidden folder on the user's computer. The default location is \MSOCache\All Users at the root of the drive on which Office is installed. Later, Setup uses Windows Installer to install Office from this local installation source.

The local installation source provides several important benefits:

  • After Office is installed, Setup can repair, reinstall, or add Office features by using the local source.

  • Users who apply software updates are less likely to be prompted for a network or CD source because an installation source is available locally.

  • You can deploy the local installation source in advance and trigger the installation of Office on users' computers later to reduce the load on the network. In this scenario, you can even run Setup from the local installation source. This lets users complete the Office installation without using a network connection.

For more information about the local installation source, see Required local installation source.

Install Office

When the installation starts, Setup checks for required disk space and feature dependencies, and then calls Windows Installer to install the correct set of packages (MSI files) on the user's computer from the local installation source. Setup uses the XML data that was described previously to determine which set of MSI files to include. The progress bar that Setup displays to users during the installation takes the whole installation process into consideration. This includes applying customizations and software updates from the Updates folder.

Note:

Although Setup uses Windows Installer to install Office, Windows Installer alone cannot install the individual MSI files independent of Setup.

Apply the customization file

During the installation process, Setup applies the customization file to the user's configuration. The result resembles the effect of applying a Windows Installer transform (MST file) in earlier versions of Office: your customizations become the default configuration for users. In addition to the XML data that customizes the installation process, the customization file might include default user settings, feature installation states, Outlook profiles, and other modifications to the user's configuration.

Customization files are product-specific; Setup applies only those files that are relevant to the product being installed.

Note:

If you plan to deploy multiple Setup customization .msp files (patches), you can place only one Setup customization .msp file for each Office 2013 product in the Updates folder for an initial installation. You must deploy the rest of the customization .msp files after the Office installation is complete. Only one customization file for each product patch in the Updates folder is supported. The customization .msp file that you place in the Updates folder will be deployed first. Therefore, it must include any Setup customizations that cannot be changed after the installation, for example, the installation location.

If you create different configurations for different groups of users, we recommend that you store the customization files in another location and then use the /adminfile option on the Setup command line to specify the file that you want. For example:

\\server\share\Office15\setup.exe /adminfile \\server\share\Office15\MyUpdates\Engineering.msp

where Office15 is the root of the network installation point.

Note:

When you precache the local installation source, Setup copies the Updates folder from the network installation point to the local installation source. In this manner, your customizations can be included in offline installation scenarios. This is the only circumstance in which Setup caches the customization file on the local computer before the installation.

For more information, see Precache the local installation source for Office 2010. The information also applies to Office 2013.

Apply software updates

At the end of the installation process, Setup checks the Updates folder on the installation point for software updates (.msp files). Unlike Setup customization files that you create by using the Office Customization Tool, software updates are distributed by Microsoft to enhance the product.

If you are deploying Office to users and you also have to deploy a set of software updates, Setup can apply the updates as part of the initial installation process. Costing (estimated required disk space) and progress bar indicators all take this step of the installation process into consideration. From a user's perspective, the complete process is a single event. This model preserves the original installation point and still lets you give new users the most up-to-date version of the product.

Note:

The Updates folder is used only for initial or new installations of Office 2013. The Updates folder can contain only one Setup customization .msp flle, and multiple service packs and hotfixes that are in .msp format only.

For more information about the software update process, see Consolidated update process.

Including more than one product on the installation point

If the network installation point contains more than one Office 2013 product, Setup searches all folders and subfolders for Config.xml and Setup.xml files and then prompts the user to select a product to install.

If you are installing more than one Office product, it is more efficient to store all the products on the same installation point and then customize Setup to install a specific Office product on users' computers.

Note:

When you copy multiple Office products to the same installation point, you might be prompted to overwrite shared Setup files. Because these files are duplicated among all Office 2013 products, you do not have to recopy any of the duplicate folders. When you are prompted to overwrite duplicate Setup files, choose No. This efficient design saves space and ensures consistency when you create and replicate network installation points.

Running Setup interactively

You can choose to run the installation quietly so that users see little or none of the process. However, if you let users view the Setup user interface, the choices that you make affect several aspects of Setup behavior. For example:

  • If more than one Office product is available on the installation point and a user runs Setup.exe without command-line options, Setup gives the user a choice of products to install.

  • If more than one language is available on the installation point, Setup matches the language of Office to the Windows user locale on the user's computer. This is by default. However, if a user selects the Customize installation option, the Languages tab in the Setup interface gives the user a choice of all available languages on the network installation point.

  • If you enter a product key and accept the Microsoft Customer License Terms in the customization file or Config.xml, those Setup screens are not displayed to the user during Setup.

    Note:

    A product key entry is not required for enterprise deployments that use Key Management Service (KMS) activation because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products that are licensed under Microsoft Volume Licensing programs. A prompt for a product key does not occur for Volume License editions of Office 2013, even when Setup runs in interactive mode. For more information about volume activation, see Plan volume activation of Office 2013.

  • If you use a customization file to hide and lock certain features, those features are not displayed in the feature tree.

To learn more about how to customize display settings, see Customize Setup before installing Office 2013.

Language-neutral design

In Office 2013 (and in Office 2010and Office 2007), an Office product such as Office Professional Plus 2013 is organized as follows:

  • Language-neutral elements are grouped in one core package (MSI file).

  • Language-specific elements are organized in separate packages by application.

This arrangement of files simplifies international deployments. The most basic installation of an Office product consists of the core package plus one language. Adding more languages is as easy as copying additional Single Language Packs (SLPs) to the network installation point — all work with the core product in exactly the same way. All language versions of Office, including the English version, are deployed in the same manner. Setup combines the language-neutral core package with the language-specific packages in a seamless installation process.

Important:

The current Office 2013 release includes English, Japanese, and Spanish language sources only. Later releases will provide additional languages.

Language versions of Office

Every Office product must include at least one set of language-specific packages. You cannot deploy just the core package (MSI file) by itself. On the Office product CD and the network installation point, these language packages are contained in folders. Each folder name includes a language tag, in the form ll-cc (for example, en-us for English U.S.), that identifies the language. Each folder also contains a set of installation files.

For example, the Office Professional Plus 2013 product is spread out among the files in these folders. Elements that are not specific to any language, such as Winword.exe (the executable file for Word 2013), are located in the core ProPlus.WW package. Other elements, such as Help and the user interface for Word 2013, are located in the appropriate language-specific package for Word or for shared Office features.

Both language-neutral and language-specific elements are required to make a functionally complete feature. Winword.exe by itself does not represent a Word application that anyone can use. Similarly, the core Office Professional Plus 2013 MSI file in the ProPlus.WW folder does not represent a complete Office product.

Setup assembles all these parts into a whole product. The Package.xml and Setup.xml files in each folder contain information that Setup uses to assemble complete features, build a consolidated feature tree, and collect the correct set of MSI files for the installation. After collecting the XML data and assembling the required MSI files, Setup uses Windows Installer to install Office on the user's computer. From a user's perspective, this process happens automatically and seamlessly.

You cannot deploy a specific application in Office 2013 by detaching the language-specific folder that contains the individual MSI file, such as the Word.en-us folder. However, you can determine which applications and features are installed on users' computers by customizing the installation.

Note:

None of the MSI files on an Office installation point can be installed independently by using Windows Installer or any other method. Also, none of the digitally signed XML files (Setup.xml and Package.xml) can be edited or altered. In Office 2013, Setup is required to collect the files and installation information and to orchestrate the installation process.

Language packs for Office

Language-specific packages are used in two contexts: in the language version of an Office product, and in the Single Language Pack (SLP) for that language. For example, the Japanese version of Office Professional Plus 2013 includes a language-specific folder for each application and for shared features in Office Professional Plus 2013. The same folders are included in the Japanese SLP, which includes language-specific folders for other products in Office 2013.

Language packs can be deployed as separate products, or they can be used to deploy an Office product in multiple languages. You are not required to enter a unique product key for language packs, whether you are deploying them separately or as part of the installation of another product.

Note:

In versions of Office earlier than the Office 2007, enterprise customers added languages by deploying Multilanguage User Interface (MUI) packs after a U.S. English version of Office was installed. Localized versions, such as the Japanese version of Office Standard Edition, were not identical to the core version with a Japanese MUI pack. This design was simplified and improved in Office 2007 and is the same in Office 2013 and Office 2010.

Streamlined customization model

In versions of Office earlier than Office 2007, several tools were required to customize Setup and to manage Office after installation. Office 2007 introduced a consistent, streamlined model. In Office 2013 (as in the Office 2007 and Office 2010), administrators can use Setup to install, customize, and manage Office. To enforce specific user and computer settings, administrators can use Group Policy (see Using Group Policy).

Using the Office Customization Tool

You customize an Office installation by using the Office Customization Tool, a component of Setup, which is included in volume licensed versions of Office 2013 client. Start the OCT by running Setup with the /admin command-line option. By using the OCT, create a Setup customization file (.msp file), which you place in the Updates folder in the network installation point. The Updates folder is used only for initial or new installations of Office 2013 (and Office 2010 and Office 2007), and only one customization patch in the Updates folder is supported.

A Setup customization file is an expanded form of a Windows Installer .msp file. Each file is configured for a specific product, such as Office Professional Plus 2013 or OneNote 2013. When you run Setup to install an Office product, Setup looks in the Updates folder for a customization file that corresponds to the product that you are installing. As Setup installs the product, it applies the customizations from this file.

You can create more than one Setup customization file to configure Office for different groups of users. When you run Setup, you specify the appropriate customization file to use for each installation by using the Setup command-line option /adminfile, or by using Config.xml (see Using the Config.xml file to customize Office).

For complete details on how to use the OCT to create a Setup customization file, see Office Customization Tool (OCT) reference for Office 2013.

Customizing a new installation

By using a Setup customization file that you create with the OCT, you can modify the way Setup installs Office on a user's computer the first time. For example, the OCT lets you customize Office in the following ways:

  • Direct Setup to run without user interaction (quietly).

  • Predefine the product key and accept the Microsoft Software License Terms on behalf of the user.

  • Specify where you want to install Office files on the user's computer.

  • Choose whether to remove earlier versions of Office before you install the Office 2013.

    Note:

    We recommend that enterprise customers first uninstall any earlier versions of Office before they install Windows Installer-based Volume License editions of Office 2013.

  • Determine which Office features are installed.

  • Specify the default values for many user options, including Outlook settings.

Note:

Office 2013 does not support side-by-side installations of 64-bit and 32-bit Office, including across applications. For example, there is no support for side-by-side installations of the 2007 Office system 32-bit with Office 2013 64-bit, or for Access 2013 64-bit and Excel 2013 32-bit. You cannot use the Office 2013 customization tools to configure side-by-side installations or customizations of 64-bit and 32-bit Office. For example, you cannot create a custom side-by-side installation by using 64-bit Office Professional 2013 and 32-bit Visio 2013 single image. For more information about 64-bit Office 2013, see 64-bit editions of Office 2013.

For information about how to customize Setup, see Customize Setup before installing Office 2013.

Making changes to an existing Office installation

If you have to change an existing Office installation, use the same tool that you used to customize the original installation: Run the OCT to update a Setup customization file or to create a new one. Then apply the customization file to the user's computer exactly as you would a software update. The user's existing Office installation will be updated with your customizations. This means that the customizations that are available when you install Office are also available when you change Office after installation.

Note:

There are some customizations that Setup applies only when you are installing Office for the first time. These include the following: specifying where you can install Office on the user's computer, defining the product key, and removing earlier versions of Office applications. The OCT identifies the customizations that apply only to a new installation.

Using the Config.xml file to customize Office

You can use the Config.xml file to change your Office installation. You can customize most of the same options that you can with the Office Customization Tool, including some additional options that are not available in the OCT.

Using the Config.xml file is the recommended method for performing the following installation tasks:

  • Instructing Setup to copy the local installation source to the user's computer without installing Office.

  • Specifying the path of the network installation point.

  • Selecting the product or language to install.

  • Changing where Setup looks for Setup customization files and updates.

  • Making last-minute or one-off customizations that do not warrant running the OCT to create a new customization file.

If you put the Config.xml file in the same folder as Setup.exe, Setup finds and uses the file. You can also specify the location of the file by using the /config Setup command-line option.

Note:

If you specify both a Setup customization file and the Config.xml file, the customizations that you define in Config.xml take precedence over the same customizations in the customization file.

For a complete description of the contents and format of the Config.xml file, see Config.xml file reference for Office 2013.

Using Setup command-line options

Setup recognizes only a few command-line options in the Office 2013. This is the same as for Office 2007 and Office 2010. The OCT is the primary tool to configure Setup properties and specify other customizations.

You can use Setup.exe commands to perform the following tasks:

  • Run the Office Customization Tool to create a Setup customization (.msp) file.

  • Apply the specified Setup customization file to the installation. For example, you can specify a path of a specific customization file (.msp file) or to the folder where you store customization files.

  • Specify the Config.xml file that Setup uses during the installation.

  • Run Setup in maintenance mode and change an existing Office installation.

  • Run Setup to repair the specified product from the user's computer.

  • Run Setup to remove the specified product from the user's computer.

For more information about the Setup.exe commands, see Setup command-line options for Office 2010. The information also applies to Office 2013. For information about Windows Installer properties that were used in earlier versions of Office, and about properties that can be used when you install Office 2013, see Setup properties in Office 2010. The information also applies to Office 2013

Using Group Policy

Administrators can use Group Policy settings to define and maintain an Office configuration on users' computers. Group Policy is used to configure the Office 2013 policy settings that are contained in Administrative Templates, and the operating system enforces those policy settings. In an Active Directory environment, administrators can apply policy settings to groups of users and computers in a site, domain, or organizational unit to which a Group Policy object is linked. True policy settings are written to the approved registry keys for policy, and these settings have access control list (ACL) restrictions that prevent people who are not administrator users from changing them. This allows administrators to create highly restricted or lightly managed configurations.

Administrators can use policy settings for the Office 2013 applications to manage most options that configure the Office user interface. These include the following:

  • Menu commands and their corresponding toolbar buttons

  • Shortcut keys

  • Most options in the Options dialog box

Note:

Most of the Office 2013 policy settings are also available in the OCT (OPA settings). To configure initial default settings in a Setup customization .msp file, administrators can use the OCT. However, users can change most of the settings after the installation. Use Group Policy if you want to enforce specific configurations. Group Policy settings have precedence over OCT settings.

Required local installation source

In Office 2013, Setup creates a local installation source on the user's computer as part of the default installation process. Setup installs all Office 2013 products in a two-step process. First, Setup copies compressed installation source files to the user's computer. Second, Setup calls Windows Installer to perform the actual installation from the local installation source. After the installation is complete, the local installation source remains available for any Setup operations that require access to an original source. Minimum disk space requirements include the local installation source.

Note:

In Office 2003, large organizations typically installed the product from an administrative installation point. Installing Office from a local installation source was optional. However, In the Office 2013,and in Office 2010 and Office 2007, the administrative installation option no longer exists. The local installation source is a required part of the design.

The local installation source makes the distribution of software updates process more efficient and reliable. Neither the network installation point nor the user's local installation source is ever updated directly. Users' installations remain synchronized when they apply the client version of software updates.

Additional benefits of having a complete installation source always available on the local computer include the following:

  • You can deploy the local installation source to users before they install Office. This minimizes the effect on the network and makes sure that all users install the product and begin to use Office 2013 applications at the same time.

  • Users can perform maintenance tasks, such as applying software updates, without being prompted for their Office CD or a network source.

  • Traveling users, or users who have slow or intermittent network connections, can run Setup without access to the network if they have a local installation source that was installed in advance.

These benefits come at minimal cost. Although the local installation source does use some hard disk space, creating the local installation source and installing Office takes approximately the same time as installing Office by itself.

Creating a local installation source on users' computers

When users install Office from a DVD or from a network installation point, Setup creates the local installation source by using a program called the Office Source Engine (Ose.exe) to copy required installation files to a hidden folder on the local computer. The default location is \MSOCache\All Users at the root of the drive on which Office is installed.

Each package that consists of an Office product, both the language-neutral core package and one or more language-specific packages, has a separate download code. The package is cached in the subfolder under MSOCache\All Users. Setup always caches a complete local installation source, which includes all the files that are associated with the product that is being installed. If the installation point includes multiple languages, Setup caches only the packages for the languages that are installed on the user's computer.

When additional Office products are installed on the user's computer, those products are cached in the same local installation source.

Note:

If a user installs a second Office product on a different drive, Setup creates a second local installation source at the root of that drive. In this scenario, shared files might be duplicated between the two local installation sources. However, this design makes sure that each local installation source is complete and functions correctly.

Users cannot unintentionally delete the local installation source or remove it by using the Setup user interface or the Windows Disk Cleanup Wizard. If the MSOCache folder is deleted or corrupted, Setup automatically re-creates or repairs the folder the next time that a source is required. If users do not have sufficient disk space, they are prompted to free up space. You can rely on the fact that every user has access to a source when you distribute new updates or customizations.

Note:

Once the local installation source is created, its location on the user's computer is fixed. Unless the user specifies a different drive, additional Office products installed later are always added to the existing MSOCache\All Users folder.

Deploying the local installation source by itself

Because Setup performs the installation of Office from the local installation source, you can minimize the demand on the network by deploying the installation source beforehand. For example by using your usual method for running Setup on users' computers, you can distribute the local installation source to one group of users at a time. After all users have a precached source, you can have everyone run Setup to install Office at the same time. In this scenario, most of the installation activity occurs on the local computer instead of over the network.

For more information, see Precache the local installation source for Office 2010. This information also applies to Office 2013.

You can also run Setup directly from the local installation source on the local computer. Running Setup locally means that no activity, even loading Setup files and reading metadata, occurs over the network. In this scenario, you must identify the subfolder in MSOCache\All Users that contains the core product that you want to install. Each core product subfolder contains a copy of the Setup program, and running Setup from a specific folder installs that product. This method lets users install Office without relying on a network connection.

For more information, see Install Office 2010 from local installation source. This information also applies to Office 2013

Consolidated update process

In versions of Office earlier than Office 2007, you made several choices to make sure that client computers received the latest Office software updates and that client computers did not become out of sync with the administrative installation point. You might have configured Setup to chain software updates with new installations of Office, or you might have applied updates to the administrative installation point and reinstalled Office on all the client computers.

The architecture that was introduced in Office 2007 makes this process much simpler. In Office 2013, Office 2010, and Office 2007, you create a network installation point that you never have to update. Instead, a simple copy operation makes software updates available for new installations. You update existing installations independent of the network installation point so you do not have to worry about keeping client computers synchronized with the installation source.

Applying Office updates during new installations

When you obtain Office software updates from Microsoft, copy the updates into the Updates folder in the root of the network installation point. The existing files in the network installation point remain the same as when you first copied them from the Office CD.

Note:

You can use the Updates folder to incorporate the installation of updates with an initial installation of the Office 2013 products. Only Windows Installer update files that are contained in this folder are installed with the initial installation. Therefore, you must extract the updates from Microsoft Self-Extractor packages. You can also place a Setup customization .msp patch in the Updates folder to customize initial installations.

When you run Setup to install Office on a client computer, Setup looks in the Updates folder for software updates and incorporates the updates automatically as it installs Office. If there are multiple updates in the folder, Setup applies only those updates that are targeted at the Office product being installed. If the Updates folder includes both a Setup customization .msp file (patch) and product updates, Setup applies only the Setup customization .msp file with the initial installation and the product updates are applied after the installation is completed. Setup also applies the updates in the correct sequential order. The result is that the user receives the latest updates with the new installation of Office.

Tip:

To direct Setup to look for software updates in a folder other than the Updates folder, use the SetupUpdates element in the Config.xml file. For more information, see SetupUpdates element in Config.xml file reference for Office 2013.

Updating existing Office installations

After Office is installed, you apply software updates directly to the client computer without returning to the network installation point. You do this through a deployment management program such as Microsoft Systems Management Server or System Center 2012 Configuration Manager, by using Windows Server Update Services, or by updating computers directly from the Internet by using Microsoft Update.

Note:

After Office is installed on a client computer, a reinstallation of Office reapplies only those software updates that were applied during the original installation. If you copied new software updates in the Updates folder, they will not be applied during the reinstallation.

See also

Office Customization Tool (OCT) reference for Office 2013
Config.xml file reference for Office 2013
Customize Setup before installing Office 2013


Customize the Accessibility Checker for Office 2013

Published: July 16, 2012

Summary: Use Group Policy settings to control what the Accessibility Checker checks when users run it on Office 2013 files.

Applies to: Excel 2013 | Office 2013 | Office 365 ProPlus | PowerPoint 2013 | Word 2013

The Accessibility Checker in Office 2013 lets users create more accessible documents for people who have disabilities. The Accessibility Checker (like a spelling checker, but for accessibility issues) is a core feature of Excel 2013, PowerPoint 2013, and Word 2013.

Audience: IT Professionals

Important:

Are you looking for help with using the Accessibility Checker? You may be looking for Check for accessibility issues, or Rules used by the Accessibility Checker, which will help you use the Accessibility Checker and understand its rules.

In this article:

  • Increase the visibility of violations

  • Control what the checker reports

Increase the visibility of violations

The settings that are provided in Control what the checker reports later in this article are used to control the Accessibility Checker. Of these settings, most are about stopping the Accessibility Checker from performing a particular check.

The policy setting Increase the visibility of Accessibility Checker violations controls how strongly an accessibility error will be emphasized in the user interface. If enabled, you can specify what happens when a document, workbook, or spreadsheet has accessibility errors, as shown here:

  • Accessibility violations do not change the Prepare for Distribution area in the Office Backstage view (default).

  • Accessibility errors cause the Prepare for Distribution area to be strongly emphasized in the Backstage view.

  • Accessibility errors or warnings cause the Prepare for Distribution area to be less strongly emphasized in the Backstage view.

If disabled or not configured, the Accessibility Checker user interface is presented in its normal state.

Important:

Group Policy settings can be used to control the Accessibility Checker. For Excel 2013, PowerPoint 2013, and Word 2013, the Group Policy settings are located in the gpedit node <AppName>\File tab\Check Accessibility.

Control what the checker reports

The following tables provide the complete Group Policy settings that can be used to control the Accessibility Checker for Excel 2013, PowerPoint 2013, and Word 2013.

Group Policy settings for Excel 2013

Setting for Excel 2013 Associated registry key Description

Stop checking for alt text accessibility information

AltText

If enabled, the Accessibility Checker does not determine whether objects such as images and shapes contain alternative text.

If disabled or not configured, objects are checked for alternative text and any issues that it finds will appear in the Accessibility Checker.

Stop checking for table header accessibility information

TableHeaders

If enabled, the Accessibility Checker does not determine whether tables have a header row specified.

If disabled or not configured, tables are checked for header rows and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure workbooks allow programmatic access

ProgrammaticAccess

If enabled, the Accessibility Checker does not check whether workbooks have blocked programmatic access through Digital Rights Management (DRM).

If disabled or not configured, workbooks are checked for programmatic access and any issues that it finds will appear in the Accessibility Checker.

Stop checking for merged cells

MergedCells

If enabled, the Accessibility Checker does not check whether tables have merged cells.

If disabled or not configured, worksheets are checked for merged cells and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure hyperlink text is meaningful

MeaningfulHyperlinks

If enabled, the Accessibility Checker does not check whether hyperlinks have meaningful text.

If disabled or not configured, hyperlink text is checked and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure non-default sheet names

SheetNames

If enabled, the Accessibility Checker does not check whether worksheets with content have non-default names.

If disabled or not configured, worksheet names are checked and any issues that it finds will appear in the Accessibility Checker.

Stop checking for blank table rows used as formatting

BlankTableRows

If enabled, the Accessibility Checker does not check whether blank table rows are used as formatting.

If disabled or not configured, tables are checked for blank rows and any issues that it finds will appear in the Accessibility Checker.

Group Policy settings for PowerPoint 2013

Setting for PowerPoint 2013 Associated registry key Description

Stop checking for alt text accessibility information

AltText

If enabled, the Accessibility Checker does not determine whether objects such as images and shapes contain alt text.

If disabled or not configured, objects are checked for alternative text and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure hyperlink text is meaningful

HyperlinkText

If enabled, the Accessibility Checker does not check whether hyperlinks have meaningful text.

If disabled or not configured, hyperlink text is checked and any issues that it finds will appear in the Accessibility Checker.

Stop checking for media files which might need captions

ClosedCaptions

If enabled, the Accessibility Checker does not flag media files that might need caption information.

If disabled or not configured, presentations are scanned for media files and any issues that it finds will appear in the Accessibility Checker.

Stop checking for table header accessibility information

HeaderRow

If enabled, the Accessibility Checker does not determine whether tables have a header row specified.

If disabled or not configured, tables are checked for header rows and any issues that it finds will appear in the Accessibility Checker.

Stop checking for blank table rows and columns

BlankRowCol

If enabled, the Accessibility Checker does not determine whether blank rows and blank columns were inserted into tables.

If disabled or not configured, tables are checked for blank rows and blank columns and any issues that it finds will appear in the Accessibility Checker.

Stop checking for merged and split cells

SimpleStructure

If enabled, the Accessibility Checker does not determine whether tables have merged or split cells.

If disabled or not configured, tables are checked for merged and split cells and any issues that it finds will appear in the Accessibility Checker.

Stop checking that slide titles exist

HasTitle

If enabled, the Accessibility Checker does not determine whether every slide has a title placeholder.

If disabled or not configured, slides are checked for titles and any issues that it finds will appear in the Accessibility Checker.

Stop checking to make sure that each slide has a unique title

UniqueTitle

If enabled, the Accessibility Checker does not determine whether every slide has a unique title.

If disabled or not configured, slide titles are checked for uniqueness and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure a meaningful order of objects on slides

NonPlaceholderShapes

If enabled, the Accessibility Checker does not check whether a slide has non-placeholder objects which might be read back out of order.

If disabled or not configured, slides are checked for objects which might be read back out of order and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure presentations allow programmatic access

IRM

If enabled, the Accessibility Checker does not check whether presentations have blocked programmatic access through DRM.

If disabled or not configured, presentations are checked for programmatic access and any issues that it finds will appear in the Accessibility Checker.

Group Policy settings for Word 2013

Setting for Word 2013 Associated registry key Description

Stop checking for alt text accessibility information

AltText

If enabled, the Accessibility Checker does not determine whether objects such as images and shapes contain alt text.

If disabled or not configured, objects are checked for alternative text and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure hyperlink text is meaningful

MeaningfulHyperlinks

If enabled, the Accessibility Checker does not determine whether hyperlinks have meaningful text.

If disabled or not configured, hyperlink text is checked and any issues that it finds will appear in the Accessibility Checker.

Stop checking for table header accessibility information

TableHeaders

If enabled, the Accessibility Checker does not determine whether tables have a header row specified.

If disabled or not configured, tables are checked for header rows and any issues that it finds will appear in the Accessibility Checker.

Stop checking for blank table rows and columns

BlankTableCells

If enabled, the Accessibility Checker does not determine whether blank rows and blank columns were inserted into tables.

If disabled or not configured, tables are checked for blank rows and blank columns and any issues that it finds will appear in the Accessibility Checker.

Stop checking for merged and split cells

2DTableStructure

If enabled, the Accessibility Checker does not determine whether tables have merged or split cells.

If disabled or not configured, tables are checked for merged and split cells and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure documents allow programmatic access

ProgrammaticAccess

If enabled, the Accessibility Checker does not check whether documents have blocked programmatic access through DRM.

If disabled or not configured, documents are checked for programmatic access and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure long documents use styles for structure

StylesAsStructure

If enabled, the Accessibility Checker does not check whether long documents have used styles to define content structure.

If disabled or not configured, documents are checked for style usage and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure styles have been used frequently

HeadingSpacing

If enabled, the Accessibility Checker does not check whether documents that use styles have used them frequently enough to accurately represent the document's content structure.

If disabled or not configured, the frequency of style usage is checked and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure headings are succinct

SuccinctHeadings

If enabled, the Accessibility Checker does not check whether headings in a document are succinct.

If disabled or not configured, document headings are checked for length and any issues that it finds will appear in the Accessibility Checker.

Stop checking whether objects are floating

FloatingObjects

If enabled, the Accessibility Checker does not check whether a document has objects that are floating instead of inline.

If disabled or not configured, objects are checked for floating text wrapping properties and any issues that it finds will appear in the Accessibility Checker.

Stop checking whether blank characters are used for formatting

BlankCharacters

If enabled, the Accessibility Checker does not check whether multiple consecutive white-space characters are used for formatting.

If disabled or not configured, documents are checked for consecutive white-space usage and any issues that it finds will appear in the Accessibility Checker.

Stop checking for image watermarks

ImageWatermarks

If enabled, the Accessibility Checker does not check whether a document has image watermarks.

If disabled or not configured, documents are checked for watermarks and any issues that it finds will appear in the Accessibility Checker.

Stop checking to ensure heading styles do not skip style level

HeadingOrder

If enabled, the Accessibility Checker does not check whether headings in a document are used in order.

If disabled or not configured, the ordering of headings in a document is checked and any issues that it finds will appear in the Accessibility Checker.

Stop checking for tables used for layout

LayoutTablesReadingOrder

If enabled, the Accessibility Checker does not flag layout tables (that is, tables that have no style applied).

If disabled or not configured, tables that have no styles are flagged and violations appear in the Accessibility Checker.


Use the OCT to customize Office 2013

Published: January 22, 2013

Summary Explains how to use the Office Customization Tool (OCT) to customize Windows Installer-based Office 2013 installations.

Applies to: Office 2013

Audience: IT Professionals

The Office Customization Tool is part of the Setup program and is the primary tool for customizing a Windows Installer-based Office 2013 (MSI) installation. The OCT is available only with volume licensed versions of Windows Installer-based Office 2013, Office 2010, and the 2007 Office system. The OCT saves customizations in a Setup customization (.msp) file, which is applied at either Setup time or during a maintenance mode operation. You can use the OCT to alter the way that Setup performs an installation and to configure Office applications that are on a user's computer. Use the OCT to configure the installation for users after you create a network installation point, but before you install Office 2013.

Administrators use the OCT to customize the following areas:

  • Setup Use this section to specify default installation location and default organization name, additional network installation sources, the product key, end-user license agreement, display level, earlier versions of Office to remove, custom programs to run during installation, security settings, and Setup properties.

  • Features Use this section to configure user settings and to customize how Office features are installed.

  • Additional content Use this section to add or remove files, add or remove registry entries, and configure shortcuts.

  • Outlook Use this section to customize a user's default Outlook profile, specify Exchange settings, add accounts, remove accounts and export settings, and specify Send\Receive groups.

In Office 2013, two architecture-specific versions of the Office Customization Tool (OCT) are available: one for 32-bit Office 2013 and one for 64-bit Office 2013. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version. You use the same command to run the 32-bit or 64-bit version of the OCT, as explained in Customize Office. For more information about 64-bit Office 2013, see 64-bit editions of Office 2013.

Note:

Office 2013 doesn't support side-by-side installations of 64-bit and 32-bit Office or Office applications. For example, there is no support for side-by-side installations of the 2007 Office system 32-bit along with Office 2013 64-bit, or for Access 2013 64-bit along with Excel 2013 32-bit.

You can't use the Office 2013 customization tools to configure side-by-side installations or customizations of 64-bit and 32-bit Office. For example, you can't create a custom side-by-side installation that uses 64-bit Office Professional Plus 2013 and 32-bit Visio 2013 single image. For more information about supported scenarios for 64-bit Office, see Supported scenarios in 64-bit editions of Office 2013.

Administrators can also use the Config.xml file, which runs during Setup, to specify options for Windows Installer-based Office 2013 (and Office 2010 and Office 2007) installations. You can use the Config.xml file to configure many of the same options that you configure by using the OCT, and some additional options that aren't available in the OCT. The Config.xml file that is stored in the core product folders (core_product_folder_name.WW folder, such as ProPlus.WW for Office Professional Plus 2013) directs Setup to install that product. If the network installation point contains multiple Office 2013 products, you can use the /config command-line option when you run Setup.exe to specify the path of the Office 2013 product that you want to install. If you do this, Setup won't prompt you about which product to install.

For more information about Setup commands, see Setup command-line options reference for Office 2013.

The following customizations can only be made by using the Config.xml file:

  • Specifying the path of the network installation point.

  • Selecting which product to install.

  • Customizing Setup options such as logging and the location of the Setup customization file and software updates.

  • Setting installation options such as user and company name.

  • Copying the local installation source (LIS) to the user's computer without installing Office.

  • Adding or removing languages from the installation.

Note:

If you use both an OCT Setup customization (.msp) file and the Config.xml to customize the installation, the settings that you specify in Config.xml take precedence over those in the Setup customization file. The Config.xml file reference for Office 2013 article provides detailed information about the installation options and indicates whether a setting has a corresponding OCT setting.

We recommend that you read the Plan volume activation of Office 2013 and Volume activation methods in Office 2013 articles before you customize Setup.

In this article:

  • Create a network installation point

  • Customize Office

Create a network installation point

The first steps in a typical corporate deployment are to create, replicate, and secure a network installation point. To create a network installation point, copy all source files from the Office 2013 installation media to a shared location on the network. Also copy any language packs that you want to deploy. Users can run Setup from the network installation point, or you can use the network installation point as a starting place to distribute Office 2013 by using a software deployment tool, such as Microsoft System Center 2012 Configuration Manager. You can also use it to create a hard-disk image or a custom DVD.

Make sure that access to Office 2013 source files is read-only. The Setup.xml and Package.xml files, such as ProPlusWW.xml for Office Professional 2013, are digitally signed and can't be changed.

For more information about the network installation point, see Create a network installation point in Customize Setup before installing Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To create a network installation point

  1. Copy all the files and folders from the Office 2013 DVD to a folder on the network or on your computer. For example, copy the files to \\server\share\Office15.

  2. Copy all the language packs and additional Office products that you want to deploy to the same network installation point.

  3. When you are prompted to overwrite duplicate Setup files, choose No.

Customize Office

Note:

As noted earlier, there are two versions of the OCT, one for 32-bit and one for 64-bit Office 2013. To run the 32-bit OCT, run the setup.exe /admin command line from the x86 (32-bit) folder, as shown in the following example:

\\server\share\Office15\x86\setup.exe /admin

To run the 64-bit OCT, run the setup.exe /admin command line from the x64 (64-bit) folder, as shown in the following example:

\\server\share\Office15\x64\setup.exe /admin

To customize Office by using the OCT

  1. From the root of the network installation point, run the following command line to start the Office Customization Tool: \\server\share\setup.exe /admin.

  2. In the Select Product dialog box, choose a single product that you want to customize, and then choose OK.

  3. In the navigation pane, select an area of customization and customize the options available in the details pane. For example, to configure Setup to run quietly, choose Licensing and user interface in the navigation pane, and then select None for Display level in the details pane.

  4. When you finish making your customizations, select Save As in the File menu.

  5. Specify a unique name for the file and save the file in the Updates folder of the network installation point.

  6. Choose Save on the File menu.

When you run Setup.exe from the network installation point, Setup looks in the Updates folder for Setup customization files for the product that you are installing. Setup then applies your customizations to the installation.

The following articles provide more information about how to customize specific aspects of the installation:

  • To customize the default behavior of Setup during installation, see Customize Setup before installing Office 2013.

  • To customize which Office features are installed on the user's computer, see Configure feature installation states for Office 2013.

  • To customize the user's default environment during installation, see Configure user settings for Office 2013.

  • To configure Outlook options, start with the Overview of Outlook 2013 planning.

For complete information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

See also

Overview of Setup architecture for Office 2013
Deploy volume activation of Office 2013
Configure a silent installation of Office 2013
Create custom configurations of Office 2013
Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013
Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013

Download: Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool


Customize Setup before installing Office 2013

Published: July 16, 2012

Summary: Explains how to use the Office Customization Tool to customize a Windows Installer-based installation of Office 2013.

Applies to: Office 2013

Audience: IT Professionals

To customize Setup for Windows Installer-based Office 2013, follow the procedures in this article before you begin the installation.

In Office 2013 (as in Office 2010 and Office 2007), Setup controls the complete installation. This includes processes that Windows Installer handled in Office versions earlier than Office 2007. Customizing the default behavior of Setup lets you specify how the installation runs. For example, you can run the installation without user interaction, handle the product key and the Microsoft Software License Terms on behalf of users, and specify an organization name or a different installation location.

We recommend that you read the Plan volume activation of Office 2013 and Volume activation methods in Office 2013 articles before you customize Setup.

In this article:

  • Use the OCT to customize the installation

  • Create a network installation point

  • Customize Setup

  • Install Office silently

Use the OCT to customize the installation

To customize how Setup manages the installation process, use the Office Customization Tool (OCT) to create a Setup customization (.msp) file. Setup applies this file when users install Office on their computers.

In Office 2013, two architecture-specific versions of the Office Customization Tool (OCT) are available: one for 32-bit and one for 64-bit Office. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version. You use the same command to run the 32-bit or 64-bit version of the OCT.

  • To run the 32-bit OCT, run the setup.exe /admin command line from the x86 (32-bit) folder as shown in the following example: \\server\share\Office15\x86\setup.exe /admin.

  • To run the 64-bit OCT, run the setup.exe /admin command line from the x64 (64-bit) folder. For more information about 64-bit Office 2013, see 64-bit editions of Office 2013.

Create a network installation point

The first step in a typical corporate deployment is to create, replicate, and secure a network installation point. To do this, copy all source files from the Office 2013 installation DVD to a shared location on the network. Also copy any language packs that you want to deploy from the source media to the network installation point. Users can run Setup from the network installation point, or you can use the network installation point as a starting place to distribute Office 2013 by using a software deployment tool, such as Microsoft System Center 2012 Configuration Manager, or to create a hard-disk image or a custom DVD.

Make sure that access to Office 2013 source files is read-only. The Setup.xml and Package.xml files, such as ProPlusWW.xml for Office Professional 2013, are digitally signed and cannot be changed.

We recommend that you replicate the network installation point to multiple locations for the following reasons:

  • Ensure that users always have access to a network source.

  • Support remote locations if you are deploying to multiple geographical locations.

  • Provide consistent configurations to users in your organization.

  • Provide flexibility. If you define a standard corporate configuration of Office 2013, regional administrators can apply additional customizations to the replicated network installation points to address their specific requirements.

To learn about shared folders, see the following resources:

  • Shared Folders

  • Share a Folder or Drive

  • Set Permissions for Shared Folders

Customize Setup

Use the following instructions to customize Office Setup.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To customize Office Setup

  1. Create a network installation point. To do this, create a shared folder for the Office 2013 source files at a location that can be easily accessed on the server, and copy all the files and folders from the Office 2013 DVD to that share. For example:

    \\server\share\Office2013

    Important:

    Do not create the network installation point at the root of the server.

    If you deploy multiple language versions of Office 2013, copy each language pack that you want to deploy from the source media to the installation point. When you are prompted to overwrite duplicate Setup files, choose No. Core Setup files are shared among all Office 2013 products and language packs. Because the core Setup files are identical, there is no reason to overwrite the files when you add language packs.

    If you deploy multiple Office 2013 products, copy those files from the DVD to the installation point. When you are prompted to overwrite duplicate Setup files, choose No.

  2. From the root of the network installation point, run the following command line to start the Office Customization Tool:

    \\server\share\Office2013\setup.exe /admin

    where:

    • \\server\share\Office2013\ is the network installation point that contains the Office 2013 sources

    • setup.exe /admin starts the OCT

  3. Choose the Office 2013 product that you want to configure, and then choose OK.

  4. In the OCT navigation pane, choose Installation location and organization name.

  5. In the Default installation path box, enter the path of a default installation location on users' computers. You can enter a relative path that includes the folder keyword [ProgramFilesFolder].

  6. In the Organization name box, enter a default organization name for all users who install Office with this customization file.

  7. In the navigation pane, choose Additional network sources, and then choose Add.

  8. In the Network server box, enter the path of any backup sources that you have created on the network. If neither the user's local installation source nor the original network installation point is available, Setup uses one of these replicated installation points for operations that require the source. You can add as many sources as you need.

  9. In the navigation pane, choose Licensing and user interface. The following options are available:

    • Use KMS client key. A product key entry is not required for enterprise deployments that are using Key Management Service (KMS) activation because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products that are licensed under Microsoft Volume Licensing programs. Only a KMS host computer needs a KMS host key to be activated and to establish a local activation service in your environment. Office 2013 connects to the local KMS host for activation. By default, the Use KMS client key option is selected.

      For more information about the licensing options for Office 2013, see Volume activation overview for Office 2013.

    • Enter another product key. You can enter a valid Multiple Activation Key (MAK) key in the OCT by using the Enter another product key entry. A MAK key is another method that Office Activation Technologies provides for activating products licensed under Microsoft Volume Licensing programs. By using a MAK, clients activate Office 2013 online by using the Microsoft hosted activation servers or by telephone.

      To use a MAK key, select the Enter another product key option, and in the Product key text box, enter the MAK key (twenty-five numbers or characters) without spaces..

  10. Select the I accept the terms in the License Agreement check box. When you provide this information in a Setup customization file, users are not prompted for a product key or Microsoft Software License Terms during the installation or the first time that they start an Office application.

  11. In the details pane, set the Display Level to Basic or None to install Office quietly (without user interaction). For more information about display settings see Licensing and user interface in Office Customization Tool (OCT) reference for Office 2013.

    Note:

    In enterprise deployments, we recommend that you set Display level to None to make sure that that Setup runs silently. It also prevents prompts to users to enter information, and prevents the installation from waiting for user interactions, ieven when files are being used. When you set Display Level to none, the Suppress modal and Completion notice options are silenced and the Microsoft Software License Terms are accepted. Administrators must also make sure that no Office applications are running during an installation of Office 2013.

    If you set Display level to Basic and select the Suppress modal option, users may be prompted if any Office files are being used. Setting Display level to None prevents prompts to users in these cases. The Suppress modal option does not prevent files-in-use messages from being displayed. Only Display level set to None prevents the messages from being displayed.

  12. Make any additional customizations. Choose Save on the File menu, and save the Setup customization file in the Updates folder at the root of the network installation point.

    Note:

    If you plan to deploy multiple Setup customization files (.msp files), you can place only one customization .msp file for each Office 2013 product that you are installing in the Updates folder for an initial installation. You must deploy the rest of the customization .msp files for a product after the Office installation is finished Only one Setup customization file per product in the Updates folder is supported. For example, if you are deploying multiple Office 2013 products, such as Office Professional Plus 2013 and Visio Professional 2013, you can include one customization .msp file for Office Professional Plus 2013 and one customization .msp file for Visio Professional 2013 in the Updates folder. The customization .msp files that you place in the Updates folder are deployed first. Therefore, they must include any Setup customizations that cannot be changed after the installation, such as the installation location.

Your customizations apply to any language version of the specified product that is available on the network installation point. Most customizations apply to the language-neutral core product. However, the feature tree in the tool also includes a subset of language-specific features. Customizations to language-specific features are applied when a user installs that language; otherwise, the customizations are ignored.

Note:

Typically, you do not have to customize logging options. By default, Setup creates a standard log file and saves it as a text file in the %Temp% folder on the user's computer. If an installation fails, Setup creates a verbose log file in the same location, starting with the package that caused the failure. To change logging options, open the Config.xml file in Notepad and modify the <Logging> element. For more information, see Config.xml file reference for Office 2013.

Install Office silently

When you deploy Office throughout an organization, you determine how much of the Setup user interface is displayed to users. By default, Setup runs interactively and gives users choices during the installation. If you are distributing a customized configuration, we recommend that you limit how much users interact with Setup. The installation continues with fewer interruptions, and your customizations are set by default for all users. For more information about display options, see Licensing and user interface in Office Customization Tool (OCT) reference for Office 2013.

If you are using a deployment tool such as Microsoft System Center 2012 Configuration Manager or Microsoft Systems Management Server (SMS) to deploy Office 2013 while users are not logged on to the network, set the display level to None, which installs Office 2013 without displaying any Setup user interface.

Note:

When you install Office 2013 silently, you must provide a valid product key. If the product key is missing, Setup logs an error and exits. As mentioned previously, if you are using KMS activation, a product key entry is not required because all Volume License editions of Office 2013 have a KMS client key pre-installed. However, if you are using MAK, you must enter the MAK key. If you do not accept the license terms on behalf of users, Setup does complete the installation. Note that, by installing Office 2013 silently, you have implicitly accepted the license terms.

The Windows Installer properties DISPLAY and PIDKEY do not work in Office 2013 (or in Office 2010 or Office 2007). Instead, in Office 2013, you customize Setup directly by specifying a display setting and a product key in the OCT. You can either accept the default option, Use KMS client key if you are using KMS validation, or enter a MAK key in the Enter another product key text box if you are using KMS, as described in Customize Setup.

Because Setup plays a more significant role in controlling the installation, many Windows Installer properties are no longer required. In fact, some Windows Installer properties are blocked and generate an error if you try to set them using the Office Customization Tool.

See also

Plan volume activation of Office 2013
Volume activation methods in Office 2013
Office Customization Tool (OCT) reference for Office 2013
Config.xml file reference for Office 2013


Configure feature installation states for Office 2013

Published: January 22, 2013

Summary Use the Office Customization Tool (OCT) to specify how Office 2013 features are installed for Windows Installer-based Office 2013 installations.

Applies to: Office 2013

Audience: IT Professionals

After you create a network installation point, but before you install Office 2013, you can use the Office Customization Tool to create a Setup customization file (.msp file) to configure the installation for users. You can use the OCT to change the default way that Office features are installed. You can set some features to be installed on the user's computer, some features to be installed only on first use, and some features that are not to be installed. You can even hide or lock features so that a user who runs Windows Installer-based (MSI) Setup interactively can't change what you have configured. For information about how to create the network installation point, see Create a network installation point in Customize Setup before installing Office 2013.

In Office 2013 and Office 2010, two architecture-specific versions of the OCT are available: one for 32-bit Office 2013 and one for 64-bit Office 2013. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version. You use the same command to run the 32-bit or 64-bit version of the OCT as explained in Configure feature installation states. For more information about 64-bit Office 2013, see 64-bit editions of Office 2013.

Configure installation states

Use the following procedure to configure feature installation states.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

The following instructions assume that you have already created a network installation point to store all source files from the Office 2013 installation media to a shared location on the network. For more information, see Create a network installation point in Use the OCT to customize Office 2013.

Note:

As noted earlier, there are two versions of the OCT, one for 32-bit and one for 64-bit Office 2013. If you want to run the 32-bit OCT, run the setup.exe /admin command line from the x86 (32-bit) folder as shown in the following example:

\\server\share\Office15\x86\setup.exe /admin

To run the 64-bit OCT, run the setup.exe /admin command line from the x64 (64-bit) folder as shown in the following example:

\\server\share\Ofice15\x64\setup.exe /admin

To configure Office feature installation states

  1. To start the OCT, from the root of the network installation point, type the following at the command prompt: setup.exe /admin.

  2. In the Select Product dialog box, choose the product that you want to configure, and then choose OK.

  3. In the navigation pane, locate Features, and then choose Set feature installation states.

  4. In the details pane, expand the tree and choose the feature that you want to customize. For example, if you opt not to install the Equation Editor, expand Microsoft Office and Office Tools, open the shortcut menu for Equation Editor, and then choose the installation options Not Available, Hidden, and Locked. Setup doesn't install the Equation Editor. If Setup is run interactively, this feature isn't visible and the user can't install it.

  5. On the File menu, choose Save As.

  6. In the Save As dialog box, specify a path and file name for the Setup customization file, and then choose Save.

  7. On the File menu, choose Exit.

  8. Copy the Setup customization file to the Updates folder in the network installation point.

When you run Setup to install Office, Setup uses the customization file that it finds in the Updates folder and configures Office features according to your customizations.

The following table describes the available installation options.

Installation options

Option Description

Run from My Computer

Setup copies files to the user's hard disk and also writes registry entries and shortcuts that are associated with the feature. The feature (or application) runs on the user's computer.

Run all from My Computer

This option is the same as Run from My Computer, except that all child features that belong to the feature are also set to this state.

Installed on First Use

Setup leaves components for the feature and all its child features in the local installation source until the user first attempts to use the feature, at which time the components are copied to the Office program folder on the user's local hard disk. Some features don't support Installed on First Use. This option is not available for these features in the OCT.

Not Available

The components for the feature, and all of the child features that belong to that feature, aren't installed on the user's computer.

Note:

The Not Available installation state is reversible. When Not Available is set, a feature won't be installed. But, you can later install the feature locally by using an .msp customization file or a Config.xml file.

To unlock and install a feature locally, you can edit the Config.xml file to change the OptionState element, as described in the note for the Locked feature state description.

Hidden

Neither this feature nor any of its child features appear in the feature tree when Setup runs interactively. Setup uses the default installation state, or the state specified in the customization file, to determine how to install the feature.

Note:

The Hidden option isn't reversible. After you set it, a Hidden feature won't be displayed in the feature tree either during or after installation. You can't use another Config.xml file or apply a second .msp file after the initial installation to "unhide" a feature.

The feature remains hidden even if you opt to change your installation by using Programs and Features in Control Panel to change your Office 2013 installation.

Also, it won't be displayed in the Office Setup feature installation tree under the Add or Remove Features option for Office 2013. Even though the feature remains hidden, you can unlock the feature to install and run it locally later by using an .msp file or a Config.xml file.

For more information about the Config.xml file, see Config.xml file reference for Office 2013.

You can also use the OCT to create an .msp customization file to install the feature later. To do this, choose Set feature installation states in the navigation pane. In the details pane, open the shortcut menu for a feature, and then set the feature installation state to Run all from My Computer.

Locked

The user can't change this feature during interactive Setup or maintenance mode.

Note:

The Locked option is reversible. If you set the Locked option for a feature by using the OCT or the Config.xml file during initial installation, you can unlock that feature and install it locally by using an .msp file or a Config.xml file at a later date.

For example, you can edit the Config.xml file to change the OptionState element as shown in the following example. This adds the OptionState element line to install the feature (in this case, Access 2013) on a user's computer, and sets child features of the feature to the specified state.

To edit the Config.xml file to change the OptionState element, follow these steps:

  1. Open the Config.xml file in the core product folder (core_product_folder_name.WW folder, for example, ProPlus.WW) for the Office 2013 product that you are installing. Use a text editor tool, such as Notepad, to customize the file.

  2. Locate the line in the Config.xml file that contains the OptionState element:

    <!-- <OptionState Id="OptionID" State="absent" Children="force" /> -->

  3. Change the OptionState element as follows and then save the Config.xml file:

    <OptionState Id="ACCESSFiles" State="local" Children="force" />

For more information about OptionState syntax, see OptionState element in Config.xml file reference for Office 2013.

Note:

The following subcomponents of Publisher 2013 aren't visible in the Setup feature installation state tree in Office 2013:

  • Commercial Printing and its Enhanced RGB to CMYK Conversion subcomponent

  • Font Schemes

  • PaperDirect Previews

  • Publisher Templates and its Business Publications and Other Publications subcomponents

When you change the installation state of a feature, Setup might change the installation state of a parent or child feature to match. For more information, see the Set feature installation states section in Office Customization Tool (OCT) reference for Office 2013.

As with any deployment of Office, make sure that you test customizations and deployment in a non-production environment before you deploy Office 2013 to users in the organization.

For information about how to specify application installation options for a group of users, see this Office 2010 blog: How to install Office 2010 applications for a subset of users in your organization. Although the blog is about Office 2010, the information also applies to Office 2013.

See also

Deploy Office 2013 from a network installation point
Overview of Setup architecture for Office 2013


Configure user settings for Office 2013

Published: January 22, 2013

Summary: Explains how to use the Office Customization Tool (OCT) to configure user and computer default settings before you deploy Office 2013.

Applies to: Office 2013

Audience: IT Professionals

The Office Customization Tool lets you create a Setup customization file (.msp file) to configure user settings to customize the user's environment before you deploy Office 2013.

For example, you can use the OCT to configure the default settings for several AutoCorrect options in Word 2013. When you configure a user setting, that setting is in place when the user first runs an Office application.

Note:

Configuring a user setting in this manner is not necessarily permanent. It merely establishes the initial default value for the setting. The user can change most settings after Office is installed. If you have to enforce user settings and prevent users from changing the settings, use Group Policy.

For information about how to use Group Policy, see Overview of Group Policy for Office 2013 and Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013. For information about how to configure Group Policy for Office, see Use Group Policy to enforce Office 2010 settings. Although the article is for Office 2010, the Administrative Templates information also applies to Office 2013.

In Office 2013 and Office 2010, two architecture-specific versions of the Office Customization Tool are available: one for 32-bit Office 2013 and one for 64-bit Office 2013. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version. You use the same command to run the 32-bit or 64-bit version of the OCT as explained in Configure user settings. For more information about 64-bit Office 2013, see 64-bit editions of Office 2013.

For the latest information about OCT settings, please refer to the updated Excel 2013 workbook, Office2013GroupPolicyAndOCTSettings.xls, which is available in the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool download page. The OCT settings are listed in the OPAX worksheet.

Configure user settings

Use the following procedure to configure user settings for Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

The following instructions assume that you have already created a network installation point to store all source files from the Office 2013 installation media to a shared location on the network. For more information, see Create a network installation point in Use the OCT to customize Office 2013.

Note:

As noted earlier, there are two versions of the OCT in Office 2013 and Office 2010. If you want to run the 32-bit OCT, run the setup.exe /admin command line from the x86 (32-bit) folder as shown in the following example:

\\server\share\Office15\x86\setup.exe /admin

To run the 64-bit OCT, run the setup.exe /admin command line from the x64 (64-bit) folder as shown in the following example:

\\server\share\Office15\x64\setup.exe /admin

To configure user settings

  1. To start the OCT, from the root of the network installation point, type the following at the command prompt: setup.exe /admin.

  2. In the Select Product dialog box, select the product that you want to configure, and then choose OK.

  3. In the navigation pane, locate Features, and then choose Modify user settings.

  4. In the details pane, expand the tree, and then choose the product for which you want to configure settings.

  5. In the Settings column, choose the user setting that you want to configure. A Properties dialog box appears.

  6. Select one of the following options, and then choose OK.

    • Not Configured The setting remains as it is.

    • Enabled The setting is changed based on your choices in the Properties dialog box. If values are available for the setting, select the value that you want to use.

    • Disabled The setting is disabled. Note that disabling an option may differ from not configuring the option. See the description of the specific option for more information.

      Note:

      If you choose Enabled to view the options for a setting and then choose OK, Previous Setting, or Next Setting, the status changes to configured, even if you do not change the setting. If you unintentionally configure the setting by using an empty hyperlink, path, or file name, an error might result. If you selected Enabled and you want to ignore your changes or avoid configuring the setting, choose Cancel in the Properties dialog box for the setting. You can also return a setting to the Not Configured state by double-clicking the setting, selecting Not Configured, and choosing OK.

    For example, to specify the default format in which you want users to save Word 2013 files, in the navigation pane expand Microsoft Word 2013, expand Word Options, and then choose Save. In the list pane, in the Setting column, select Default file format. The Default file format properties dialog box appears. Select Enabled, and in the Save Word files as drop-down list, choose the file format that you want to specify, and then choose OK.

  7. If you want to preserve user settings from earlier versions of Office, select the Migrate user settings check box.

    Note:

    If you change user settings and also select the Migrate user settings check box, Setup first applies the modified settings and then migrates the user's existing custom settings, overwriting any conflicting settings.

  8. On the File menu, choose Save As.

  9. Specify a path and file name for the Setup customization file, and then choose Save.

  10. On the File menu, choose Exit.

  11. Copy the Setup customization file to the Updates folder in the network installation point.

When you run Setup to install Office 2013, Setup uses the Setup customization file (.msp file) in the Updates folder and configures user settings.

See also

Deploy Office 2013 from a network installation point
Use the OCT to customize Office 2013
Overview of Setup architecture for Office 2013
Office Customization Tool (OCT) reference for Office 2013


Configure a silent installation of Office 2013

Published: October 16, 2012

Summary: Provides information about how to configure a silent installation of the Windows Installer-based (MSI) version of Office 2013.

Applies to: Office 2013

Audience: IT Professionals

You can configure a silent installation (unattended installation) of the MSI-based version of Office 2013 by using the Config.xml file or the Office Customization Tool (OCT). The Config.xml file is used to configure installation tasks and is used only when you run Setup. It is not installed or cached on users' computers. You can edit the Config.xml file to customize an installation.

A silent installation of an Office 2013 product requires no user interaction. You can modify the Config.xml file manually for the product that you are installing and specify options for Display element attributes so that the installation occurs silently and does not prompt users to enter information or wait for user input. The Display element specifies the level of user interface that Setup displays to users.

By default, the Config.xml file that is stored in the core product folder, core_product_folder_name.WW, directs Setup to install that product. For example, the Config.xml file in the ProPlus.WW folder installs Office Professional Plus 2013.

You can also use the OCT to set silent installation options.

In this article:

  • Modify the Config.xml file to configure a silent installation

  • Use the OCT to a configure silent installation and automatic activation

If you are using Key Management Service (KMS) activation to activate Office 2013 (MSI) for an enterprise deployment, a product key entry is not required because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products that are licensed under Microsoft Volume Licensing programs. When you install a Volume License edition of Office 2013, Office seeks a KMS host to activate against.

A Multiple Activation Key (MAK) key is another method that Office Activation Technologies provides for activating products that are licensed under Microsoft Volume Licensing programs. If you use MAK activation, you can add a MAK key by using the PIDKEY element in the Config.xml file. Note that the PIDKEY element is only used for volume license editions of Office 2013. It does not apply to Office 365 ProPlus which is licensed through subscription.

You can also use the AUTO_ACTIVATE property of the Setting element in Config.xml to specify that product activation occur automatically during Office 2013 deployment.

Important:

When the AUTO_ACTIVATE property is used for an installation, only one attempt is made to activate Office 2013. If that activation attempt fails (for example, because of proxy issues, user rights, or Internet connectivity issues), another attempt will not be made and users will later be prompted to activate Office 2013.

For more information about volume activation, see Plan volume activation of Office 2013 and Deploy volume activation of Office 2013.

Modify the Config.xml file to configure a silent installation

To configure a silent installation of an Office 2013 product that requires no user interaction, modify the Config.xml file for the product that you are installing, set the Display element's Level attribute to "none," and set CompletionNotice, SuppressModal, and AcceptEula attributes as shown in the following procedure. Then, save the Config.xml file. This example also shows how to set options to add a MAK product key, set automatic activation options, and prevent computer restarts.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To specify silent installation options in Config.xml

  1. Open the Config.xml file for the Office product (such as Office Professional Plus 2013) that you are installing by using a text editor tool such as Notepad.

  2. Locate the line that contains the Display element, as shown in the following example:

    <!-- <Display Level="full" CompletionNotice="yes" SuppressModal="no" AcceptEula="no" /> -->

  3. Modify the Display element entry with the silent options that you want to use. Make sure that you remove the comment delimiters, "<!--" and "-->." For example, use the following syntax:

    <Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

    These options will direct Setup to run silently, prevent the prompting of users to enter information, and prevent the installation from waiting for user interactions. For more information about the syntax and Config.xml, see Display element in Config.xml file reference for Office 2013.

  4. To suppress restarts, add the following lines:

    <Setting Id="SETUP_REBOOT" Value="Never" />

    <Setting Id="REBOOT" Value="ReallySuppress"/>

  5. To add a MAK key, use the PIDKEY element to enter the 25 character volume license key. Add the following line to the Config.xml file:

    <PIDKEY Value="AAAAABBBBBCCCCCDDDDDEEEEE" />

    AAAAABBBBBCCCCCDDDDDEEEEE represents the product key. Use your organization's specific MAK product key for Office 2013.

  6. To set the automatic activation option, add the following line to the Config.xml file:

    <Setting Id="AUTO_ACTIVATE" Value="1" />

    Not setting AUTO_ACTIVATE is the same as setting AUTO_ACTIVATE to a value of 0. The result is that product activation does not occur during Office 2013 deployment.

  7. Save the Config.xml file.

Important:

If any Office applications are running when you do a silent install of Office 2013, a restart may be required at the end of setup. Instruct users to close any Office applications before you install Office 2013. Otherwise their open documents may lose unsaved changes during the upgrade.

After you modify the Config.xml file to specify silent installation options, you can install Office Professional Plus 2013 by using the following command:

\\server\share\Office15\setup.exe /config \\server\share\Office15\ProPlus.WW\config.xml

Where:

\\server\share\Office15 is the path of the Office Professional Plus 2013 source files.

/config is a Setup command-line option that specifies the location of the Config.xml file. See Setup command-line options reference for Office 2013.

\\server\share\Office15\ProPlus.WW\config.xml is the location of your customized Config.xml file for Office Professional Plus 2013.

Note:

If you use the Config.xml file to set silent installation options as in the previous example, you will also want to use the OCT to create a Setup customization file (.msp file) to configure additional installation customizations. For example, you can use the OCT to set feature installation states to change the default way in which Office features are installed. For a complete description of the areas that you can configure by using the OCT, see Office Customization Tool (OCT) reference for Office 2013. Note that the OCT is available with Volume Licensing editions of Office 2013 (and Office 2010 and Office 2007). To determine whether your Office 2013 installation is a Volume Licensing edition, check the Office 2013 installation disk to see whether it contains a folder named Admin. If the Admin folder exists, the product is Volume Licensing edition.

You can also set silent installation options by using the OCT instead of manually editing the Config.xml file. For more information, see the Licensing and user interface section in Office Customization Tool (OCT) reference for Office 2013. (The Level attribute of the Display element in the Config.xml file is equivalent to the Display Level option in the OCT). In enterprise deployments, we recommend that you set the Display Level to None if you use the OCT to make sure that Setup runs silently, to prevent prompting users to enter information, and to prevent the installation from waiting for any user interaction. This includes when files are being used. Setting the Display Level to None assumes that the Suppress modal and Completion notice options are silenced and that the I accept the terms in the License Agreement check box is selected. As noted previously, administrators must also make sure that no other Office applications are running during an installation of Office 2013.

Use the OCT to a configure silent installation and automatic activation

The following example shows how to use the OCT to set silent installation options, enter a MAK product key, and specify the AUTO_ACTIVATE property value for automatic activation.

To configure silent installation and automatic activation options in the OCT

  1. Run the OCT by typing setup.exe /admin at the command line from the root of the network installation point that contains the Office 2013 source files. For example, use \\server\share\Office15\setup.exe /admin.

  2. To set silent installation options, choose Licensing and user interface in the navigation pane, in the details pane choose None in the Display level drop-down box, choose Suppress modal, clear the Completion notice check box, and then choose I accept the terms in the License Agreement.

  3. To enter a MAK key, choose Licensing and user interface in the navigation pane, and in the details pane select Enter another product key, add your organization's MAK product key for Office 2013 in the Product key text box.

  4. To set automatic activation options, choose Modify Setup properties on the navigation pane, and then choose Add in the details pane.

  5. In the Add/Modify Property Value dialog box, in the Name box, type AUTO_ACTIVATE. Note that property names must be uppercase.

  6. In the Value box, type 1, and then choose OK.

  7. When you complete your customizations in the OCT, click Save as on the File menu to save the Setup customization .msp file. You can save the customization .msp file in the Updates folder on the network installation point. Note that you can place only one Setup customization .msp file per product in the Updates folder for initial installations. For more information about using the Updates folder, see "Updates folder" in Office Customization Tool (OCT) reference for Office 2013.

    A network installation point is a secure shared location on the network to which you copy all source files, and any language packs that you want to deploy, from the Office 2013 installation media. For more information about the network installation point, see Create a network installation point in Customize Setup before installing Office 2013.

    To install Office 2013, users can run Setup from the network installation point, or you can use the network installation point as a starting place to distribute Office 2013 by using a software deployment tool, such as Microsoft System Center 2012 Configuration Manager, or to create a hard-disk image or a custom DVD.

See also

Config.xml file reference for Office 2013
Office Customization Tool (OCT) reference for Office 2013
Customize Setup before installing Office 2013
Plan volume activation of Office 2013
Deploy volume activation of Office 2013
Volume activation methods in Office 2013


Create custom configurations of Office 2013

Published: October 16, 2012

Summary: Explains how to use the Office Customization Tool (OCT) and the Config.xml file to customize an Office 2013 Windows Installer-based (MSI) installation.

Applies to: Office 2013

Audience: IT professionals

You can deploy an initial customized installation of Office 2013 to users in your organization by using the examples that are in this article. A Config.xml file example is included.

In this article:

  • Office Customization Tool versions

  • Create a custom configuration

    • To create a network installation point

    • To use the OCT to customize the installation

    • To use the Config.xml file to set installation options

  • Choose a deployment method

  • Config.xml example

We recommend that you read the following articles before you customize the installation:

  • Plan volume activation of Office 2013

  • Deploy volume activation of Office 2013

  • Volume activation methods in Office 2013

Office Customization Tool versions

The Office Customization Tool (OCT), part of the Setup program, is the primary tool that is used to customize a Windows Installer-based Office 2013 client installation. It is included in Volume License versions of Office 2013 such as Office Professional Plus 2013. Before you begin your customizations, you should be aware of the following.

There are two architecture-specific versions of the Office Customization Tool: one for 32-bit Office 2013 and one for 64-bit Office 2013. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version.

The Office 2013 OCT supports the import of setup customization .msp files:

  • 32-bit Office 2013 .msp files can be imported into the 64-bit OCT, and then they can be used to customize 64-bit Office 2013 products.

  • 64-bit Office 2013 .msp files can be imported into the 32-bit OCT, and then they can be used to customize 32-bit Office 2013 products.

Note:

You can import a setup customization .msp file for equivalent cross-architecture products only. For example, you can import a 32-bit Office Professional Plus 2013 customization .msp file into the 64-bit version of the OCT for a 64-bit Office Professional Plus 2013 .msp file. However, you cannot import a 32-bit Word 2013 stand-alone customization .msp file into the 64-bit OCT for a 64-bit Office Professional Plus 2013 .msp file. If you do this, OCT prevents this and displays an error message. You cannot import Office 2010 or Office 2007 Setup customization files (.msp files) into the Office 2013 OCT.

For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013. For information about 64-bit Office 2013, see 64-bit editions of Office 2013.

For more information about the import feature, see Import an Office 2010 Setup customization file. Although the article is about Office 2010, the information also applies to Office 2013.

Create a custom configuration

The following procedures explain how to deploy a custom configuration by using the OCT and Config.xml.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To create a network installation point

  1. Copy all the files and folders from the Office 2013 CD to a folder on the network or on your computer. For example, copy the files to \\server\share\Office15.

    Copy all the language packs and additional Office products that you want to deploy to the same network installation point. When you are prompted to overwrite duplicate Setup files, click No. For more information, see Create a network installation point in Customize Setup before installing Office 2013

Use the Office Customization Tool (OCT) to customize Setup, and configure additional customizations and installation options. This creates a Setup customization file (.msp file). For a complete description of the areas that you can configure by using the OCT, see Office Customization Tool (OCT) reference for Office 2013. In the following example, a new Setup customization .msp file is created.

To use the OCT to customize the installation

  1. From the root of the network installation point that you created previously, run the following command-line option to start the OCT: setup.exe /admin. For example, use the following: \\server\share\Office15\setup.exe /admin.

  2. In the Select Product dialog box, select Create a new Setup customization file for the following product to create a new customization file (for example, for Office Professional Plus 2013 (32-bit)). Choose OK.

    The OCT user interface is displayed, and you can then configure settings in the following areas: Setup, Features, Additional content, and Outlook.

  3. Customize Setup to specify how you want Setup to manage the installation. Use the Setup section of the OCT to configure options such as the default installation location, default organization name, additional network locations that contain the Office 2013 sources, product key, Microsoft Software License Terms, level of user interface to be displayed, and earlier versions of Office to remove.

    The product key option depends on the Office 2013 licensing method that you use. The following options are available in Licensing and user interface:

    1. Use KMS client key A product key entry is not required for enterprise deployments that use Key Management Service (KMS) activation because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products that are licensed under Microsoft Volume Licensing programs. Only a KMS host computer needs a KMS host key to be activated and to establish a local activation service in your environment. Office 2013 connects to the local KMS host for activation. Use KMS client key is the default. For information about how to configure the KMS host, see Prepare and configure the Office KMS host in Deploy volume activation of Office 2013.

      Similar to KMS activation, which activates all Office Volume License clients that are connected to a KMS host, Active Directory-Based Activation activates all Office Volume License clients in an Active Directory domain. For more information about Active Directory-Based Activation, see Active Directory-Based Activation Overview. Note that KMS and MAK are supported on Windows 7 and Windows 8. Active Directory-Based activation is supported only on Windows 8 and Windows Server 2012.

      For more information about volume activation, see Plan volume activation of Office 2013, Deploy volume activation of Office 2013, and Volume activation methods in Office 2013.

    2. Enter another product key You can enter a valid Multiple Activation Key (MAK) key in the OCT by using the Enter another product key entry. A MAK key is another method that Office Activation Technologies provide for activating products that are licensed under Microsoft Volume Licensing programs. By using a MAK, clients activate Office 2013 online by using the Microsoft hosted activation servers or by telephone. To use a MAK key, in the Enter another product key text box, enter the MAK key (twenty-five numbers or characters) without spaces. For more information about how to use a MAK key, see Deploy volume activation of Office 2013.

    Expand the Display level menu to set the behavior of the user interface during installation. In enterprise deployments, we recommend that you set Display level to None to make sure that Setup runs silently, to prevent prompting users to enter information, and to prevent the installation from waiting for any user interaction. This includes when files are being used. Setting Display Level to None selects the Suppress modal option. Select the Completion notice and I accept the terms in the License Agreement options to make sure that the installation is silent. You can also configure display level options by using the Config.xml file; see Display element in Config.xml file reference for Office 2013.

    You can also configure Office security settings if you want to provide an initial default configuration of security settings. For information, see Office security settings in Office Customization Tool (OCT) reference for Office 2013.

    Important:

    Although you can use the OCT to specify initial default security settings in a Setup customization file (.msp file), users can change the settings after installation. To enforce security settings, you must use Group Policy. For more information about security settings, see Overview of security in Office 2013.

    For more detailed information, see Customize Setup before installing Office 2013.

  4. Use the Features section to configure feature installation states. For information, see Set feature installation states in Office Customization Tool (OCT) reference for Office 2013.

    For each application that you want to add to the installation, set the installation option to Run all from My Computer or Installed on First Use in the details pane. For example, to install Outlook 2013, expand Microsoft Office and change the installation option for Microsoft Office Outlook to Run all from My Computer.

    For applications that you do not want to install, set the installation option to Not Available in the details pane. The application name is set to bold to show that you have changed its installation option.

    To prevent users from installing this application themselves, select the Hidden and Locked options. The symbols [H] and [L] are added to the application name to indicate that these options are set.

    Important:

    The Hidden option is not reversible. After it is set, a Hidden feature will not be displayed in the feature tree during or after installation. You cannot use another Config.xml file or apply a second .msp file after the initial installation to "unhide" a feature.

    The feature remains hidden even if you opt to change the installation by using Programs and Features in Control Panel to change the Office 2013 installation.

    It will also not be displayed in the Office Setup feature installation tree under the Add or Remove Features option for Office 2013. Though the feature remains hidden, you can unlock the feature to install and run it locally later by using an .msp file or a Config.xml file. For more information, see Set feature installation states in Office Customization Tool (OCT) reference for Office 2013.

    The Locked option is reversible. If you set the Locked option for a feature by using the OCT or the Config.xml during initial installation, you can later unlock and install the feature locally by using a customization .msp file or a Config.xml file.

    For example, you can customize the Config.xml file to modify the OptionState element and add the following line to uninstall the feature (Access in this case) on the user's computer and set child features of the feature to the specified state:

    <OptionState Id="ACCESSFiles" State="Absent" Children="force" />

    For information about the OptionState element, see Config.xml file reference for Office 2013.

    You can also use the OCT to create a customization .msp file to install the feature later by setting the feature installation state to Run All from My Computer on the Set feature installation states screen.

  5. Use the Modify user settings section (under Features) to specify the user settings that you want to apply. For information, see Modify user settings in Office Customization Tool (OCT) reference for Office 2013.

    Use the Modify user settings section to set the default values of Office application settings for users who install Office with this customization file.

    To configure an option, expand the navigation tree, and then choose the user interface element that you want to configure. The configurable settings that are associated with that element appear on the details pane. You can specify one of the following options:

    Not Configured The setting remains as it is.

    Enabled The setting is changed according to the selections that you make on the setting's Properties page.

    Disabled The setting is disabled. Note that disabling an option may differ from not configuring the option. See the description of the specific option for more information.

    Note:

    Use of the OCT to configure user settings establishes the initial default values for the settings. Users can change most of the settings after Office is installed. If you want to enforce user settings, use Group Policy.

    You can also use Group Policy settings to mandate settings for Outlook. You can manage the following Outlook areas by using Group Policy:

    • Specify the COM add-ins that are trusted.

    • Customize cryptographic options.

    • Configure Outlook Junk E-mail Filter settings. For more information, see Configure junk email settings in Outlook 2013.

    • Configure the method that Outlook uses for security settings.

    • Configure attachment settings.

    • Configure programmatic security settings.

    • Customize ActiveX options and custom forms settings.

    • Disable folder home pages.

  6. You can use the Additional content section of the OCT to configure the following options:

    • Add files to, or remove files from, users' computers when Office is installed. For information, see Add files and Remove files in Office Customization Tool (OCT) reference for Office 2013.

    • Add, modify, or remove registry entries on users' computers when Office is installed. For information, see Add registry entries and Remove registry entries in Office Customization Tool (OCT) reference for Office 2013.

    • Add shortcuts to files that are installed together with Office 2013 or files that are already on the user's computer. For information, see Configure shortcuts in Office Customization Tool (OCT) reference for Office 2013.

  7. You can use the Outlook section (Outlook in Office Customization Tool (OCT) reference for Office 2013) of the OCT to configure the following Outlook areas:

    • Specify settings for Exchange accounts. You can configure users' Exchange Server settings in a new or modified Outlook profile. For information, see Exchange settings in Office Customization Tool (OCT) reference for Office 2013.

    • Outlook Profile settings. You can customize a user's default Outlook profile, which is the set of values in the Windows registry that defines user-specific information. An Outlook profile can contain multiple email accounts. Users can have multiple Outlook profiles, and the Office 2013 OCT provides support for adding multiple Outlook email accounts. For information, see Outlook Profile and Add Accounts in Office Customization Tool (OCT) reference for Office 2013.

    • Include new Outlook email accounts in the user's profile. If you are adding or modifying an Exchange account, you can configure additional Exchange settings. For example, you can configure Exchange Server offline use options, the Outlook Anywhere feature, and you can specify the Cache Mode option to configure users' Outlook profiles to use a local copy of the Exchange mailbox. For more information, see Add Accounts and the "Add Account and Account Settings dialog box," and "Cached Mode" sections in Office Customization Tool (OCT) reference for Office 2013.

    • Export settings to an Outlook profile file (.prf file). For information, see Export Settings in Office Customization Tool (OCT) reference for Office 2013.

    • Define Send/Receive groups for Exchange accounts and folders, and specify the tasks that are performed on each group during a Send/Receive operation in Outlook. A Send/Receive group contains a collection of Outlook accounts and folders. For information, see Specify Send/Receive Groups in Office Customization Tool (OCT) reference for Office 2013.

  8. When you complete your customizations, choose Save As on the File menu, specify a path and file name for the Setup customization file, and then choose Save.

    For initial installations, you can save the custom .msp file in the Updates folder on the network installation point. When Setup runs, it searches the Updates folder on the installation point for a customization file that is specific to the product that is being installed.

    Note:

    If you plan to deploy multiple Setup customization files (.msp files), you can place only one customization .msp file for each Office 2013 product that you are installing in the Updates folder for an initial installation. You must deploy the rest of the customization .msp files after the Office installation is completed. Only one Setup customization .msp file per product in the Updates folder is supported. The customization .msp files that you place in the Updates folder will be deployed first. Therefore, they must include any Setup customizations that cannot be changed after the installation, for example, the installation location.

    If you do not put the customization file in the Updates folder, you can use the Setup command-line option /adminfile to specify the fully qualified path of the folder in which you store the custom .msp file. For example, setup.exe /adminfile \\server\share\myNewUpdatesFolder.

    You can also specify the location of the folder that contains your .msp files in the Config.xml file by using the SUpdateLocation attribute of the SetupUpdates element. For more information about SetupUpdates, see SetupUpdates element in Config.xml file reference for Office 2013.

You can use the Config.xml file to customize many of the same options that you can configure by using the Office Customization Tool. This includes some additional options that are not available in the OCT. For a complete description of the areas that you can configure in Config.xml, see Config.xml file reference for Office 2013.

To specify installation options, such as the path of the network installation point, the product to install, and custom setup options, and to specify the languages to install, use the Config.xml file that is located in the root of the product folder for the product that you are installing.

To edit the Config.xml file, use a text editor, such as Notepad.

To use the Config.xml file to set installation options

  1. To modify the display options that users see during installation, locate the line in the Config.xml file that contains the Display element:

    <!-- <Display Level="full" CompletionNotice="yes" SuppressModal="no" AcceptEula="no" /> -->

    To prevent user intervention during the installation and to specify display options, you can modify the Display element information as shown in the following example:

    <Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

    For information, see Display element in Config.xml file reference for Office 2013.

  2. To specify additional languages to install, use the AddLanguage elements and attributes in the Config.xml file.

    Note:

    If you are adding more than one AddLanguage element, you must add the ShellTransform attribute of the AddLanguage element. This attribute specifies the language that Setup uses for the shell user interface.

    For example, to specify that Setup install full English, French, German, and Spanish language support along with the user's default regional options language as the default installation language, you add the following AddLanguage elements and attributes in the Config.xml file:

    <AddLanguage Id="match" ShellTransform="yes"/> <AddLanguage Id="en-us" /> <AddLanguage Id="fr-fr" /> <AddLanguage Id="de-de" /> <AddLanguage Id="es-es" />

    In the previous example, Setup installs all specified languages plus the language that matches the user's locale, if that language is different and is available in the installation source. For more information, see AddLanguage element in Config.xml file reference for Office 2013.

    You can also use the Config.xml file to configure additional options such as the following:

    • Specify the path of the network installation point. For information, see DistributionPoint element in Config.xml file reference for Office 2013.

    • Specify the 25-character volume license key. The equivalent option in the OCT is the Product key setting in the Licensing and user interface section. As mentioned previously, a product key entry is not required for enterprise deployments that use Key Management Service (KMS) activation because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products that are licensed under Microsoft Volume Licensing programs. However, administrators must make sure that appropriate Office 2013 KMS host licenses are installed and a valid KMS host key is installed, and the key is activated against Microsoft hosted activation servers. You can install Office 2013 KMS host licenses by running the Microsoft Office 2013 KMS Host License Pack. Office 2013 connects to the local KMS host for activation. By default, the Use KMS client key option is selected in the OCT. For more information, see Licensing and user interface in Office Customization Tool (OCT) reference for Office 2013. For information about volume activation, see Plan volume activation of Office 2013 and Deploy volume activation of Office 2013.

      A Multiple Activation Key (MAK) key is another method that Office Activation Technologies provide for activating products that are licensed under Microsoft Volume Licensing programs. By using a MAK, clients activate Office 2013 online by using Microsoft-hosted activation servers or by telephone. Administrators can use the Config.xml file or the OCT to enter a MAK key.

      To enter a MAK key in the Config.xml file, you add the 25-character product key as shown in the following example, where AAAAABBBBBCCCCCDDDDDEEEEE represents the product key:

      <PIDKEY Value="AAAAABBBBBCCCCCDDDDDEEEEE" />

      For more information, see PIDKEY element in Config.xml file reference for Office 2013.

    • Specify the fully qualified path of the folder on users' computers in which the product is installed. For information, see INSTALLLOCATION element in Config.xml file reference for Office 2013.

    • Specify logging options for Setup. For information, see Logging element in Config.xml file reference for Office 2013.

    • Specify how the local installation source (LIS) is cached on the user's computer. For more information, see LIS element in Config.xml file reference for Office 2013.

    • Set the user or company name for the user on whose computer the product is being installed. For information, see USERNAME element and COMPANYNAME element in Config.xml file reference for Office 2013.

    You can use the Config.xml file to customize many of the same options that you can configure by using the Office Customization Tool. This includes some additional options that are not available in the OCT. For a complete description of the areas that you can configure in Config.xml, see Config.xml file reference for Office 2013.

  3. When you complete the Config.xml customizations, save the Config.xml file. You can use the /config Setup command-line option to specify the location of the Config.xml file, as shown in the following example:

    \\server\share\setup.exe /config \\server\share\ProPlus.WW\config.xml

    For information about the /config Setup command-line option, see /config [path] in Setup command-line options reference for Office 2013.

    To see an example of a custom Config.xml file, see Config.xml example. For information about how to set silent installation options, see Configure a silent installation of Office 2013.

Choose a deployment method

To install Office 2013 on users' computers, you can use one of the following approaches, depending on your particular environment and requirements:

  • Use the precached local installation source to install Office on users' computers. When you deploy Office 2013, Setup creates a local installation source on the user's computer — a copy of the compressed source files for the Office product that you are installing. After the files are copied to the user's computer, Setup completes the installation from the local installation source. To minimize the load on the network, you can deploy the local installation source to users' computers separately, before you deploy Office.

    To use this approach, perform the followings tasks:

    • Distribute the local installation source to users. For information, see Deploy the local installation source.

    • Run Setup directly from the local installation source. For information, see Deploy Office 2013 from a local installation source.

  • On the user's computer, run Setup.exe from the root of the network installation point.

  • To deploy Office to users who are not administrators of their computers, you can use one of the following methods.

    Log on to the computer as an administrator and install Office 2013.

    -or-

    Use an enterprise deployment method such as the following:

    • Use Microsoft System Center 2012 Configuration Manager. If you manage lots of clients in a complex or quickly changing environment, System Center 2012 Configuration Manager is the recommended method for installing and maintaining Office 2013 in medium- and large-sized organizations. Configuration Manager offers sophisticated functionality, such as inventory, scheduling, and reporting features.

    • If you have deployed Active Directory and Group Policy in your organization, you can use Group Policy to assign computer startup scripts to deploy Office 2013.

    • You can deploy Office 2013 (MSI) by using virtualization technologies, such as Microsoft Application Virtualization (App-V) and Remote Desktop Services.

    • You can also deploy an image of an installation that includes the operating system and Office 2013.

Config.xml example

The following example shows a Config.xml file for an installation of Office Professional Plus 2013. The following options are used in this example:

  • Display Level is set to turn off the Setup user interface, hide error messages and other dialog boxes, and accept the Microsoft License Terms.

  • Verbose logging is turned on (Logging Type value is set to verbose), and log files are stored in the AppInst folder.

  • INSTALLLOCATION specifies the fully qualified path of the folder on the user's computer in which the product is installed.

  • LIS SOURCELIST provides a list, separated by semicolons, of the network installation points that contain the installation files for the product. The equivalent option in the OCT is Additional network sources.

  • Setting Id specifies the suppress reboot option (SETUP_REBOOT value is set to NEVER).

  • OptionState element specifies to uninstall the feature (Access in this case) on the user's computer and sets child features of the feature to the same specified state.

<Configuration Product="ProPlus">

          <Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

          <Logging Type="verbose" Path="%SYSADMINROOT%\Log\AppInst\Office2013" Template="Microsoft Office 2013 Professional Plus Setup(*).txt" />

          <INSTALLLOCATION Value="%programfiles%\Microsoft Office" />

          <LIS SOURCELIST Value="\\server1\share\Office15;\\server2\share\Office15" />

          <Setting Id="SETUP_REBOOT" Value="NEVER" />

          <OptionState Id="ACCESSFiles" State="absent" Children="force" />

</Configuration>

See also

Office Customization Tool (OCT) reference for Office 2013
Config.xml file reference for Office 2013
Plan volume activation of Office 2013
Deploy volume activation of Office 2013
Configure a silent installation of Office 2013
Overview of Setup architecture for Office 2013
Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013


Office Customization Tool (OCT) reference for Office 2013

Updated: February 26, 2013

Summary: Explains how to use the Office Customization Tool (OCT) to customize Windows Installer-based Office 2013 installations.

Applies to: Office 2013

Audience: IT Professionals

To customize an installation of Office 2013, you can use the Office Customization Tool (OCT) to perform tasks such as the following:

  • Specifying installation options

  • Customizing how Office applications and features are installed

  • Configuring default user settings

  • Managing additional content: add or remove files, registry entries or shortcuts

  • Configuring Outlook options: setting the default profile, adding email accounts, and specifying Exchange settings

In this article:

  • Overview of the Office Customization Tool

  • Architecture-specific versions of the Office Customization Tool

  • Importing Office Customization Tool .msp customization files

  • Configuring Setup, Features, Additional content, and Outlook settings

    • Setup

    • Features

    • Additional content

    • Outlook

  • Downloading updated OCT files

Overview of the Office Customization Tool

The OCT is part of the Setup program and is the recommended tool for most customizations. The OCT is available only with volume licensed versions of Windows Installer-based Office 2013, Office 2010, and the 2007 Office system. To determine whether an Office 2013 installation is a volume licensed version, check the Office 2013 installation disk to see whether it contains a folder named Admin. If the Admin folder exists, the disk is a volume license edition. If the Admin folder does not exist, the disk is a retail edition. For information about the network installation point, see Customize Setup in Customize Setup before installing Office 2013.

You run the OCT by typing setup.exe /admin at the command line from the root of the network installation point that contains the Office 2013 source files. For example, use the following: \\server\share\Office15\setup.exe /admin. When you run the OCT, you choose to create a new Setup customization (.msp) file or to open an existing .msp file. If you create a new file, the OCT displays a list of the products that are available on the network installation point. You must select a single product that you want to customize.

If you use the OCT to change an existing .msp customization file, we recommend that you select the .msp file for the same product that you customize. For example, if you customize Office Professional Plus 2013, select an Office Professional Plus 2013 customization .msp file.

Note:

The Office 2013 release requires Windows Installer 4.0 on computers that are running the 64-bit version of the OCT or importing 64-bit customization .msp files. Windows Installer 3.1 does not recognize properties such as "ProgramFiles64Folder," which are used by the 64-bit version of the OCT and the OCT Import feature. For information about Windows Installer, see Windows Installer (http://go.microsoft.com/fwlink/p/?LinkID=111108).

Updates folder

By using the OCT, you customize Office and save your customizations in a Setup customization .msp file. You place the file in the Updates folder on the network installation point. When you install Office, Setup looks for a Setup customization file in the Updates folder and applies the customizations. The Updates folder can only be used to deploy software updates during an initial installation of Office 2013.

Important:

If you plan to deploy multiple Setup customization files (.msp files), you can place only one customization .msp file for each Office 2013 product that you are installing in the Updates folder for an initial installation. You must deploy the rest of the customization .msp files for a product after the Office installation is complete. Only one Setup customization file per product in the Updates folder is supported. If you are deploying multiple Office 2013 products, such as Office Professional Plus 2013 and Visio Professional 2013, you can include one customization .msp file for Office Professional Plus 2013 and one customization .msp file for Visio Professional 2013 in the Updates folder. The customization .msp files that you place in the Updates folder are deployed first. Therefore, they must include any Setup customizations that cannot be changed after the installation, for example, the installation location.

If you are deploying an initial installation of Office 2013 and you also want to deploy Office 2013 software updates, such as service packs and hotfixes, Setup can apply the product updates as part of the installation process. You can place the Office 2013 product updates in the Updates folder. In scenarios such as this where the Updates folder includes both one Setup customization .msp file and product updates, Setup applies only the Setup customization .msp file during the initial installation and the product updates are applied after the installation is complete.

As an alternative to placing the customization .msp file in the Updates folder, you can use the Setup command-line option /adminfile to specify the fully-qualified path of the location of the .msp file. For example, type: setup.exe /adminfile \\server\share\mychanges\custom.msp.

If you use a folder other than the Updates folder for your customization files, you can specify the folder's location in the Config.xml file by using the SUpdateLocation attribute of the SetupUpdates element. The Config.xml file is located in the core product folder (core_product_folder_name.WW) for the Office 2013 product that you install. For example, ProPlus.WW is the folder name for Office Professional Plus 2013). For more information, see Config.xml file reference for Office 2013.

Modify existing installations

You can also use a Setup customization file to change an existing installation. Because a Setup customization file is an expanded form of a Windows Installer .msp file, you apply the customization file to the user's computer exactly as you would a software update. The user's existing Office installation is updated with the customizations that you make. For example, if you change the installation states of some features to Not Available and apply the resulting customization file to an existing installation of Office, those features are removed from the user's computer. For more information about changing installations, see Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013.

Some options in the OCT are applicable only to a new installation of Office. These options are identified in the OCT and in the OCT Help. For example, you can use the Default installation path option (in the Installation location and organization name section) to specify the folder where Office is to be installed on the user's computer. However, if a customization file is applied to an existing installation, the Default installation path option is ignored (you must uninstall and reinstall Office to change the installation location).

Before you exit the OCT, choose the File menu, and then choose Save as to save the Setup customization file.

Every time that you save a customization file in the OCT, the tool updates the customization file's sequencing number with the current computer date and time stamp and generates a new update globally unique identifier (GUID). The OCT .msp files are applied chronologically according to their time stamp.

To show the sequencing behavior, assume that you have created the following OCT .msp maintenance files:

  1. An OCT .msp file that is named "uninstall-access.msp" in which you set Microsoft Office Access to Not Available. This file is saved first so that it has a lower sequencing number and an older date and time stamp. This .msp file is sequenced first and Access is set to Not Available on users' computers.

  2. An OCT .msp file that is named "install-access.msp" in which you set Microsoft Office Access to Run All from My Computer (by selecting the product and setting the installation state in the Set feature installation states section). This file is saved last so that it has a higher sequencing number and a newer date and time stamp. This .msp file is sequenced later than the first OCT .msp file, "uninstall-access.msp." Therefore, the Access feature is set to Run All from My Computer on users' computers.

Choose OCT options

The OCT includes four major sections: Setup, Features, Additional Content, and Outlook. Each section contains several pages of options. When you change an option, the page name in the navigation pane of the OCT changes to bold type. If you open an existing Setup customization file, the bold page names indicate where options are customized.

The following table lists options that are available in the OCT.

Office Customization Tool options

Section | Page
Setup |
 | Installation location and organization name
 | Additional network sources
 | Licensing and user interface
 | Remove previous installations
 | Add installations and run programs
 | Office security settings
 | Modify Setup properties
Features |
 | Modify user settings
 | Set feature installation states
Additional content |
 | Add files
 | Remove files
 | Add registry entries
 | Remove registry entries
 | Configure shortcuts
Outlook |
 | Outlook Profile
 | Add Accounts
 | Export Settings
 | Specify Send/Receive Groups

Architecture-specific versions of the Office Customization Tool

The OCT provides two architecture-specific versions, one for 32-bit Office 2013 and one for 64-bit Office 2013. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version. The OCT files are located in the Admin folder under the x86 (32-bit) and x64 (64-bit) folders, respectively.

For information about 64-bit Office 2013, see 64-bit editions of Office 2013.

Administrators run the following command-line option to start the OCT from the root of the network installation source: setup.exe /admin. You use the same command to run the 32-bit or 64-bit version of the OCT. Running setup.exe /admin on a 32-bit computer starts the 32-bit OCT, and running this command on a 64-bit computer starts the 64-bit OCT.

  • To run the 32-bit OCT, run the setup.exe /admin command line from the x86 (32-bit) folder as shown in the following example: \\server\share\Office15\x86\setup.exe /admin.

  • To run the 64-bit OCT, run the setup.exe /admin command line from the x64 (64-bit) folder as shown in the following example: \\server\share\Office15\x64\setup.exe /admin.

Setup detects which products are available to create Setup customization updates and lists the results in the Create a new Setup customization file for the following product list. Because the 64-bit and 32-bit Office files are in different root directories, the 32-bit OCT lists all 32-bit Office products in the product selection dialog box (Create a new Setup customization file for the following product), and the 64-bit OCT lists the 64-bit Office products.

Administrators use the 32-bit OCT to create, edit, and save OCT customization updates for the 32-bit Office products, and the 64-bit OCT to create, edit, and save OCT updates for the 64-bit Office products.

Office 2013 includes two architecture-specific folders: one for 32-bit and one for 64-bit, with a separate Config.xml file and Updates subfolder in the 32-bit and 64-bit folders.

Note:

Office 2013 does not support side-by-side installations of 64-bit and 32-bit Office on the same computer, including across applications. For example, there is no support for side-by-side installations of 2007 Office system 32-bit with Office 2013 64-bit, or for Access 2013 64-bit and Excel 2013 32-bit. You cannot use the Office 2013 customization tools to configure side-by-side installations or customizations of 64-bit and 32-bit Office. For example, you cannot create a custom side-by-side installation of a 64-bit Office Professional Plus 2013 and 32-bit Visio 2013 single image. For more information about 64-bit Office, see 64-bit editions of Office 2013.

Importing Office Customization Tool .msp customization files

The OCT Import feature enables administrators to import 32-bit OCT customization .msp files into the 64-bit version of the OCT and 64-bit .msp files into the 32-bit version of the OCT. Administrators of mixed environments (32-bit and 64-bit) can do the Setup customizations one time and import the customizations as follows:

  • Import the 32-bit Setup customization .msp files into 64-bit OCT and then use them to customize 64-bit Office products.

  • Import the 64-bit Setup customization .msp files into 32-bit OCT and can then use them to customize 32-bit Office products.

A 32-bit Setup customization .msp file that is imported to 64-bit OCT is converted to 64-bit, and a 64-bit customization .msp file that is imported to 32-bit OCT is converted to 32-bit. To import a customization .msp file, in the Office Customization Tool, open the File menu and then choose Import. In the Open dialog box, select the .msp file that you want to convert, and then choose Open to start the conversion.

Note:

Importing customization .msp files is intended for equivalent cross-architecture products only. You can import a 32-bit Office Professional Plus 2013 customization .msp file into the 64-bit version of the OCT for a 64-bit Office Professional Plus 2013 .msp file. However, you cannot import a 32-bit Word 2013 stand-alone customization .msp file into the 64-bit OCT for a 64-bit Office Professional Plus 2013 .msp file; doing so is prevented and an error message is displayed.

You cannot import Office 2010 or 2007 Office system Setup customization .msp files into the Office 2013 OCT.

You can also use the Import feature when you have created an initial Setup customization .msp file for an Office 2013 product (for example, Office Professional Plus 2013) and then you later want to modify the installation to add language packs. In such cases, you first add the language packs to the network installation point that contains the Office product source files. Then you run the OCT from the root of the network installation point, create a new Setup customization file for the same product (in this example, Office Professional Plus 2013), and then import the original customization .msp file that you created previously for Office Professional Plus 2013. To import an .msp customization file, in the OCT, open the File menu, and then choose Import. In the Open dialog box, select the previously created customization .msp file that you want to update. On the File menu, choose Save As. Specify a unique name for the .msp file, and then choose Save. Importing the previously created .msp file into the OCT will update the .msp file and include the added languages.

Use the following links to view an Office 2010 video that shows how to use the OCT Import feature. Even though the video was created for Office 2010, the information also applies to Office 2013.

Office Customization Tool Import feature

Running time: 06:06

Play video Watch the "Office 2010 client: Office Customization Tool import feature" video.

Download video For an optimal viewing experience, download the "Office 2010 client: Office Customization Tool import feature" video.

Right-click the link, and then choose Save Target As to download a copy. Choosing the link will open a .wmv file in the default video viewer for full-resolution viewing.

Configuring Setup, Features, Additional content, and Outlook settings

The following sections provide information about the OCT areas that you can configure:

  • Setup

  • Features

  • Additional content

  • Outlook

Note:

You might see a dialog box that prompts you to choose a default document format if the geographic location of the computer on which you are running the Office Customization Tool is set to a European location, and you are creating a new Setup customization .msp file. It can also occur if you open an existing customization .msp file for which no file format settings were configured for Excel, PowerPoint, or Word. Administrators can choose to keep the current settings for the Setup customization file, or choose Office Open XML Formats that support all features of Office 2013, or OpenDocument formats to use the ODF format.

To learn about the file formats, choose Learn more in the dialog box to display the OCT online Help.

Use the following links to view a walkthrough of the Office 2010 OCT user interface. The information also applies to Office 2013.

Office Customization Tool walkthrough

Running time: 08:26

Play video Watch the "Office 2010 client: Office Customization Tool walkthrough" video.

Download video For an optimal viewing experience, download the "Office 2010 client: Office Customization Tool walkthrough" video.

Right-click the link, and then choose Save Target As to download a copy. Choosing the link will open a .wmv file in the default video viewer for full-resolution viewing.

Setup

Use the Setup section to specify the following:

  • Default installation location

  • Default organization name

  • Additional network installation sources

  • Product key

  • Microsoft End-user license agreement

  • Display level

  • Previous versions of Office to remove

  • Custom programs to run during installation

  • Security settings

  • Setup properties

Installation location and organization name

Specify a default organization name and installation location for all users whose installation includes this Setup customization file:

  • Default installation path - This option specifies where Setup installs Office on the user's computer. You can use the predefined folder keyword [ProgramFilesFolder] to specify a path to standard folders in Windows. The default path is [ProgramFilesFolder]\Microsoft Office. This option is recognized only when you first install Office on a user's computer. You cannot change the installation path without uninstalling and reinstalling Office.

  • Organization name - This name appears in the About text box (Help menu) and on the banner pages of Office applications. The name that you specify is used as the default company name for all users whose installation includes this customization file.

Additional network sources

Specify additional servers that have a copy of the network installation point.

Setup looks for servers in this list, in the order specified, if it is installing a feature on demand or if it is repairing Office and the original network installation point is unavailable.

Choose Add to add a source to the list. To edit a path, select a server from the list and then choose Modify. To remove a server from this list, select the server and then choose Remove. To change the order of the list, select a server and then choose the Move arrows to move the server up or down in the list. To remove all servers from the list, select Clear existing server list.

Note:

The OCT verifies all server paths and connects to any available servers during the initial installation process to load balance the file copy process when it creates the Local Installation Source (LIS). However, be aware that specifying an unavailable source as an additional source does not cause the installation to fail.

Add/Modify Network Server Entry dialog box

In the Add Network Server Entry dialog box or Modify Network Server Entry dialog box, enter the path of a server and then choose OK.

You can use a UNC path or, if all users have access to the server that uses the same drive letter, you can use a drive letter in the path. The path can contain environment variables that are delimited by percent (%) if the variables are defined for all users.

For example:

z:\office

\\server1\share\office_root

%USERNAME%\office_root

Licensing and user interface

Use this section for the product key and to accept the Microsoft Software License Terms on behalf of each user who installs Office by using the Setup customization file. Set the Display level of the user interface. These options are recognized by Setup only when you first install Office on a user's computer.

  • Use KMS client key A product key entry is not required for enterprise deployments that use Key Management Service (KMS) activation because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products that are licensed under Microsoft Volume Licensing programs. Only a KMS host computer needs a KMS host key to be activated and to establish a local activation service in your environment. Office 2013 connects to the local KMS host for activation. By default, the Use KMS client key option is selected in Enter a valid product key and licensing agreement for users.

    For more information about the licensing options for Office 2013, see Plan volume activation of Office 2013.

  • Enter another product key You can enter a valid Multiple Activation Key (MAK) key in the OCT by using the Enter another product key option in Enter a valid product key and licensing agreement for users in the details pane. A MAK key is another method that Office Activation Technologies provide to activate products that are licensed under Microsoft Volume Licensing programs. By using a MAK key, clients activate Office 2013 online by using the Microsoft hosted activation servers or by telephone.

    To use a MAK key, in the Enter another product key text box, enter the MAK key (25 numbers or characters) without spaces.

    Important:

    This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription. The Product key text box must not be used to set product keys for Office Professional Plus for Office 365. For information about Office Professional Plus for Office 365, see Overview of Office 365 ProPlus.

    Note:

    You can also activate Office 2013 at the time that you install a MAK key by setting the AUTO_ACTIVATE property value. To do this, follow these steps:

    1. In the OCT, select Modify Setup properties on the navigation pane, and then choose Add in the details pane.

    2. In the Add Property Value dialog box, in the Name box, type AUTO_ACTIVATE. Note that property names must be in uppercase.

    3. In the Value box, type 1, and then choose OK.

    For information about how to configure the AUTO_ACTIVATE property by using the Config.xml file, see Setting element in Config.xml file reference for Office 2013.

  • I accept the terms in the License Agreement Select this check box to accept terms of your license agreement on behalf of the user.

    If Display level is set to Basic or None and you supply a product key, Setup assumes that you also accept the license terms on behalf of the user. In this case, even if you do not select the I accept the terms in the License Agreement check box, the user is not prompted to accept license terms either during installation or the first time that an Office application runs.

  • Display level Select the user interface that you want displayed to users during installation. The options are as follows:

    • Full - default Setup runs interactively, displaying all the user interface options and messages.

    • Basic Setup displays the Welcome screen, prompts for the product key and license terms, if they are needed, and displays a progress bar and completion notice. No other options are presented to the user.

    • None Setup runs silently and displays no user interface.

      Important:

      In enterprise deployments, we recommend that you set Display level to None to make sure that that Setup runs silently. This prevents prompts to users to enter information, and also prevents the installation from waiting for user interactions, even when files are being used. Setting Display level to None selects Suppress modal. Clear the Completion notice check box and choose I accept the terms in the license agreement to make sure that the options are silenced and the license agreement is accepted. Administrators should instruct users to close any Office applications before an installation of Office 2013.

      If you set Display level to Basic and select the Suppress modal option, users may be prompted if there are any Office files that are being used. Setting Display level to None prevents prompting users in these cases. The Suppress modal option does not prevent files-in-use messages from being displayed; only Display level set to None prevents files-in-use messages from being displayed.

  • Completion notice Select this check box if you want Setup to display a message to the user when installation is complete.

  • Suppress modal Select this check box if you do not want Setup to display error messages and other dialog boxes that might interrupt the installation. If you set Display level to Full, error messages and other dialog boxes are displayed regardless of the state of this check box.

  • No cancel Select this check box if you want to disable the cancel button (the X in upper corner). This setting only applies when Display level is set to Full or Basic.

Note:

The Setup customization file (.msp) sets the licensing information only during the initial installation.

The previous licensing and user interface options are identical to the settings in the Config.xml file that are shown in the following table.

Config.xml settings and corresponding OCT options

OCT option | Config.xml setting
Product key | PIDKEY element
I accept the terms in the License Agreement | AcceptEula attribute of the Display element
Display level | Level attribute of the Display element
Completion notice | CompletionNotice attribute of the Display element
Suppress modal | SuppressModal attribute of the Display element
Note:

If there are multiple products on the network installation point and you do not specify which product Setup is to install, Setup uses full display level when it prompts the user for a product, regardless of how you set Display level in the Setup customization file. You use the /config command-line option to specify which product to install. For more information, see Deploy Office 2010 by using Setup from a network installation point.

Remove previous installations

Specify the earlier versions of Office applications that you want to keep or remove. This option is only recognized by Setup when you first install Office on a user's computer.

By default, Setup removes earlier versions of Office applications. To keep an installed Office application, choose Remove previous installations in the OCT, and, in the results pane, select Remove the following earlier versions of Microsoft Office programs, in the list select the Office application that you do not want to remove, choose Details, and in the Select Earlier Versions to Remove dialog box, under Choose which earlier versions you want Setup to remove, clear the check box for the product that you want to remove, and then choose OK.

Important:

Outlook 2013 cannot coexist with earlier versions of Outlook. If you choose to keep earlier versions, do not install Outlook 2013.

Add installations and run programs

Run additional executable programs before or after the Office installation is complete. Setup runs command lines in the order listed in the tool and does not finish the installation until all command lines are run.

Note:

The Add installations and run programs option in the OCT (command-lines that are entered in the Add Program Entry and Modify Program Entry dialog boxes) and the Command element in the Config.xml file and are intended to be used only for initial product installations and uninstallations. The Command element commands are processed only during initial installations and uninstallations. If Command element commands are used for customizations after the initial installation, they are ignored.

The command line can be specified to run an arbitrary command or to run a lightweight executable that you want to run when this product is installed.

The Add installations and run programs option in the OCT and the Command element in Config.xml do not provide the software deployment capabilities that an enterprise software deployment and management tool provides, such as the ability to track deployment progress and troubleshoot problems. Therefore, we recommend that you limit the use of Command element in Config.xml and Add installations and run programs in the OCT to running only lightweight executables or arbitrary commands that will not make changes to the computer or that do not require user input. For example, you can run a utility to copy logs or a command to launch a Welcome page at the end of installation.

  • To add a program to the list in OCT, choose Add installations and run programs and in the results pane choose Add.

  • To change a program, select the program from the list and then choose Modify.

  • To remove a program, select the program and then choose Remove.

  • To change the order of programs in the list, select a program and then choose the Move arrows to move the program up or down in the list.

Note:

Do not add a program that requires the computer to be restarted, unless it is the last program in the list. If a custom program restarts the computer, the Office installation will be complete. However, the custom programs that appear later in this list will not run.

Command-lines that are entered in the Add Program Entry and Modify Program Entry dialog boxes or by using the Command element in the Config.xml file are intended to be used only for initial product installations or uninstallations. Command element commands are processed only during initial installations and uninstallations. If Command element commands are used for customizations after the initial installation, they are ignored.

Add/Modify Program Entry dialog box

When you add or change a program entry, enter the following information in the Add Program Entry dialog box or Modify Program Entry dialog box, and then choose OK.

  • Target Enter the path and file name of the program.

  • Arguments Enter a string of command-line options. For example, /q /path c:\temp.

  • Run this program after the Office product has been installed. The program runs after the Office installation is complete. This is the recommended option. If the program does not close correctly or if the program restarts the computer, the Office installation is not affected. However, programs that are further down the list do not run.

  • Run this program before the Office product has been installed. The program runs before the Office installation starts. If the program does not close correctly or if it restarts the computer, Office is not installed, and programs that are further down the list do not run.

In the Add Program Entry dialog box or Modify Program Entry dialog box, you can include any of the following standard Windows folders in the path of the executable file.

Windows folders

Folder | Description
[INSTALLLOCATION] | The folder in which Office is installed
[WindowsFolder] | Windows folder
[SystemFolder] | Windows System32 folder
[ProgramFilesFolder] | Program Files folder
[CommonFilesFolder] | Program Files\Common Files folder
[DesktopFolder] | Windows Desktop folder
[StartMenuFolder] | Windows Start menu
[ProgramMenuFolder] | Windows Start\Programs menu

Office security settings

Customize the security settings for Office applications.

Important:

Security settings specified in a Setup customization (.msp) file provide only initial default settings on users' computers. Users can change the settings after installation. To help lock down and enforce security settings, you must use Group Policy. For more information, refer to the recommendations in the 2007 Microsoft Office Security Compliance Management Toolkit (http://go.microsoft.com/fwlink/p/?LinkId=158689).

The following table lists the available options.

Security settings

Setting Description

Trusted Publishers

Manage the list that identifies trusted sources for digitally signed macros, add-ins, Microsoft ActiveX controls, and other executable code that is used by Office applications. Office applications share a certificate-based list of trusted sources with Internet Explorer. Choose Add to add a digital certificate (CER file).

Trusted Locations

Manage the list that identifies locations from which any file can be opened without a check by the Trust Center security feature. Choose Add to add a new location, enter the following information, and then choose OK:

  • Application Select the Office application that uses this location. This is supported by Access 2013, Excel 2013, PowerPoint 2013, Visio 2013, and Word 2013.

  • Path Enter the path of the trusted location. Enter a fully qualified path with drive letter or UNC path. The path can include environment variables.

  • Subfolders of this location are also trusted Select this check box to include subfolders as trusted locations.

  • Description Enter text to describe the purpose of the location.

    To remove a trusted location from this list, select the location and then choose Remove.

    Note:

    When you specify one or more trusted locations here, the Trusted Locations list previously defined on the user's computer is cleared and replaced by this list.

Remove all Trusted Locations written by OCT during installation

Clears the Trusted Locations list on the user's computer. Use this check box to clear the Trusted Locations list on the user's computer without adding new locations.

Default Security Settings

Set default security levels for add-ins, templates, and Office applications. You can set security options for the following Office applications:

  • Microsoft Access

  • Microsoft Excel

  • Microsoft Outlook

  • Microsoft PowerPoint

  • Microsoft Project

  • Microsoft Publisher

  • Microsoft Visio

  • Microsoft Word

The following security options are available:

  • Allow trusted locations options

    • Allow trusted locations that are NOT on user's computer

    • Allow Trusted Locations on the User's machine only (application default)

    • Disable all trusted locations. Only files signed by trusted publishers will be trusted

  • Application Add-ins warnings options

    • Disable all Application Extensions

    • Require that Application Extensions are signed by a trusted publisher

    • Require that Application Extensions are signed and silently disable unsigned Extensions

    • Enable all installed Application Add-ins (application default)

  • VBA macro warnings options

    • Disable all VBA macros

    • Disable Trust Bar warning for unsigned VBA macros (unsigned code will be disabled)

    • Disable all VBA macros with notification (application default)

    • No security checks for VBA macros (not recommended, code in all documents can run)

  • Add-ins and templates (Project 2013 only)

    • Trust all installed add-ins and templates

    • Do not trust installed add-ins and templates

  • Security level (Project 2013 only)

    • Very High - Only macros installed in trusted locations will be able to run. All other signed and unsigned macros are automatically disabled

    • High - Only signed macros from trusted sources will be able to run; unsigned macros are disabled

    • Medium - The user can choose whether to run potentially unsafe macros

    • Low (not recommended) - Users are not protected from potentially unsafe macros

Unsafe ActiveX Initialization

Determine whether unsigned and, therefore potentially unsafe, ActiveX controls can initialize using persisted data, that is, data that is saved from one instance of the control to the next. The possible values are as follows:

  • <do not configure> - Setup does not modify the setting specified on the user's computer. New applications are installed with the default setting, which is Prompt user to use persisted data.

  • Prompt user to use control defaults - The user is warned before an application begins ActiveX controls that might be unsafe. If the user trusts the source of the document, the control is initialized by using its default settings.

  • Prompt user to use persisted data - The user is warned before an application begins ActiveX controls that might be unsafe. If the user trusts the source of the document, the control is initialized by using persisted data.

  • Do not prompt - All unsigned ActiveX controls run without prompting the user. This setting provides the least protection and we do not recommend it.

  • Do not prompt and disable all controls - All unsigned ActiveX controls are disabled without prompting the user.

Modify Setup properties

Modify Setup properties that are applied during the Office installation. You can customize Setup properties only when you first install Office on a user's computer. Properties set in a customization file do not take effect if you apply the file to an existing installation.

To add a property, choose Add. To change a property that you have added, select the property and then choose Modify. To remove a property that you have added, select the property and then choose Remove.

For more information about properties and their values, see Setup properties reference for Office 2013.

Add/Modify Property Value dialog box

When you add or change a Setup property, enter the information that is shown in the following table in the Add/Modify Property Value dialog box, and then choose OK.

Add/Modify property value settings

Setting | Description
Name | The property name. Property names must all be in uppercase.
Value | The value of the property.

Features

Use the Features section of the OCT to configure user settings and to customize which Office features are installed.

Modify user settings

Set the default values of Office application settings for users who install Office with this customization file.

Note:

When you use the OCT to configure user settings, it establishes the initial default values for the settings. Users can change most of the settings after Office is installed. If you want to enforce user settings, use Group Policy.

You can use the OCT to provide default user settings for the following Office applications:

  • Microsoft Access 2013

  • Microsoft Excel 2013

  • Microsoft InfoPath 2013

  • Microsoft Office 2013

  • Microsoft OneNote 2013

  • Microsoft Outlook 2013

  • Microsoft PowerPoint 2013

  • Microsoft Project 2013

  • Microsoft Publisher 2013

  • Microsoft SharePoint Designer 2013

  • Microsoft Visio 2013

  • Microsoft Word 2013

Some applications also provide computer settings, including the following: Microsoft InfoPath 2013 (Machine), Microsoft Office 2013 (Machine), Microsoft PowerPoint 2013 (Machine), and Microsoft Visio 2013 (Machine).

To configure an option, expand the application folder and subfolders in the user settings navigation pane until the setting that you want to configure is listed in the details pane, and choose the setting. Configurable settings that are associated with that element appear on the Setting column in the details pane. Double-click a setting in the details pane, and select one of the options shown in the following table.

OCT user and computer settings states

Setting | Description
Not Configured | The setting remains as it is.
Enabled | The setting is changed, based on your choices in the dialog box.
Disabled | The setting is disabled. Disabling an option may differ from not configuring the option. See the description of the specific option for more information.

Choose Show all settings to display all available user settings. Choose Show configured settings only to display only those settings that you have configured.

Select the Migrate user settings check box to preserve users' custom settings from an earlier version of Office. If you change user settings and also select this check box, Setup first applies the modified settings and then migrates the user's existing custom settings, overwriting any conflicting settings.

Note:

When you choose Enabled to view the options for a setting and then choose OK, Previous Setting, or Next Setting, the status changes to Configured, even if you do not change the setting. If you unintentionally configure the setting by using an empty hyperlink, path, or file name, errors might result. If you chose Enabled and want to ignore your changes or avoid configuring the setting, choose Cancel. You can also return a setting to the Not Configured state by double-clicking the setting, selecting Not Configured, and choosing OK.

Set feature installation states

Customize how Office features are installed on the user's computer.

To change the installation state of a feature, choose Set feature installation states in the OCT. In the results pane, open the shortcut menu (or right-click the feature), and choose the installation state. Some parent features consist of multiple child features. Choose the plus sign (+) that is next to the parent feature to expand the tree and view child features.

When you change the installation state of a feature, the name of the feature and the names of all its child features, if any, are displayed in bold font. This indicates that Setup will apply these changes to the installation. Features that are not displayed in bold font are installed by using the default installation state. To remove a change, select the feature and select the Reset option or select the feature and choose the Reset Branch button.

The following feature installation states are typically available to users during Setup. Not all installation states are available for every feature. For example, if a feature contains a component that cannot be advertised, Installed on First Use is not included in the list of available installation states for that feature.

Feature installation states

State Description

Run from My Computer

Setup copies files and writes registry entries and shortcuts that are associated with the feature to the user's hard disk. The application or feature runs locally.

Run All from My Computer

Same as Run from My Computer, except all child features that belong to the feature are also set to this state.

Installed on First Use

Setup leaves components for the feature and its child features in the local installation source until the user attempts to use the feature for the first time, at which time the components are installed. This is also known as an advertised feature.

Not Available

The components for the feature and the child features that belong to this feature are not installed on the computer.

Note:

The Not Available installation state is reversible. When Not Available is set, a feature will not be installed. However, the feature can later be installed locally by using an .msp or a Config.xml file.

To unlock and install a feature locally, you can edit the Config.xml file to modify the OptionState element, as described in the note for the Locked feature state description. For more information about the Config.xml file, see Config.xml file reference for Office 2013.

You can also use the OCT to create an .msp file to install a feature locally. To do this, choose Set feature installation states in the navigation pane. In the details pane, choose a feature, and then from its shortcut menu, choose Run All from My Computer. For more information, see Set feature installation states in Office Customization Tool (OCT) reference for Office 2013.

Note:

The following subcomponents of Publisher 2013 are not visible in the Setup feature installation state tree in the Office 2013 release:

  • Commercial Printing and the Enhanced RGB to CMYK Conversion subcomponent

  • Font Schemes

  • PaperDirect Previews

  • Publisher Templates and the Business Publications and Other Publications subcomponents

The following options are also available for each feature.

Feature options

Option Description

Hidden

Setup does not display the feature in the feature tree during installation if Setup runs interactively. The symbol [H] is prepended to the feature name to indicate the feature is hidden.

Note:

The Hidden option is not reversible. After it is set, a Hidden feature will not be displayed in the feature tree during or after installation. You cannot use another Config.xml file or apply a second .msp file after the initial installation to "unhide" a feature.

The feature remains hidden even if you opt to change your installation by using Programs and Features in Control Panel to change your Office 2013 installation.

It will also not be displayed in the Office Setup feature installation tree under the Add or Remove Features option for Office 2013. Though the feature remains hidden, you can unlock the feature to install and run it locally later by using an .msp file or a Config.xml file.

Locked

The installation state that you choose for this feature cannot be changed by the user during installation or in maintenance mode after Office is installed. The symbol [L] is prepended to the feature name to indicate the feature is locked.

Note:

The Locked option is reversible. If you set the Locked option for a feature by using the OCT or the Config.xml file during initial installation, that feature can be unlocked and installed locally by using an .msp file or a Config.xml file at a later date.

For example, you can edit the Config.xml file to modify the OptionState element as shown in the following example. This adds the OptionState element line to install the feature (in this case, Access 2013) on a user's computer, and to set child features of the feature to the specified state.

  • To edit the Config.xml file to modify the OptionState element, open the Config.xml file in the core product folder (core_product_folder_name.WW folder, for example, ProPlus.WW) for the Office 2013 product that you are installing. Use a text editor tool, such as Notepad, to modify the file.

  • Locate the line in the Config.xml file that contains the OptionState element:

    <!-- <OptionState Id="OptionID" State="absent" Children="force" /> -->

  • Modify the OptionState element as follows and then save the Config.xml file:

    <OptionState Id="ACCESSFiles" State="local" Children="force" />

For information about the OptionState element, see Config.xml file reference for Office 2013.

You can also use the OCT to create an .msp file to install a feature locally. To do this, choose Set feature installation states in the navigation pane. In the details pane, choose a feature, and then from its shortcut menu, choose Run All from My Computer. For more information, see Set feature installation states in Office Customization Tool (OCT) reference for Office 2013.

Reset

The feature is returned to its default installation state. This is the same as selecting the feature and choosing the Reset Branch button.

If you explicitly set a feature to its default state, the symbol [F] is prepended to the feature name to indicate that the feature will be forced into this state. This is useful if you are creating a Setup customization file to change an existing Office installation. If you do not change the installation state of a feature, Setup does not change the feature on the user's computer. If you specify a change, including setting the feature to its default state, Setup ensures that the feature is set to that state on the user's computer.

When you change the installation state of a feature, Setup might change the installation state of a parent or child feature to match the installation state. For example, if you set a parent feature to Installed on First Use, but set a child feature to Run from My Computer, Setup also changes the state of the parent feature to Run from My Computer.

Setup does not display hidden features in the feature tree when users run Setup interactively. The feature is installed according to its defined installation state. Child features that belong to the hidden feature are also hidden.

Tip:

The best use of the Hide setting is to simplify the feature tree for users. For example, you might hide the Office Tools branch of the feature tree so that users do not have to decide which tools they need to install. Only the tools that you select are installed.

If you set a feature to Not Available and hide the feature in the feature tree, users can still change the setting and install the feature by installing the parent feature or by running Setup in maintenance mode. For example, if you set the Name Smart Tag Plugin feature to Not Available and Hidden, users can still install the feature by setting the parent Smart Tags Plugins feature to Run All from My Computer.

If you want to help prevent users from installing hidden features, select the Not Available, Hidden, and Locked installation states. In this case, the feature or application is not installed and is not available in maintenance mode. Users cannot install the feature by changing the state of the parent feature. The only way to reverse the Not Available, Hidden, and Locked installation state selection after Office is installed is to use the OCT to create a Setup customization file that is configured to change the installation state of the feature. Then you apply the customization file to the user's computer.

Additional content

Use the Additional content section of the OCT to add or remove custom files, registry entries, and shortcuts during the installation.

Add files

Add files to users' computers when Office is installed.

To create a list of files to add to the user's computer during installation, choose Add, select the file that you want to add to the list, and choose Add again. To change the destination path of a file, select the file in the Add custom files list and choose Modify. To remove a file from the list, select the file and choose Remove. You can use the SHIFT and CTRL keys to select multiple files at the same time.

When you add files to an Office installation, note the following:

  • Files are copied into the Setup customization file when you save the customization file and exit the OCT. Large files increase the size of the customization file and the time that is required to create the file.

  • If you revise a file that is currently included in the customization file, you must open the customization file by using the OCT, remove the file from the Add files list, add the revised version, and save the customization file.

  • If the user removes, repairs, or reinstalls Office, the custom files are removed or reinstalled together with Office. Setup does not reinstall a custom file if the file has changed since installation.

File Destination Path dialog box

In the Destination path on the user's computer dialog box, enter the folder where you want to install the file on users' computers, and Choose OK.

You can select multiple files at the same time by using the SHIFT and CTRL keys. These files will be associated with the same destination folder. You can use the special folder names that are shown in the following table in the destination path.

Special folders

Folder | Description
[INSTALLLOCATION] | The folder in which Office is installed
[ROOTDRIVE] | The local disk drive that has the most free space
[ProgramFilesFolder] | Program Files folder
[CommonFilesFolder] | Program Files\Common Files folder
[WindowsFolder] | Windows folder
[SystemFolder] | Windows System32 folder
[PersonalFolder] | The user's My Documents folder
[AppDataFolder] | The user's Application Data folder
[NetHoodFolder] | The user's My Network Places folder

Remove files

Remove files from users' computers when Office is installed.

To create a list of files to remove from the user's computer during installation, choose Add. To modify the path or name of a file, select the file in the Remove files list and choose Modify. To remove a file from the list, select the file and choose Remove. You can use the SHIFT key and CTRL key to select multiple files at the same time.

Note:

Files that are listed in the Remove files list are removed from the user's computer before files that are listed in the Add files list are installed. Therefore, you can delete existing files on a user's computer and replace them with new versions. If the destination file on a user's computer is renamed or changed, an added file that has the same name does not replace it.

File Path dialog box

In the File path dialog box, enter the path and file name of the file that you want to add to the list of files to remove from the user's computer, and choose OK.

The path must begin with a drive letter, a UNC path, or one of the special folders shown in the following table.

Special folders (file path)

Folder | Description
[INSTALLLOCATION] | The folder in which Office is installed
[ROOTDRIVE] | The local disk drive that has the most free space
[ProgramFilesFolder] | Program Files folder
[CommonFilesFolder] | Program Files\Common Files folder
[WindowsFolder] | Windows folder
[SystemFolder] | Windows System32 folder
[PersonalFolder] | The user's My Documents folder
[AppDataFolder] | The user's Application Data folder
[NetHoodFolder] | The user's My Network Places folder

Add registry entries

Add or change registry entries on users' computers when Office is installed.

To create a list of registry entries to add to users' computers, choose Add. To change an entry in the list, select the entry and choose Modify. To remove an entry from the list, select the entry and choose Remove. Choose Import to add a set of entries from a registry file (.reg file). If an entry in the .reg file duplicates an entry in the list, the OCT prompts you to decide whether to overwrite existing registry entries with entries in the .reg file.

Important:

Registry entries customized in this section might override settings that are customized elsewhere in the OCT. Use this section to customize options that cannot be set directly in the Office user interface and that are not configurable by using other methods in the OCT.

You should not use the Add registry entries section of the OCT to add registry-based policy keys (Group Policy-based registry keys). Configuring and distributing those settings in a customization update (.msp file) to users is not supported, and the settings might not be applied correctly. Registry-based policy settings are settings that are stored in any of the four registry locations for Group Policy settings:

For user policy settings:

  • HKCU\Software\Policies

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Policies

For computer policy settings:

  • HKLM\Software\Policies

  • HKLM\Software\Microsoft\Windows\CurrentVersion\Policies

The supported way to manage registry-based policy keys is to use Group Policy to apply the registry policy settings. By using Group Policy, you can centrally manage client registry keys. Use Group Policy to define configurations once and then rely on the operating system to enforce that state. Administrative Templates files are UNICODE text files that Group Policy uses to describe where registry-based policy settings are stored in the registry. All registry-based policy settings appear and are configured in Group Policy Management Editor in Group Policy Management Console (GPMC) under the Administrative Templates nodes.

Add/Modify Registry Entry dialog box

In the Add/Modify Registry Entry dialog box, enter the information that is shown in the following table for each registry entry, and then choose OK.

Add/Modify Registry Entry dialog box options

Setting | Description
Root | Select the branch that contains the entries that you want to add or change. Settings are applied one time per user (HKEY_CURRENT_USER) or one time per computer (HKEY_LOCAL_MACHINE). You cannot add registry entries to the root of HKEY_USERS or HKEY_LOCAL_MACHINE.
Data type | Select a data type for the registry value.
Key | Enter the name of the subkey where the entry is stored. For example, Software\Microsoft\Office\15.0\Common.
Create empty key | Select this check box if the registry entry does not contain a value name or value data. Some settings are determined by the presence or absence of the registry entry.
Value name | Enter a name for the new registry entry. If you include Value data but leave this field blank, the value is assigned the name <Default>. A key can have only one <Default> value name.
Value data | Enter the data (value) to store in the new registry entry. The data must match the data type.

Remove registry entries

Remove registry entries from users' computers when Office is installed.

To create a list of registry entries to remove from users' computers, choose Add. To change an entry in the list, select the entry and choose Modify. To remove an entry from the list, select the entry and choose Remove.

To create a list of registry entries to remove from users' computers, choose Add and enter the following information for each registry entry.

Note:

If the user removes, repairs, or reinstalls Office, the custom registry entries are removed or reinstalled with Office.

Delete/Modify Registry Entry dialog box

In the Delete/Modify Registry Entry dialog box, enter the information that is shown in the following table for each registry entry, and then choose OK.

Delete/Modify Registry Entry dialog box options

Entry | Description
Root | Select the branch that contains the entries that you want to remove.
Key | Enter the full name of the subkey where the entry is stored. For example, Software\Microsoft\Office\15.0\Common.
Value name | Enter the name of the registry entry that you want to remove. Leave this field blank to remove the complete subkey, including all its value entries.

Configure shortcuts

Add shortcuts to files that are installed with Office 2013 or files that were already on the user's computer. You can configure shortcuts only when you first install Office on a user's computer. This option is ignored if you apply the Setup customization file to an existing installation.

Choose Add to add a new shortcut. To change a shortcut in the list, select the shortcut and choose Modify. To remove a shortcut from the list, select the shortcut and choose Remove.

Important:

There is a known issue about changing the shortcut location for an Office 2013 application. For more information, see the Microsoft Knowledge Base article Can't change Office 2013 shortcut locations in the Office Customization Tool.

Shortcuts with Yes in the Installed column are configured during installation. Shortcuts that have No in this column are configured if the corresponding product is later installed.

Note:

If you add a shortcut to a custom application or file, that shortcut is not updated or removed if the user changes, repairs, reinstalls, or removes Office.

Add/Modify Shortcut Entry dialog box

In the Add/Modify Shortcut Entry dialog box, enter the information that is shown in the following table for the shortcut that you create or change, and then choose OK.

Add/Modify Shortcut Entry dialog boxoptions

Setting Description

Target

Specify the application associated with the shortcut by selecting a predefined application keyword or by entering the name and path of the file to which the shortcut will point. If you select an application keyword, the OCT automatically enters information in the remaining boxes. The names in the list correspond to features that you select on the Set feature installation states page of the OCT, plus any custom files that you add to the installation on the Add files page. If you enter a name and path and the name or path contains a space, you must enclose the complete string in double quotation marks (""). You can add command-line options for the application by using the Arguments field.

Location

Specify the folder in which the shortcut is created by selecting a predefined folder keyword or by entering the name and path of the location of the shortcut. You can specify a subfolder by appending a backslash (\) followed by the subfolder name. For example, to install the Microsoft Word 2010 shortcut in the Microsoft Office subfolder in the Programs folder in the Start menu, select [ProgramMenuFolder] and append the subfolder name as follows: [ProgramMenuFolder]\Microsoft Office.

You can use the following special folders for Location:

  • [StartMenuFolder]: Windows Start menu.

  • [ProgramMenuFolder]: Windows Start\Programs menu.

  • [StartupFolder]: Startup folder in the Windows Start\Programs menu.

  • [DesktopFolder]: Windows Desktop folder.

  • [INSTALLLOCATION]: The folder in which Office is installed.

  • [FavoritesFolder]: The user's Favorites folder.

  • [AppDataFolder]: The user's Application Data folder.

  • [NetHoodFolder]: The user's My Network Places folder.

Name

Enter any string to specify a name for the shortcut.

Start in

Enter a path to specify the default starting folder for the application. If you leave this box blank, the default folder is set to the folder where the destination file resides. If the path is not valid on a user's computer, the user sees an error message when the user tries to use the shortcut.

Arguments

Enter optional arguments to pass to the application on the command line.

Shortcut key

Enter an optional keyboard shortcut for the application or file. The syntax for the shortcut key is as follows:

[modifier+]VK_key

where modifier is SHIFT, CTRL, ALT, or EXT, and VK_key is a virtual key name (virtual key names, and hexadecimal key codes and descriptions are provided in the following table). The modifier is optional. You can specify more than one, in any order, separated by plus signs (+). If you use a modifier, it must precede the virtual key name. You must enter one virtual key name. Do not use spaces anywhere in the key definition.

For example,

CTRL+VK_F12

CTRL+SHIFT+VK_A

ALT+CTRL+VK_SNAPSHOT

Some key combinations, such as CTRL+ALT+VK_DELETE, might be used by the system or other processes. Do not use these combinations to open the application on the user's computer.

Run

Select the kind of window in which the application or file is to start (Normal window, Minimized, or Maximized).

Change Icon

Select a different icon for the shortcut.

The following table lists virtual key names and their corresponding hexadecimal key codes.

Virtual key names and hexadecimal key codes

Virtual Key Name | Key Code (Hex) | Description
VK_0 - VK_9 | 30-39 | Keys 0-9
VK_A - VK_Z | 41-5A | Keys A-Z
VK_NUMPAD0 - VK_NUMPAD9 | 60-69 | Keys 0-9 on the numeric keypad
VK_F1 ... VK_F24 | 70-87 | Function keys F1-F24
VK_LBUTTON | 01 | Left mouse button
VK_RBUTTON | 02 | Right mouse button
VK_CANCEL | 03 | Control-break processing
VK_MBUTTON | 04 | Middle mouse button (three-button mouse)
VK_BACK | 08 | BACKSPACE key
VK_CLEAR | 0C | CLEAR key
VK_RETURN | 0D | ENTER key
VK_PAUSE | 13 | PAUSE key
VK_CAPITAL | 14 | CAPS LOCK key
VK_PRIOR | 21 | PAGE UP key
VK_NEXT | 22 | PAGE DOWN key
VK_END | 23 | END key
VK_HOME | 24 | HOME key
VK_LEFT | 25 | LEFT ARROW key
VK_UP | 26 | UP ARROW key
VK_RIGHT | 27 | RIGHT ARROW key
VK_DOWN | 28 | DOWN ARROW key
VK_SELECT | 29 | SELECT key
VK_EXECUTE | 2B | EXECUTE key
VK_SNAPSHOT | 2C | PRINT SCREEN key
VK_INSERT | 2D | INS key
VK_DELETE | 2E | DEL key
VK_HELP | 2F | HELP key
VK_MULTIPLY | 6A | Multiply key
VK_ADD | 6B | Add key
VK_SEPARATOR | 6C | Separator key
VK_SUBTRACT | 6D | Subtract key
VK_DECIMAL | 6E | Decimal key
VK_DIVIDE | 6F | Divide key
VK_NUMLOCK | 90 | NUM LOCK key
VK_SCROLL | 91 | SCROLL LOCK key

Outlook

Use the Outlook section of the OCT to customize the default Outlook 2013 profile and to set Outlook 2013 and Exchange Server 2010 options.

The OCT provides support for adding multiple Outlook email accounts.

Outlook Profile

Customize a user's default Outlook profile, which is the set of values in the Windows registry that defines user-specific information. An Outlook profile can contain multiple email accounts. Users can have multiple Outlook profiles. However, you can configure only one profile in the Setup customization file. The settings in the following table enable you to customize a user's Outlook profile.

Outlook profile customization options

Setting Description

Use existing profile

Use the profile that is already configured on the user's computer, or if no profile exists, prompt the user to create a profile the first time Outlook starts.

Modify profile

Select one of two options:

  • Define changes to make to the existing default profile. If a default profile does not exist, Outlook creates a new one using your customizations. Modify the default profile on the user's computer.

  • Define changes to the profile named Specify the name of the profile to which your changes apply.

If no default profile exists or there is no profile by the name that you specify with the second option, Outlook creates a profile that is based on the options that you choose in the other Outlook sections of the OCT. Outlook uses the default profile name or uses the profile name that you specify.

New profile

Create a new profile on the user's computer and make it the default profile. Existing profiles are not removed and remain available to users. You must enter a name in the Profile name text box. To find the name of an existing profile, open Mail in the Control Panel and choose Show Profiles. Outlook creates the profile, based on the options that you choose in the other Outlook sections of the OCT.

Apply PRF

Import an Outlook profile file (.prf) to define a new default profile or to update an existing profile. Selection of this option does not update the OCT with the settings in the .prf file. Enter a name and path for the profile in the Apply the following profile (PRF file) text box. If you created a .prf file for an earlier version of Outlook, you can import it to Outlook 2013 if the profile defines only MAPI services.

Add Accounts

Include new Outlook email accounts in the user's profile.

Select the Do not customize Outlook profile and account information option if you do not want to add accounts to a new or changed Outlook profile.

Select the Customize additional Outlook profile and account information option to specify new account information in a new or changed Outlook profile.

Choose Add to add a new account to the list. To change an account in the list, select the account and then choose Modify. To remove an account from the list, select the account and then choose Remove.

You can also specify the following:

  • Deliver new mail to the following location When you configure an Exchange Server computer or add an Outlook data file (.pst), select this option to specify a delivery location for new email messages. The default location is the Exchange Server computer, if one is configured; otherwise, the location uses the .pst file on the user's computer.

  • Default e-mail account Select the account that is the default email account for users.

Add Account and Account Settings dialog box

If you are adding a new account, select the kind of account that you want to add and then choose Next.

In the <account type> Settings dialog box, set the options that are appropriate for the kind of account that you are adding or changing, such as account name, user name, mail server, and email address. Choose More Settings for additional configuration options. If you are adding or changing an Exchange account, see Exchange settings in the next section. choose Finish when you are finished.

To make sure that that email services do not overlap, Outlook might not enable you to add more than one new account for the same kind of service. For example, Outlook verifies that all POP accounts have unique names. The following table shows how Outlook determines whether a new account of the same type as an existing account can be added to the Setup customization file.

Adding additional accounts

Account type | More than one of this type allowed? | Data used to determine whether conflict exists
POP3 | Yes | Account name
IMAP | Yes | Account name
Exchange | Yes | Account name
Outlook Data File (.pst) | Yes | File name and path of .pst file
Outlook Address Book | No | Existence of account
LDAP | Yes | Account name

Exchange settings

Configure users' Microsoft Exchange settings in a new or changed Outlook profile. The following table lists the possible settings.

Exchange options

Setting | Description
Account name | Specify a name for the Account type.
User name | Identify the user by using a specific value or replaceable parameter. If you specify the default %USERNAME%, Outlook uses the user's exact logon name, instead of prompting the user with possible variations when Outlook starts.
Exchange Server | Enter the name of an Exchange server that is likely to be available when users start Outlook. When a user starts Outlook for the first time, Outlook replaces this value with the user's correct Exchange server. Provide only a literal server name in this text box. For example, Exch-2-Srvr. Do not include backslashes (\\) or similar syntax.
Overwrite existing Exchange accounts | Select this option to replace an existing Exchange Server account in the user's profile with this account.

More Exchange Server Settings

Choose the More Settings button in the Exchange Settings dialog box to configure Exchange Server offline use options and the Outlook Anywhere feature.

Exchange

Use the following options to configure user's Outlook profiles for offline use and Outlook Anywhere.

Outlook Anywhere options

Option Description

Configure Outlook Anywhere

Connect to Exchange Mailbox using HTTP Select this option to enable Outlook Anywhere.

If you have enabled Outlook Anywhere, you can configure the following options:

  • Use this URL to connect to the proxy server for Exchange Server name URL for the Outlook Anywhere proxy server

    Do not enter http://or https:// as part of the name. The appropriate entry (http:// or https://) is included automatically in the box after you enter the name, based on the authentication settings that you choose.

  • Connect using SSL only Select this option to connect to the proxy server by using Secured Sockets Layer only. If you want to support both server authentication and client authentication, select:

    • Mutually authenticate the session when connecting with SSL If this is enabled, enter the Principal name for proxy server.

  • On fast network, connect using HTTP first, then connect using TCP/IP On a fast network, connect by using Outlook Anywhere (HTTP) first instead of the default LAN (TCP/IP).

  • On slow network, connect using HTTP first, then connect using TCP/IP On a slow network, connect by using Outlook Anywhere (HTTP) first instead of the default LAN (TCP/IP).

  • Use this authentication when connecting to the proxy server for Exchange The default method is Password Authentication (NTLM).

Cached Mode

Use the following options to configure users' Outlook profiles to use a local copy of the Exchange mailbox.

Cached Mode options

Option Description

Do not configure Cached Exchange Mode

By default, Exchange mailboxes can be accessed from the Exchange Server computer, instead of being cached on users' computers in an offline Outlook Data File (.ost).

Configure Cached Exchange Mode

Create an .ost file or use an existing .ost file. Users work with a local copy of their Exchange mailbox. If you select Use Cached Exchange Mode, you can configure Cached Exchange Mode for users by using the following options:

  • Download only headers Download copies of headers only from users' Exchange mailboxes.

  • Download headers followed by the full item Download copies of headers from users' Exchange mailboxes and download copies of messages.

  • Download full items Download copies of full messages (headers and message bodies) from users' Exchange mailboxes.

  • On slow connections, download only headers When a slow network connection is detected, download copies of headers only from users' Exchange mailboxes.

  • Download shared non-mail folders Download shared non-mail folders from other users' mailboxes.

  • Download Public Folder Favorites Download the list of Public Folder Favorites.

  • Customize location for .ost and .oab files

    • Path and file name of the Outlook data (.ost) file Specify the name and location where the offline Outlook data file should be stored.

  • Directory path to store Offline Address Book files Specify the path where the offline Address Book files should be stored.

Export Settings

Export settings to an Outlook profile file (.prf).

Choose the Export Profile Settings button to save the Outlook profile settings that you have defined in a .prf file.

Tip:

An efficient way to create an Outlook .prf file is to use the OCT to make selections and then export them to a .prf file, even if you are not using a Setup customization file when you deploy Office. You can edit the .prf file to make additional customizations that are not exposed in the OCT. For example, you can add an email provider that is not listed in the OCT.

Specify Send/Receive Groups

Define Send/Receive groups for Exchange accounts and folders, and specify the tasks that are performed on each group during a Send/Receive in Outlook. A Send/Receive group contains a collection of Outlook accounts and folders. You can specify different options for Send/Receive groups when Outlook is online and offline, as shown in the following table.

Send/Receive groups options

Option Description

Do not configure Send/Receive settings

Do not configure settings for Send/Receive groups. Outlook is configured to use only the All Accounts group and its default settings. (If users have created additional groups, those groups migrate when users upgrade to Outlook 2013.)

Configure Send/Receive settings

Configure settings for Send/Receive groups (Exchange accounts and folders only).

  • Choose New to create a new group of accounts and folders.

  • Choose Modify to specify or redefine options for a Send/Receive group.

  • Choose Rename to change the name of an existing Send/Receive group.

  • Choose Remove to remove an existing Send/Receive group.

New Exchange Group dialog box

Enter the name of the Exchange send/receive group that you are creating in the New Group Name box and then choose OK.

Modify Group dialog box

When you change a group, select from the following options in the Modify Group dialog box and then choose OK.

Select the options shown in the following table under Select options for this Send/Receive group.

Send/Receive settings for the selected group

Option | Description
Send mail items | Send mail items from the Outbox when you execute a Send/Receive for this group.
Receive mail items | Receive mail items when you execute a Send/Receive for this group.
Make folder home pages available offline | Refresh the content in folder home pages when you execute a Send/Receive for this group.
Synchronize forms | Synchronize forms when you execute a Send/Receive for this group.

Under Change folder options for this Send/Receive group, select a folder and provide the information that is shown in the following table.

Folder options for this Send/Receive group

Option Description

Include this folder in Send/Receive

Add this folder to the set of folders that are updated during a Send/Receive for this Send/Receive group, and select from the following options:

  • Download headers only Download only headers for this folder when you update the folder by executing a Send/Receive for this Send/Receive group.

  • Download complete item including attachments Download complete e-mail messages (or other items) for this folder when you update the folder by executing a Send/Receive for this Send/Receive group.

  • Download only headers for items larger than When items are larger than the specified size, download only the header for the item. This setting applies to only this folder when you update the folder by executing a Send/Receive for this Send/Receive group.

Rename Exchange Group dialog box

Enter the new name of the Exchange send/receive group in the New Group Name box and then choose OK.

Send/Receive settings for the selected group

Specify settings for the Send/Receive group that is selected in the list. The name of the selected group appears in the option label. You can specify different settings for the Send/Receive group when Outlook is either online or offline.

  • When Outlook is Online

    • Include this group in Send/Receive Execute a Send/Receive action on this group when the user chooses Send/Receive.

    • Schedule an automatic Send/Receive every n minutes Choose the interval between each Send/Receive action.

    • Perform an automatic Send/Receive when exiting Automatically execute a Send/Receive action for this group when the user exits Outlook.

  • When Outlook is Offline

    • Include this group in Send/Receive Execute a Send/Receive action on this group when the user chooses Send/Receive.

    • Schedule an automatic Send/Receive every n minutes Choose the interval between each Send/Receive action.

  • Exchange Address Book

    • Download offline address book Download the offline address book (OAB) when the user chooses Send/Receive.

    • Choose Address Book Settings to open the Modify Address Book Settings dialog box. You can select Download changes since last Send/Receive to download only updates to the address book since the last download. To download the full address book with each Send/Receive, clear the Download changes since last Send/Receive check box.

Modify Address Book Settings dialog box

Configure the default way in which Outlook updates the offline address book (OAB). Select from the following options:

  • Download changes since last Send/Receive Outlook downloads only the changes that were made to the address book since the last Send/Receive. This generally takes less time to download than downloading the complete address book.

  • Full Details When the address book is downloaded, Outlook copies all details for each entry.

  • No Details When the address book is downloaded, Outlook copies only required information, such as the name and e-mail address for each entry. This takes less time to download, but address details are not included in the offline address book. This is a legacy option that is supported by Outlook Address book (OAB) versions 2.0 and 3.0. If Outlook connects to a server that supports OAB 4.0 or a later version, the full details are downloaded even if this option is selected.

Downloading updated OCT files

After the initial release of Office, you can download updates of the OCT and .opax settings files from the Microsoft Download Center. The Office 2013 Administrative Templates download package includes an \Admin folder that contains the OCT and OCT files (.opax and .opal files).

If you have to update the OCT, replace the /Admin folder in your Office 2013 installation files or installation image with the new /Admin folder that is included in the download package.

See also

Overview of Setup architecture for Office 2013
Config.xml file reference for Office 2013
Customize Setup before installing Office 2013

Video: Office 2010 client: Office Customization Tool walkthrough
Video: Office 2010 client: Office Customization Tool import feature

Change History

Date | Description
February 26, 2013 | Added information about changing shortcut locations for Office 2013 applications and provided a link to a KB article about this known issue.
July 16, 2012 | Initial publication


Config.xml file reference for Office 2013

Published: July 16, 2012

Summary: Provides information about how to use the Config.xml file to customize Windows Installer-based Office 2013 installations.

Applies to: Office 2013

Audience: IT Professionals

Administrators use the Config.xml file to perform installation and maintenance tasks for Office 2013.

The primary tool that administrators use to customize the installation of Windows Installer-based products in Office 2013 is the Office Customization Tool (OCT). The customization tools and methods in Office 2013 are the same as for Office 2010and Office 2007. For more information about how to use the OCT to create a Setup customization file and to learn about updates to the OCT in Office 2013, see Office Customization Tool (OCT) reference for Office 2013.

Use the Config.xml file to configure installation tasks and use it only when you run Setup. Config.xml is not installed or cached on users' computers. Administrators can edit the Config.xml file to customize the installation. By default, the Config.xml file that is stored in the core product folder, core_product_folder_name.WW, directs Setup to install that product. For example, the Config.xml file in the ProPlus.WW folder installs Office Professional Plus 2013.

You use the Config.xml file to perform the following installation tasks:

  • Specify the path of the network installation point.

  • Select which product to install.

  • Customize Setup options, such as logging and the location of the Setup customization file and software updates.

  • Set installation options, such as user and company name.

  • Copy the Local Install Source (LIS) to the user's computer without installing Office.

  • Add or remove languages from the installation.

You can also use the Config.xml file for maintenance operations such as adding or removing features, repairs, and removing installations. To do this, administrators must run Setup.exe again from the original source.

Important:

To edit Config.xml, use a text editor, such as Notepad. Do not use a general-purpose XML editor, such as Word 2013.

In this article:

  • Config.xml element quick reference

  • How Setup uses Config.xml

  • Config.xml file format

  • Config.xml element reference

  • Sample Config.xml file

Config.xml element quick reference

The following table lists the Config.xml elements. These elements can appear in any order, except for Configuration element, which must be first, and elements such as Command element, whose order in Config.xml affects how they are processed during installation.

Config.xml quick reference

Element | Description
Configuration element | Top-level element
AddLanguage element | Add a language to the installation
ARP element | Values that control the text and behavior of the Programs and Features option, in Control Panel, to add or remove features for the product
Command element | Run a command during installation
COMPANYNAME element | The name of the organization or company of the user on whose computer the product is being installed
Display element | The level of UI that Setup displays to the user
DistributionPoint element | The fully qualified path of the network installation point from which the installation is to run
INSTALLLOCATION element | The fully qualified path of the folder on the user's computer in which the product is installed
LIS element | Options for how the Local Install Source (LIS) is cached on the user's computer
Logging element | Options for the kind of logging that Setup performs
OptionState element | Options to specify how individual product features are to be handled during installation
PIDKEY element | The 25-character volume license key
RemoveLanguage element | Remove a language from the installation
Setting element | Values for Windows Installer properties
SetupUpdates element | The search path for Setup to use to find Setup customization files
USERINITIALS element | The initials of the user on whose computer the product is being installed
USERNAME element | The name of the user on whose computer the product is being installed

How Setup uses Config.xml

Setup looks for a copy of Config.xml in the same folder as Setup.exe. If a copy is not found there, Setup uses the Config.xml file that is located in the core product folder for the product that you are installing. (If multiple products are in the network installation point, Setup waits until you specify which product to install before it looks for the copy of Config.xml.) The copy of Config.xml that is located in the product folder identifies the product through the Product attribute of the Configuration element.

You can also use the /config Setup command-line option to specify the location of the Config.xml file. For example:

\\server\share\setup.exe /config \\server\share\ProPlus.WW\config.xml

Note:

If you also created a Setup customization (.msp) file by using the OCT, the customizations that you define in Config.xml take precedence over those in the customization file.

Config.xml file format

XML elements in Config.xml begin with < and end with />.

The basic element format is as follows:

<element [attribute="value"] [attribute="value"] … />

For example:

Copy code
<Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

The following statements apply to format:

  • Elements and attributes are case-sensitive.

  • Attribute values must be enclosed in quotation marks (") and are not case-sensitive.

  • An element definition can span multiple lines. Spaces, carriage returns, line feeds, and tab characters are ignored in an element definition.

    The following is an example of an element definition that spans multiple lines.

    Copy code
    <Display
   Level="none"
   CompletionNotice="no"
   SuppressModal="yes"
   AcceptEula="yes"
/>
Tip:

For long element definitions, put attributes on separate lines and use indentation to make the file easier to read.

The Configuration element is a special case and is required. All other elements are contained in the Configuration element, and the element is closed with </Configuration>, as shown in the following example.

Copy code
<Configuration Product="ProPlus">
  <!--  <Display Level="full" CompletionNotice="yes" SuppressModal="no" AcceptEula="no" />  -->
  <!--  <Logging Type="standard" Path="%temp%" Template="Microsoft Office Professional Plus Setup(*).txt" />  -->
  <!--  <USERNAME Value="Customer" />   -->
  <!--  <COMPANYNAME Value="MyCompany" />   -->
  <!--  <INSTALLLOCATION Value="%programfiles%\Microsoft Office" />   -->
  <!--  <LIS CACHEACTION="CacheOnly" />   -->
  <!--  <LIS SOURCELIST="\\server1\share\Office;\\server2\share\Office" /> -->
  <!--  <DistributionPoint Location="\\server\share\Office" />   -->
  <!--  <OptionState Id="OptionID" State="absent" Children="force" />   -->
  <!--  <Setting Id="SETUP_REBOOT" Value="IfNeeded" />   -->
  <!--  <Command Path="%windir%\system32\msiexec.exe" Args="/i \\server\share\my.msi" QuietArg="/q" ChainPosition="after" Execute="install" />   -->
  </Configuration>

Comments can be added anywhere and are delimited by "<!--" and "-->".

For example:

Copy code
<!-- Configure install options for Microsoft Office Professional Plus 2010 -->
<Configuration Product="ProPlus" >
   <Display
      <!-- Turn off all Setup UI and prevent prompting users-->
      Level="none"
      CompletionNotice="no"
      SuppressModal="yes"
      <!-- Accept the EULA for the user -->
      AcceptEula="Yes"
   />
</Configuration>

Each Office product folder contains a default Config.xml file, which consists of a Configuration element that has the Product attribute set to the appropriate value for the product. Configuration element includes several examples of elements that are enclosed in comments. To activate these elements, remove the beginning and closing comment marks and enter the appropriate attribute values.

As shown in the following example, you can activate the Display element by changing this line:

Copy code
<!-- <Display Level="full" CompletionNotice="yes" SuppressModal="no" AcceptEula="no" /> -->

to this:

Copy code
<Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

The Display options in the previous example direct Setup to run a silent installation, to prevent users from being prompted to enter information, and to prevent the installation from waiting for any user interaction.

Config.xml element reference

The following conventions are used in the descriptions in this reference.

Formatting conventions

bold | Element or attribute name
normal | Text to be entered exactly as shown
italic | Placeholder for a value to be added
x|y | Choose among multiple values
[x] | Optional value

Configuration element

Top-level element. This element is required, and all other elements must appear in this element.

Syntax

<Configuration [Product="productID"] >

...

</Configuration>

Attributes

The following table describes Configuration element attributes and values.

Configuration element attributes

Attribute | Value | Description
Product | productID | The value of the ID attribute in the Setup element in the Setup.xml file for the product that is being installed.

Remarks

The Product attribute identifies the product affected by this Config.xml file. The productID is defined in the Setup.xml file that is located in the core folder for the product, in the ID attribute of the Setup element.

The Product attribute is optional, unless you set the Display element Level attribute to "basic" or "none". In this case, the Product attribute is required. If the product specified by the Product attribute does not exist in the network installation point, Setup ends the installation.

Example

The productID for Office Professional Plus 2013 is located in ProPlus.WW\Setup.xml in the following line:

Copy code
<Setup Id="ProPlus" Type="Product"  ... >

You use this productID in Config.xml to specify Office Professional Plus 2013 by entering the following line:

Copy code
<Configuration Product="ProPlus">
   ...
</Configuration>

AddLanguage element

Adds the specified language to the installation.

Syntax

<AddLanguage

Id="ll-cc" | "match"

[ShellTransform="Yes"]

/>

Attributes

The following table describes AddLanguage element attributes and values.

AddLanguage attributes

Attribute | Value | Description
Id | ll-cc | The language identifier.
 | match | Matches the language Id of the user's Windows user locale.
ShellTransform | Yes | Specifies the language for the shell user interface. If more than one AddLanguage element is specified, one (and only one) language must specify the ShellTransform element.

Remarks

The language must be available on the network installation point.

You can have multiple elements for AddLanguage and RemoveLanguage element. If both the RemoveLanguage element and the AddLanguage element specify the same language, the AddLanguage element takes precedence and the language is installed.

Note:

If more than one AddLanguage element is specified, one (and only one) language must specify the ShellTransform element or Setup ends the installation.

There are three language concepts that you should know about when you install the Office 2013:

  • Setup user interface (UI): the language of the installation.

  • Shell UI: the language of shortcuts, right-click context menus, and tooltips.

  • Office UI: the language of the Office user interface and menus.

When there are multiple Office languages, these three values are determined as follows:

By default, the Setup UI depends on the set of available resources for installation and the ability to match the user locale. By default, the Setup UI matches the user locale. The Shell UI depends on the set of languages that is being installed and, by default, follows the Setup UI. The default Office UI language depends on the user locale and current user settings. The default is to use the Windows user locale set on each user's computer. This means that in the default case, the Setup UI, Shell UI, and Office UI will all be the same.

A locale in the Windows operating system is a set of user preference information related to the user's language, environment, and cultural conventions. This information is represented as a list of values that are used to determine the correct input language, keyboard layout, sorting order, and the formats that are used for numbers, dates, currencies, and time. The user locale is a per-user setting that determines the formats that are used, by default, to display dates, times, currency, and numbers, and the sorting order of text. A user locale is specified for each account that is created on a computer.

If an administrator specifies multiple languages for installation in the Config.xml file, the Shell UI language must be selected from the set of languages that are being installed. To do this, administrators specify the ShellTransform attribute of the AddLanguage element in the Config.xml file. AddLanguage specifies the language that Setup uses for the Shell UI. However, this does not necessarily affect the choice of Setup UI or Office UI when it is installed on the user's computer.

For example, if you have an Office image with English, French, German, and Spanish, to specify that Setup install full language support for all these languages and have the Shell UI follow the user's default regional options, you add the following elements in the Config.xml file.

<AddLanguage Id="match" ShellTransform="yes"/> <AddLanguage Id="en-us" /> <AddLanguage Id="fr-fr" /> <AddLanguage Id="de-de" /> <AddLanguage Id="es-es" />

In the previous example, Setup installs all the specified languages and the Shell UI matches the language of the user's locale. If more languages were available in the source image, the match value in the previous example might install an additional language if the match language does not resolve to one of the other four explicitly called-out languages. For instance, if Japanese was also included in the source, this example would install Japanese in addition to the other four languages when it is installed on a computer that has the user locale set to Japanese.

Example

Copy code
<AddLanguage Id="en-us" ShellTransform="Yes" />

ARP element

Specifies values that control the text and behavior of Programs and Features in Control Panel for the product.

Syntax

<ARP attribute="value" [attribute="value"] ... />

Attributes

The following table describes ARP element attributes and values.

ARP attributes

Attribute | Value | Description
ARPCOMMENTS | text | Additional text. Can be up to 255 characters, although all characters might not be displayed.
ARPCONTACT | text | List of technical support contacts.
ARPNOMODIFY | Yes | Prevents users from changing the product installation by making the Change button unavailable.
 | No (default) | Allows users to modify the product installation.
ARPNOREMOVE | Yes | Prevents users from removing the product by making the Remove button unavailable.
 | No (default) | Allows users to remove the product.
ARPURLINFOABOUT | URL | URL for the product's home page.
ARPURLUPDATEINFO | URL | URL for information about product updates.
ARPHELPLINK | URL | URL of a website where users can receive technical support.
ARPHELPTELEPHONE | text | Telephone numbers for technical support.

Command element

Specifies a command line to run. For more information, see Remarks later in this article.

Tip:

The equivalent option in the OCT is Add installations and run programs.

Syntax

<Command

Path="path"

[QuietArg="arguments"]

[Args="args"]

[ChainPosition="Before" | "After"(default)]

[Wait="mseconds"]

[Execute="Install"(default) | "Uninstall"]

[Platform="x86"(default) | "x64"]

/>

Attributes

The following table describes the Command element attributes.

Command attributes

Attribute Value Description

Path

path

Fully qualified path of the executable file. If the path value contains a space, you must use double quotation marks as shown in the following example:

"\\server\share\Office 14\copylogs.bat"

QuietArg

string

String of arguments to be appended to the command line if you configure a silent installation. For more information about when to use the QuietArg attribute, see the Remarks section that follows this table.

Args

string

String of arguments to be passed to the executable. For information about when to use the Args attribute for chained installations, see the Remarks section, following this table.

If the value of the Args element includes quotation marks, you can enclose the whole value in single (') quotation marks, as shown in the following example:

Args='"/param value"'

ChainPosition

Before

This command is executed before the primary product installation.

After (default)

This command is executed after the primary product installation.

Wait

mseconds

When you install a product with the Display element Level attribute set to "full" or "basic," this is the number of milliseconds to wait after you run the program before you continue the installation. The default is 0 (zero), which indicates no waiting.

Execute

Install (default)

Setup executes this command when the primary product is installed.

Uninstall

Setup executes this command when the primary product is uninstalled.

Platform

x86 (default)

Specifies that this program requires the Intel x86 platform. This command runs only if the computer on which the installation is run matches this platform requirement.

x64

Specifies that this program requires a 64-bit processor that supports the x64 extensions to the x86 architecture. This command runs only if the computer on which the installation is run matches this platform requirement.

Remarks

The Command element in the Config.xml file and the Add installations and run programs option in the OCT (command-lines entered in the Add Program Entry and Modify Program Entry dialog boxes) are intended to be used only for initial product installations and uninstallations. The Command element commands are processed only during initial installations and uninstallations. If Command element commands are used for customizations after the initial installation, they are ignored.

The command line can be specified to run an arbitrary command or to run a lightweight executable that you want to run when this product is installed.

The Command element in Config.xml and the Add installations and run programs option in the OCT do not provide the software deployment capabilities that an enterprise software deployment and management tool provides, such as the ability to track deployment progress and troubleshoot problems. Therefore, we recommend that you use the Command element in Config.xml and Add installations and run programs in the OCT to run only lightweight executables or arbitrary commands that will not change the computer or that do not require user input. For example, you can run a utility to copy logs or a command to launch a Welcome page at the end of installation.

Important:

Chaining is not as reliable as installing each product separately. For example, if you chain two installations together and one of the products fails or encounters an unexpected error, the primary installation and the chained installation might not be completed successfully. Therefore, we recommend that you do not use the chaining approach. The recommended method for installing multiple products together in enterprise environments is to use a deployment management program, such as Microsoft System Center 2012 Configuration Manager or Microsoft Systems Management Server (SMS) 2003, or a third party tool, instead of chaining.

The use of Args and QuietArg is as follows:

  • The Args attribute is always appended to the command. This can include switches such as "/install" or "Company=MyCorporation."

  • The QuietArg attribute is also appended if setup is running silently (with Display set as Display="none"). In such cases, you can specify the QuietArg attribute by using the "/quiet" switch, for example, you can use: QuietArg="/quiet".

The following statements apply to the Wait attribute:

  • Setting the Wait attribute to 0 milliseconds indicates no waiting after you run the program before you continue the installation. The command will execute and move on immediately.

    Return codes are only respected if the Wait value is nonzero. If you specify 0, Setup will not wait to continue the installation after it runs the specified program. Therefore,, there is no return code to report in that case.

  • Setting the Wait attribute to any positive nonzero value will wait exactly the number of milliseconds you specify. If the process ends earlier than the specified time, setup will continue. If the process has not ended when the specified time is up, setup will fail.

  • Setting the Wait attribute to -1 indicates to wait indefinitely. This can be problematic because if the command process stops responding (hangs), setup will stop responding and will wait indefinitely for the command to run.

If there are two or more Command elements in the Config.xml file, they run in the order in which they are specified in Config.xml.

Examples

Copy code
<Command Path="\\server\share\myscript.exe" Args='/id "123 abc"' QuietArg="/q" Wait="30000" />

COMPANYNAME element

The name of the organization or company of the user on whose computer the product is being installed.

Tip:

The equivalent option in the OCT is the Organization name setting in Installation location and organization name.

Syntax

<COMPANYNAME Value="companyname" />

Attributes

The following table describes COMPANYNAME element attributes and values.

COMPANYNAME attributes

Attribute | Value | Description
Value | companyname | The company or organization name.

Example

Copy code
<COMPANYNAME Value="Microsoft Corporation" />

Display element

The level of UI that Setup displays to the user.

Tip:

The equivalent option in the OCT is the Display level and license agreement settings in "Licensing and user interface" in Office Customization Tool (OCT) reference for Office 2013.

Syntax

<Display

Level="None" | "Basic" | "Full"(default)

CompletionNotice="Yes" | "No"(default)

SuppressModal="Yes" | "No"(default)

NoCancel="Yes" | "No"(default)

AcceptEula="Yes" | "No"(default)

/>

Attributes

The following table describes Display element attributes and values.

Display attributes

Attribute | Value | Description
Level | None | No Setup UI is displayed. If you set Display Level="none", Setup runs a silent (unattended) installation. See the Remarks section for more information.
 | Basic | Setup displays a Welcome screen, the product key (PIDKEY) page (if it is needed), the software license terms page (if you need it), a progress bar, and the completion notice (if it is allowed).
 | Full (default) | Setup displays all UI to the user.
CompletionNotice | Yes | Only applies if Level is set to "basic" or "none": Setup displays the completion notice.
 | No (default) | Only applies if Level is set to "basic": Setup does not display the completion notice.
SuppressModal | Yes | Only applies if Level is set to "basic": Setup does not display error messages and other dialog boxes that might interrupt the installation.
 | No (default) | Only applies if Level is set to "basic": Setup displays errors and other dialog boxes as needed.
NoCancel | Yes | If Level is set to "full" or "basic", disable the cancel button (X in upper-right corner of the progress dialog box).
 | No (default) | If Level is set to "full" or "basic", let the user cancel the installation from the progress bar.
AcceptEULA | Yes | Microsoft Software License Terms are accepted on behalf of the user. Setup does not display the software license terms page.
 | No (default) | If Level is not set to "none", Setup displays the software license terms page.

Remarks

If this element is not defined, the default settings are used. If an invalid value is specified, Setup ends the installation.

If the Level attribute is set to "basic" or "none" and you supply a product key by using the PIDKEY element, Setup assumes that you also accept the license agreement on behalf of the user.

Note:

In enterprise deployments, we recommend that you set the Display Level value to "none" to direct Setup to run a silent installation. This prevents prompts to users to enter information, and prevents the installation from waiting for user interactions, even when files are in use. Setting the Display Level value to "none" assumes that the SuppressModal and CompletionNotice attributes are silenced and that the Microsoft Software License Terms is accepted. Administrators must also make sure that no Office applications run during an installation of the Office 2013.

If you set the Display Level value to "basic" and SuppressModal to "yes", users might be prompted if any Office files are being used. Setting Display Level to "none" prevents prompting users in these cases. The SuppressModal attribute does not prevent files in use messages from being displayed. Only if Display Level is set to "none" are files in use messages prevented from being displayed.

The Display element is used by Setup only if Setup finds the Config.xml file in the same folder as setup.exe, or if you specify the Config.xml file by using the Setup /config command-line option. If Setup uses the Config.xml file in the product folder, Setup uses the default display options.

Example

Copy code
<Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="Yes" />

DistributionPoint element

Specifies the fully qualified path of the network installation point from which the installation is to run.

Syntax

<DistributionPoint Location="path" />

Attributes

The following table describes DistributionPoint element attributes and values.

DistributionPoint attributes

Attribute | Value | Description
Location | path | The fully qualified path of the network installation point from which the installation is to run.

Remarks

If this is not specified, Setup assumes that the Setup.exe file is located at the root of the network installation point.

Note:

The DistributionPoint element is used by Setup only if Setup finds the Config.xml file in the same folder as setup.exe, or if you specify the Config.xml file by using the Setup /config command-line option. If Setup uses the Config.xml file in the product folder, it ignores this element because the network installation point has already been found.

Example

Copy code
<DistributionPoint Location="\\server1\office" />

INSTALLLOCATION element

Specifies the fully qualified path of the folder on the user's computer where the product is installed.

Tip:

The equivalent option in the OCT is the Default installation path setting in Installation location and organization name.

Syntax

<INSTALLLOCATION Value="path" />

Attributes

The following table describes INSTALLLOCATION element attributes and values.

INSTALLLOCATION attributes

Attribute | Value | Description
Value | path | The fully qualified path of the folder on the user's computer in which the product is installed.

Remarks

You can use system environment variables in the path. If this element is not specified, Office is installed in %ProgramFiles%\Microsoft Office.

Example

Copy code
<INSTALLLOCATION Value="%ProgramFiles%\MyApps" />

LIS element

Controls how the Local Installation Source (LIS) is cached on the user's computer and specifies the location of one or more network installation points that contain the installation files for the product.

Syntax

<LIS

[CACHEACTION="CacheOnly" | "RemoveCacheOnly"]

[SOURCELIST="semicolon-delimited-path-list"]

/>

Attributes

The following table describes LIS element attributes and values.

LIS attributes

Attribute Value Description

CACHEACTION

CacheOnly

Setup copies the LIS to the user's computer, but does not install the product.

Note:

Do not use Command elements in a Config.xml file that specifies the CacheOnly value because the specified commands will not run.

RemoveCacheOnly

If the cache is copied to the user's computer and Office is not installed, Setup removes the LIS from the user's computer but does not install or uninstall the product.

SOURCELIST

semicolon-delimited-path-list

A list, separated by semicolons, of one or more network installation points that contain the installation files for the product.

The equivalent option in the OCT is Additional network sources.

Remarks

By default, the LIS is created in the folder \MsoCache\All Users at the root of the drive on which Office is installed. Setup customization files and software updates in the Updates folder in the network installation point are also copied.

If you specify INSTALLLOCATION element, the drive designation in the path is used to determine on what drive the LIS is created. For example, if the INSTALLLOCATION element path is E:\office\files, the LIS is created on drive E. The sources listed by the SOURCELIST attribute are kept with the installed product and are used by Setup if the LIS on the user's computer is missing or corrupted.

Example

Copy code
<LIS CACHEACTION="CacheOnly" />
<LIS SOURCELIST="\\server1\office;\\server2\corpdata" />

Logging element

Specifies the kind of logging that Setup performs.

Syntax

<Logging

Type="Off" | "Standard"(default) | "Verbose"

Path="path"

Template="filename.txt"

/>

Attributes

The following table describes Logging element attributes and values.

Logging attributes

Attribute | Value | Description
Type | Off | Setup performs no logging.
 | Standard (default) | Setup writes installation information to the log file.
 | Verbose | Setup writes all installation information to the log file.
Path | path | The fully qualified path of the folder used for the log file. You can use environment variables. Default is %temp%.
Template | filename.txt | The name of the log file. If you insert the string * anywhere in the file name, a unique log file is created for each installation performed by setup.exe (see the explanation later in this article). If the * character is not included and the file name that is specified already exists, log information is appended to the existing file. The .txt file name extension must be included. The default template is SetupExe(*).log.

Remarks

You can specify a * anywhere in the Template value. Setup inserts a string in that location that has the following format.

YYYYMMDDHHMMSS xxx

where:

  1. YYYY = Year

  2. MM = Month

  3. DD = Day

  4. HH = Hour

  5. MM = Minute

  6. SS = Seconds

  7. xxx = a unique string generated by Setup

Note:

The Logging element is used by Setup only if Setup finds the Config.xml file in the same folder as setup.exe, or if you specify the Config.xml file by using the Setup /config command-line option. If Setup uses the Config.xml file in the product folder, Setup uses the default logging options.

Example

Copy code
<Logging Type="standard" Path="%temp%"
   Template="MyLog(*).txt"
/>

In the following example, Setup creates a log file every time that it installs the product. Setup uses unique file names such as the following:

Copy code
%temp%\MyLog(20060428110717CFC).txt
%temp%\MyLog(20060429113143C70).txt

OptionState element

Specifies how specific product features are handled during installation.

Important:

In most situations, we recommend that you use the OCT to change the installation state of features. The equivalent option in the OCT is Set feature installation states.

Syntax

<OptionState

Id="optionID"

State="Absent" | "Advertise" | "Local"

[Children="force"]

/>

Attributes

The following table describes OptionState element attributes and values.

OptionState attributes

Attribute | Value | Description
Id | optionID | An item that the user can choose to install.
State | Absent | The feature is not installed.
 | Advertise | The feature is installed the first time that it is used.
 | Local | The feature is installed on the user's computer.
Children | force | All child features of the feature are set to the specified state.

Remarks

A feature is an item that the user can choose to install. The Id value for a feature is defined in the Option element of the Setup.xml file in the core product folder.

Note:

The following subcomponents of Publisher 2013 are not visible in the Setup feature installation state tree in Office 2013.

  • Commercial Printing and the Enhanced RGB to CMYK Conversion subcomponent

  • Font Schemes

  • PaperDirect Previews

  • Publisher Templates and the Business Publications and Other Publications subcomponents

Example

Copy code
<OptionState Id="ExcelAddinFiles"
   State="Absent"
   Children="force"
/>

PIDKEY element

The 25-character volume license key.

Note:

The equivalent option in the OCT is the Product key setting in Licensing and user interface in Office Customization Tool (OCT) reference for Office 2013. For more information about volume licensing in Office Professional 2013, see Plan volume activation of Office 2013.

A product key entry is not required for enterprise deployments that use Key Management Service (KMS) activation because all Volume License editions of Office 2013 have a KMS client key pre-installed. KMS is one of the methods that are provided by Office Activation Technologies for activating products licensed under Microsoft Volume Licensing programs. KMS uses a KMS host key to activate a KMS host computer and establish a local activation service in your environment. Office 2013 connects to the local KMS host for activation. By default, the Use KMS client key option is selected in the OCT (in the Licensing and user interface section).

A Multiple Activation Key (MAK) key is another method that Office Activation Technologies provide for activating products licensed under Microsoft Volume Licensing programs. By using a MAK, clients activate Office 2013 online with Microsoft-hosted activation servers or by telephone. Administrators can use the Config.xml file to enter a MAK key. See the Remarks section for more information about how to add a MAK key.

Similar to KMS activation, which activates all Office Volume License clients that are connected to a KMS host, Active Directory-Based Activation activates all Office Volume License clients in an Active Directory domain. For more information about Active Directory-Based Activation, see Active Directory-Based Activation Overview. For more information about volume activation, see Plan volume activation of Office 2013.

Important:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription. The PIDKEY element must not be used to set product keys for Office Professional Plus for Office 365. For information about Office Professional Plus for Office 365, see Overview of Office 365 ProPlus.

Syntax

<PIDKEY Value="25-character-key" />

Attributes

The following table describes PIDKEY element attributes and values.

PIDKEY attributes

Attribute | Value | Description
Value | 25-character-key | The 25-character volume license key.

Remarks

When the PIDKEY value is set, users are not required to enter a product key when they install Office.

To enter a MAK key in the Config.xml file, add the following line to the file.

<PIDKEY Value="AAAAABBBBBCCCCCDDDDDEEEEE" />

Where AAAAABBBBBCCCCCDDDDDEEEEE is the 25-character product key. For more information about licensing for Office 2013, see the Volume activation methods in Office 2013.

Example

Copy code
<PIDKEY Value="1234512345123451234512345" />
Note:

If the Level attribute of the Display element is set to "basic" or "none" and you supply a product key by using the PIDKEY element, Setup assumes that you also accept the license agreement on behalf of the user. In this case, regardless of how you set the AcceptEULA attribute of the Display element, the user is not prompted for the license agreement either during installation or the first time that an Office application runs.

RemoveLanguage element

Removes the specified language from the installation.

Syntax

<RemoveLanguage Id="ll-cc" />

Attributes

The following table describes RemoveLanguage element attributes and values.

RemoveLanguage attributes

Attribute | Value | Description
Id | ll-cc | The language identifier.

Remarks

If the language is not installed on the user's computer, the RemoveLanguage element is ignored.

You can have multiple elements for AddLanguage element and RemoveLanguage. If both RemoveLanguage and AddLanguage element elements specify the same language, the AddLanguage element element takes precedence and the language is installed.

Example

Copy code
<RemoveLanguage Id="en-us" />

Setting element

Allows you to specify values for Windows Installer properties.

Tip:

The equivalent option in the OCT is "Modify Setup properties" in Office Customization Tool (OCT) reference for Office 2013.

Syntax

<Setting Id="name" Value="value" />

Attributes

The following table describes Setting element attributes and values.

Setting attributes

Attribute | Value | Description
Id | name | The name of the Windows Installer property.
Value | value | The value to assign to the property.

Remarks

Not all Windows Installer properties can be specified in the Setting element. If a blocked property is specified, Setup ends the installation process. If a supported property is specified, Setup passes the property directly to Windows Installer.

The Setting element supports the following Key Management System (KMS) properties:

  • KMSSERVICENAME — Specifies the KMS host name.

  • KMSSERVICEPORT — Specifies the KMS host port.

For example, to use the KMS properties, use the following syntax:

<Setting Id="KMSSERVICENAME" Value="contoso.com" />

<Setting Id="KMSSERVICEPORT" Value="1234" />

where:

contoso.com is the name of the KMS host

1234 is the port number value

Note:

The recommended tool for specifying the KMSSERVICENAME and KMSSERVICEPORT values is the Office Software Protection Platform script (ospp.vbs). To set the KMS host name and port values by using ospp.vbs, run the following commands:

ospp.vbs /sethst:value

ospp.vbs /setprt:value

In the preceding example, the sethst value is the KMS host name, and the setprt value is the KMS host port.

Alternatively, you can set the KMS attributes in the Config.xml file, such as in a scenario that has a 32-bit Office 2013 installation on a computer that runs a 64-bit edition of Windows. For information about volume activation, see Plan volume activation of Office 2013.

The Setting element supports the AUTO_ACTIVATE property for product key activation. This property specifies that product activation occur automatically during Office 2013 deployment and it uses the following syntax.

<Setting Id="AUTO_ACTIVATE" Value="1" />

Note:

Not setting AUTO_ACTIVATE is the same as setting AUTO_ACTIVATE to a value of 0. The result is that product activation does not occur during Office 2013 deployment.

Note that you can also set the AUTO_ACTIVATE property value by using the Office Customization Tool. To do this, follow these steps:

  1. In the OCT, select Modify Setup properties on the navigation pane, and then click Add in the details pane.

  2. In the Add Property Value dialog box, in the Name box, type AUTO_ACTIVATE. Note that property names must be uppercase.

  3. In the Value box, type 1, and then click OK.

The Setting element supports the REMOVEPREVIOUS property. This property removes the specified application from the installation and uses the following syntax.

<Setting Id="REMOVEPREVIOUS" Value="Option Id" />

where Option Id is the identifier value for the Office 2013 application. To specify multiple applications, use a comma-separated list to indicate the appropriate Option Id values.

Note:

If you install Outlook, a previously installed version of Outlook is always removed, regardless of the user's preference.

If you specify REMOVEPREVIOUS with an Option Id value, only the specified applications are removed.

If you do not specify REMOVEPREVIOUS, any previously installed Office applications for which a replacement is being installed are removed. This is the default behavior.

If you specify REMOVEPREVIOUS with a blank value (REMOVEPREVIOUS=""), no applications are removed.

The Setting element also supports the SETUP_REBOOT property. SETUP_REBOOT begins a restart after installation. It uses the following syntax. You must use all uppercase letters for the SETUP_REBOOT property.

<Setting Id="SETUP_REBOOT" Value="value" />

where value can be one of the following:

  • AutoAlways — Always begin a restart. Do not prompt the user.

  • Always — Always prompt for a restart at the end of setup.

  • IfNeeded — Prompt for a restart at the end of setup if setup requires a restart. (Default)

  • AutoIfNeeded — Begin a restart if setup requires a restart. Do not prompt the user.

  • Never — Never begin or prompt for a restart.

Examples

Copy code
<Setting Id="SETUP_REBOOT" Value="Never" />
<Setting Id="REMOVEPREVIOUS" Value="WORDFiles" />

SetupUpdates element

Specifies a search path for Setup to use to find Setup customization files.

Syntax

<SetupUpdates

[CheckForSUpdates="Yes"(default) | "No"]

[SUpdateLocation="path-list"]

/>

Attributes

The following table describes SetupUpdates element attributes and values.

SetupUpdates attributes

Attribute Value Description

CheckForSUpdates

Yes (default)

Setup uses the path list in SUpdateLocation to find Setup customization files.

No

Setup does not search for Setup customization files by using the path list in SUpdateLocation.

SUpdateLocation

path-list

A list of fully qualified paths to folders, separated by semicolons.

Note:

Environment variables cannot be used in the SUpdateLocation path. If an environment variable is used in the path, Setup ignores update files that are located in the specified path location.

Remarks

Setup looks in all the specified folders for Setup customization files that were created for the product that is being installed, and applies them in alphabetical order by file name. If a Setup customization file was specified in the Setup command line, that file is applied first, followed by any files that are found in the folder that is specified by this element.

Example

Copy code
<SetupUpdates
   CheckForSUpdates="Yes"
   SUpdateLocation="\\server1\office\updates;\\server2\corpdata\updates"
/>

USERINITIALS element

The initials of the user on whose computer the product is being installed.

Syntax

<USERINITIALS Value="value" />

Attributes

The following table describes USERINITIALS element attributes and values.

USERINITIALS attributes

Attribute | Value | Description
Value | value | The user's initials

Example

Copy code
<USERINITIALS Value="JD" />

USERNAME element

The name of the user on whose computer the product is being installed.

Syntax

<USERNAME Value="value" />

Attributes

The following table describes USERNAME element attributes and values.

USERNAME attributes

Attribute | Value | Description
Value | value | The user's name.

Remarks

The Office 2013 Username element data is populated as follows.

If the user who runs Office is the same user who installed Office, the Username and Initials supplied during setup are used. The user is not prompted when Office first starts. This case is most popular for home users who install Office themselves.

If the user who is running Office is not the same user who installed Office, Office prompts the user to confirm his or her Username and Initials when Office first starts. This case is most popular in a corporate environment, where an administrator installs Office for the user.

The value for the Username element shown to the user at first start time might be pre-populated with a default value from a previously installed version of Office or from the currently logged-on user. Note that the default value is not used unless it is confirmed by the user. If an earlier version of Office is installed on the computer, the registry key that was created by the earlier version of Office is used. For example, if the previous Office installation is Microsoft Office 2003, the registry key is provided at HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo.

Example

Copy code
<USERNAME Value="John Doe" />

Sample Config.xml file

The following example shows a Config.xml file for a typical installation. The example uses the Office Professional Plus 2013 version of the product.

Copy code
<Configuration Product="ProPlus">

<!-- <Display Level="full" CompletionNotice="yes" SuppressModal="no" AcceptEula="no" /> -->

<!-- <Logging Type="standard" Path="%temp%" Template="Microsoft Office Professional Plus Setup(*).txt" /> -->

<!-- <USERNAME Value="Customer" /> -->

<!-- <COMPANYNAME Value="MyCompany" /> -->

<!-- <INSTALLLOCATION Value="%programfiles%\Microsoft Office" /> -->

<!-- <LIS CACHEACTION="CacheOnly" /> -->

<!-- <LIS SOURCELIST="\\server1\share\Office;\\server2\share\Office" /> -->

<!-- <DistributionPoint Location="\\server\share\Office" /> -->

<!-- <OptionState Id="OptionID" State="absent" Children="force" /> -->

<!-- <Setting Id="SETUP_REBOOT" Value="IfNeeded" /> -->

<!-- <Command Path="%windir%\system32\msiexec.exe" Args="/i \\server\share\my.msi" QuietArg="/q" ChainPosition="after" Execute="install" /> -->

</Configuration>

See also

Office Customization Tool (OCT) reference for Office 2013
64-bit editions of Office 2013


Setup command-line options reference for Office 2013

Published: July 16, 2012

Summary: Provides information about Setup.exe command lines for Windows Installer-based Office 2013.

Applies to: Office 2013

Audience: IT Professionals

The Setup.exe command line is used for very few operations in Office 2013 (just as in Office 2010 and Microsoft Office 2007). Setup recognizes the command-line options that are described in this article.

In this article:

  • /admin

  • /adminfile [path]

  • /config [path]

  • /modify [ProductID]

  • /repair [ProductID]

  • /uninstall [ProductID]

Note:

Although Setup recognizes only a few command-line options in Office 2013, you can still make all the same changes to the Office installation. Instead of using the command line, you use the Office Customization Tool (OCT) reference for Office 2013 to set Setup properties and make other customizations. You can also edit the Config.xml file for the product that you are installing.

/admin

Runs the Office Customization Tool to create a Setup customization file (.msp file).

Example

\\server\share\Office15\setup.exe /admin

/adminfile [path]

Applies the specified Setup customization file to the installation. You can specify a path of a specific customization file (.msp file) or to the folder where you store customization files.

Note:

The /adminfile command-line option can be used only during initial installation of the product.

The recommended location for customization files is the Updates folder at the root of the network installation point. When you store a customization file in this folder, you do not have to specify the file on the command line. Setup automatically finds the customization file that matches the product that is being installed and applies the file during the installation. The Updates folder can only be used to deploy software updates during an initial installation of Office 2013.

If you store more than one customization file per product in the Updates folder, Setup applies all the files to the installation. If you want to create unique configurations for different groups of users, you must store the customization files in a separate folder and specify the customization file that you want on the command line.

Example

\\server\share\Office15\setup.exe /adminfile \\server\share\MyUpdates\Engineering.msp

where Office15 is the root of the network installation point.

/config [path]

Specifies the Config.xml file that Setup uses during the installation. By default, the Config.xml file that is stored in the core product folder directs Setup to install that product. For example, the Config.xml file in the ProPlus.WW folder installs Office Professional Plus 2013.

You can edit Config.xml to make additional customizations to the installation. This includes specifying one or more language versions to install. Use /config on the Setup command line to point to the location of the default Config.xml file for a product or to point to a custom Config.xml file.

Example

\\server\share\Office15\setup.exe /config \\server\share\Office15\ProPlus.WW\Config.xml

where Office15 is the root of the network installation point.

Note:

You must use a fully qualified path. Setup does not recognize relative paths with /config.

/modify [ProductID]

Used with a modified Config.xml file to run Setup in maintenance mode and make changes to an existing Office installation. For example, you can use the /modify option to add or remove features. Look up the value of [ProductID] in the Setup.xml file for the product that you want to modify.

The Setup.xml file is located in the core product folder on the network installation point. In Setup.xml, [ProductID] is equal to the value of the Id attribute of the Setup element. For example:

Copy code
<Setup Id="ProPlus" Type="Product" ProductCode="{20150000-0011-0000-0000-0000000FF1CE}">

Example

\\server\share\Office15\setup.exe /modify ProPlus /config \\server\share\Office15\AddOutlookConfig.xml

where Office15 is the root of the network installation point.

/repair [ProductID]

Runs Setup to repair the specified product from the user's computer. Look up the value of [ProductID] in the Setup.xml file for the product that you want to modify.

Example

\\server\share\Office15\setup.exe /repair ProPlus

where:

  • Office15 is the root of the network installation point.

  • ProPlus is the [ProductID] ([ProductID] is equal to the ID attribute of the Setup element listed in \\server\share\Office15\ProPlus.WW\setup.xml), where ProPlus.WW is the location of the Office Professional Plus 2013 installation files.

You can customize the /repair option by using it with /config and a modified Config.xml file. This is necessary if you want to run a "silent" repair. In enterprise deployments, we recommend that you run a silent repair to prevent prompting users to enter information, and to prevent the installation from waiting for user interactions, even when files are being used.

To run a silent repair

  1. Using a text editor, edit the following element attributes in the \\server\share\Office15\ProPlus.WW\SilentRepairConfig.xml file:

    Copy code
    <Configuration Product="ProPlus">

<Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

</Configuration>

  2. At the command line, use the following syntax:

    Copy code
    \\server\share\Office15\setup.exe /repair ProPlus /config  \\server\share\Office15\ProPlus.WW\SilentRepairConfig.xml

/uninstall [ProductID]

Runs Setup to remove the specified product from the user's computer. Look up the value of [ProductID] in the Setup.xml file for the product that you want to modify.

Example

\\server\share\Office15\setup.exe /uninstall ProPlus

where:

  • Office15 is the root of the network installation point.

  • ProPlus is the [ProductID] ([ProductID] is equal to the ID attribute of the Setup element listed in \\server\share\Office15\ProPlus.WW\setup.xml), where ProPlus.WW is the location of the Office Professional Plus 2013 installation files.

You can customize the /uninstall option by using it with /config and a modified Config.xml file. This is necessary if you want to run a "silent" uninstall. In enterprise deployments, we recommend that you run a silent uninstall to prevent prompting users to enter information, and to prevent the installation from waiting for user interactions, even when files are being used.

To run a silent uninstall

  1. Using a text editor, edit the following element attributes in the \\server\share\Office15\ProPlus.WW\SilentUninstallConfig.xml file:

    Copy code
    <Configuration Product="ProPlus">

<Display Level="none" CompletionNotice="no" SuppressModal="yes" AcceptEula="yes" />

</Configuration>

  2. At the command line, use the following syntax:

    Copy code
    \\server\share\Office15\setup.exe /uninstall ProPlus /config  \\server\share\Office15\ProPlus.WW\SilentUninstallConfig.xml
Note:

In Office 2013, just as in Office 2010 and Office 2007, you cannot use the Setup.exe command line to set Windows Installer properties, such as PIDKEY or DISPLAY. Setup does not pass these properties to Windows Installer. Instead, you make these customizations by using the Office Customization Tool or Config.xml. For a complete list of Setup properties, including blocked and unsupported properties, see Setup properties in Office 2010. The information also applies to Office 2013.

See also

Office Customization Tool (OCT) reference for Office 2013
Config.xml file reference for Office 2013


Setup properties reference for Office 2013

Published: July 31, 2012

Summary: Learn about which Windows Installer properties are available for Office 2013 installations.

Applies to: Office 2013

Most of the Windows Installer properties that were previously used to customize and control Office installations were replaced in Microsoft Office 2007 by options in the Office Customization Tool (OCT) or elements in the Config.xml file. The following information also applies to Office 2013 and Office 2010.

In versions of Office earlier than Office 2007, you used Windows Installer properties to customize and control the Office installation. The Setup process was redesigned in the Office 2007 release, and most of these functions were replaced by options in the Office Customization Tool or elements in the Config.xml file.

In this article:

  • Property quick reference

  • Available properties

  • Replaced properties

  • Blocked properties

  • Office activation

Property quick reference

The following table summarizes the recognized Windows Installer properties that you might have used in versions of Office earlier than Microsoft Office 2007. The table shows if the functionality of that property is blocked and replaced by options in the OCT or Config.xml, or if the property is available for use. More detail is provided in the following sections.

Windows Installer properties and their use in Office 2013

Property | Use in Office 2013
ADDDEFAULT | Replaced
ADDLOCAL | Replaced
ADDSOURCE | Replaced
ADVERTISE | Replaced
ALLUSERS | Blocked
ARPAUTHORIZEDCDFPREFIX | Replaced
ARPCOMMENTS | Replaced
ARPCONTACTS | Replaced
ARPHELPLINK | Replaced
ARPHELPTELEPHONE | Replaced
ARPINSTALLLOCATION | Replaced
ARPNOMODIFY | Replaced
ARPNOREMOVE | Replaced
ARPNOREPAIR | Replaced
ARPPRODUCTICON | Replaced
ARPREADME | Replaced
ARPSIZE | Replaced
ARPSYSTEMCOMPONENT | Replaced
ARPURLINFOABOUT | Replaced
ARPURLUPDATEINFO | Replaced
COMPADDLOCAL | Replaced
COMPADDSOURCE | Replaced
COMPANYNAME | Replaced
DISABLEROLLBACK | Blocked
EXECUTEACTION | Blocked
EXECUTEMODE | Blocked
FILEADDDEFAULT | Replaced
FILEADDLOCAL | Replaced
FILEADDSOURCE | Replaced
HIDEUPDATEUI | Available
INSTALLLEVEL | Blocked
INSTALLLOCATION | Replaced
LIMITUI | Replaced
LOGACTION | Blocked
MEDIAPACKAGEPATH | Blocked
NOCOMPANYNAME | Replaced
NOUSERNAME | Replaced
PIDKEY | Replaced
PRIMARYFOLDER | Available
PROMPTROLLBACKCOST | Blocked
REBOOTPROMPT | Blocked
REINSTALL | Blocked
REMOVE | Replaced
ROOTDRIVE | Available
SEQUENCE | Blocked
SETUP_REBOOT | Available
SOURCELIST | Replaced
TARGETDIR | Replaced
UNINSTALL | Blocked
USERNAME | Replaced

Available properties

The following properties can be used when you install Office 2013 (and Office 2010 and Office 2007):

  • HIDEUPDATEUI If set to True, hides the Check for Updates button on the completion dialog box. This property is ignored if the completion dialog box does not appear. The default value is False.

  • PRIMARYFOLDER Designates a primary folder for the installation.

  • ROOTDRIVE Specifies the default drive for the destination folder of the installation. The value for this property must end with '\'.

  • SETUP_REBOOT Determines how Setup restarts the computer after installation. You must use all uppercase letters, SETUP_REBOOT.

    • AutoAlways Always trigger a restart. Do not prompt the user.

    • Always Always prompt for a restart at the end of Setup.

    • IfNeeded Prompt for a restart at the end of Setup, if Setup requires a restart. (Default)

    • AutoIfNeeded Begin a restart, if Setup requires a restart. Do not prompt the user.

    • Never Never trigger or prompt for a restart.

You set these properties in the Modify Setup properties page of the OCT, or the Setting element in the Config.xml file for Windows Installer-based installations.

Replaced properties

A number of Windows Installer properties are replaced by options in the OCT or in the Config.xml file. Some properties are not applicable in Office 2013 (or in Office 2010 or Office 2007) because of Setup design changes that were introduced in Office 2007. All of these properties are blocked by Setup. That is, if you specify any of these properties in the OCT Modify Setup properties page, or by using the Config.xml Setting element, Setup will end the installation.

The following table lists blocked properties whose functions are replaced by options in the OCT or by elements in the Config.xml file.

Replaced Windows Installer properties

Property | Replacement OCT option | Replacement Config.xml element
SOURCELIST (in LIS element) | Additional network sources | SOURCELIST attribute in LIS element element
COMPANYNAME | Installation location and organization name | COMPANYNAME element
INSTALLLOCATION | Installation location and organization name | INSTALLLOCATION element
TARGETDIR | Installation location and organization name | INSTALLLOCATION element
LIMITUI | Licensing and user interface | Display element
PIDKEY | Licensing and user interface | PIDKEY element
ARPAUTHORIZEDCDFPREFIX | None | ARP element
ARPCOMMENTS | None | ARP element
ARPCONTACTS | None | ARP element
ARPHELPLINK | None | ARP element
ARPHELPTELEPHONE | None | ARP element
ARPINSTALLLOCATION | None | ARP element
ARPNOMODIFY | None | ARP element
ARPNOREMOVE | None | ARP element
ARPNOREPAIR | None | ARP element
ARPPRODUCTICON | None | ARP element
ARPREADME | None | ARP element
ARPSIZE | None | ARP element
ARPSYSTEMCOMPONENT | None | ARP element
ARPURLINFOABOUT | None | ARP element
ARPURLUPDATEINFO | None | ARP element
NOCOMPANYNAME | None | None
NOUSERNAME | None | None
USERNAME | None | USERNAME element
ADDDEFAULT | Set feature installation states | OptionState element
ADDLOCAL | Set feature installation states | OptionState element
ADDSOURCE | Set feature installation states | OptionState element
ADVERTISE | Set feature installation states | OptionState element
COMPADDLOCAL | Set feature installation states | OptionState element
COMPADDSOURCE | Set feature installation states | OptionState element
FILEADDDEFAULT | Set feature installation states | OptionState element
FILEADDLOCAL | Set feature installation states | OptionState element
FILEADDSOURCE | Set feature installation states | OptionState element
REMOVE | Set feature installation states | OptionState element

The following properties are replaced by Setup command-line options:

  • REINSTALL Use the Setup /repair command-line option.

  • UNINSTALL Use the Setup /uninstall command-line option.

Blocked properties

The following properties are no longer applicable in Office 2013 (and in Office 2010 and Office 2007). These properties are blocked. That is, if you specify these properties in the OCT Modify Setup properties page, or by using the Config.xml Setting element, Setup will end the installation.

  • ALLUSERS (All installations of Office 2013, Office 2010, and Office 2007 are per-computer.)

  • DISABLEROLLBACK

  • EXECUTEACTION

  • EXECUTEMODE

  • INSTALLLEVEL

  • LOGACTION

  • MEDIAPACKAGEPATH

  • PROMPTROLLBACKCOST

  • REBOOTPROMPT

  • SEQUENCE

Office activation

The Microsoft policy for Office 2013 requires the activation of all editions of Office 2013. This includes those obtained through a Volume Licensing program. This requirement applies to Office 2013 running on both physical computers and virtual computers. Activation is not required for any Office 2013 server products, such as SharePoint Server 2013, Project Server 2013, or for any version of Microsoft Exchange Server.

Office Activation Technologies provide the following methods for activating products licensed under Microsoft Volume Licensing programs:

  • Key Management Service (KMS) KMS uses a KMS host key to activate a KMS host computer and establish a local activation service in your environment. Office 2013 connects to the local KMS host for activation.

  • Multiple Activation Key (MAK) With a MAK, clients activate Office 2013 online by using the Microsoft hosted activation servers or by telephone.

  • Active Directory-Based activation Similar to KMS activation, which activates all Office volume license clients that are connected to a KMS host, Active Directory-based activation activates all Office volume license clients in an Active Directory domain.

  • A combination of KMS, MAK, and Active Directory-Based activation.

For more information about the licensing options in Office 2013, and instructions for configuring the KMS host and port number, see Plan volume activation of Office 2013 and Volume activation methods in Office 2013.

Note:

This information applies to volume-licensed editions of Office 2013. It does not apply to either Office Professional Plus for Office 365 or Office 365 ProPlus, both of which are licensed through subscription.

For information about Office 2013 product activation via the Internet or phone for non-volume licensed versions of Office 2013 products, see Activate Microsoft Office 2013 programs on the Office.com website.

See also

Office Customization Tool (OCT) reference for Office 2013
Config.xml file reference for Office 2013
Setup command-line options reference for Office 2013
Overview of Setup architecture for Office 2013


Roll out Office 2013

Published: July 16, 2012

Summary Find articles about architecture, deployment scenarios, step-by-step installation instructions, and methods of rolling out Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The following table lists and describes articles that will help you deploy Office 2013.

Articles about rolling out Office 2013

Article | Description
Deployment methods for Office 2013 | Provides an overview of different methods of deploying Office 2013, such as Group Policy, network share, and virtualization technologies.
Deploy Office 2013 from a local installation source | Provides information about how to install Office 2013 from the local installation source
Deploy Office 2013 from a network installation point | Provides information about how to use a network share as a network installation point from which to deploy Office 2013.
Deploy Office 2013 by using Group Policy computer startup scripts | Provides information about how to use Group Policy and a computer startup script to install Office 2013.


Deployment methods for Office 2013

Published: October 23, 2012

Summary: Provides an overview of different methods of deploying Office 2013, such as Group Policy, network share, and virtualization technologies.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

There are several different ways that you can deploy Office, either the Windows Installer-based (MSI) version or the Click-to-Run version, to users in an organization. The method that you chose to deploy Office depends on the specific requirements and characteristics of your organization. For example, a small organization that only has several dozen users might deploy Office from a network share. But a larger organization that has hundreds or thousands of users might use a software distribution product, such as Microsoft System Center Configuration Manager, to deploy Office to users. You can also take advantage of virtualization technologies, such as Remote Desktop Services and Microsoft Application Virtualization (App-V), to deploy Office.

In this article:

  • Versions of Office

  • Deployment methods for Office

  • Supported deployment methods for Office

Versions of Office

There are two versions of Office 2013 that you can deploy to a user's computer:

  • Windows Installer-based (MSI)

  • Click-to-Run

Windows Installer (MSI) is the traditional Setup architecture for installing Office products and languages. It is the same Setup architecture that is used in Office 2010 and Office 2007. Office Standard 2013 is an example of a Windows Installer-based version of Office.

Click-to-Run is a newer Setup architecture and is based on Microsoft streaming and virtualization technology. This technology reduces the time that is required to download, install, and update Office products and languages. Office 365 ProPlus is an example of a Click-to-Run version of Office. For more information, see Click-to-Run overview and Overview of Office 365 ProPlus.

Note:

You can also give users access to browser-based versions of Word, PowerPoint, Excel, and OneNote by deploying Office Web Apps Server. For more information, see Deploy the infrastructure: Office Web Apps Server.

The following table provides a general comparison between the Windows Installer-based version and the Click-to-Run version of Office.

Comparison of Windows Installer-based version and Click-to-Run version of Office

Area of comparison Windows Installer (MSI) Click-to-Run

Licensing

Volume license

Subscription (for example, Office 365 ProPlus) and Retail (for example, Office Professional 2013)

Activation

Device-based

User-based

Installation time

You have to wait until the whole Office product is installed before you can open and start to use the product. If you also have to apply any updates or service packs, the required installation time increases.

You can start to use Office before the product is completely installed. Under normal conditions, you can have Office installed and running in a few minutes.

Updates

Updates and service packs have to be downloaded and then applied. You can choose the updates and service packs that you want to apply to your Office installations. For example, you can decide that you want to apply all updates for Excel, but only apply critical updates for Word.

Click-to-Run products that you download and install from Microsoft are up-to-date from the start. You won't have to download and apply any updates or service packs immediately after you install the products.

By default, Click-to-Run products are configured to be updated automatically over time. Users don't have to download or install updates. Updates are seamlessly applied in the background.

But, you can't specify which particular updates or service packs to apply to your Office installations. Also, you can't use standard update processes, such as Windows Update or Windows Server Update Services (WSUS), to apply updates.

Customizations

Highly customizable

For example, you can specify which products and features to install or specify where product shortcuts are displayed.

To customize installation settings, use the Office Customization Tool (OCT) and a config.xml file. For more information, see Office Customization Tool (OCT) reference for Office 2013 and Config.xml file reference for Office 2013.

Limited customization available

For example, you can't specify the drive on which to install Office.

Also, you can't specify which products and features to install. For example, you can't install Office without including Access.

Group Policy settings, by using the Office-specific Administrative Template files (ADMX/ADML)

Supported

Supported

Deployment methods for Office

The following are some common ways to deploy Office:

  • Local installation source

  • Network installation point

  • Group Policy computer startup script

  • Software distribution product

  • Virtualization technology

  • Standard desktop image

In most cases, these deployment methods work with both the Windows Installer-based version and the Click-to-Run version of Office. For more information about which deployment methods work with which version of Office, see Supported deployment methods for Office.

The method that you chose for deploying Office depends on the specific requirements and characteristics of your organization. Some common factors that determine which deployment method is appropriate include the following:

  • Are users local administrators on their computers? To install Office, users must be local administrators on their computers. You can use Group Policy computer startup scripts or a software distribution product to install Office if users are not local administrators on their computers.

  • How many users are you deploying Office to? If you have to deploy Office to several hundred or more users, you can use a software distribution product to help automate the deployment of Office.

  • Do the client computers support the system requirements for Office? If not, you can use the features of Remote Desktop Services to provide Office to users. For more information about system requirements, see System Requirements for Office 2013.

  • Where are users located? If users are geographically dispersed, you want to make sure that users can install Office from a location that is near to them. For example, you can create network installation points of Office in each region or each branch office, depending on the network connectivity.

  • What other programs are installed on the client computers? If there is potential conflict between a program that is already installed on the client computer and Office, you can use virtualization technologies, such as Remote Desktop Services and Microsoft Application Virtualization (App-V).

You can also use multiple deployment methods together. For example, you can use a Group Policy computer startup script that installs Office from a network installation point.

The following sections provide brief overviews of each type of deployment method.

Local installation source

You can copy the appropriate Office product and language files to the local computer, and then run Setup from that local installation source. But, users must be local administrators on their computers to run the Office Setup program and install Office.

Network installation point

A common way to deploy Office is to create a network share and copy the Office product and language files to the network share. Users install Office by running Setup from this network installation point. You can simplify and automate the process for users by giving them a script or batch file to run. Users require only Read permissions to the network share.

Group Policy computer startup script

To deploy Office to specific computers, you can use a Group Policy computer startup script. You can also use a Group Policy startup script to install Office when users are not local administrators on their computers. The script runs when the computer starts, and before a user logs in to the computer. Because the startup script runs in the context of the Local System account, the script has the necessary permissions to install Office on the computer.

Note:

Use of Group Policy Software Installation to deploy Office is not supported.

Software distribution product

Some organizations use software distribution products, such as System Center Configuration Manager or Windows Intune, to deploy software to users and computers. A software distribution product is often used to install Office when users are not local administrators on their computers. Software distribution products also have advanced deployment, updating, and reporting capabilities that are helpful to medium-sized or large-sized organizations.

Virtualization technology

You can use virtualization technologies, such as Remote Desktop Services and Microsoft Application Virtualization (App-V), to deploy Office. You can use virtualization technologies when users are not local administrators on their computers.

Remote Desktop Services, a role in Windows Server, provides a centralized server on which you can install Office. Users log on remotely to this centralized server to run Office. You can use Remote Desktop Services if the client computers in your organization do not meet the system requirements for installing Office. Also, a centralized installation of Office can be easier to manage and update.

Important:

You can use only a Volume License edition of Office on a Remote Desktop Session Host server. Volume License editions are available only for Windows Installer-based versions of Office.

You can also use Remote Desktop Services with Hyper-V, another role in Windows Server, to deploy virtual desktops to users. A virtual desktop is like a standard desktop image. But, the user connects to the virtual desktop from over the network. A single Windows Server computer can support multiple virtual desktops that are running at the same time.

Note:

You can use either a Windows Installer-based version or a Click-to-Run version of Office on a virtual desktop. However, if you are using a Click-to-Run version of Office, the virtual desktop must be assigned to a single user.

App-V is a streaming and virtualization technology. App-V enables you to stream programs, such as Office, down on demand from a centralized server to a computer. All the information about the program is contained in an App-V package. You can use App-V by itself or together with System Center Configuration Manager to deploy and manage your programs by using App-V packages. App-V can also be used to deploy programs to virtual desktops.

Standard desktop image

Some organizations deploy new computers by using a standard desktop image that includes a pre-configured version of the operating system and programs, such as Office, already installed. The standard desktop image is deployed to all the computers in the organization so that all computers are configured identically. Software, such as the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager, can help you automate the deployment of a standard desktop image.

Supported deployment methods for Office

The following table provides information about which deployment methods can be used with the Windows Installer-based version and Click-to-Run version of Office.

Supported deployment methods

Deployment method | Windows Installer (MSI) | Click-to-Run | More information
Local installation source | Yes | Yes | For Windows Installer-based versions of Office, see Deploy Office 2013 from a local installation source.
Network installation point | Yes | Yes | Deploy Office 2013 from a network installation point
Group Policy computer startup script | Yes | Yes | Deploy Office 2013 by using Group Policy computer startup scripts
System Center Configuration Manager | Yes | Yes | System Center 2012 Configuration Manager (Additional Office-specific information is currently not available.)
Windows Intune | Yes | Yes | Windows Intune (Additional Office-specific information is currently not available.)
Remote Desktop Services | Yes | No | Remote Desktop Services in Windows Server 2008 R2 Remote Desktop Services Overview (Windows Server 2012) (Additional Office-specific information is currently not available.)
Microsoft Application Virtualization (App-V) 5.0 | No | Yes | Earlier versions of App-V are not supported to deploy Office 2013. Microsoft Office 2013 App-V packages
Microsoft Deployment Toolkit (MDT) 2012 | Yes | Yes | Microsoft Deployment Toolkit (Additional Office-specific information is currently not available.)


Deploy Office 2013 from a local installation source

Published: October 16, 2012

Summary: Explains how to install the Windows Installer-based version of Office 2013 (MSI) from the local installation source.

Applies to: Office 2013

Audience: IT Professionals

When you deploy Office 2013, Setup creates a local installation source on the user's computer. It is a copy of the compressed source files for the Office product that you install. The default location is \MSOCache\All Users, which is a hidden folder at the root of the drive on which Office is installed. After the files are copied to the user's computer, Setup completes the installation from the local installation source. You can minimize the load on a network by doing the installation in two steps:

  1. Deploy the local installation source by using Setup and a customized Config.xml file, which will copy the compressed source files to the local computer. This is called precaching and an MSOCache folder is created on the local computer to store the installation files.

  2. Run Setup from the local installation source.

Precaching lets most of the installation activity occur on the local computer instead of over the network. You can distribute the local installation source to groups of users over time and then schedule a concurrent installation throughout the organization without overtaxing the network.

Important:

Running Setup.exe from the MSOCache, as described in this article, is intended only for new installations of Office 2013. This method does not work if you have an existing Office 2010 or Office 2007 installation on the computer on which you are installing Office 2013. If you attempt to upgrade from Office 2010 or Office 2007 to Office 2013 by installing Office 2013 from the MSOCache folder, an error message that resembles the following may be displayed: "The Language of this installation package is not supported by your system."

In this article:

  • Create a network installation point

  • Deploy the local installation source

  • Run Setup from the local installation source

Create a network installation point

Before you begin, you will want to create, replicate, and secure a network installation point. To do this, copy all source files and any language packs that you want to deploy from the Office 2013 installation media to a shared location on the network. You can then use the network installation point as a starting place to distribute Office 2013. Make sure that access to Office 2013 source files is read-only. The Setup.xml and Package.xml files, such as ProPlusWW.xml for Office 2013, are digitally signed and cannot be changed. For more information, see Create a network installation point in Customize Setup before installing Office 2013.

Deploy the local installation source

Use the following procedure to deploy the local installation source before you deploy Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To deploy the local installation source separately

  1. On the network installation point, open the Config.xml file in a text editor, such as Notepad. For information about the Config.xml file, see Config.xml file reference for Office 2013.

    By default, Config.xml is located in the core product folder for the Office product that you are installing. For example, if you install Office Professional Plus 2013, open the Config.xml file in the ProPlus.WW folder.

  2. Find the LIS element (<LIS>); remove the comment marks in the line by deleting the opening <!-- and closing --> tags.

  3. Set the <CACHEACTION> attribute to "CacheOnly".

    The line in Config.xml should look as shown in the following example.

    <LIS CACHEACTION="CacheOnly" />

  4. Save the Config.xml file.

  5. Run Setup.exe on users' computers. On the Setup command line, specify the path of the custom Config.xml file.

    You must use a fully qualified path. For example: \\server\share\Office15\setup.exe /config \\server\share\Office15\ProPlus.WW\Config.xml

    where:

    Office15 is the root of the network installation point.

    /config specifies the path of the customized Config.xml file.

Note:

If you precache the local installation source on users' computers and then later have to remove it, you can set the <CACHEACTION> attribute to "RemoveCacheOnly" and run Setup again. This setting works only if users have not yet installed Office.

To take full advantage of precaching the local installation source for new installations of Office 2013, you can use the Setup.exe file from the local cache and only pass in the optional files, the Setup customization file (.msp file), and the custom Config.xml file from a network installation source. You must use the fully qualified path of these files. If the share names contain spaces, use quotation marks around the paths as shown in the following example.

"C:\MSOCache\All Users\{90150000-0011-0000-0000-0000000FF1CE}-C\setup.exe" /adminfile "\\server\share\Office15\mychanges\db_outlookonly.msp" /config "\\server\share\Office15\ProPlus.WW\Config.xml"

where:

/adminfile specifies the location of the Setup customization .msp file.

/config specifies the location of the customized Config.xml file.

Setup handles the creation and maintenance of the local installation source automatically. The default location is \MSOCache\All Users at the root of the drive on which Office is installed. In addition to installing Office from the local installation source, Setup uses the local installation source to repair, reinstall, or update Office later. If the local installation source is corrupted or deleted, Setup uses the original source on the network to repair or re-create it. For information about the /adminfile and /config setup command-line options, see /adminfile [path] and /config [path] in Setup command-line options reference for Office 2013.

Note:

If you set the installation location for Office to another location (for example, by entering a new value for the INSTALLLOCATION attribute in Config.xml), Setup creates the local installation source at that location.

MSOCache folder

Setup copies each package from the network installation point to a separate subfolder under MSOCache\All Users. The subfolder for the core product package includes a copy of Setup.exe that defaults to installing that product. Subfolders under MSOCache\All Users are named according to the download code for each package, instead of the folder naming convention that is used on the network installation point.

Note:

Download codes for each Office product can be found in the Setup.xml file in the core product folder. The line in the Setup.xml file for Office Professional Plus 2013 should look as shown in the following example:

<LocalCache DownloadCode="{90150000-0011-0000-0000-0000000FF1CE}"

The letter that is appended to the end of each download code (-C, for example) indicates the drive on which the local installation source for that product is installed. If a user has installed multiple Office products on different drives, each drive contains a local installation source in the MSOCache\All Users folder. The drive letter in the download code enables Windows Installer to identify the correct location for the specified product.

In the precache scenario only, Setup also copies the Updates folder from the network installation point to the local installation source. You can store both Setup customization files (.msp files) and software update files (.msp files) in the Updates folder and automatically include them in the installation. You gain the benefits of an offline installation without losing any of your customizations. For more information about using the Updates folder, see "Updates folder" in Office Customization Tool (OCT) reference for Office 2013.

Run Setup from the local installation source

To run Setup, you must identify the subfolder in MSOCache\All Users that contains the core product that you want to install. See MSOCache folder. Setup.exe is located in the same folder that contains the core product file <product_name>WW.msi, for example, ProPlusWW.msi. For example, for Office Professional Plus 2013, the core product file is ProPlusWW.msi, and the folder that contains Setup.exe is {90150000-0011-0000-0000-0000000FF1CE}-<drive letter>. The folder includes files, such as the following:

  • Office64WW.msi

  • Office64WW.xml

  • Ose.exe

  • Osetup.dll

  • OWOW64WW.cab

  • PidGenX.dll

  • pkeyconfig-office.xrm-ms

  • ProPlusWW.msi

  • ProPlusWW.xml

  • ProPsWW.cab

  • ProPsWW2.cab

  • Setup.dll

  • Setup.exe

  • Setup.xml

To run setup from the local installation source

  1. Distribute the local installation to users. See Deploy the local installation source.

  2. Locate the download code for the Office product that you want to install. Download codes are included in the Setup.xml file in the core product folder.

    For example, locate the line in Setup.xml that contains the LocalCache entry as in this example from Office Professional Plus 2013:

    <LocalCache DownloadCode="{90150000-0011-0000-0000-0000000FF1CE}" SkuComponentDirectory="ProPlus.WW">

  3. Run Setup.exe from the subfolder in MSOCache\All Users that corresponds to the download code. You can use a relative path of point to the location of Setup.exe on each user's computer.

    For example, if you deployed the local installation source for Office Professional Plus 2013 on drive C, use the following command line:

    C:\MSOCache\All Users\{90150000-0011-0000-0000-0000000FF1CE}-C \setup.exe

    You can send the Setup.exe command line to users by whatever means that you want — for example, in a logon script or a batch file.

See also

Create a network installation point

Overview of Setup architecture for Office 2013
Config.xml file reference for Office 2013
Customize Setup before installing Office 2013
Office Customization Tool (OCT) reference for Office 2013


Deploy Office 2013 from a network installation point

Published: October 16, 2012

Summary: Provides information about how to use a network share as a network installation point from which to deploy Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

One way that you can deploy Office 2013 is from a central location, such as a shared folder on a network file server. By creating a network installation point to deploy Office, you can control which Office products and languages that users can install. You can also make sure that Office is deployed consistently throughout the organization.

The basic steps to use a network installation point to deploy Office are as follows:

  • Copy all the appropriate Office product and language files to a location on the network.

  • Create a network share and assign the appropriate permissions.

  • Have users run the Office Setup program from the network installation point to install Office on to their local computers. Remember that, to install Office, users must be local administrators on their computers.

    Another option is to create a script that performs a silent (unattended) installation of Office from the network installation point and that requires no input from the user. You can then deploy the script by using Group Policy or by using a software distribution product such as Microsoft System Center Configuration Manager. You can use this option if users are not local administrators on their computers.

    Note:

    For more information about how to deploy Office by using Group Policy, see Deploy Office 2013 by using Group Policy computer startup scripts.

You can use a network installation point to deploy a Windows Installer-based (MSI) version of Office such as Office Standard 2013) or a Click-to-Run version of Office such as Office 365 ProPlus).

In this article:

  • Planning considerations for using a network installation point to deploy Office

  • Using a network installation point to deploy a Windows Installer-based (MSI) version of Office

  • Using a network installation point to deploy a Click-to-Run version of Office

Planning considerations for using a network installation point to deploy Office

The amount of disk space that is required on the network installation point depends on the Office products and languages that you are deploying. You can include multiple products on the same network installation point. For example, the network installation point can include the installation files for Office Standard 2013, Project Professional 2013, and Visio Professional 2013. The network installation point can also include the language files for multiple languages. For example, you can include the language files for French and Spanish on the same network installation point as the English language files.

When you create a network installation point to deploy Office, you must assign the appropriate permissions to the network share. Users require only Read permissions to the network share to be able to run the Setup program to install Office. If you configure Office Setup to place installation log files on a network share, users must have Read and Write permissions to that network share.

Note:

For more information about how to create network shares and assign permissions in Windows Server, see Shared Folders.

We recommend that you make the Office product and language files available from multiple locations on the network. Some benefits of multiple network installation points include the following:

  • Availability If you create multiple network installation points, you help make sure that users always have access to a network source for the Office installation files. You can use the Distributed File System (DFS) role service in Windows Server to create a network share that is replicated to multiple locations. For more information, see DFS Management.

  • Proximity You want to have a network installation point on the same part of the network as the users who are installing Office. This can help minimize the effect on network bandwidth and provide a better installation experience for the users. For example, if users are located in a branch office, you can create a network installation point on a file server in the branch office. The users can then install Office from the local network, which will be faster than installing over the network from a network installation point in another office.

  • Consistency By copying a network installation point, you can make sure that the same Office configuration is installed throughout the organization.

  • Flexibility Regional offices within the organization can copy the network installation point and then add region-specific customizations for installing Office.

Using a network installation point to deploy a Windows Installer-based (MSI) version of Office

To deploy a Windows Installer-based (MSI) version of Office 2013 from a network installation point, begin by copying the Office product and language files from your installation media to the network share.

In a Windows Installer-based version of Office 2013, core Setup files are shared among all the Office products and language packs. Because core Setup files are identical, you only need one copy of the core Setup files on the network installation point. For example, when you copy a language pack to the network installation point, you are prompted to indicate whether you want to overwrite existing Office Setup files on the network installation point. Because the files are the same, you can skip copying those duplicate files to the network installation point.

If there are multiple Office products on the network installation point when you run Setup, Setup prompts you to select the product that you want to install. If there are multiple Office languages on the network installation point when you run Setup, and if you select Customize during Setup, you can select which languages that you want to install.

After Office is installed, users do not typically have to use the network installation point to update, change, or reinstall Office. Setup automatically creates a local installation source on each user's computer when it installs Office. But, if the local installation source is corrupted or deleted, Setup returns to the original network installation point to re-create the local installation source on the user's computer.

To make sure that a network installation point is available if it is needed, you can use the Office Customization Tool (OCT) to specify Additional network sources. Setup looks for servers in the Additional network sources list, in the order that you specify, if the original network installation point is unavailable. For more information about how to specify Additional network sources, see Office Customization Tool (OCT) reference for Office 2013.

Note:

If you are concerned about the effect on network bandwidth of multiple users who are installing Office from a network installation point at the same time, you can copy (precache) the product and language files to the user's computer. Then, the user can run the Setup program from that local installation source. For more information, see Deploy Office 2013 from a local installation source.

As part of deploying Office from a network installation point, you might want to customize the installation or create a scripted installation that performs a silent (unattended) installation and that requires no input from the users. The following articles provide information that will help you customize or script installations of a Windows Installer-based version of Office:

  • To customize the installation of Office (for example, which applications and features are installed), use the Office Customization Tool. This will create a Setup customization .msp file that you place in the Updates folder on the network installation point. For more information, see Office Customization Tool (OCT) reference for Office 2013.

  • To specify the languages that are installed, configure the AddLanguage element in a Config.xml file. For more information, see Config.xml file reference for Office 2013.

  • For more information about Setup command-line options to use in scripts, see Setup command-line options reference for Office 2013.

  • For more information about how to perform a silent (unattended) installation of a Windows Installer-based version of Office, see Configure a silent installation of Office 2013.

Using a network installation point to deploy a Click-to-Run version of Office

To deploy a Click-to-Run version of Office from a network installation point, use the Office Deployment Tool.

First, create a customized Configuration.xml file to specify which Office products and languages for the Office Deployment Tool to download. In the Configuration.xml, you can use the SourcePath attribute to specify the network share as the download location. Then, run the Office Deployment Tool with the /download command. The tool reads the information in the customized Configuration.xml file and then downloads the specified Office products and languages to the network share that you specify.

To install specific Office products and languages to a user's computer, make sure that the network share is specified as the SourcePath in the Configuration.xml file, and then run the Office Deployment Tool with the /configure command.

For more information about how to use the Office Deployment Tool to deploy a Click-to-Run version of Office from a network installation point, see the following articles:

  • Office Deployment Tool for Click-to-Run

  • Click-to-Run for Office 365 Configuration.xml file

  • Download Click-to-Run for Office 365 products by using the Office Deployment Tool

  • Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool

See also

Deployment methods for Office 2013
Language in Office 2013

Click-to-Run overview


Deploy Office 2013 by using Group Policy computer startup scripts

Published: October 16, 2012

Summary: Provides information about how to use Group Policy and a computer startup script to install Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

One way that you can deploy Office 2013 is to use a script that installs Office when the computer starts. To deploy this script to a computer, you use Group Policy. Group Policy is a feature of Windows Server and Active Directory Domain Services (AD DS) and it enables you to create policies to apply standard configurations to computers and users in your organization. For more information about Group Policy, see Group Policy.

One situation in which it makes sense to use a computer startup script to install Office is when users are not local administrators on their computers. To install Office, you must be a local administrator on the computer. Because the startup script runs in the context of the Local System account, the script has the necessary permissions to install Office on the computer.

You might also want to use a computer startup script if you must install Office only on certain computers in your organization or if you want to automate the installation of Office for users.

You can use a computer startup script to deploy a Windows Installer-based (MSI) version of Office, such as Office Standard 2013, or a Click-to-Run version of Office such as Office 365 ProPlus.

Important:

You can't use the following in Group Policy to deploy Office 2013:

  • Group Policy Software Installation

  • The "Always install with elevated privileges" Group Policy setting for Windows Installer

This is because the setup architecture for Office 2013 uses multiple .msi files and the Office Setup program is an executable (.exe) file.

In this article:

  • Copy the Office product and language files to a network share

  • Create a script to perform a silent (unattended) installation of Office from the network share

  • Configure the installation script as a computer startup script by using Group Policy

Copy the Office product and language files to a network share

To use a computer startup script, start by copying the Office product and language files to a central location, such as a network share. All computers on which you want to install Office must be able to reach the network share. Also, Authenticated Users must have Read permissions to the network share.

To deploy a Windows Installer-based (MSI) version of Office 2013, copy the Office product and language files from the installation media to the network share. For more information about how to create a network share to install Office, see Deploy Office 2013 from a network installation point.

Note:

To customize the installation of a Windows Installer-based version of Office, use the Office Customization Tool. For example, you can do this to specify which applications and features are installed. For more information, see Office Customization Tool (OCT) reference for Office 2013.

To deploy a Click-to-Run version of Office, use the Office Deployment Tool to download the Office product and language files to the local network. For more information about how to use the Office Deployment Tool, see Office Deployment Tool for Click-to-Run.

Create a script to perform a silent (unattended) installation of Office from the network share

After you copy the Office product and language files to a network share, create a script that runs Setup from the network share and installs Office on the user's computer. You can write the script in any language that is supported by the client computer. To create scripts, people frequently use Windows Scripts Host-supported languages such as VBScript and Jscript, command files such as batch files, and Windows PowerShell.

Remember that, because the script runs before a user logs in to the computer, you must write the script to perform a silent (unattended) installation of Office that requires no input from the user. For more information about how to perform a silent installation of Office, see the following:

  • For a Windows Installer-based (MSI) version of Office 2013, see Configure a silent installation of Office 2013.

  • For a Click-to-Run version of Office, use the Office Deployment Tool with the /configure command and a customized Configuration.xml file. In the customized Configuration.xml file, for the Display element, you'll configure the appropriate values for the Level and the AcceptEULA attributes. For more information, see the following articles:

    • Click-to-Run for Office 365 Configuration.xml file

    • Office Deployment Tool for Click-to-Run

Because the startup script runs every time that the computer starts, the script should check whether Office is already installed on the computer before the script continues.

After you create the script, test that the script works in a controlled test environment before you use the script as a computer startup script in Group Policy.

Configure the installation script as a computer startup script by using Group Policy

After you test the installation script, do the following:

  • Create a Group Policy Object (GPO)

  • Copy the script to the Startup folder for the GPO

  • Configure the GPO to use the script as a computer startup script

Create a Group Policy Object (GPO)

To create a Group Policy Object, use the Group Policy Management Console (GPMC). By default, only domain administrators, enterprise administrators, and members of the Group Policy creator owners group in AD DS can create and edit GPOs. For more information about how to use the GPMC, see Group Policy Management Console.

One possible configuration is to create an organizational unit (OU) in AD DS and place the computers on which you want to install Office into that OU. Then, create the GPO and link the GPO to that OU.

Caution:

Group Policy enables you to affect configurations across hundreds and even thousands of computers in an organization. Therefore, make sure that you rigorously test all new Group Policy configurations or deployments in a test environment before you move them into a production environment.

Copy the script to the Startup folder for the GPO

After you create the GPO, copy the script to the Startup folder for the GPO on a domain controller for the Active Directory domain. The path of the Startup folder for the GPO is as follows:

%systemroot%\sysvol\domain\Policies\{GPO ID}\Machines\Scripts\Startup

where:

  • %systemroot% is an environment variable that represents the drive and folder where the operating system is installed. For example, c:\windows.

  • {GPO ID} is the unique ID for the GPO. For example, {467FE97D-0A65-4EE1-AE41-EB9A27E7DC7A}. To find the ID for the GPO, select the GPO in the GPMC, and then in the details pane, select the Details tab. The ID is listed as Unique ID on the Details tab.

The GPO and the script are replicated automatically to all domain controllers in the domain.

Configure the GPO to use the script as a computer startup script

After you copy the script to the Startup folder for the GPO, configure the GPO to use the script as a computer startup script. To configure the GPO, use the GPMC and follow the steps in the Assign Computer Startup Scripts.

By default, the total time that the system waits for all logon, logoff, startup, and shutdown scripts that are applied by Group Policy to finish running is 600 seconds (10 minutes). If necessary, you can use the "Maximum wait time for Group Policy scripts" Group Policy setting to adjust this time to make sure that the startup script finishes running. The path of this setting in the GPMC, when you edit a GPO, is Computer Configuration\Policies\Administrative Templates\System\Scripts.

See also

Deployment methods for Office 2013

Click-to-Run overview


Plan an Outlook 2013 deployment

Published: July 16, 2012

Summary: Find articles that will help you plan, configure, customize, and deploy Outlook 2013.

Applies to: Office 2013 | Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Office 2013 logo To plan an Outlook deployment or configure Outlook Anywhere, Cached Exchange Mode, and security and protection features, or to customize Outlook profiles, follow the steps that are described in these articles.

Outlook 2013 deployment articles on TechNet

Article | Description
Overview of Outlook 2013 planning | Provides information about what you should consider when you plan to deploy Outlook 2013.
Choose between Cached Exchange Mode and Online Mode for Outlook 2013 | Provides information about the two Exchange connectivity modes that you can choose to use for Outlook 2013 deployments
Plan a Cached Exchange Mode deployment in Outlook 2013 | Provides information about how to plan a Cached Exchange Mode deployment for Outlook 2013.
Plan feature customizations in Outlook 2013 | Provides information about some features that you can configure and deploy with Outlook 2013.
Plan attachment settings in Outlook 2013 | Provides information about how to use Group Policy to configure attachment security settings for Outlook 2013
Overview of security and protection settings for Outlook 2013 | Provides information about security settings in Outlook 2013.
Outlook 2013 features supported by different versions of Exchange Server | Provides information about the Outlook 2013 features that are supported by each version of Exchange Server.
Configure multiple Exchange accounts for Outlook 2013 | Provides information about how administrators can use the Office Customization Tool to configure multiple Exchange email accounts for an Outlook 2013 profile.
Configure Cached Exchange Mode in Outlook 2013 | Describes how administrators can configure Cached Exchange Mode for Exchange Server email accounts in Outlook 2013.
Configure Outlook Anywhere in Outlook 2013 | Explains how administrators can configure Outlook Anywhere in Outlook 2013.
Configure junk email settings in Outlook 2013 | Provides information about how to use Junk E-mail Filter lists and configure the Junk E-mail Filter and automatic picture download to help users avoid receipt of junk email messages.


Outlook 2013 features supported by different versions of Exchange Server

Published: January 8, 2013

Summary: Learn which Outlook 2013 features are supported by each version of Exchange Server.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Outlook 2013 works well with many email servers, but you can take advantage of an even richer feature set by using Outlook with Microsoft Exchange Online or the latest version of Exchange Server. Features of Outlook 2013 that are available with Exchange Server 2013 and Exchange Online include apps for Outlook, Data Loss Protection, and site mailboxes.

Note:

Outlook 2013 can't connect to a computer that is running Microsoft Exchange Server 2003 or an earlier version of Exchange.

Features that are supported by Exchange Online, Exchange Server 2013, Exchange Server 2010, and Exchange Server 2007

The following table shows which Outlook 2013 features are supported by different versions of Exchange Server.

Outlook 2013 features supported by different versions of Exchange Server

Outlook 2013 feature | Exchange 2013 / Exchange Online | Exchange 2010 | Exchange Server 2007 SP2/SP3
Windows Rights Management Services (RMS) support for email. | X | X | X
Local copy of a user's mailbox to enable users to work offline (Cached Exchange Mode). | X | X | X
Search Folders display the results of previously defined search queries of Outlook folders. | X | X | X
Outlook Anywhere (RPC over HTTP) connections are automatically configured. | X | X | X
Exchange Server settings are automatically detected over the Internet (Autodiscover). | X | X | X
Exchange servers are automatically found in multi-forest environments. | X | X | X
Out of Office improvements: separate internal/external Out of Office messages, external replies can be limited to Contacts folder entries, HTML formatting for reply messages, scheduling Out of Office replies during a specified time period only. | X | X | X
Voice mail messages can be delivered in email. | X | X | X
Managed Folders can help organizations to reduce the legal risks that are associated with email and other communications. | X | X | X
Scheduling Assistant helps users decide the most convenient times for meetings and it includes easy checking for conference room availability. | X | X | X
Free/Busy information is always up-to-date for users who have the Availability service. | X | X | X
Tentative calendar booking is managed on the Exchange Server. Users do not have to run Outlook for other users to see their Free/Busy status for new meeting invitations. | X | X | X
Larger mailboxes are supported. Maximum data file size increased 2.5 times from Outlook 2007. | X | X | X
Sender ID Anti-Spam can reduce the number of unsolicited email messages that enter the organization. | X | X | X
Photos can be displayed for your colleagues in the global address list (GAL). | X | X | X
When scheduling a meeting, Room Finder suggests the best times for a meeting based on attendee availability. | X | X | X
MailTips can help users make the correct choices when they send sensitive communications. | X | X |
Calendar details can be shared with external business partners by using federation. | X | X |
Microsoft speech technology converts voice mail messages into text that users receive in an email or text message. | X | X |
RMS protected voice mail enables encrypted voice mail to be sent to a user's mailbox. | X | X |
Online Personal Archive eliminates the need for Personal Folder files (.pst). | X | X |
Message tracking lets you confirm that an email message was delivered. | X | X |
Exchange Administrators can make specific apps for Outlook available to their end-users. | X |  |
Data Loss Protection capabilities help you protect sensitive data and inform users of internal compliance policies. | X |  |
Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint 2013 documents and Exchange email by using the same client interface. | X |  |
Note:

  • If you have an on-premises Exchange Server and plan to add Exchange Online to co-exist in your environment, there are two things to consider:

    • There is no cross-premises manager delegation. If the manager's account is on Exchange Online, the delegate's account must be on Exchange Online too.

    • An account that is on-premises can't have "Send As" permissions for an account that is on Exchange Online.

  • Also be aware that the user authentication method is different between an on-premises Exchange Server and Exchange Online. An Exchange Online user enters his or her email address (as the user name) and password. However, the user can decide to save the password so the user only has to enter it one time.

Additional resources

More information about how Outlook and Exchange Server versions work together is listed in the following list.

  • For more information about Exchange Server 2013, see What's New in Exchange 2013.

  • For more information about Exchange Online, see Microsoft Exchange Online.

  • For information about how Outlook for Mac 2011 works with different versions of Exchange Server, see Outlook for Mac 2011 supported by different versions of Exchange Server.

See also

What's new in Outlook 2013


Overview of Outlook 2013 planning

Updated: May 14, 2013

Summary: Learn about what you should consider when you deploy Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

A close review of the organization's messaging requirements will help you plan the optimal Outlook 2013 deployment.

In this article:

  • Determining an organization's needs

  • Choosing when and how to install Outlook

  • Outlook security and privacy considerations

  • Upgrading from an earlier version of Outlook

  • Additional considerations when planning an Outlook upgrade

  • Considerations for 32-bit Outlook applications when upgrading to a 64-bit platform

Determining an organization's needs

The organization's messaging environment helps shape the Outlook 2013 deployment. Factors to consider include whether you are upgrading Outlook, installing the application for the first time, planning for roaming or remote users, or choosing a combination of these and other factors.

MSI versus Click-to-Run deployment methods

The new Office is available in two delivery formats: Windows Installer-based (MSI) and Click-to-Run. Traditional Windows Installer-based deployments of Office 2013 are available for enterprise organizations through volume licensing. Office 2013 Click-to-Run is available with an Office subscription of Office 365 ProPlus. Users who do not have Office 365 accounts can download Office 2013 from Office.com.

The Office 365 ProPlus offering provides the complete Office client suite as a monthly subscription service. Office 365 ProPlus is part of the Office 365 product suite and is downloaded and managed through the Office 365 portal. The download process for Office 365 ProPlus is known as Click-to-Run, a streaming and virtualization technology that is designed to significantly reduce the time that is required to download and use Office 365 ProPlus client products. Streaming enables users to begin to use a Click-to-Run program before the complete program is downloaded. For more information, see Overview of Office 365 ProPlus Preview.

Administrators who have signed up for Office 365 can also stage and deploy Click-to-Run products from an on-premises location. This is useful in scenarios where administrators want to minimize the demand on the network or to prevent users from installing products from the Internet because of corporate security requirements. To stage a deployment on-premises, administrators use the Office Deployment Tool for Click-to-Run. For more information, see Office Deployment Tool for Click-to-Run.

The MSI and Click-to-Run versions of the new Office and Outlook 2013 have different configuration options and administration tools. For the Click-to-Run version of Outlook 2013, you can change the settings from the default configuration by deploying Group Policy settings or registry keys. For the MSI version of Outlook 2013, you can use Group Policy and the Office Customization Tool (OCT) to specify user settings. If you want to enforce specific settings, you must use Group Policy. For more information, see Office Customization Tool (OCT) reference for Office 2013 and Customization overview for Click-to-Run.

Upgrade or initial installation of Outlook

If you are upgrading to Outlook 2013 from an earlier version of Outlook, consider whether you will migrate previous settings, change user profiles, and use new customization options. By default, user settings are migrated automatically, except for security settings. Customization of Outlook settings is optional and only needed if you want to change the settings from the default configuration. Also Outlook can automatically create a new Outlook profile by using the Account Auto Configuration process (Autodiscover). If you are deploying Office 2013 (a MSI deployment), the Office Customization Tool (OCT) enables you to migrate users' current settings and make other customizations. For example, you can define new Microsoft Exchange servers or customize new features. If you are deploying Office 365 ProPlus and must change settings from the default configuration, you can use Group Policy or the registry.

If you are deploying Outlook on client computers for the first time, you should use the Account Auto Configuration process (Autodiscover) to automatically create new Outlook profiles. If you are deploying Office 2013 and must change settings from the default configurations, you can use the OCT to define profile settings for users. If you are deploying Outlook as part of Office 365 ProPlus, you can deploy registry settings to define profile settings.

For more information, see the following articles.

  • Office Customization Tool (OCT) reference for Office 2013

  • Customization overview for Click-to-Run

Migrating data

When you upgrade from Office Outlook 2003, Outlook 2007, or Outlook 2010 to Outlook 2013 Outlook data is migrated. Data migration from versions of Outlook earlier than Office Outlook 2003 and other email applications is not supported in Outlook 2013.

Remote and roaming users

You can customize Outlook to optimize the experience for remote and roaming users, and to set up Outlook for multiple users on the same computer.

You might want to configure features such as Outlook Anywhere (known as RPC over HTTP in earlier versions of Outlook) and Cached Exchange Mode for remote users. These features enhance the user experience when Outlook is used over slower or less reliable connections. By using Outlook Anywhere, you can configure connections that enable users to connect more securely from the Internet to Exchange servers in your organization or to Exchange Online without using a virtual private network (VPN) connection. Cached Exchange Mode is an Outlook feature that was introduced with Office Outlook 2003. It creates a local copy of users' mailboxes. Cached Exchange Mode is recommended for all configurations, but especially benefits remote users. The feature enables users to have more reliable access to their Outlook data, whether or not they are connected to a network. For more information, see Configure Outlook Anywhere in Outlook 2013 and Plan a Cached Exchange Mode deployment in Outlook 2013.

When multiple users share the same computer, use Windows logon features on the computer's operating system to manage user logon verification. Unless you deploy the Click-2-Run version of Outlook which is available with Office 365 ProPlus, users must use the same version of Outlook. If you deploy the Windows Installer-based (MSI) version of Outlook, only one version of Outlook can be installed on the same computer. See Supported scenarios for more information. To learn more about how to set up multiple Outlook users on the same computer, see Using Outlook on a computer you share with other people .

Multilingual requirements

Office 2013 provides broad support for deployment in international or multilingual environments. As with the 2007 Microsoft Office system and Office 2010 suites, the Office 2013 product consists of the language-neutral core package plus one or more language-specific packages. In addition to the proofing tools that are included in each language version, you can download and deploy proofing tools for other languages to help multilingual groups work with and edit files in many languages. For more information, see Plan for multilanguage deployment of Office 2013.

Outlook 2013 supports Unicode throughout the product to help multilingual organizations seamlessly exchange messages and other information in a multilingual environment.

Client and messaging server platforms

Some features of Outlook 2013 (for example, Cached Exchange Mode) require Exchange Server as a messaging platform. Although Outlook 2013 works well with earlier versions of Exchange, some features of Outlook 2013 require specific versions of Exchange. Because of this and other improved integration with Exchange throughout Outlook 2013, we recommend that you combine Outlook 2013 with the latest version of Exchange Server or use Exchange Online. For more information, see Outlook 2013 features supported by different versions of Exchange Server.

Deployment customization decisions for Outlook 2013 depend on which version of Exchange Server you use. If you currently use Exchange Server as your messaging server and you have not upgraded to Exchange 2007 or a later version, consider coordinating the Exchange Server upgrade or Exchange Online migration with the deployment timing for Outlook 2013. Exchange Server 2007 is the earliest version of Exchange Server that can be used with Outlook 2013.

If you have an on-premises Exchange Server and plan to add Exchange Online to co-exist in your environment, there are two things to consider:

  • There is no cross-premises manager delegation. If the manager's account is connected to Exchange Online, the delegate's account must be on Exchange Online too.

  • An account that is on-premises cannot have "Send As" permissions for an account that is connected to Exchange Online.

Also be aware that the user authentication method is different between an on-premises Exchange Server and Exchange Online. An Exchange Online user enters his or her email address (as the user name) and password. However, the user can decide to save the password so that the user only has to enter it one time.

Choosing when and how to install Outlook

You have options for when and how you install Outlook 2013. For example, consider whether which of the following would be best for your organization:

  • Install or upgrade Outlook for different groups of users in stages, or at the same time.

  • Install Outlook as a stand-alone application.

  • Install Outlook before, during, or after an Office 2013 installation.

Each organization has a different environment and might make a different choice about timing Outlook 2013 upgrades. For example, you might have a messaging group that is responsible for upgrading Outlook and a separate group that plans deployment for other Office applications. In this case, it might be easier to upgrade Outlook separately from the rest of Office, instead of trying to coordinate deployment between the two groups.

Note that the MSI version of Outlook 2013 cannot coexist with earlier versions of Outlook on the same computer. However, you can install a Click-to-Run version of Outlook 2013 to run side-by-side with Outlook 2007 or Outlook 2010. However, side-by-side installations of Outlook 2013 with earlier versions of Outlook, such as Office Outlook 2003 are not supported.

Customizing Outlook settings and profiles

You can customize an MSI installation of Outlook to handle Outlook user settings and profiles in two ways:

  • Specify Outlook user settings in the OCT.

  • Specify options for managing new and existing Outlook profiles in the OCT or use an Outlook Profile file (.prf).

For example, you can enable Outlook users to migrate their current profiles and settings while default profiles and settings are defined for new Outlook users. You can also change existing profiles and establish new default profiles for new Outlook users. If you deploy Outlook 2013 together with Exchange Server 2010 or Exchange Online, you can add more than one Exchange account for a profile by using the OCT or .prf file.

When you use the OCT to customize Outlook, you save choices and other installation preferences in the customization .msp file that is applied during Setup. Later, you update settings and profile information by opening the file in the OCT and saving a new copy of the file.

For more information about how to configure Outlook profiles, see Office Customization Tool (OCT) reference for Office 2013 and Customize Outlook profiles by using an Outlook Profile (PRF) file. These articles also apply to environments that have Exchange Online deployed.

For Click-to-Run installations of Outlook 2013, you can use Group Policy or registry keys to customize Outlook settings and profiles.

Configuring subscriptions and other sharing features for Outlook

As with Office Outlook 2007 and Outlook 2010, Outlook 2013 includes features that let you easily subscribe to new sources of content and share the features with users inside and outside your organization. Content sources include SharePoint Foundation 2013 and SharePoint Foundation 2013 contacts, tasks, and calendars, together with local and Internet-based calendars (iCals).

Really Simple Syndication (RSS) is another sharing feature that enables users to subscribe to internal or Internet-based sources of syndicated content (.xml files) to avoid having to check a site for new information. You can deploy specific RSS feeds or calendar subscriptions to users, configure settings to manage how users can share these subscriptions or content, specify how often the servers update users' copies of the data, and more.

Using Outlook with Remote Desktop Services (formerly known as Terminal Services)

Remote Desktop Services in Windows Server enables you to install a single volume licensed copy of an MSI version of Outlook 2013 on a Remote Desktop Services-enabled computer. Instead of running Outlook on local computers, multiple users connect to the server and run Outlook from that server.

To achieve optimal results when you use Outlook with Remote Desktop Services, think about how you customize your Outlook configuration. For example, in Outlook 2013 you can configure Cached Exchange Mode with Remote Desktop Services. However, you will have to provide sufficient disk space to accommodate each user's mailbox on the Remote Desktop Session Host server (terminal server). Note that Outlook might be part of an environment that includes other applications that are provided on the same Remote Desktop Session Host computer. For more information, see Cached Exchange Mode in a Remote Desktop Session Host environment: planning considerations (Outlook 2010) (white paper). Although this article is for Outlook 2010, the content still applies to Outlook 2013.

Mail apps for Outlook

A mail app for Outlook is a cloud-enabled application that integrates rich, scenario-focused content and services together with Outlook 2013. You can obtain apps for Outlook from the Office Store. Exchange Administrators can make specific apps for Outlook available to their end-users if their Exchange accounts are on Exchange Server 2013. For more information, see Overview of apps for Office 2013.

AutoArchive in Outlook

Outlook mailboxes grow as users create and receive items. To keep mailboxes manageable, users need another place to store or archive older items that are important but rarely used. It is typically most convenient to automatically move these older items to the archive folder and to discard items whose content has expired and is no longer valid. Outlook 2013 AutoArchive can manage this process automatically for users. However, we recommend that you use the Personal Archive feature in Exchange Server 2013 Messaging Records Management (MRM) (or in Exchange Online) because it eliminates the need for Personal Folder files (.pst). By using Personal Archive in Exchange Server 2013 or in Exchange Online, the email archive folders are stored online so that users can access the archived files by using Outlook Web App or from a secondary computer by using Outlook 2013. By using either of these client applications, users can view an archive mailbox and move or copy messages between their primary mailboxes and the archive.

Note that when Personal Archive is enabled, AutoArchive is not available to the user and does not archive messages.

If you plan to deploy Outlook 2013 together with Exchange Server 2010, Exchange Server 2013 or Exchange Online, consider using the Exchange Server Personal Archive feature instead of Outlook 2013 AutoArchive. For more information, see Understanding Personal Archive: Exchange 2010 Help, Plan for compliance and archiving in Outlook 2010, and Microsoft Exchange Online Archiving.

If you choose to use the AutoArchive feature in Outlook 2013, you can configure the settings to customize Outlook 2013 AutoArchive by using the Outlook Group Policy template (Outlk15.adm). Or if you are deploying the MSI version of Outlook you can configure default settings by using the Office Customization Tool (OCT), in which case users can change the settings.

Outlook data files (.pst)

If you plan to deploy Outlook 2013 together with Exchange Server 2013 or Exchange Online, we recommend that you use the Personal Archive feature in Exchange Server 2013 Messaging Records Management (MRM) (or in Exchange Online) because it eliminates the need for Outlook data files (.pst). By using the Personal Archive in Exchange Server 2013 or in Exchange Online, the email archive is stored online so that users can access the archived files by using Outlook Web App or from a secondary computer by using Outlook 2013. By using either of these client applications, users can view an archive mailbox and move or copy messages between their primary mailboxes and the archive. For more information, see Understanding Personal Archive: Exchange 2010 Help, Plan for compliance and archiving in Outlook 2010, and Microsoft Exchange Online Archiving.

If you plan to deploy Outlook 2013 together with Exchange Server 2007, you can configure .pst files to be stored locally (recommended) or on a network share. Storing .pst files on a network share is unsupported in most scenarios. Consider storing .pst files on a network share only if the network has high bandwidth and reliability. If a user's .pst file is stored on a network share and the user loses the connection to the network, the user might lose unsaved changes and have a poor Outlook experience.

Retention policies in Outlook

Retention policy settings can help users follow retention policy guidelines that your organization establishes for document retention. You cannot deploy AutoArchive-based retention settings through Outlook 2013 by using Group Policy. If you must deploy retention policies, explore the Messaging Records Management (MRM) features in Exchange Server. For more information, see Messaging Records Management: Exchange 2010 Help and Plan for compliance and archiving in Outlook 2010.

Outlook security and privacy considerations

Outlook includes many security and privacy features, some of which are highlighted in the following sections. For more information about how to plan for security and privacy in Outlook 2013, see Overview of security and protection settings for Outlook 2013.

Limiting viruses and junk email messages for users

Outlook 2013 includes features to help minimize the spread of viruses and to help users avoid junk email.

As in Outlook 2007 and Outlook 2010, in Outlook 2013 you can configure virus-prevention and other security settings by using Group Policy to support the needs of an organization. You can also use the Outlook Security Template to configure settings, as in earlier releases of Outlook. By using either configuration method, you can, for example, modify the list of file types that are blocked in email messages.

The Object Model (OM) Guard that helps prevent viruses from using the Outlook Address Book (OAB) to spread is updated. Outlook checks for up-to-date antivirus software to help determine when to display OAB access warnings and other Outlook security warnings.

Outlook 2013 has several features to help users reduce receipt of junk email messages. Outlook 2013 includes a Junk Email Filter that replaces the rules that were used in earlier versions of Outlook to filter mail. Messages caught by the filter are moved to the Junk Email folder, where they can be viewed or deleted later.

Junk email senders can include a web beacon in HTML email messages that includes external content, such as graphic images. When users open or view the email, the web beacons verify that their email addresses are valid. This increases the probability that users will receive more junk email messages. Outlook 2013 reduces the probability that users will become targets for future junk email by blocking automatic picture downloads from external servers by default.

Outlook 2013 helps protect against issues that are created by phishing email messages and deceptive domain names. By default, Outlook screens phishing email messages. These messages seem to be legitimate but they capture personal information, such as a user's bank account number and password. Outlook also helps prevent the receipt of email messages from deceptive users by warning about suspicious domain names in email addresses. Outlook 2013 supports internationalized domain names (IDNs) in email addresses. IDNs allow people to register and use domain names in their native languages instead of online English. IDN support allows phishers to send homograph attacks, a situation in which a look-alike domain name is created by using alphabet characters from different languages, not just English, with the intention of deceiving users into thinking that they are visiting a legitimate website.

For more information, see Overview of security and protection settings for Outlook 2013 and Plan for limiting junk email in Outlook 2010.

Configuring cryptographic features for Outlook

Outlook provides cryptographic features for sending and receiving security-enhanced email messages over the Internet or local intranet. You can customize features in an Outlook 2013 deployment to set cryptographic options that are appropriate for your organization.

You can also implement additional features to help improve security in email messaging. For example, you can provide security labels that match your organization's security policy. An Internal Use Only label might be implemented as a security label to apply to email messages that should not be sent or forwarded outside your company.

For more information, see Plan for email messaging cryptography in Outlook 2010.

Restricting permission on email messages

Information Rights Management (IRM) helps users prevent sensitive email messages and other Office content, such as documents and worksheets, from being forwarded, edited, or copied by unauthorized people. In Outlook 2013, users can use IRM to mark email messages with "Do not forward," which automatically restricts permission for recipients to forward, print, or copy the message. In addition, you can define customized Office-wide IRM permission policies for your organization's needs and can deploy the new permission policies for users to use with email messages or other Office documents. For more information, see Plan Information Rights Management in Office 2013.

Outlook 2013 and email protocols and servers

Outlook 2013 can be used with many email servers and services. The primary email servers and services supported by Outlook include the following:

  • Simple Mail Transfer Protocol (SMTP)

  • Post Office Protocol version 3 (POP3)

  • Internet Mail Access Protocol version 4 (IMAP4)

  • MAPI for Exchange Server (version 2007 and later versions)

  • Exchange Active Sync for connection to services such as Outlook.com (Hotmail) to access mail, calendar, contacts and tasks

  • Other messaging and information sources, such as Hewlett-Packard OpenMail. Use of these additional service providers is made possible by how Outlook 2013 uses the MAPI extensibility interface.

Users can use the Contacts, Tasks, and Calendar features in Outlook 2013 without being connected to an email server.

Upgrading from an earlier version of Outlook

You can install Outlook 2013 over any previous installation of Outlook. As in other Office 2013 applications, user settings that are stored in the registry are migrated when you upgrade from Office Outlook 2003 or later versions to Outlook 2013. If a MAPI profile already exists on a user's computer, you typically can configure a deployment to continue to use the profile

The MSI version of Outlook 2013 cannot coexist with earlier versions of Outlook on the same computer. However, you can install a Click-to-Run version of Outlook 2013 to run side-by-side with Outlook 2007 or Outlook 2010. But, side-by-side installations of Outlook together with earlier versions, such as Office Outlook 2003 are not supported. If you determine that users have to run Outlook 2007 or Outlook 2010 side-by-side with Outlook 2013, deploy the Click-to-Run version of Outlook 2013 or deploy Outlook 2013 with application virtualization.

When you upgrade users from an earlier version of Outlook, you must make choices about how to configure user profiles, consider Cached Exchange Mode issues, and be aware of fax and forms changes.

For an overview of feature changes and migration considerations, see What's new in Outlook 2013 and Changes in Office 2013.

Upgrading to Office 2013 with Cached Exchange Mode enabled

The process of upgrading users who currently have Cached Exchange Mode enabled in Office Outlook 2003, Office Outlook 2007 or Outlook 2010 is straightforward. If you do not change Cached Exchange Mode settings, the same settings are kept for Outlook 2013.

By default, when Outlook 2013 is installed, a new compressed version of the Outlook data file (.ost) is created. This new compressed version of the .ost is up to 40% smaller than the size of the .ost files that were created in earlier versions of Outlook. If you must keep Outlook 2013 from creating a new compressed Outlook data file (.ost), use the Outlook Group Policy template (Outlk15.admx) to enable the Do not create new OST file on upgrade policy. You can find this setting under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange.

Two new features are available with Cached Exchange Mode in Outlook 2013: Exchange Fast Access and Sync Slider. Exchange Fast Access combines the instant-access of Online Mode with the offline capabilities and syncing robustness of Cached Exchange Mode. This is specifically useful when synchronizing data locally would take enough time to be noticed by the user (for example, during initial synchronization, or resuming after returning from vacation). When you first start Outlook 2013, you will immediately see your most recent email messages and a completely up-to-date calendar. Outlook 2013 caches items in the background without affecting the user's experience.

Sync Slider allows an Outlook 2013 user to limit the email messages that are synchronized locally in an Outlook data file (.ost). By default, if Cached Exchange Mode is enabled, Outlook 2013 will only cache email messages from the last 12 months and remove anything older than 12 months from the local cache. Users can view messages that were removed from the local cache by scrolling to the end of an email list in a folder and clicking the message Click here to view more on Microsoft Exchange. Users can also change how many email messages are kept offline. You, as the IT Administrator, can change the default age or enforce the age of email messages that are removed from the local cache by using Group Policy or the Office Customization Tool to set Cached Exchange Mode Sync Settings. For more information, see Cached Exchange Mode settings for Outlook 2013 .

For additional Cached Exchange Mode planning considerations, see Plan a Cached Exchange Mode deployment in Outlook 2013.

Additional considerations when planning an Outlook upgrade

To prepare for an upgrade, you must determine answers to the following additional questions:

  • Should you upgrade to Exchange Server 2010 or migrate to Exchange Online to take advantage of features such as Data Loss Protection, integrated email archive, centralized rights management, support for multiple Exchange accounts, MailTips, Policy Tips, Voice Mail Preview and Protected Voice Mail? For more information, see Microsoft Exchange on TechNet, and Outlook 2013 features supported by different versions of Exchange Server.

  • Should you change Outlook user profiles as part of an upgrade? For example, you might define a new Exchange Server (like Exchange Online) or enable new features of Outlook 2013. For more information about how to customize Outlook profiles for the MSI version of Outlook 2013, see Office Customization Tool (OCT) reference for Office 2013 and Plan feature customizations in Outlook 2013. These articles apply to Outlook 2013 with Exchange Server 2007 and Exchange Server 2010.

  • How should you create and store a backup of your existing installation? Before you upgrade to any new release, we recommend that you back up existing data. For more information about how to back up Outlook files, see Back up Outlook data with the Microsoft Outlook Personal Folders Backup tool.

  • How will users learn about the new interface and features of Office 2013? For more information, see User Readiness for Office 2013.

  • Will any discontinued features or new or changed functionality affect when and how you upgrade? For a list of changes from earlier versions of Outlook, see Changes in Office 2013.

  • Will you have to assess and remediate Outlook add-ins in your environment?

    • Outlook 2013 enforces a fast shutdown process for add-ins. The shutdown process prevents add-ins from causing long delays by holding on to resources after the user exits Outlook. Although this change could adversely affect some existing add-ins, add-in vendors and IT administrators can resolve those effects by forcing Outlook to revert to the standard add-in shutdown process. For more information about the new shutdown process, see Shutdown Changes for Outlook 2010. For more information about add-in assessment and remediation, see Compatibility in Office 2013.

    • Exchange Client Extensions (ECEs) do not load in Outlook 2013. Some third-party applications such as archiving or security solutions use ECEs and must be updated for Outlook 2013. For more information, see Announcing the deprecation of Exchange Client Extensions.

    • If you are installing 64-bit Outlook 2013, you must update 32-bit MAPI applications, add-ins, and macros for Outlook to 64-bit. For more information, see the next section, Considerations for 32-bit Outlook applications when upgrading to a 64-bit platform .

Considerations for 32-bit Outlook applications when upgrading to a 64-bit platform

If you developed 32-bit Messaging Application Programming Interface (MAPI) applications, add-ins, or macros for Outlook, there are actions that you should take to change and rebuild the 32-bit applications to run on a 64-bit platform.

Starting with Office 2010, Outlook is available as a 32-bit application and a 64-bit application. Which version of Outlook you choose depends on the edition of the Windows operating system (32-bit or 64-bit) and the edition of Office 2013 (32- or 64-bit) that is installed on the computer, if Office is already installed on that computer.

Factors that determine the feasibility of installing a 32-bit or a 64-bit version of Outlook include the following:

  • You can install 32-bit Office 2013 and 32-bit Outlook 2013 on a supported 32-bit or 64-bit version of the Windows operating system. You can install the 64-bit version of Office 2013 and 64-bit Outlook 2013 only on a supported 64-bit Windows operating system.

  • The default installation of Office 2013 on a 64-bit version of the Windows operating system is 32-bit Office 2013.

  • The installed version of Outlook is always the same as the version of Office 2013, if Office is installed on the same computer. That is, a 32-bit version of Outlook 2013 cannot be installed on the same computer on which 64-bit versions of other Office 2013 applications are already installed, such as 64-bit Word 2013 or 64-bit Excel 2013. Similarly, a 64-bit version of Outlook 2013 cannot be installed on the same computer on which 32-bit versions of other Office applications are already installed.

MAPI applications include stand-alone applications such as Lync, Microsoft Office Communicator, and MFCMAPI, and service providers such as address book, store, and transport providers. For MAPI method and function calls to work in a MAPI application (except for one Simple MAPI function, MAPISendMail), the bitness of the MAPI application must be the same as the bitness of the MAPI subsystem on the computer on which the application is targeted to run. The bitness of the MAPI subsystem, in turn, is determined by and is always the same as the bitness of the installed version of Outlook. For information about how to prepare Outlook applications for 32-bit and 64-bit platforms, see the Outlook 2013 MAPI Reference in Microsoft Office Development in the MSDN Library, Building MAPI Applications on 32-Bit and 64-Bit Platforms, and Developing Outlook 2010 Solutions for 32-Bit and 64-Bit Systems.

See also

Office Customization Tool (OCT) reference for Office 2013
Changes in Office 2013
What's new in Outlook 2013
Plan a Cached Exchange Mode deployment in Outlook 2013

Learn about Microsoft Exchange Online

Change History

Date | Description
May 14, 2013 | Added a section that discusses what to consider for 32-bit Outlook applications when you upgrade to a 64-bit platform.
October 16, 2012 | Initial publication


Choose between Cached Exchange Mode and Online Mode for Outlook 2013

Published: October 16, 2012

Summary: Learn about the two Exchange connectivity modes that you can choose to use for Outlook 2013 deployments.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Outlook 2013 offers two basic connectivity modes when you are connected to an Exchange Server computer: Cached Exchange Mode or Online Mode. This article discusses which connectivity mode might be appropriate for your environment.

In this article:

  • Overview of Cached Exchange Mode and Online Mode

  • Choosing between Cached Exchange Mode and Online Mode

  • How Cached Exchange Mode can help improve the Outlook user experience

  • Outlook features that can reduce the effectiveness of Cached Exchange Mode

Overview of Cached Exchange Mode and Online Mode

When you configure an Outlook 2013 account to use Cached Exchange Mode, Outlook 2013 works from a local copy of a user's Microsoft Exchange mailbox that is stored in an offline data file (.ost file) on the user's computer, together with the Offline Address Book (OAB). The cached mailbox and OAB are updated periodically from the Exchange Server computer.

Cached Exchange Mode was introduced in Outlook 2003 to provide users a better online and offline experience. Cached Exchange Mode lets users move between connected and disconnected environments without interrupting their experience in Outlook. Also, it insulates users from network latency and connectivity issues while they are using Outlook.

In contrast, Online Mode works by using information directly from the server. When new information is required in Outlook, a request is made to the server and the information is displayed. Mailbox data is only cached in memory and never written to disk.

The user can select Cached Exchange Mode or Online Mode during account setup or by changing the account settings. You can also deploy the mode by using the Office Customization Tool (OCT) or Group Policy.

Choosing between Cached Exchange Mode and Online Mode

When to use Cached Exchange Mode

Cached Exchange Mode is the premier configuration in Outlook 2013. We recommend it in all circumstances, except those specifically indicated in When to use Online Mode later in this article.

Although we recommend Cached Exchange Mode in most user configurations, it is especially valuable for the following types of users:

  • Portable computer users who frequently move in and out of connectivity.

  • Users who frequently work offline or without connectivity.

  • Users who have high-latency connections (greater than 500ms) to the Exchange Server computer.

When to use Online Mode

Online Mode is the legacy method of connecting to Microsoft Exchange. It is a fully supported configuration in Outlook 2013. Online Mode has value in certain scenarios in which the behavior of Cached Exchange Mode is unwanted. The following scenarios are examples:

  • "Kiosk" scenarios in which a particular computer has many users who access different Outlook accounts and the delay to download e-mail messages to a local cache is unacceptable.

  • Heavily regulated compliance or secure environments in which data must not ever be stored locally. In these environments, we recommend that you evaluate Encrypting File System (EFS) or BitLocker in addition to Cached Exchange Mode as a potential solution.

  • Very large mailboxes on computers that have insufficient hard disk space for a local copy of the mailbox.

  • Very large mailboxes (greater than 25 GB) on which performance considerations become an issue in Cached Exchange Mode.

  • Virtualized or Remote Desktop Services (Terminal Services) environments that run Outlook 2013 and on which disk size or disk input/output (I/O) limitations prevent running Cached Exchange Mode at the desired scale.

If you work with a very large mailbox, you can reduce the size of the local data file by using Cached Exchange Mode with the Exchange Fast Access Sync Slider enabled. Sync Slider allows an Outlook 2013 user to limit the email messages that are synchronized locally in an Outlook data file (.ost). By default, if Cached Exchange Mode is enabled, Outlook 2013 will only cache email messages from the last 12 months and it will remove anything older than 12 months from the local cache. The email messages that are removed from the local cache will still be available for users to view. Users can scroll to the end of an email list in a folder and then choose the message Click here to view more on Microsoft Exchange to view the email messages that were removed. For more information, see Synchronization, disk space, and performance considerations for Cached Exchange Mode.

If you work with a very large mailbox on which performance considerations become an issue in Cached Exchange Mode, see How to troubleshoot performance issues in Outlook.

Special considerations for Cached Exchange Mode

Outlook 2013 supports running in Cached Exchange Mode in a Remote Desktop Services (Terminal Services) environment that has multiple users. When you configure a computer that is running Remote Desktop Services (Terminal Services) to use Cached Exchange Mode, you must consider the additional storage space and disk I/O that are required for multiple client access.

By default, new Exchange accounts that are set up on a computer that is running Remote Desktop Services (Terminal Services) use Online Mode. Upon setup, the user can decide to enable Cached Exchange Mode or this setting can be controlled by using the Use Cached Exchange Mode for new and existing Outlook profiles option in the Office Customization Tool or Group Policy.

In very limited bandwidth environments, Cached Exchange Mode can be configured to download only e-mail headers and a 256-character preview of the message body. For more information, see Configure Cached Exchange Mode in Outlook 2013.

Even when it is configured in Cached Exchange Mode, Outlook 2013 must contact the server directly to do certain operations. These operations do not function when Outlook is not connected and can take longer to complete on high-latency connections. These operations include the following:

  • Working with Shared Folders that were not made available offline. For more information, see Configure Offline Availability for a Shared Folder.

  • Retrieving Free/Busy information

  • Setting, changing, or canceling an Out of Office message

  • Accessing Public Folders

  • Retrieving rights to a rights-protected message

  • Editing rules

  • Retrieving MailTips

  • Retrieving Policy Tips

How Cached Exchange Mode can help improve the Outlook user experience

Use of Cached Exchange Mode provides the following key benefits:

  • Shields the user from network and server connection issues.

  • Facilitates switching from online to offline for mobile users.

By caching the user's mailbox and the OAB locally, Outlook no longer depends on continuous network connectivity for access to user information. While connected, Outlook continuously updates users' mailboxes so that the mailboxes are kept up-to-date. If a user disconnects from the network, for example, by removing a portable computer, such as a laptop, from a docking station, the latest information is automatically available offline.

In Outlook 2013, Exchange Fast Access is a new feature that is available with Cached Exchange Mode. It combines the instant access of Online Mode with the offline capabilities and syncing robustness of Cached Exchange Mode. When Cached Exchange Mode is enabled, and users first start Outlook 2013, they immediately see their most recent email messages and up-to-date calendar information as if they are in Online Mode. Outlook 2013 caches a local copy the user's mailbox in the background to prepare the user for offline use without affecting the user's experience. This is especially helpful in scenarios when syncing data locally would take enough time to be noticed by the user (for example, initial sync, resume, returning from vacation).

Besides using local copies of mailboxes to improve the user experience, Cached Exchange Mode optimizes the type and amount of data that is sent over a connection with the server. For example, if the On slow connections, download only headers setting is configured in the Office Customization Tool, Outlook changes the type and amount of data sent over the connection.

Note:

Outlook checks the network adapter speed on the user's computer to determine a user's connection speed, as supplied by the operating system. Reported network adapter speeds of 128 kilobytes (KB) or lower are defined as slow connections. Under some circumstances, the network adapter speed might not accurately reflect data throughput for users. For more information about adjusting the behavior of Outlook in these scenarios, see Managing Outlook behavior for perceived slow connections in Plan a Cached Exchange Mode deployment in Outlook 2013.

Outlook can adapt to changing connection environments by offering different levels of optimization, such as disconnecting from a corporate local area network (LAN), going offline, and then re-establishing a connection to the server over a slower, dial-up connection. When the Exchange Server connection type changes, such as LAN, wireless, cellular, or offline connections, transitions are seamless and do not require changing settings or restarting Outlook.

For example, a user might have a portable computer at work that has a network cable connection to a corporate LAN. In this scenario, the user has access to headers and full items, including attachments. The user also has quick access and updates to the computer that runs Exchange Server. If a user disconnects the portable computers from the LAN, Outlook switches to Trying to connect mode. The user can continue to work uninterruptedly by using the data in Outlook. If a user has wireless access, Outlook can re-establish a connection to the server and then switch back to Connected mode.

If the user later connects to the Exchange Server computer over a dial-up connection, Outlook recognizes that the connection is slow and automatically optimizes for that connection by downloading only headers and by not updating the OAB. In addition, Outlook 2013, Outlook 2010 and Office Outlook 2007 include optimizations to reduce how much data that is sent over the connection. The user does not have to change settings or restart Outlook in this scenario.

Outlook 2013 also includes the Need Password mode. A Need Password message is displayed when Outlook is in a disconnected status and requires user credentials to connect. For example, when a user chooses Cancel in a credentials authentication dialog box. When Outlook is disconnected but is not offline, a user-initiated action (such as choosing Send/Receive or the Type Password button on the ribbon) causes Outlook to prompt again for the password and to display a Trying to connect message until the user can successfully authenticate and connect.

Outlook features that can reduce the effectiveness of Cached Exchange Mode

Some Outlook features reduce the effectiveness of Cached Exchange Mode because they require network access or bypass Cached Exchange Mode functionality. The primary benefit of using Cached Exchange Mode is that the user is shielded from network and server connection issues. Features that rely on network access can cause delays in Outlook responsiveness that users would not otherwise experience when they use Cached Exchange Mode.

The following features might rely on network access and can cause delays in Outlook unless users have fast connections to Exchange Server data:

  • Delegate access, when folders are not cached locally (local cache is the default).

  • Opening another user's calendar or folder that is not cached locally (local cache is the default).

  • Using a public folder that is not cached.

For more information, see Managing Outlook folder sharing in Plan a Cached Exchange Mode deployment in Outlook 2013.

We recommend that you disable or do not implement the following features, or combination of features, if you deploy Cached Exchange Mode:

  • The toast notification that has digital signatures on email messages Outlook must check a server to verify a digital signature. By default, when new messages arrive in a user's Inbox, Outlook displays a toast notification that contains a part of an email message. If the user chooses the toast notification to open a signed email message, Outlook uses network access to check for a valid signature on the message.

  • Multiple Address Book containers The Address Book typically contains the global address list (GAL) and user Contacts folders. Some organizations configure subsets of the GAL, which display in the Address Book. These subset address books can also be included in the list that defines the search order for address books. If subset address books are included in the search order list, Outlook might have to access the network to check these address books every time that a name is resolved in an email message that a user is composing.

Certain Outlook add-ins can affect Cached Exchange Mode. Some add-ins can access Outlook data by using the object model to bypass the expected functionality of the Download only headers and On slow connections, download only headers settings in Cached Exchange Mode. For example, full Outlook items, not only headers, download if you use Microsoft ActiveSync technology to synchronize a hand-held computer, even over a slow connection. In addition, the update process is slower than if you download the items in Outlook, because one-time-only applications use a less-efficient kind of synchronization.

See also

Plan a Cached Exchange Mode deployment in Outlook 2013
Configure Cached Exchange Mode in Outlook 2013


Plan a Cached Exchange Mode deployment in Outlook 2013

Published: October 16, 2012

Summary: Plan a Cached Exchange Mode deployment for Outlook 2013.

Applies to: Exchange 2013 | Office 2013 | Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Outlook 2013 offers two basic connectivity modes when you are connected to an Exchange Server computer: Cached Exchange Mode or Online Mode. Cached Exchange Mode is the premier configuration in Outlook 2013. We recommend it in all circumstances, except those that are specifically indicated in When to use Online Mode, which is in the article Choose between Cached Exchange Mode and Online Mode for Outlook 2013.

This article describes planning considerations and settings for Cached Exchange Mode deployments in Outlook 2013 including information about the new Cached Exchange Mode features, Exchange Fast Access and Sync Slider, and the new Outlook compressed data file (.ost) format.

In this article:

  • Synchronization, disk space, and performance considerations for Cached Exchange Mode

  • Managing Outlook behavior for perceived slow connections

  • Options for staging a Cached Exchange Mode deployment

  • Upgrading current Cached Exchange Mode users to Outlook 2013

  • Cached Exchange Mode settings for Outlook 2013

Synchronization, disk space, and performance considerations for Cached Exchange Mode

Cached Exchange Mode uses a local copy of the user's Exchange mailbox, and in some cases, you can improve the performance of Cached Exchange Mode for your whole organization or for a group of users. For example, you can improve the performance of Cached Exchange Mode for users who work remotely.

Synchronization changes in Outlook 2013

In Outlook 2013, two new features are available with Cached Exchange Mode: Exchange Fast Access and Sync Slider. Exchange Fast Access combines the instant-access of Online Mode with the offline capabilities and syncing robustness of Cached Exchange Mode, specifically in scenarios when syncing data locally would take enough time to be noticed by the user (for example, initial sync, resume, returning from vacation). When you first start Outlook 2013, you will immediately see your most recent email messages and a completely up-to-date calendar. Outlook 2013 caches items in the background to prepare users for offline use without affecting their experience.

Sync Slider allows an Outlook 2013 user to limit the email messages that are synchronized locally in an Outlook data file (.ost). By default, if Cached Exchange Mode is enabled, Outlook 2013 will only cache email messages from the last 12 months and remove anything older than 12 months from the local cache. Users can view messages that were removed from the local cache by scrolling to the end of an email list in a folder and choosing the message Click here to view more on Microsoft Exchange. Users can also change how many email messages are kept offline. You, as the IT Administrator, can change the default age or enforce the age of email messages that are removed from the local cache by using Group Policy or the Office Customization Tool to set Cached Exchange Mode Sync Settings. For more information, see Cached Exchange Mode settings for Outlook 2013 later in this article.

Outlook data file (.ost) recommendations

If you are moving from using Online Mode to Cached Exchange Mode as part of the deployment of Outlook 2013, be aware that users' local .ost files can increase 50 percent to 80 percent over the size of the mailbox that is reported in Exchange Server. The format that Outlook uses to store data locally for Cached Exchange Mode is less space-efficient than the server data file format. This means that more disk space is used when mailboxes are downloaded to provide a local copy for Cached Exchange Mode.

By default, when you install Outlook 2013 and enable Cached Exchange Mode, a new compressed version of the Outlook data file (.ost) is created. This new compressed version of the .ost is up to 40% smaller than the size of the .ost files that were created in earlier versions of Outlook. If you must keep Outlook 2013 from creating a new compressed Outlook data file (.ost), use the Outlook Group Policy template (Outlk15.admx) to enable the Do not create new OST file on upgrade policy. You can find this setting under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange.

The maximum size for the new compressed format of the .ost files is configurable. The default is 50 GB of data storage. Make sure that users' .ost files are located in a folder that has sufficient disk space to accommodate users' mailboxes. For example, if users' hard disk drives are partitioned to use a smaller drive for system programs (the system drive is the default location for the folder that contains the .ost file), specify a folder on another drive that has more disk space as the location of users' .ost files.

  • For more information about how to deploy .ost files in a location other than the default location, see To configure a default .ost location by using Group Policy in Configure Cached Exchange Mode in Outlook 2013.

  • For more information about how to configure the Unicode .ost file size, see How to configure the size limit for both (.pst) and (.ost) files in Outlook 2010, Outlook 2007, and in Outlook 2003.

Managing performance issues in Outlook

Most users find that Cached Exchange Mode performs faster than online mode. However, many factors influence a user's perception of Cached Exchange Mode performance, such as hard disk size and speed, CPU speed, .ost file size, and the expected level of performance.

For troubleshooting tips about diagnosing and addressing performance issues in Outlook, see How to troubleshoot performance issues in Outlook and Performance tips for deploying Outlook 2007.

Managing Outlook folder sharing

By default, when Cached Exchange Mode is enabled in Outlook 2013 and Outlook 2010, shared mail and non-mail folders that users access in other mailboxes, are downloaded and cached in the user's local .ost file. This behavior differs from Outlook 2007 in which only shared non-mail folders are cached by default. For example, if a coworker shares a calendar with another user and the other user opens it, Outlook 2013 starts caching the folder locally so that the user has offline access to the folder and is insulated from network issues. Similarly, if a manager delegates access to his or her Inbox to a team member, when the team member accesses the folder, Outlook 2013 also starts caching the Inbox folder locally.

Cached folders enable offline access and can provide a much more reliable experience on slow or unreliable networks. But be aware that they take a little more time to populate at first; more data is synchronized so that the local .ost file size increases; and in scenarios that have slow connections or where the user is offline, the folder is not current until the latest changes are synchronized and downloaded.

You can disable the caching of all shared folders for profiles that have Cached Exchange Mode enabled. To do this, configure the Download shared non-mail folders option in the Office Customization Tool (OCT) when you customize your Cached Exchange Mode deployment. Note that this setting applies to both mail and non-mail folders in Outlook 2013.

If you want to disable the caching of shared mail folders (like a delegated Inbox) but not shared non-mail folders (like Calendar), see By default, shared mail folders are downloaded in Cached mode in Outlook 2010.

For more information about how to change these settings, see Cached Exchange Mode settings for Outlook 2013 later in this article and Configure Cached Exchange Mode in Outlook 2013 for step by step instructions.

Public Folder Favorites considerations

You can configure Cached Exchange Mode to download and synchronize the public folders that are included in users' Favorites folders for Outlook Public Folders. By default, Public Folder Favorites are not synchronized. However, you might want to enable this option if your organization uses public folders extensively. You can configure an option to download Public Folder Favorites in the .ost when you customize your Cached Exchange Mode deployment.

If users' Public Folders Favorites folders include large public folders, their .ost files can also become large. This can adversely affect Outlook performance in Cached Exchange Mode. Before you configure Cached Exchange Mode to enable this option, make sure that users are selective about the public folders that are included in their Public Folder Favorites. Also, make sure that users' .ost files are large enough, and are in folders that have sufficient disk space, to accommodate the additional storage requirements for the public folder downloads.

As an alternative to Public Folders, consider Site Mailboxes. Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint 2013 documents and Exchange email that are in the same client interface. A site mailbox consists of SharePoint 2013 site membership (owners and members), shared storage through an Exchange Server 2013 mailbox for email messages and a SharePoint 2013 site for documents, and a management interface that addresses provisioning and life-cycle needs. SharePoint 2013 documents that are viewed in the site mailbox are stored only on SharePoint 2013.

Site mailboxes require Exchange Server 2013 and SharePoint Server 2013 integration and configuration. For more information, see Site mailboxes in the new Office and Configure site mailboxes in SharePoint Server 2013.

Managing Outlook behavior for perceived slow connections

Outlook is configured to determine a user's connection speed by checking the network adapter speed on the user's computer, as supplied by the operating system. If the reported network adapter speed is 128 KB or lower, the connection is defined as a slow connection.

When a slow connection to an Exchange Server computer is detected, Outlook helps users have a better experience if they reduce the less-important information that is synchronized with the Exchange Server computer. Outlook makes the following changes to synchronization behavior for slow connections:

  • Switches to downloading only headers.

  • Does not download the Offline Address Book or OAB updates.

  • Downloads the body of an item and associated attachments only when it is requested by the user.

Outlook continues to synchronize the Outlook data with mobile devices, and some client-side rules might run.

Note:

We recommend that you do not synchronize mobile devices when the Cached Exchange Download only headers setting is enabled. When you synchronize a mobile device by using ActiveSync, for example, full items are downloaded in Outlook, and the synchronization process is less efficient than it is during regular Outlook synchronization to users' computers.

The Download only headers setting for synchronization is designed for Outlook users who have dial-up connections or cellular wireless connections, to minimize network traffic when there is a slow or expensive connection.

Under some circumstances, the network adapter speed might not accurately reflect data throughput for users. For example, if a user's computer is connected to a local area network (LAN) for fast access to local file servers, the network adapter speed is reported as fast because the user is connected to a LAN. However, the user's access to other locations on an organization's network that include the Exchange Server computer might use a slow link, such as an ISDN connection. For such a scenario, where users' actual data throughput is slow, even though their network adapters report a fast connection, you can configure an option to change or lock down the behavior of Outlook. You can do this, for example, by disabling automatic switching to downloading only headers by using the Group Policy option, Disallow On Slow Connections Only Download Headers. Similarly, there might be connections that Outlook has determined are slow but which provide high data throughput to users. In this case, youcan also disable automatic switching to downloading only headers.

You can configure the On slow connections, download only headers option in the OCT, or lock down the option by using Group Policy to set Disallow On Slow Connections Only Download Headers. For more information about how to customize this setting, see Cached Exchange Mode settings for Outlook 2013 later in this article or Configure Cached Exchange Mode in Outlook 2013 for step by step instructions.

Options for staging a Cached Exchange Mode deployment

If you plan to upgrade a large group of users from an Online Mode deployment of Outlook to Outlook 2013 with Cached Exchange Mode enabled, stage the rollout over time. A staged rollout over time helps your organization's Exchange Server computers manage the requirements of creating or updating users' .ost files.

Caution:

If most user accounts are updated to use Cached Exchange Mode at the same time and then start Outlook at the same time (for example, on a Monday morning after a weekend upgrade), the Exchange Server computers may have significant performance issues. These performance issues can sometimes be reduced, But we generally recommend that you stage deployment of Cached Exchange Mode over time.

The following scenarios include examples of how you can deploy Cached Exchange Mode to avoid a large initial performance effect on the Exchange Server computers and, in some cases, minimize the time users spend waiting for the initial synchronization:

  • Provide seed .ost files to remote users, and then deploy Cached Exchange Mode after users have installed the .ost files that you provide. If most users in your organization do not currently have .ost files or are not using Cached Exchange Mode, you can deploy Outlook 2013 with Cached Exchange Mode disabled. Then, before the date on which you plan to deploy Cached Exchange Mode, you provide to each user an initial, or seed, .ost file that has a snapshot of the user's mailbox. For example, you can provide or mail to the user a CD that contains the file together with installation instructions. You might also want to provide a recent version of your organization's Office Address Book (OAB) that has full details. You configure and deploy Cached Exchange Mode when users confirm that they have installed the files.

    When you update your Outlook deployment to use Cached Exchange Mode later, Exchange Server updates users' existing .ost files. There is much less data to synchronize than there would be if you create a new .ost file and OAB for each user. Creating individual CDs for each user's .ost file can be time-consuming. Therefore, this seed-file deployment option might be most useful for select groups of remote users who would otherwise spend lots of time waiting for the initial mailbox and OAB synchronization, perhaps at a high cost, depending on the remote connection scenario.

    For more information about how to create initial .ost files, see Providing an initial OST file for an Outlook Cached Exchange Mode deployment. The article describes the creation initial .ost files for Office Outlook 2003. The process works similarly for Office Outlook 2007, Outlook 2010, and Outlook 2013.

  • Deploy Outlook with Cached Exchange Mode to groups of users over time. You can balance the workload on the Exchange Server computers and the local area network by upgrading groups of users to Cached Exchange Mode over time. By rolling out the new feature in stages, you can reduce the network traffic and server-intensive work of populating .ost files that have users' mailbox items and downloading the OAB.

    The way that you create and deploy Cached Exchange Mode to groups of users depends on your organization's usual deployment methods. For example, you might create groups of users in Microsoft System Center Configuration Manager to which you deploy a System Center Configuration Manager package that updates Outlook to use Cached Exchange Mode. You deploy that package to each group over time. To balance the load as much as you can, choose groups of users whose accounts are spread across groups of Exchange Server computers.

Upgrading current Cached Exchange Mode users to Outlook 2013

The process of upgrading users to Outlook 2013 when Cached Exchange Mode is already enabled in Office Outlook 2003, Outlook 2007, or Outlook 2010, is straightforward. If you do not change Cached Exchange Mode settings, the same settings are kept for Outlook 2013.

However, by default, when Outlook 2013 is installed and Cached Exchange Mode is enabled, a new compressed version of the Outlook data file (.ost) is created. This new compressed version of the .ost is up to 40% smaller than the size of the .ost files that were created in earlier versions of Outlook. If you are upgrading from an earlier version of Outlook that had Cached Exchange Mode enabled, the earlier version of the .ost file is kept and, if it is necessary, can be opened by Outlook 2013. If you must keep Outlook 2013 from creating a new compressed Outlook data file (.ost), use the Outlook Group Policy template (Outlk15.admx) to enable the Do not create new OST file on upgrade policy. For more information, see Cached Exchange Mode settings for Outlook 2013 later in this article.

Also, be aware that in Outlook 2013, by default, shared mail and non-mail folders that users access in other mailboxes are downloaded and cached in the user's local .ost file when Cached Exchange Mode is enabled. This behavior differs from Outlook 2007 in which only shared non-mail folders are cached by default. Therefore, when a user's existing Office Outlook 2003 or Outlook 2007 profile has Cached Exchange Mode enabled and that profile is upgraded to Outlook 2013, shared mail and non-mail folders are downloaded when the user accesses them. This can be problematic if your organization uses shared folders extensively and if you have .ost files that are close to the file limit (2 GB for ANSI .ost files and 20 GB by default for Unicode or compressed .ost files). When these factors are both present, you may experience performance issues and other problems if you download shared folders. For more information about file size limits, see The file size limits of .pst and .ost files are larger in Outlook 2010.

For new Outlook 2013 profiles or for upgrading existing Office Outlook 2003, Outlook 2007, or Outlook 2010 profiles, you can use the OCT or Group Policy to disable the download shared folder option and therefore help prevent problems that involve downloading shared folders. Be aware that the setting Download non-mail shared folders applies to both mail and non-mail folders in Outlook 2013.

If you want to disable the caching of shared mail folders (such as a delegated Inbox) but non shared non-mail folders (such as Calendar), see By default, shared mail folders are downloaded in Cached mode in Outlook 2010.

In addition, be aware that caching for shared folders works differently from other caching for Cached Exchange Mode. For shared folders, replication to the local .ost file starts only when the user chooses the shared folder. After a user starts caching for the folder by choosing (clicking) it, Outlook updates the folder exactly like other Outlook folders that are synchronized in Cached Exchange Mode. However, if the user does not go to the folder at least one time every 45 days (the default value), the locally cached data for the folder is removed from the .ost file and will not be downloaded until the user chooses on the folder again.

To configure the number of days when cached shared data is removed from the .ost file, you can configure the Synchronizing data in shared folders option in the OCT or Group Policy. For more information, see Cached Exchange Mode settings for Outlook 2013 later in this article or see Configure Cached Exchange Mode in Outlook 2013 for step by step instructions.

Cached Exchange Mode settings for Outlook 2013

You can lock down the settings to customize Cached Exchange Mode by using the Outlook Group Policy Administrative template (Outlk15.admx). Or, you can configure default settings by using the Office Customization Tool (OCT), in which case users can change the settings.

By using Group Policy, you can help prevent users from enabling Cached Exchange Mode in Outlook 2013, and you can enforce download options for Cached Exchange Mode or configure other Cached Exchange Mode options. For example, you can specify the default times between Exchange Server synchronizations when data changes on an Exchange Server computer or on the client computer.

For steps to lock down settings by using Group Policy, see Configure Cached Exchange Mode in Outlook 2013.

The following table shows some settings that you can configure for Cached Exchange Mode. In Group Policy, you can find the settings under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange\Cached Exchange Mode. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Cached Exchange Mode settings

Setting name Registry path and value name Description

Cached Exchange Mode Sync Settings

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\cached mode!syncwindowsetting

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!syncwindowsetting

Enable to configure how much user email that Outlook synchronizes locally by date of message. To allow all email messages regardless of date to synchronize to users' local mailbox cache, enable and select All from the list. By default, if you do not configure this setting, Outlook synchronizes email messages sent or received in the last 12 months to users' local mailbox cache (.ost).

Disable Exchange Fast Access

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\hybrid!localcaching

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\ hybrid!localcaching

Enable setting to turn off Exchange Fast Access. This forces user accounts to access data from the local cache.

Disallow Download Full Items

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!nofullitems

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ outlook\cached mode!nofullitems

Enable to turn off the Download Full Items option in Outlook. To find this option, choose the Send/Receive tab, and then choose Download Preferences.

Disallow Download Headers

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!noheaders

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ outlook\cached mode!noheaders

Enable to turn off the Download Headers option in Outlook. To find this option, choose the Send/Receive tab.

Disallow Download Headers then Full Items

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!nodrizzle

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ outlook\cached mode!nodrizzle

Enable to turn off the Download Headers then Full Items option in Outlook. To find this option, choose the Send/Receive tab, and then choose Download Preferences.

Disallow On Slow Connections Only Download Headers

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!noslowheaders

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!noslowheaders

Enable to turn off the On Slow Connections Download Only Headers option in Outlook. To find this option, choose the Send/Receive tab, and then choose Download Preferences.

Download Public Folder Favorites

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!syncpffav

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!syncpffav

Enable to synchronize Public Folder Favorites in Cached Exchange Mode.

Download shared non-mail folders

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!downloadsharedfolders

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!downloadsharedfolders

Enable to synchronize shared non-mail folders in Cached Exchange Mode.

Use Cached Exchange Mode for new and existing Outlook profile

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ outlook\cached mode!enable

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!enable

Enable to configure new and existing Outlook profiles to use Cached Exchange Mode. Disable to configure new and existing Outlook profiles to use Online Mode.

The following table shows some additional settings that you can configure for Exchange connectivity. In Group Policy, you can find the settings under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Exchange connectivity settings

Setting name Registry path and value name Description

Automatically configure profile based on Active Directory Primary SMTP address

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\autodiscover!zeroconfigexchange

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\autodiscover!zeroconfigexchange

Enable to prevent users from changing the SMTP e-mail address that is used to set up a new account from the one retrieved from Active Directory.

Configure Outlook Anywhere user interface options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\rpc!enablerpctunnelingui

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\rpc!enablerpctunnelingui

Enable to let users view and change user interface (UI) options for Outlook Anywhere.

Do not allow an OST file to be created

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\ost!noost

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\ost!noost

Enable to prevent offline folder use.

Do not create new OST file on upgrade

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\ost!donotcreatenewostonupgrade

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\ost!donotcreatenewostonupgrade

Enable to force Outlook 2013 to use the existing .ost file that was created by an earlier version of Outlook. If you disable or do not configure this setting (recommended), a new .ost file is created when you upgrade to Outlook 2013.

Set maximum number of Exchange accounts per profile

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\exchange!maxnumexchange

OCT registry path: HKEY_CURRENT_USER\software\microsoft\exchange!maxnumexchange

Enable to set the maximum number of Exchange accounts that are allowed per Outlook profile.

Synchronizing data in shared folders

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\cached mode!sharedfolderageoutdays

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!sharedfolderageoutdays

Enable to control the number of days that elapses without a user accessing an Outlook folder before Outlook stops synchronizing the folder with Exchange.

See also

Choose between Cached Exchange Mode and Online Mode for Outlook 2013
Configure Cached Exchange Mode in Outlook 2013

Plan to automatically configure user accounts in Outlook 2010


Plan feature customizations in Outlook 2013

Published: October 16, 2012

Summary: Learn about some features that you can configure and deploy with Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Some features that you might have to configure and deploy with Outlook 2013, such as Contact Cards and the Outlook Social Connector, are discussed in this article. For security and protection features, see Overview of security and protection settings for Outlook 2013. For Cached Exchange Mode settings, see Plan a Cached Exchange Mode deployment in Outlook 2013.

Important:

Are you looking for help with customizing new Outlook features on your desktop? You may be looking for What's new in Outlook 2013, which will help you get started with Outlook 2013.

In this article:

  • Overview

  • Add-ins

  • Attachment Reminder

  • Contact Cards

  • Conversation arrangement view

  • Data Loss Prevention and Policy Tips

  • Exchange ActiveSync

  • Exchange Fast Access and Sync Slider

  • Global address list synchronization

  • MailTips

  • Mail apps for Outlook

  • Outlook Social Connector

  • Site mailboxes

  • Weather bar

Overview

You can customize the installation of Outlook 2013 by using Group Policy or the Office Customization Tool (OCT). To enforce settings, use Group Policy together with the Outlook 2013 Group Policy template (Outlk15.admx/Outlk15.adml), and for some settings, such as those for Contact Cards, use the Office 2013 Group Policy template (Office15.admx/Office15.adml).

To configure default settings where users can later change the settings, use the OCT. The OCT settings are in corresponding locations of the Group Policy settings on the Modify user settings page of the OCT. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

  • For information about how to download the Outlook 2013 administrative template, and about other Office 2013 Administrative Templates, see Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013.

  • For more information about Group Policy, see Overview of Group Policy for Office 2013 and Enforce settings by using Group Policy in Office 2010.

Note that some features that are available with Exchange Server, such as Data Loss Prevention and Policy Tips, are only administratively configurable through Exchange.

Add-ins

By default, Outlook 2013 now turns off any add-in that adversely affects performance, resiliency, or reliability of Outlook. Users can view and re-enable add-ins by going to File, Options, Add-ins, Manage and selecting Disabled items in Outlook 2013. If you, as the IT Administrator, do not want Outlook 2013 to automatically disable an add-in when it affects performance, you can use the Outlook Group Policy template (Outlk15.admx) to set the Group Policy option: List of managed add-ins. You can find the settings in the following table under User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous.

Add-in settings

Setting name | Registry path and value name | Description
Block all unmanaged add-ins | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\resiliency!addinlist | Enable to block all add-ins not managed by the List of managed add-ins policy. If you disable or do not configure this setting, users can enable or disable any add-in not managed by the List of managed add-ins policy.
List of managed add-ins | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\resiliency!addinlist | Enable and add the programmatic identifier (ProgID) for COM add-ins that you want to manage. You can specify which add-ins are always enabled, always disabled (or blocked), or configurable by users.

Attachment Reminder

Before an email message is sent, Outlook 2013 can detect if an attachment was omitted from the message and notify the user. Users can turn off the Attachment Reminder in Outlook 2013 by selecting Don't show this message again in the Attachment Reminder dialog box or by going to File, Options, Mail and under Send messages, selecting Warn me when I send a message that may be missing an attachment.

The settings that you can configure for Attachment Reminder in Group Policy and the OCT are shown in the following table. In Group Policy, the settings are found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Attachment Reminder setting

Setting name Registry path and value name Description

Attachment Reminder Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\mailsettings!checkforgottenattachments

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ common\mailsettings!checkforgottenattachments

Disable to turn off the attachment reminder in Outlook.

Contact Cards

In Office 2013, Contact Cards appear when you rest the mouse pointer over a name, for example a sender's name in an email message or the author's name in an Office 2013 document. If you install Office 2013 with Office Communicator 2007 R2, Lync 2010 or Lync 2013, Contact Cards displays a person's availability and lets you easily start a conversation directly through instant messaging, voice call, or video. When you expand the Contact Card, you can view the Contact, Notes, Organization, What's new and Membership tabs.

  • The Contact tab is the default view and it displays information such as office location, company, and work telephone number.

  • The Notes tab shows the notes that the user added for the contact through Outlook contacts.

  • The Organization tab displays the contact's manager and contacts that share the same manager.

  • The What's new tab displays the contact's social network updates from the social networks you've added if you are friends with that contact on that specific social network or if they have public social network updates.

  • The Membership tab displays the distribution lists for which the contact is a member.

In Office 2013, you can customize Contact Cards to turn off certain features and specify where presence icons are displayed. For the Contact tab on the Contact Card, you can replace labels and values. Some of the specific settings that you can configure for Contact Cards are described in the following two sections.

Contact Card

To configure Contact Card settings, load the Office 2013 administrative template. In Group Policy, the settings in the following table are found under User Configuration\Administrative Templates\Microsoft Office 2013\Contact Card. The OCT settings are in corresponding locations on the Modify user settings page of the OCT. The settings in the following table apply to all Office applications where the Contact Card is available.

Contact Card settings

Setting name Registry path and value name Description

Configure presence icon

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\im!

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\im!

Specifies where the presence icons are displayed.

Display all Displays the presence icons.

Display some Displays only in the Contact Card and in lists in SharePoint.

Display None Presence icons are not displayed.

Display legacy GAL dialog

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnonlegacygaldialog

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnonlegacygaldialog

Displays the global address list (GAL) dialog box instead of the Contact Card when users choose (double-click) a contact in Outlook.

Do not display Hover Menu

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoffhoverfunctionality

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoffhoverfunctionality

Stops the Hover menu from displaying when a user pauses on a contact's presence icon or display name.

Do not display photograph

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common!turnoffphotograph

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common!turnoffphotograph

Prevents display of the contact photograph on the Contact Card, email header, reading pane, fast search results, GAL dialog box, and File tab. For Outlook deployments with Lync Server, you can turn off photographs in the Lync contact list. See Customizing Lync Behavior and the User Interface.

Remove Member Of tab

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoffmemberoftab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoffmemberoftab

Removes the Membership tab on the Contact Card.

Remove Organization tab

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnofforganizationtab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnofforganizationtab

Removes the Organization tab on the Contact Card.

Turn off click to IM option

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\im!turnoffclicktoim

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\im!turnoffclicktoim

Removes the Instant Messaging (IM) option from the Contact Card and Outlook ribbon.

Turn off click to telephone

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\im!turnoffclicktophone

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\im!turnoffclicktophone

Removes the telephone option from the Contact Card and Outlook ribbon.

Turn off presence integration

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\im!turnoffpresenceintegration

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\im!turnoffpresenceintegration

Turns off IM presence integration for Office 2013 applications.

Contact tab

Some of the Contact tab options that you can set are in the following table. In Group Policy, you can find these settings and more under User Configuration\Administrative Templates\Microsoft Office 2013\Contact Card\Contact Tab. The OCT settings are in the corresponding locations on the Modify user settings page of the OCT.

If Outlook is installed, Office uses the MAPI property settings for the Contact tab. If Outlook is not installed, Office uses the Active Directory property settings. So to customize the Contact Card Contact tab in Office 2013, use the Replace MAPI - property settings for Office deployments where Outlook is installed. For Office deployments where Outlook is not installed use the Replace AD - property settings.

For information about Active Directory attributes, see Property Sets in Exchange 2007 and Attributes defined by Active Directory (Windows). For information about MAPI properties, see Mail User Properties.

Contact tab settings

Setting name Registry path and value name Description

Replace Label - Office

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplaceoffice

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplaceoffice

Enable and enter a new label name for the Office (office location) field.

Replace Label - Work

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplacework

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplacework

Enable and enter a new label name for the Work (work phone) field.

Replace Label - Mobile

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplacemobile

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplacemobile

Enable and enter a new label name for the Mobile (mobile phone) field.

Replace Label - Home

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplacehome

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplacehome

Enable and enter a new label name for the Home (home phone) field.

Replace Label - E-mail

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplaceemail

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttablabelreplaceemail

Enable and enter a new label name for the E-mail (e-mail address) field.

Replace AD - Office

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplaceoffice

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplaceoffice

Enable and enter the Active Directory attribute to replace the Office field value.

If you enable this setting, also set Replace MAPI- Office.

Replace AD - Work

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplacework

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplacework

Enable and enter the Active Directory attribute to replace the Work field value.

If you enable this setting, also set Replace MAPI - Work.

Replace AD - Mobile

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplacemobile

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplacemobile

Enable and enter the Active Directory attribute to replace the Mobile field value.

If you enable this setting, also set Replace MAPI - Mobile.

Replace AD - Home

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplacehome

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplacehome

Enable and enter the Active Directory attribute to replace the Home field value.

If you enable this setting, also set Replace MAPI - Home.

Replace AD - E-mail

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplaceemail

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplaceemail

Enable and enter the Active Directory attribute to replace the E-mail field value.

If you enable this setting, also set Replace MAPI - E-mail.

Replace MAPI- Office

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplaceoffice

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabadreplaceoffice

Enable and enter the MAPI property to replace the Office field value.

If you enable this setting, also set Replace AD - Office.

Replace MAPI - Work

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacework

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacework

Enable and enter the MAPI property to replace the Work field value.

If you enable this setting, also set Replace AD - Work.

Replace MAPI - Mobile

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacemobile

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacemobile

Enable and enter the MAPI property to replace the Mobile field value.

If you enable this setting, also set Replace AD - Mobile.

Replace MAPI - Home

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacehome

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacehome

Enable and enter the MAPI property to replace the Home field value.

If you enable this setting, also set Replace AD - Home.

Replace MAPI - E-mail

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacehome

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\contactcard!turnoncontacttabmapireplacehome

Enable and enter the MAPI property to replace the E-mail field value.

If you enable this setting, also set Replace AD - E-mail.

Conversation arrangement view

The Conversation arrangement view provides a threaded view of email messages in an Outlook folder. To access the Conversation arrangement view in Outlook 2013, click View, and then select the Show as Conversations check box.

The settings that you can configure for Conversation arrangement view in Group Policy and the OCT are shown in the following table. In Group Policy, the settings are found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Conversation arrangement view settings

Setting name Registry path and value name Description

Configure Cross Folder Content in Conversation view

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\conversations!

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\conversations!

Enable and select the email folder content to include in Conversation arrangement view.

On and cross-store Email that is displayed is from all connected Outlook data files whether they are cached on the local computer or online.

Off Email that is displayed in Conversation arrangement view is only from the current folder (such as the Inbox).

On and current Email that is displayed in Conversation arrangement view is only from the current Outlook data file being viewed.

On and local Email that is displayed is only from the current Outlook data file being viewed and any other local Outlook data file (such as a personal data file (.pst)).

Do not use Conversational arrangement in Views

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\setup!upgradetoconversations

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\setup!upgradetoconversations

If you do not configure this setting, the Outlook 2013 views will display Date view as the default. Enable this setting to turn off Conversation arrangement and to prevent users from using Conversation arrangement in Outlook 2013. Disable this setting to turn on Conversation arrangement as the default Outlook view.

Data Loss Prevention and Policy Tips

Data loss prevention (DLP) is a new feature area in Exchange Server 2013. DLP capabilities help you protect sensitive data and inform users of internal compliance policies. DLP can also help keep your organization safe from users who mistakenly send sensitive information to unauthorized people. The new Exchange DLP features help you identify, monitor, and protect sensitive data by using deep content analysis.

Exchange Server 2013 offers built-in DLP policies that are based on regulatory standards such as personally identifiable information (PII) and payment card industry data security standards (PCI). DLP is extensible so that it can support other policies that are important to your business. Additionally, the new Policy Tips in Outlook inform users about policy violations before they send sensitive data.

For information about how to configure Data Loss Prevention and Policy Tips with Exchange Server 2013, see Data Loss Prevention and Policy Tips.

Exchange ActiveSync

Exchange ActiveSync is a protocol that lets Outlook 2013 connect to services such as Outlook.com to access email, calendar, contacts, and tasks. Using Exchange ActiveSync to connect Outlook 2013 to an Exchange Server is not supported. With the exception of one setting, EAS Sync Frequency, Exchange ActiveSync is only administratively configurable through Exchange. For more information, see Exchange ActiveSync.

The setting that you can configure for Exchange ActiveSync in Group Policy and the OCT is shown in the following table. In Group Policy, the setting is found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange ActiveSync. The OCT setting is in corresponding location on the Modify user settings page of the OCT.

Exchange Active Sync settings

Setting name | Registry path and value name | Description
EAS Sync Frequency | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\eas!pushduration OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\eas!pushduration | Enable to change the number of minutes that Outlook automatically synchronizes users' Exchange ActiveSync accounts. The default is 59 minutes.

Exchange Fast Access and Sync Slider

Exchange Fast Access and Sync Slider are two new features that are available with Cached Exchange Mode. By default, they are enabled when Cached Exchange Mode is enabled.

Exchange Fast Access combines the instant-access of Online Mode with the offline capabilities and syncing robustness of Cached Exchange Mode, specifically in scenarios when syncing data locally would take enough time to be noticed by the user (for example, initial sync, resume, returning from vacation). When you first start Outlook 2013, you will immediately see your most recent email messages and a completely up-to-date calendar. Outlook 2013 caches items in the background to prepare you for offline use without affecting the user experience.

Sync Slider allows an Outlook 2013 user to limit the email messages that are synchronized locally in an Outlook data file (.ost). By default, if Cached Exchange Mode is enabled, Outlook 2013 will only cache email messages from the last 12 months and remove anything older than 12 months from the local cache. Users can view messages that were removed from the local cache by scrolling to the end of an email list in a folder and clicking the message Click here to view more on Microsoft Exchange. Users can also change how much email to keep offline. You, as the IT Administrator, can change the default age or enforce the age of email messages that are removed from the local cache by using Group Policy or the Office Customization Tool.

The settings that you can configure for Exchange Fast Access and Sync Slider in Group Policy and the OCT are shown in the following table. In Group Policy, the settings are found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange\Cached Exchange Mode. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Exchange Fast Access settings

Setting name Registry path and value name Description

Disable Exchange Fast Access

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\hybrid!localcaching

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\hybrid!localcaching

Enable to turn off Exchange Fast Access. This will force Outlook to download mailbox items to the local cache from Exchange before it displays new items to users. If you disable or do not set this policy, by default, Exchange Fast Access is turned on for Exchange accounts that have Cached Exchange Mode enabled.

Cached Exchange Mode Sync Settings

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\cached mode!syncwindowsetting

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\ cached mode!syncwindowsetting

Enable to configure how much user email Outlook will synchronize locally by date of message. To allow all email messages, regardless of date, to synchronize to users' local mailbox cache, enable and select All from the list. By default, if you do not configure this setting, Outlook synchronizes email messages sent or received in the last 12 months to users' local mailbox cache.

Global address list synchronization

Global address list synchronization (GAL) is replaced in Outlook 2013 by aggregation and Favorites functionality. By default in Outlook 2013, GAL synchronization is disabled in new account profiles. If you previously enabled GAL synchronization for Outlook profiles, GAL synchronization will remain enabled when you upgrade Outlook profiles to Outlook 2013.

One of the registry values that were used in earlier versions of Outlook to control the GAL synchronization is changed in Outlook 2013. In Outlook 2013, use the registry value RunAutomaticGALSync in the following table instead of ScheduleContactGALSync to configure GAL Synchronization. ScheduleContactGALSync registry value is not included in the Outlook 2010 administration templates for Group Policy or the OCT. Similarly, RunAutomaticGALSync is not in the Outlook 2013 administration templates. For more information about GAL synchronization, see the earlier version of this article.

GAL Sync registry setting

Root | Data type | Key | Value name | Value data
HKEY_CURRENT_USER | DWORD | Software\ Microsoft\Office\Outlook\SocialConnector | RunAutomaticGALSync | Configures the GAL synchronization configuration. However, the user can override the configuration through the user interface by choosing the View tab on the ribbon, choosing the drop-down arrow next to the People Pane button, selecting the Account Settings command, and then choosing the Settings button in the Social Network Accounts dialog box. 0 = Do not synchronize contacts with the GAL 1 = Automatically update contacts with the latest GAL information 2 = Prompt before Outlook updates contacts with the latest GAL information

MailTips

MailTips is a configurable warning system to help prevent common email mistakes. Extra information is presented to users when they compose email messages. The MailTips are displayed in an InfoBar, similar to the banner that says "This message has not been sent." MailTips do not prevent sending an email message. But they reveal things that might be unexpected about the delivery or audience of the message, such as recipient validity, whether the recipient is external to the organization or is out of the office, if the distribution list is unusually large, or if a message might not be delivered.

MailTips is available with Exchange Server 2010, Exchange Server 2013 and Exchange Online. With the exception of one setting, Disable Mail Tips, it is only administratively configurable through Exchange.

You can use the Outlook setting Disable Mail Tips, shown in the following table, to turn off MailTips in Outlook by using Group Policy or the OCT. In Group Policy, the setting is found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options. The OCT setting is in the corresponding location on the Modify user settings page of the OCT.

MailTips setting

Setting name Registry path and value name Description

Disable Mail Tips

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\mail!disablemailtips

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\mail!disablemailtips

Enable to turn off MailTips in Outlook.

For more information about how to configure MailTips in Exchange Server 2010, see Understanding MailTips and Managing MailTips.

Mail apps for Outlook

An app for Outlook is a cloud-enabled application that integrates rich, scenario-focused content and services together with Outlook 2013. You can obtain apps for Outlook from the Office Store. Exchange Administrators can use the Exchange Administration Center (EAC) to make specific apps for Outlook available to their end users if their Exchange accounts are on Exchange Server 2013. Users can then manage their apps from Outlook 2013 by choosing File and then Manage apps. Administrators can also allow users to download apps from Office.com. For more information, see Exchange Administration Center and Get an app for Outlook.

To change the default configurations for apps for Office, including mail apps for Outlook, see Managing access to apps for Office.

Outlook Social Connector

The Outlook Social Connector (OSC) is an add-in that exposes social network data including friends, profiles, activities, and status information from social networks in Outlook 2013. In the People Pane at the bottom of an email message, you can see information about the sender and other recipients such as their picture, name, and title; view your communication history with this person including meetings and attachments; and view their activity feeds from social networks.

Outlook 2013 includes the OSC providers for Facebook, LinkedIn, and SharePoint My Site. You can also use OSC provider extensibility to build providers for line-of-business applications or internal corporate websites and to integrate their services into Outlook. For more information, see Outlook Social Connector 2013 Provider Reference.

To take advantage of all features that are available with the Outlook Social Connector, run Outlook 2013 in Cached Exchange Mode with Windows Desktop Search and have SharePoint Server 2013 or SharePoint 2013My Site configured for users. In this configuration, local items, such as email messages, meetings, and attachments from the sender, will be included in the communication history. Additionally, when My Site is configured, you can view the activity feed from the sender's My Site.

If you run Outlook 2013 in Online Mode, only items that are related to the sender that are stored on the server will be shown in the communication history. Also, only activity feed information about the sender from on-demand social network providers, such as SharePoint My Site and Facebook, can be shown.

To include information in the Outlook Social Connector from My Sites that are hosted on a SharePoint on-premises installation, set the MySiteHost registry key as described in the following table.

MySiteHost registry settings

Root | Data type | Key | Value name | Value data
HKEY_CURRENT_USER | REG_SZ | Software\Policies\Microsoft\Office\15.0\common\Portal\Link Providers\MySiteHost | URL | Your My Site URL. For example, http://Office/MySite.
HKEY_CURRENT_USER | REG_SZ | Software\Policies\Microsoft\Office\15.0\common\Portal\Link Providers\MySiteHost | DisplayName | Optional: The name to display to the user in the Outlook Social Connector - for example, My Site.

You can control the social network providers from which users can view activity feeds. You can prevent activity feeds from all social network providers by enabling the Disable Office connections to social networks setting in Group Policy. Or, you can deploy specific providers by using the Specify list of social network providers to load setting in the OCT and prevent other providers from being installed by using the Block specific social network providers setting in Group Policy.

You can also control whether to allow the Outlook Social Connector or social network providers to prompt users for updates, or you can manage the updates yourself by using the Do not show social network info-bars setting in Group Policy.

The settings that you can configure for the Outlook Social Connector in Group Policy and the OCT are shown in the following table. In Group Policy, you can find the settings under User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Social Connector. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Outlook Social Connector settings

Setting name Registry path and value name Description

Block Global Address List synchronization

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!disablecontactgalsync

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!disablecontactgalsync

Enable to block synchronization between Outlook and the global address list.

Block network activity synchronization

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!disableactivitydownload

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!disableactivitydownload

Enable to block synchronization of activity information between Outlook and social networks.

Block social network contact synchronization

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!disablecontactdownload

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!disablecontactdownload

Enable to block synchronization of contacts between Outlook and social networks.

Block specific social network providers

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!disabledproviderslist

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!disabledproviderslist

Enable to specify the list of social network providers to block by Program ID (ProgID). A provider's ProgID is registered under HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector\SocialNetworks.

Do not allow on-demand activity synchronization

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!ondemandactivitysync

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!ondemandactivitysync

Enable to prevent on-demand synchronization of activity information between Outlook and social networks.

Do not download photos from Active Directory

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!downloaddetailsfromad

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!downloaddetailsfromad

Enable to prevent download of contact photos from Active Directory.

Do not show social network info-bars

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!unmanagedinfobars

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!unmanagedinfobars

Enable to prevent displaying information-bar messages that will prompt users to upgrade the Outlook Social Connector when updates are available or to install or update social network providers.

Disable Office connections to social networks

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!disablesocialnetworkconnectivity

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!disablesocialnetworkconnectivity

Enable to prevent users from connecting Office to social networks (including SharePoint) and to prevent Office from displaying contacts and feeds from users' social networks.

Set GAL contact synchronization interval

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!contactsyncinterval

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!contactsyncinterval

Enable to control how often contact information is synchronized between Outlook and connected social networks (in minutes). By default, if you disable or do not configure this policy, contact information is synchronized one time per day or every 1,440 minutes.

Specify activity feed synchronization interval

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!activitysyncinterval

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!activitysyncinterval

Enable to control how often activity feed information is synchronized between Outlook and connected social networks (in minutes). By default, if you disable or do not configure this policy, activity information is synchronized every 60 minutes.

Specify list of social network providers to load

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!providersecuritymode

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!providersecuritymode

Enable to enter a list of social network providers (by ProgID) that will be loaded by the Outlook Social Connector. A provider's ProgID is registered under HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\SocialConnector\SocialNetworks.

Turn off Outlook Social Connector

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\outlook\socialconnector!runosc

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\outlook\socialconnector!runosc

Enable to turn off the Outlook Social Connector.

Site mailboxes

Site mailboxes improve collaboration and user productivity by allowing access to both SharePoint 2013 documents and Exchange email messages by using the same client interface. A site mailbox consists of SharePoint 2013 site membership (owners and members), shared storage through an Exchange Server 2013 mailbox for email messages and a SharePoint 2013 site for documents, and a management interface that addresses provisioning and life-cycle needs.

Site mailboxes require Exchange Server 2013 and SharePoint Server 2013 integration and configuration. For more information about how to configure Exchange Server 2013 to work with SharePoint Server 2013, see Configure site mailboxes in SharePoint Server 2013 .

Weather bar

Weather information for the next three days is displayed on the Calendar in the Calendar module. When Outlook 2013 starts for the first time after installation, the weather location is the default city for the market version of Outlook that is installed. Users can change the weather location displayed by selecting Add Location from the drop-down menu next to the city name in the Calendar view. Users can also configure two other options in File, Options, Calendar, Weather:

  • Show weather on the Calendar

  • Show temperature in:Celsius or Fahrenheit

Weather bar settings are saved in the user's profile. If there are multiple Exchange accounts in a user profile, the weather location is based on the location that is specified in the user's primary Exchange account. All calendars in a user profile will display the same location for weather.

The following Weather bar settings can roam depending on the account type:

  • Weather On or Off

  • Celsius or Fahrenheit

  • Weather locations

  • Currently displayed weather location

If the user has the same Exchange account on multiple computers, the user sees the same weather location on all computers. If the user has multiple Exchange accounts, the user sees the weather location that is associated with the primary Exchange account. In this case, the settings associated with the primary Exchange account will roam. If the user does not have an Exchange account and has the same IMAP/POP account on multiple computers, the settings will not roam.

The settings that you can configure for this feature in Group Policy and the OCT are shown in the following table. In Group Policy, you can find the settings under User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Weather bar settings

Setting name Registry path and value name Description

Disable Weather Bar

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!disableweather

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!disableweather

Enable to turn the Weather Bar off.

Weather Bar Update Frequency

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!weatherupdatefrequency

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!weatherupdatefrequency

Enable to change the Weather Bar update frequency. The default value is 120 minutes.

Weather Server URL

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!weatherserviceurl

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!weatherserviceurl

Enable to change the service the weather information is pulled from. If you disable or do not configure this setting, Outlook uses the default weather service URL.

See also

Plan a Cached Exchange Mode deployment in Outlook 2013
Overview of security and protection settings for Outlook 2013
Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013
Office Customization Tool (OCT) reference for Office 2013
Overview of Group Policy for Office 2013

Determine which features to enable or customize in Outlook 2010


Overview of security and protection settings for Outlook 2013

Published: October 16, 2012

Summary: Learn about security settings for Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

An administrator can customize many of the security-related features in Outlook 2013. This includes how the security settings are enforced, which kind of ActiveX controls can run, custom forms security, and programmatic security settings. You can also customize Outlook 2013 security settings for attachments, Information Rights Management, junk email, and encryption, which are covered in additional articles that are listed in Additional settings later in this article.

Important:

This article provides content for administrators who configure Outlook settings for their organizations.

Are you looking for help with security settings in Outlook on your desktop? You may be looking for one of these articles, which will help you secure Outlook on your desktop.

  • Blocked attachments in Outlook

  • How Outlook helps protect you from viruses, spam, and phishing

  • Set a password to help protect your Outlook information

  • Get a digital ID

In this article:

  • Overview

  • Specify how security settings are enforced in Outlook

  • How administrator settings and user settings interact in Outlook 2013

  • Working with Outlook COM add-ins

  • Customize ActiveX and custom forms security in Outlook 2013

  • Customize programmatic settings in Outlook 2013

  • Customize Simple MAPI settings

  • Additional settings

Overview

By default, Outlook is configured to use high security-related settings. High security levels can result in limitations to Outlook functionality, such as restrictions on email message attachment file types. You might have to lower default security settings for your organization. However, be aware that lowering any default security settings might increase the risk of virus execution or propagation.

Before you start to configure security settings for Outlook 2013 by using Group Policy or the Outlook Security template, you must configure the Outlook Security Mode in Group Policy. If you do not set the Outlook Security Mode, Outlook 2013 uses the default security settings and ignores any Outlook 2013 security settings that you have made.

For information about how to download the Outlook 2013 administrative template, and about other Office 2013 Administrative Templates, see Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013. For more information about Group Policy, see Overview of Group Policy for Office 2013 and Enforce settings by using Group Policy in Office 2010.

Specify how security settings are enforced in Outlook

As with Office Outlook 2007 and Outlook 2010, you can configure security options for Outlook 2013 by using Group Policy (recommended) or change security settings by using the Outlook Security template and publish the settings to a form in a top-level folder in Exchange Server public folders. Unless you have Office Outlook 2003 or earlier versions in your environment, we recommend that you use Group Policy to configure security settings. To use either option, you must enable the Outlook Security Mode setting in Group Policy and set the Outlook Security Policy value. Default security settings in the product are enforced if you do not enable this setting. The Outlook Security Mode setting is in the Outlook 2013 Group Policy template (Outlk15.admx) under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings. When you enable the Outlook Security Mode setting, you have the four Outlook Security Policy options, which are described in the following table.

Outlook Security Policy options

Outlook Security Mode option | Description
Outlook Default Security | Outlook ignores any security-related settings configured in Group Policy or when using an Outlook Security template. This is the default setting.
Outlook Security Group Policy | Outlook uses the security settings from Group Policy (recommended).
Security Form from "Outlook Security Settings" Public Folder | Outlook uses the settings from the security form that is published in the designated public folder.
Security Form from "Outlook 10 Security Settings" Public Folder | Outlook uses the settings from the security form that is published in the designated public folder.

Customize security settings by using Group Policy

When you use Group Policy to configure security settings for Outlook 2013, consider the following factors:

  • Settings in Outlook Security template must be manually migrated to Group Policy. If you previously used the Outlook Security template to manage security settings and now choose to use Group Policy to enforce settings in Outlook 2013, you must manually migrate the settings that you configured earlier to the corresponding Group Policy settings for Outlook 2013.

  • Customized settings configured by using Group Policy might not be active immediately. You can configure Group Policy to refresh automatically (in the background) on users' computers while users are logged on, at a frequency that you determine. To make sure that new Group Policy settings are active immediately, users must log off and log back on to their computers.

  • Outlook checks security settings only at startup. If security settings are refreshed while Outlook is running, the new configuration is not used until the user closes and restarts Outlook.

  • No customized settings are applied in Personal Information Manager (PIM)-only mode. In PIM mode, Outlook uses the default security settings. No administrator settings are necessary or used in this mode.

Special environments

When you use Group Policy to configure security settings for Outlook 2013, consider whether your environment includes one or more of the scenarios that are shown in the following table.

Special environment scenarios

Scenario Issue

Users who access their mailboxes by using a hosted Exchange Server

If users access mailboxes by using a hosted Exchange Server, you can use the Outlook Security template to configure security settings or use the default Outlook security settings. In hosted environments, users access their mailboxes remotely. For example, they can access their mailboxes remotely by using a virtual private network (VPN) connection or by using Outlook Anywhere (RPC over HTTP). Because Group Policy is deployed by using Active Directory, and in this scenario, the user's local computer is not a member of the domain, Group Policy security settings cannot be applied.

Also, by using the Outlook Security template to configure security settings, users automatically receive updates to security settings. Users cannot receive updates to Group Policy security settings unless their computer is in the Active Directory domain.

Users who have administrative rights on their computers

Restrictions to Group Policy settings are not enforced when users log on by using administrative credentials. Users who have administrative rights can also change the Outlook security settings on their computers and can remove or alter the restrictions that you have configured. This is true not only for Outlook security settings, but for all Group Policy settings.

Although this can be problematic when an organization intends to have standardized settings for all users, there are mitigating factors:

  • Group Policy overrides local changes at the next logon. Changes to Outlook security settings revert to the Group Policy settings when the user logs on.

  • Overriding a Group Policy setting affects only the local computer. Users who have administrative rights affect only security settings on their computer, not the security settings for users on other computers.

  • Users without administrative rights cannot change policies. In this scenario, Group Policy security settings are as secure as settings configured by using the Outlook Security template.

Users who access Exchange mailboxes by using Outlook Web App

Outlook and Outlook Web App do not use the same security model. Outlook Web App has separate security settings that are stored on the Exchange Server computer. For more information see, Understanding security for Outlook Web App.

How administrator settings and user settings interact in Outlook 2013

Security settings that are defined by the user in Outlook 2013 work as if they are included in the Group Policy settings that you define as the administrator. When there is a conflict between the two, settings with a greater security level override settings with a lower security level.

For example, if you use the Group Policy Attachment Security setting Add file extensions to block as Level 1 to create a list of Level 1 file name extensions to be blocked, your list overrides the default list that is provided with Outlook 2013. It also overrides the users' settings for Level 1 file name extensions to block. Users would only be able to remove file name extensions from the default list that is provided with Outlook 2013. Users cannot remove file types that you add to the Add file extensions to block as Level 1 list. For example, if the user wants to remove the file name extensions .exe and .reg from the Level 1 group, but you use the Add file extensions to block as Level 1 Group Policy setting to add .exe as a Level 1 file type, the user can only remove .reg file from the Level 1 group that is in Outlook.

Working with Outlook COM add-ins

A COM add-in should be coded so that it takes advantage of the Outlook trust model and can run without warning messages in Outlook 2013. Users might continue to see warnings when they access Outlook features that use the add-in, such as when they synchronize a hand-held device with Outlook 2013 on their desktop computers.

However, users are less likely to see warnings in Outlook 2013 than in Office Outlook 2003 or earlier versions. The Object Model (OM) Guard that helps prevent viruses from using the Outlook Address Book to propagate is updated in Office Outlook 2007, Outlook 2010 and Outlook 2013. Outlook 2013 checks for up-to-date antivirus software to help determine when to display address book access warnings and other Outlook security warnings.

You can't change the OM Guard by using the Outlook security form or Group Policy. However, if you use default Outlook 2013 security settings, all COM add-ins that are installed in Outlook 2013 are trusted by default. If you customize security settings by using Group Policy, you can specify COM add-ins that are trusted and that can run without encountering the Outlook object model blocks.

However, in Outlook 2013, two new configurations settings, List of managed add-ins and Block all unmanaged add-ins, allow you to create a list of always enabled add-ins or always blocked add-ins. These settings override the trust center settings. If an add-in is in the Block all unmanaged add-ins list and has also been added to the setting Configure trusted add-ins, the add-in will be blocked. You can find the settings List of managed add-ins and Block all unmanaged add-ins in the Outlook Group Policy template under User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous.

To trust a COM add-in, include the file name for the add-in in a Group Policy setting with a calculated hash value for the file. Before you can specify an add-in as trusted by Outlook, you must install a program to calculate the hash value. For information about how to do this, see Manage trusted add-ins for Outlook 2010.

If you enforce customized Outlook security settings with the Microsoft Exchange Server security form that is published in an Exchange Server public folder, you can learn how to trust COM add-ins. Scroll down to the Trusted Code tab section in the Microsoft Office 2003 Resource Kit article, Outlook Security Template Settings.

If the user continues to see security prompts after the add-in is included in the list of trusted add-ins, you must work with the COM add-in developer to resolve the problem. For more information about coding trusted add-ins, see Important Security Notes for Microsoft Outlook COM Add-in Developers.

Customize ActiveX and custom forms security in Outlook 2013

You can specify ActiveX and custom forms security settings for Outlook 2013 users. Custom forms security settings include options for changing how Outlook 2013 restricts scripts, custom controls, and custom actions.

Customize how ActiveX controls behave in one-off forms

When Outlook receives a message that contains a form definition, the item is a one-off form. To help prevent unwanted script and controls from running in one-off forms, Outlook does not load ActiveX controls in one-off forms by default.

You can lock down the settings to customize ActiveX controls by using the Group Policy Outlook 2013 template (Outlk15.admx). Or you can configure default settings by using the Office Customization Tool (OCT), in which case users can change the settings. In Group Policy, use the Allow ActiveX One Off Forms setting under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security. In the OCT, the Allow ActiveX One Off Forms setting is in the corresponding location on the Modify user settings page of the OCT. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

When you enable Allow ActiveX One Off Forms setting, you have three options, which are described in the following table.

Allow Active X One Off Forms setting options

Option Description

Allows all ActiveX Controls

Allows all ActiveX controls to run without restrictions.

Allows only Safe Controls

Allows only safe ActiveX controls to run. An ActiveX control is safe if it is signed with Authenticode and the signer is listed in the Trusted Publishers List.

Load only Outlook Controls

Outlook loads only the following controls, which are the only controls that can be used in one-off forms.

  • Controls from fm20.dll

  • Microsoft Office Outlook Rich Format Control

  • Microsoft Office Outlook Recipient Control

  • Microsoft Office Outlook View Control

If you do not configure any of these options, the default is to load only Outlook controls.

Customize custom forms security settings

You can lock down the settings to configure security for custom forms by using the Group Policy Outlook 2013 template (Outlk15.admx). In Group Policy, the settings are under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Custom Form Security.

The settings that you can configure for scripts, custom controls, and custom actions are shown in the following table:

Scripts, custom controls, and custom actions settings

Setting name Registry path and value name Description

Allow scripts in one-off Outlook forms

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!enableoneoffformscripts

Run scripts in forms where the script and the layout are contained in the message. If users receive a one-off form that contains script, users are prompted whether they want to run the script.

Set Outlook object model Custom Actions execution prompt

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoomcustomaction

Specifies what occurs when a program attempts to run a custom action by using the Outlook object model. A custom action can be created to reply to a message and circumvent the programmatic send protections. Select one of the following:

  • Prompt user enables the user to receive a message and decide whether to allow programmatic send access.

  • Automatically approve always allows programmatic send access without displaying a message.

  • Automatically deny always denies programmatic send access without displaying a message.

  • Prompt user based on computer security enforces the default configuration in Outlook 2013.

Customize programmatic settings in Outlook 2013

As an administrator of Outlook 2013, you can configure programmatic security settings to manage restrictions for the Outlook object model. The Outlook object model lets you programmatically manipulate data that is stored in Outlook folders.

Note:

The Exchange Server Security template includes settings for Collaboration Data Objects (CDO). However, using CDO with Outlook 2013 is not supported.

You can use Group Policy to configure programmatic security settings for the Outlook object model. In Group Policy, load the Outlook 2013 template (Outlk15.admx). The Group Policy settings are located under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security. These settings cannot be configured by using the Office Customization Tool.

The following are descriptions of the Group Policy options for programmatic settings. You can choose one of the following settings for each item:

  • Prompt user Users receive a message allowing them to choose whether to allow or deny the operation. For some prompts, users can choose to allow or deny the operation without prompts for up to 10 minutes.

  • Automatically approve Outlook automatically grants programmatic access requests from any program. This option can create a significant vulnerability, and we do not recommend it.

  • Automatically deny Outlook automatically denies programmatic access requests from any program. The user does not receive a prompt.

  • Prompt user based on computer security Outlook relies on the setting in the "Programmatic Access" section of the Trust Center. This is the default behavior.

The settings that you can configure for programmatic security settings for the Outlook object model are shown in the following table.

Programmatic security settings

Setting name | Registry path and value name | Description
Configure Outlook object model prompt when accessing an address book | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoomaddressbookaccess | Specifies what happens when a program attempts to gain access to an address book by using the Outlook object model.
Configure Outlook object model prompt when accessing the Formula property of a UserProperty object | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoomformulaaccess | Specifies what happens when a user adds a Combination or Formula custom field to a custom form and binds it to an Address Information field. By doing this, code can be used to indirectly retrieve the value of the Address Information field by getting the Value property of the field.
Configure Outlook object model prompt when executing Save As | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoomsaveas | Specifies what happens when a program attempts to programmatically use the Save As command to save an item. When an item is saved, a malicious program could search the file for email addresses.
Configure Outlook object model prompt when reading address information | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoomaddressinformationaccess | Specifies what happens when a program attempts to gain access to a recipient field, such as To, by using the Outlook object model.
Configure Outlook object model prompt when responding to meeting and task requests | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoommeetingtaskrequestresponse | Specifies what happens when a program attempts to send mail programmatically by using the Respond method on task requests and meeting requests. This method resembles the Send method on mail messages.
Configure Outlook object model prompt when sending mail | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptoomsend | Specifies what happens when a program attempts to send mail programmatically by using the Outlook object model.

Customize Simple MAPI settings

You can use Group Policy to configure Simple MAPI settings for the Outlook object model. In Group Policy, load the Outlook 2013 template (Outlk15.admx). The Group Policy settings are located under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security. These settings cannot be configured by using the Office Customization Tool.

Simple MAPI settings

Setting name | Registry path and value name | Description
Configure Simple MAPI sending prompt | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptsimplemapisend | Allows you to specify what occurs when a program attempts to send mail programmatically by using Simple MAPI.
Configure Simple MAPI name resolution prompt | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptsimplemapinameresolve | Allows you to specify what occurs when a program attempts to gain access to an Address Book by using Simple MAPI.
Configure Simple MAPI message opening prompt | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptsimplemapiopenmessage | Allows you to specify what occurs when a program attempts to gain access to a recipient field, such as the "To" field by using Simple MAPI.

Additional settings

The following table lists the articles that cover additional security settings not included in this article.

Additional security articles

Feature | Related resources
ActiveX controls | Plan security settings for ActiveX controls for Office 2013
Attachments | Plan attachment settings in Outlook 2013
Cryptography | Plan for e-mail messaging cryptography in Outlook 2010
Digital signatures | Plan digital signature settings for Office 2013
Junk email | Plan for limiting junk e-mail in Outlook 2010
Information Rights Management | Plan Information Rights Management in Office 2013
Protected view | Plan Protected View settings for Office 2013

See also

Overview of security in Office 2013


Plan attachment settings in Outlook 2013

Published: January 8, 2013

Summary Learn how to use Group Policy to configure attachment security settings for Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

In Outlook 2013, you can specify that attachments to Outlook items (such as email messages or appointments) are restricted based on the file name extension of the attachment. You can also configure what users can do with the attachment restrictions. For example, you could allow users to change the restrictions for a group of attachment file name extensions from Level 1 (user can't view the file) to Level 2 (user can open the file after they save it to disk).

Important:

Are you looking for help with blocked attachment in Outlook 2013 on your desktop? You may be looking for Blocked attachments in Outlook, which will help you share your files safely or change the types of files that are blocked on your desktop.

In this article:

  • Overview of Outlook attachment security

  • Add or remove Level 1 file name extensions for Outlook 2013

  • Add or remove Level 2 file name extensions for Outlook 2013

  • Configure additional attachment file restrictions for Outlook 2013

Overview of Outlook attachment security

To help protect users from malicious attachments, Outlook 2013 restricts access to some attachments in items, such as email messages or appointments. Files that have specific file name extensions can be categorized as Level 1 (the user can't view the file) or Level 2 (the user can open the file after they save it to disk).

By default, Outlook 2013 classifies several file name extensions as Level 1 and blocks users from receiving files that have those extensions. Examples of Level 1 file name extensions include .cmd, .exe, and .vbs. As an administrator, you can use Group Policy to manage how a file name extension is categorized for email attachment blocking. For example, you can change a file name extension categorization from Level 1 to Level 2 or create a list of Level 2 file name extensions. By default, there are no Level 2 file name extensions.

Note:

To enforce attachment settings, you must first use Group Policy to configure the method that Outlook 2013 uses to enforce security settings. For information about how to set the Outlook 2013 method to enforce security settings, see Specify how security settings are enforced in Outlook in Overview of security and protection settings for Outlook 2013.

You can configure Outlook 2013 attachment security settings by using Group Policy and the Outlook 2013 template. Most of the attachment security settings are the found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Attachment Security. You can find settings to prevent users from customizing attachment security settings and to use Protected View for attachments received from internal senders under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security. Attachment security settings can't be configured by using the Office Customization Tool (OCT).

For more information about Protected View, see Plan Protected View settings for Office 2013.

For information about how to download the Outlook 2013 administrative template, and about other Office 2013 administrative templates, see Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013. For more information about Group Policy, see Overview of Group Policy for Office 2013.

Add or remove Level 1 file name extensions for Outlook 2013

Level 1 files are hidden from the user. The user can't open, save, or print a Level 1 attachment. If you specify that users can demote a Level 1 attachment to a Level 2 attachment, Level 2 restrictions apply to the file. If a user receives an email message or appointment that has a blocked attachment, the InfoBar at the top of the item displays a list of the blocked files. Note that the InfoBar doesn't appear on a custom form.

When you remove a file name extension from the Level 1 list, attachments that have that file name extension are no longer blocked. The default list of Level 1 file name extensions is shown in the table in the article Blocked attachments in Outlook.

The settings in the following table let you add or remove Level 1 file name extensions from the default list. In Group Policy, these settings are found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Attachment Security. These settings can't be configured by using the OCT.

Level 1 attachment security settings

Setting name | Registry path and value name | Description
Add file extensions to block as Level 1 | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!FileExtensionsAddLevel1 | Specifies the file name extensions (usually three letters) that you want to add to the Level 1 file list. Do not enter a period before each file name extension. If you enter multiple file name extensions, separate them with semicolons.
Remove file extensions blocked as Level 1 | Group Policy registry path: HKEY_CURRENT_USER\Software\Policies\Microsoft\office\15.0\outlook\security!FileExtensionsRemoveLevel1 | Specifies the file name extensions (usually three letters) that you want to remove from the Level 1 file list. Do not enter a period before each file name extension. If you enter multiple file name extensions, separate them with semicolons.

Add or remove Level 2 file name extensions for Outlook 2013

With a Level 2 file name extension, the user is required to save the file to the hard disk before the file is opened. A Level 2 file can't be opened directly from an Outlook item.

When you remove a file name extension from the Level 2 list, it becomes a regular file name extension that can be opened, saved, and printed in Outlook 2013. There are no restrictions on the file.

The settings in the following table let you add or remove Level 2 file name extensions from the default list. In Group Policy, these settings are found under User Configuration\Administrative Templates\ Microsoft Outlook 2013\Security\Security Form Settings\Attachment Security. These settings can't be configured by using the OCT.

Level 2 attachment security settings

Setting name | Registry path and value name | Description
Add file extensions to block as Level 2 | Group Policy registry path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Outlook\Security!FileExtensionsAddLevel2 | Specifies the file name extension (usually three letters) that you want to add to the Level 2 file list. Do not enter a period before each file name extension. If you enter multiple file name extensions, separate them with semicolons.
Remove file extensions blocked as Level 2 | Group Policy registry path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Outlook\Security!FileExtensionsRemoveLevel2 | Specifies the file name extension (usually three letters) that you want to remove from the Level 2 file list. Do not enter a period before each file name extension. If you enter multiple file name extensions, separate them with semicolons.

Configure additional attachment file restrictions for Outlook 2013

The settings in the following table are additional settings that you can configure for attachments in Group Policy. In Group Policy, these settings are found under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Attachment Security. These settings can't be configured by using the OCT.

Additional attachment security settings

Setting name | Registry path and value name | Description
Display Level 1 attachments | Group Policy registry path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Outlook\Security!FileExtensionsAddLevel2 | Enables users to access all attachments that have Level 1 file name extensions by first saving the attachments to disk, and then opening them (as with Level 2 attachments).
Allow users to demote attachments to Level 2 | Group Policy registry path:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security!AllowUsersToLowerAttachments | Enables users to create a list of attachment file name extensions to demote from Level 1 to Level 2. If you do not configure this Group Policy setting, the default behavior in Outlook is to ignore the user's list. The registry key in which users create the list of file name extensions to demote is as follows: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security!Level1Remove. In the registry key, users specify the file name extensions (usually three letters) to remove from the Level 1 file list, separated by semicolons.
Do not prompt about Level 1 attachments when sending an item | Group Policy registry path:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security!DoNotPromptLevel1AttachSend | Prevents users from receiving a warning when they send an item that contains a Level 1 attachment. This option affects only the warning. After the item is sent, recipients might be unable to view or access the attachment, depending on their security settings. If you want users to be able to post items to a public folder without receiving this prompt, you must enable this setting and the Do not prompt about Level 1 attachments when closing an item setting.
Do not prompt about Level 1 attachments when closing an item | Group Policy registry path:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security!DoNotPromptLevel1AttachClose | Prevents users from receiving a warning when they close an email message, appointment, or other item that contains a Level 1 attachment. This option affects only the warning. After the item is closed, the user can't view or gain access to the attachment. If you want users to be able to post items to a public folder without receiving this prompt, you must enable this setting and the Do not prompt about Level 1 attachments when sending an item setting.
Display OLE package objects | Group Policy registry path:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security!ShowOLEPackageObj | Displays OLE objects that are packaged. A package is an icon that represents an embedded or linked OLE object. When you double-click the package, the program that was used to create the object either plays the object (for example, if the object is a sound file) or opens and displays the object. Allowing Outlook to display OLE package objects can be problematic, because the icon can be easily changed and used to disguise malicious files.

The settings in the following table are found in Group Policy under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security. These settings can't be configured by using the OCT.

Additional security settings

Setting name | Registry path and value name | Description
Prevent users from customizing attachment security settings | Group Policy registry path:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook!DisallowAttachmentCustomization | When enabled, users can't customize the list of file name extensions that are allowed as attachments in Outlook, regardless of how you have configured other Outlook security settings.
Use Protected View for attachments received from internal senders | Group Policy registry path:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security!MarkInternalAsUnsafe | When enabled, attachments that are received from senders within your organization will open in Protected View. This setting only applies to Outlook accounts that connect to a Microsoft Exchange Server computer.

See also

Overview of security and protection settings for Outlook 2013
Plan Protected View settings for Office 2013

Blocked attachments in Outlook


Configure multiple Exchange accounts for Outlook 2013

Published: September 11, 2012

Summary: Learn how administrators can use the Office Customization Tool to configure multiple Exchange email accounts for an Outlook 2013 profile.

Applies to: Office 2013 | Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

To configure multiple Exchange Server email accounts for an Outlook 2013 profile, follow the steps in this article.

In this article:

  • Overview

  • Before you begin

  • Add multiple Exchange accounts to a profile

Overview

In Outlook 2013, you can add multiple Exchange Server email accounts to an Outlook profile just as you can for other email accounts by using the Office Customization Tool (OCT). Without any additional configuration, Outlook 2013 can connect to up to ten Exchange accounts from a single profile.

Individual users can add more Exchange accounts to their Outlook profiles within Outlook 2013. To do so, users can click the File tab, click Account Settings, and then click Add Account, or use the Windows Control Panel Mail module. They can also remove Exchange accounts on their profiles. For more information, see Add or remove an e-mail account.

Warning:

  • Delegate accounts are not supported in profiles that have multiple Exchange accounts. Users who have delegate access to a mailbox must keep that account in a separate profile from any other Exchange account.

  • The Exchange Server 2013 Auto Mapping feature automatically adds mailboxes to the Outlook Navigation Pane if you have Full Access permission to them. Outlook manages these additional mailboxes by using a specific permission set. This could cause unexpected behavior if you also have these mailboxes configured as additional Exchange Server accounts in one Outlook profile. To prevent problems in this scenario, you will have to change your Outlook profile so mailboxes that are added through the Auto Mapping feature are also not manually added to the same profile. Use the Account Settings dialog box to remove these additional Exchange mailboxes in your profile. If you do not remove the manually added mailboxes from your profile, Outlook attempts to use the permission sets from both the auto-mapped account and the account setup by using the multiple Exchange Server accounts feature at the same time.

  • If you use the Exchange Server Security template to configure security options for Exchange accounts, the Security form settings for the first account added to the profile (the legacy account) will be used for all the accounts added to that profile.

For information about how to configure Exchange accounts for Outlook for Mac 2011, see Configuring Exchange accounts in Outlook for Mac 2011 (http://go.microsoft.com/fwlink/p/?LinkId=212911).

Before you begin

Before you begin deployment, review Overview of Outlook 2013 planning, Plan a Cached Exchange Mode deployment in Outlook 2013, and Office Customization Tool (OCT) reference for Office 2013 to determine which settings that you might have to configure for the Exchange accounts. The following three articles describe how to configure specific Exchange account features by using the OCT.

  • Configure Outlook Anywhere in Outlook 2013

  • Configure Cached Exchange Mode in Outlook 2013

  • Configure Exchange Server send/receive settings in Outlook 2010

Add multiple Exchange accounts to a profile

Use the following procedure to add multiple Exchange accounts to an Outlook profile.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To add multiple Exchange accounts to a profile

  1. From the root of the network installation point, run the following command line to start the Office Customization Tool: \\server\share\setup.exe /admin

  2. To edit an existing customization file (.msp), in the Select Product dialog box, click Open an existing Setup customization file. Or to create a new customization file, select the Office suite that you want to customize, and then click OK.

  3. In the Outlook area, click Outlook profile. Select how you want to customize profiles for users. To change an existing profile or to add a new profile, choose Modify Profile or New Profile.

  4. To add and configure new and existing accounts, click Add accounts, and then click Customize additional Outlook profile and account information.

  5. To add an Exchange account, click the Add button.

  6. In the Add Accounts dialog box, select Exchange, and then click Next.

  7. In the Exchange Settings dialog box, enter an account name and the name of the Exchange Server computer. If you want to identify the user by using a specific value, enter a User Name. Otherwise, leave the default %username% value for the User Name. Each user's account information in the Active Directory directory service will be automatically populated for the profile.

  8. If you want to change an existing Exchange account in a user's profile, select the Overwrite existing Exchange accounts check box.

  9. Click More Settings for additional Exchange configuration options such as Cached Exchange Mode and Outlook Anywhere, and then click OK.

  10. When you are finished, click Finish.

  11. To add an additional Exchange account, repeat steps 5-10.

  12. If you are creating a new profile, add the Outlook Address Book account to the profile. This account allows you to use the Contacts folder in your Exchange mailbox as an address book when you create email messages.

  13. After you have finished all the customizations, save the customization file (.msp) and exit the OCT. Put the .msp file in the Office installation source \Updates folder. Install the Office 2013 from the original installation source.

See also

Overview of Outlook 2013 planning
Plan a Cached Exchange Mode deployment in Outlook 2013
Office Customization Tool (OCT) reference for Office 2013
Configure Cached Exchange Mode in Outlook 2013
Configure Outlook Anywhere in Outlook 2013

Configure Exchange Server send/receive settings in Outlook 2010


Configure Cached Exchange Mode in Outlook 2013

Published: September 18, 2012

Summary: Describes how administrators can configure Cached Exchange Mode for Exchange Server email accounts in Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Administrators can configure Cached Exchange Mode for Exchange Server email accounts in Outlook 2013 by following the steps that are described in this article.

In this article:

  • Overview

  • Before you begin

  • Configure Cached Exchange Mode

    • To configure Cached Exchange Mode settings by using the Office Customization Tool

    • To configure Cached Exchange Mode settings by using Group Policy

    • To configure a default .ost location by using Group Policy

    • To prevent a new .ost file from being created

Overview

When an Outlook 2013 account is configured to use Cached Exchange Mode, Outlook 2013 works from a local copy of a user's Exchange mailbox that is stored in an Offline Folder (.ost file) on the user's computer, and with the Offline Address Book (OAB). The cached mailbox and OAB are updated periodically from the Exchange Server computer.

Cached Exchange Mode can be configured for Exchange Server email accounts only. Cached Exchange Mode is supported by all versions of Exchange Server with which Outlook 2013 can connect. That is, by Exchange Server 2007 or later versions.

If you do not configure Cached Exchange Mode options, the current state of Cached Exchange Mode does not change for existing profiles when Outlook is upgraded to a new version. For example, if a user account was configured to use Cached Exchange Mode in Office Outlook 2003, Office Outlook 2007, or Outlook 2010, Cached Exchange Mode remains enabled when the user upgrades the software to Outlook 2013. The location for new .ost or OAB files is the default location: For Windows XP, the location is %userprofile%\Local Settings\Application Data\Microsoft\Outlook; for Windows Vista and Windows 7, the location is %userprofile%\AppData\Local\Microsoft\Outlook.

You can configure several options for Cached Exchange Mode. These include the default .ost file location for users in your organization who do not already have .ost files for Cached Exchange Mode. If you do not specify a different .ost file location, Outlook creates an .ost file in the default location when users start Outlook in Cached Exchange Mode.

By default, when Outlook 2013 is installed, a new compressed version of the.ost file is created. This new compressed version of the .ost is up to 40% smaller than the size of the .ost files that were created in earlier versions of Outlook. If you must keep Outlook 2013 from creating a new compressed Outlook data file (.ost), use the Outlook Group Policy template to enable the Do not create new OST file on upgrade policy. If this policy setting is enabled, Outlook 2013 uses an existing .ost file that was created by an earlier version of Outlook.

Sync Slider and Exchange Fast Access are two new features that are available with Cached Exchange Mode in Outlook 2013. By default, they are enabled when Cached Exchange Mode is enabled. For more information, see Plan a Cached Exchange Mode deployment in Outlook 2013 and What's new in Outlook 2013.

You can lock down the settings to customize Cached Exchange Mode by using the Outlook Group Policy Administrative template. Or, you can configure default settings by using the Office Customization Tool (OCT), in which case users can change the settings.

Before you begin

Before you start deployment, review Plan a Cached Exchange Mode deployment in Outlook 2013 and Office Customization Tool (OCT) reference for Office 2013 to determine which settings you might have to configure for Cached Exchange Mode. Customization of Cached Exchange Mode settings is optional and only needed if you want to change the settings from the default configuration.

To download the Outlook 2013 administrative templates, see Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool. For more information about Group Policy, see Overview of Group Policy for Office 2013 and Enforce settings by using Group Policy in Office 2010.

For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Configure Cached Exchange Mode

Use the following procedures to configure Cached Exchange Mode settings. Note that customization of Cached Exchange Mode settings is optional and only needed if you want to change the settings from the default configuration.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To configure Cached Exchange Mode settings by using the Office Customization Tool

  1. In the Office Customization Tool, in the tree view, locate Outlook, and choose Add Accounts. In the Account Name column of the reading pane list, choose the account that you want to configure, and then choose Modify. The Exchange Settings dialog box appears.

    Note that in the tree view of the OCT you must choose Outlook Profile and then select Modify Profile or New Profile to add an Exchange account and configure Exchange Server settings.

  2. To enable or disable Cached Exchange Mode, or to specify default download behavior when Cached Exchange Mode is enabled, choose the Cached Mode tab.

  3. Choose Configure Cached Exchange Mode and then select the Use Cached Exchange Mode check box to enable Cached Exchange Mode for users. By default, Cached Exchange Mode is disabled if you do not select the Use Cached Exchange Mode check box.

  4. If you enabled Cached Exchange Mode in step 3, select a default download option on the Cached Mode tab:

    • Download only headers Users see header information and the beginning of the message or item body (a 256 bytes plain-text buffer of information). Full items can be downloaded later in several ways. For example, by double-clicking to open the message or by clicking Download the rest of this message now in the reading pane.

    • Download headers followed by the full item All headers are downloaded first, and then full items are downloaded. The download order might not be chronological. Outlook downloads headers followed by full items in the folder that the user is currently accessing, and then downloads headers followed by full items in folders that the user has recently viewed.

    • Download full items Full items are downloaded. We recommend this option unless you have a slow network connection. The download order might not be chronological. Outlook downloads full items in the folder that the user is currently accessing, and then downloads full items in folders that the user has recently viewed.

  5. To turn off Headers Only mode, select the Download full items option button and clear the On slow connections, download only headers check box. The default behavior, when users have slow connections, is to download only headers. There are scenarios in which Outlook perceives that users have slow connections such as when users' data throughput is fast, or vice versa. In these situations, you might want to set or clear this option.

  6. Disable the download of shared folders as part of Cached Exchange Mode synchronizations to users' .ost files. By default, in Outlook 2013, shared mail and non-mail folders are downloaded. Downloaded shared folders increase the size of users' .ost files. Be aware that the setting Download shared non-mail folders applies to both mail and non-mail shared folders in Outlook 2013. If you want to only disable the download of shared mail folders, see step 8.

  7. Download Public Folder Favorites as part of Cached Exchange Mode synchronizations to users' .ost files. By default, Public Folder Favorites are not downloaded. As with shared folders, downloading Public Folder Favorites increases the size of users' .ost files. Also, synchronizing Public Folder Favorites causes additional network traffic that might be unwelcome for users who have slow connections.

  8. If you must disable shared mail folders (like a delegated Inbox) but want to allow the download of shared non-mail folders (like Calendar) for profiles that use Cached Exchange Mode, follow these steps:

    1. In OCT, in the tree view, locate Additional Content and then click Add registry entries.

    2. In the reading pane, click Add.

    3. Enter the following information:

      Registry key to allow the download of shared non-mail folders

      Root Data type Key Value name Value data

      HKEY_Current_User

      REG_SZ

      Software\Microsoft\Office\15.0\Outlook\Cached Mode

      CacheOthersMail

      0

    4. Choose OK.

To configure Cached Exchange Mode settings by using Group Policy

  1. In Group Policy, load the Outlook 2013 template.

  2. To customize Cached Exchange Mode options, open the Group Policy Management Console (GPMC) and, in the tree view, expand Domains and then expand Group Policy Objects.

  3. From the short-cut menu (right-click), choose the policy object that you want and then choose Edit. The Group Policy Management Editor window opens.

  4. In the tree view, expand User Configuration, expand Administrative Templates, expand Microsoft Outlook 2013, expand Account Settings, and then choose Exchange. You can also expand Exchange and then choose Cached Exchange Mode.

  5. In the reading pane, in the Setting column, open (double-click) the policy that you want to set. For example, in the Exchange reading pane, open Use Cached Exchange Mode for new and existing Outlook profiles.

  6. Select Enabled and select an option (if appropriate).

  7. Choose OK.

To configure a default .ost location by using Group Policy

  1. In Group Policy, load the Outlook 2013 template.

  2. To configure a default .ost location, open the Group Policy Management Console (GPMC) and in the tree view expand Domains and then expand Group Policy Objects.

  3. From the short-cut menu (right-click) of the policy object that you want, choose Edit. The Group Policy Management Editor window opens.

  4. In the tree view, expand User Configuration, expand Administrative Templates, expand Microsoft Outlook 2013, expand Miscellaneous, and then choose PST Settings.

  5. Open (double-click) Default location for OST files.

  6. Choose Enabled to enable the policy setting.

  7. In the Default location for OST files text box, enter the default location for .ost files. For example:

    %userprofile%\Local Settings\Application Data\Microsoft\newfolder.

  8. Click OK.

    You can define a new default location for both Personal Outlook data files (.pst) and .ost files. After you choose PST Settings in the tree view, open (double-click) the Default location for PST files setting in the reading pane.

To prevent a new .ost file from being created

  1. In Group Policy, load the Outlook 2013 template.

  2. To prevent a new .ost file from being created, open the Group Policy Management Console (GPMC) and, in the tree view, expand Domains and then expand Group Policy Objects.

  3. From the short-cut menu (right-click) of the policy object that you want, choose Edit. The Group Policy Management Editor window opens.

  4. In the tree view, expand User Configuration, expand Administrative Templates, expand Microsoft Outlook 2013, expand Account Settings, and then choose Exchange.

  5. Open (double-click) Do not create new OST file on upgrade.

  6. Choose Enabled to enable the policy setting and then choose OK.

See also

Plan a Cached Exchange Mode deployment in Outlook 2013
What's new in Outlook 2013


Configure Outlook Anywhere in Outlook 2013

Published: September 25, 2012

Summary: Explains how administrators can configure Outlook Anywhere in Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Outlook Anywhere enables Outlook 2013 users to access their Exchange Server accounts over the Internet without using virtual private network (VPN) connections when they travel or when they work outside the organization firewall.

This article describes the requirements and options for administrators who configure groups of Outlook user accounts to use Outlook Anywhere. Customization of Outlook Anywhere settings is optional and only necessary if you want to change the default configuration settings.

Important:

Are you looking for help with configuring Outlook Anywhere settings in Outlook on your desktop? You may be looking for Use Outlook Anywhere to connect to your Exchange server without VPN, which will help you change your desktop settings.

In this article:

  • Overview

  • Before you begin

  • Use the OCT to configure Outlook Anywhere

  • Use Group Policy to lock down Outlook Anywhere settings

  • Verification

Overview

Customization of Outlook Anywhere settings is optional and only needed if you want to change the settings from the default configuration. By default, Exchange pushes down the Outlook Anywhere settings by using the Autodiscover service the first time that Outlook is started. We recommend that you first deploy Outlook to a test environment that has the default configurations. Review the default configurations to identify which settings, if any, you want to customize. For more information about Autodiscover and automatic account configuration, see Outlook Automatic Account Configuration.

If you have identified settings that you want to change from the default configurations, you can configure Outlook 2013 with Outlook Anywhere as part of an Outlook deployment by enabling the option in the Office Customization Tool (OCT) and (optionally) specifying additional settings, such as security-level requirements, to communicate with the Exchange Server computer. After you specify these options, you save the settings together with other configurations in the Setup customization file (.msp file) that you use to deploy Outlook to users. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

You can also lock down some Outlook Anywhere settings by using Group Policy. For more information about Outlook Anywhere Group Policy settings, see Use Group Policy to lock down Outlook Anywhere settings later in this article. For more information about Group Policy, see Overview of Group Policy for Office 2013 and Enforce settings by using Group Policy in Office 2010.

Outlook Anywhere was known as RPC over HTTP in earlier versions of Outlook.

Before you begin

  • Before you start deployment, review Overview of Outlook 2013 planning and Plan a Cached Exchange Mode deployment in Outlook 2013 to determine the settings that you might have to configure for Outlook Anywhere.

  • We recommend that you first deploy Outlook to a test environment with the default configurations. Review the default configurations to identify which settings, if any, that you want to customize.

  • We recommend that the user accounts that you configure for Outlook Anywhere use Cached Exchange Mode. For more information about Cached Exchange Mode in Outlook, see Plan a Cached Exchange Mode deployment in Outlook 2013.

  • Download the Group Policy Administrative template for Outlook 2013. To download the template files, see Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013.

  • Before you configure Outlook Anywhere for Outlook 2013 in an Exchange 2007 or Exchange Server 2010 environment without the Autodiscover service, obtain the URL for the Exchange proxy server that is configured for Outlook Anywhere. This URL is available from the organization's Exchange administrator.

Use the OCT to configure Outlook Anywhere

Use this procedure to use the OCT to configure Outlook Anywhere.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To configure Outlook Anywhere by using the OCT

  1. In the OCT, in the tree view, locate Outlook, choose Add accounts, and then choose Customize additional Outlook profile and account information.

  2. Choose the Exchange account that you want to configure and then choose Modify.

  3. If you are defining a new Exchange Server computer for users, enter a value or replaceable parameter in User Name.

    For example, you might specify =%UserName% to use the exact logon name for each user. This helps prevent user prompts when Outlook asks users to decide among several variations.

  4. If you are defining a new Exchange 2007 or Exchange Server 2010 computer, in the Exchange Server text box enter the name of the Exchange Server computer.

    Skip steps 3 and 4 if you are configuring Outlook Anywhere for existing Exchange users who are not moving to a new Exchange Server computer.

  5. Choose More Settings.

  6. In the Exchange Settings dialog box, on the Outlook Anywhere tab, select the Configure Outlook Anywhere check box and then select the Connect to Exchange Mailbox using HTTP check box.

  7. In the text box that follows these check boxes, type the server name for the Outlook Anywhere proxy server.

    Do not enter http:// or https:// as part of the name.

  8. If you want users to connect through Secured Sockets Layer (SSL) only, select Connect using SSL only. If you want to support both server authentication and client authentication, select Mutually authenticate the session when the system connects with SSL and enter the principal name of the proxy server.

  9. Select whether to reverse the default way in which Outlook decides which connection type to try first, LAN (TCP/IP) or Outlook Anywhere (HTTP). The default is LAN (TCP/IP) first, then Outlook Anywhere (HTTP). If you expect users to connect when they are outside the corporate network more frequently than when they are inside the corporate network, we recommend that you configure Outlook to try Outlook Anywhere (HTTP) first.

  10. Select an authentication method from the drop-down list.

    The default method is Password Authentication (NTLM).

  11. Choose OK to return to the Exchange Settings dialog box, and then choose Finish.

  12. Complete other Outlook or Office configurations, and on the File menu, choose Save to create the customization file that you can deploy to users.

Use Group Policy to lock down Outlook Anywhere settings

Use this procedure to use Group Policy to lock down Outlook Anywhere. The Configure Outlook Anywhere user interface options policy setting allows you to determine whether users can view and change user interface (UI) options for Outlook Anywhere.

  • If you enable this policy setting, users can view and change UI options for Outlook Anywhere.

  • If you disable, or do not configure this policy setting, users can use the Outlook Anywhere feature. However, they will be unable to view or change UI options for it.

To lock down Outlook Anywhere settings in the user interface by using Group Policy

  1. In the Group Policy Object Editor, load the Outlook 2013 Administrative template (Outlk15.admx).

  2. Open the Group Policy Management Console (GPMC) and in the tree view expand Domains and then expand Group Policy Objects.

  3. Choose the policy object that you want and then use its shortcut menu (right-click) to choose Edit. The Group Policy Management Editor window opens.

  4. In the tree view, expand User Configuration, expand Administrative Templates, expand Microsoft Outlook 2013, expand Account Settings, and then choose Exchange.

  5. In the reading pane, in the Setting column, open (double-click) Configure Outlook Anywhere user interface options.

  6. If you do not want users to be able to view or change UI options for Outlook Anywhere, select Disabled.

  7. If you want users to view or change UI options for Outlook Anywhere, select Enabled. Then choose an option in the Choose UI State when OS can support feature drop-down list.

  8. Choose OK.

Verification

After you have finished your configurations, apply the configurations in a test environment. In the test environment, open Outlook and verify that the configurations are applied as expected.

See also

Plan a Cached Exchange Mode deployment in Outlook 2013
Overview of Outlook 2013 planning

Outlook Anywhere with Exchange Server 2013


Configure junk email settings in Outlook 2013

Published: October 2, 2012

Summary: Learn how administrators can create and deploy junk email lists and configure the junk email filter for Outlook 2013.

Applies to: Office 365 ProPlus | Outlook 2013

Audience: IT Professionals

Administrators can create Junk E-mail Filter lists in Outlook 2013, and configure the Junk E-mail Filter and automatic picture download, by following the steps that are described in this article.

Important:

This article is provides content for administrators who configure Outlook settings for their organizations.

Are you looking for help with configuring junk email settings in Outlook on your desktop? You may be looking for Change the level of protection in the Junk E-Mail Filter, which will help you change your desktop settings.

In this article:

  • Overview

  • Before you begin

  • Create and deploy Junk E-mail Filter lists

  • Configure the Junk E-mail Filter

  • Configure automatic picture download

Overview

Outlook 2013 provides features that can help users avoid receiving and reading junk e-mail messages that include the Junk E-mail Filter and the ability to disable automatic content download from external servers.

Junk e-mail filtering in Outlook 2013 includes Junk E-mail Filter lists and technology built into the software that helps determine whether an e-mail message should be treated as junk e-mail. You can create the following initial Junk E-mail Filter lists to deploy to users: lists for Safe Senders, Safe Recipients, and Blocked Senders.

The lists that you provide are default lists. If you deploy the lists by using Group Policy, users can change the lists during their Outlook session. When users restart Outlook, Group Policy will append the list by default or, if you have enabled Overwrite or Append Junk Mail Import List, their changes will be overwritten with the original list that you deployed. If you deploy the lists by using the OCT, users can customize and keep their customized lists as they use Outlook, to fine-tune the filters to work best for their messaging needs.

You can use Group Policy or the Office Customization Tool (OCT) to customize settings for the Junk E-mail Filter, and to disable automatic content download to meet the needs of your organization. For example, you can configure the Junk E-mail Filter to be more aggressive. However, that might also catch more legitimate messages. Rules that are not part of the junk e-mail management built into the software are not affected.

Before you begin

Review Plan for limiting junk e-mail in Outlook 2010 to determine what settings to configure for the Junk E-mail Filter and automatic content download.

For information about how to download the Outlook 2013 administrative template, and about other Office 2013 templates, see Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013. For more information about Group Policy, see Overview of Group Policy for Office 2013 and Enforce settings by using Group Policy in Office 2010.

For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Create and deploy Junk E-mail Filter lists

To deploy Junk E-mail Filter lists, first create the lists on a test computer and then distribute the lists to users. You can distribute the lists by putting the lists on a network share. If you have remote users not connected to the domain, you can use the OCT to add the files by using the Add files option.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To create default Junk E-mail Filter lists

  1. Install Outlook 2013 on a test computer.

  2. Start Outlook 2013.

  3. In Outlook 2013, on the Home tab, in the Delete group, choose Junk and Junk E-mail Options.

  4. On the Safe Senders tab, choose Add.

  5. Enter an e-mail address. For example:

    someone@exchange.example.com

  6. Choose OK.

  7. To add more e-mail addresses, repeat steps 3 through 6.

  8. Choose Export to file.

  9. Enter a unique file name for the Safe Senders list, and then choose Save.

  10. Repeat steps 3 through 9 with the Safe Recipients tab and the Blocked Senders tab to create Safe Recipients and Blocked Senders lists. Be sure to specify a unique file name for each list.

To deploy Junk E-mail Filter lists for users by using the Office Customization Tool

  1. Copy the three Junk E-mail Filter files that you created in the previous procedure to a network file share.

  2. If you have remote users not connected to the domain, follow these steps.

    1. In the OCT, choose Add Files and then choose Add.

    2. In the Add Files to MSP File dialog box, select the three Junk E-mail Filter files that you created in the previous procedure.

      Hold down the CONTROL or SHIFT key to select multiple files.

    3. Choose Add.

    4. In the File Destination Path dialog box, in the Destination path on the user's computer box, enter the folder where you want to install the file on users' computers, and then choose OK.

  3. In the OCT, in the tree view, choose Modify User Settings.

  4. In the reading pane, expand Microsoft Outlook 2013, expand Outlook Options, expand Preferences, and then choose Junk E-mail.

  5. Open (double-click) Trigger to apply junk email list settings, choose Enabled and OK so that the setting is applied and Junk E-mail Filter lists are imported for users.

  6. To overwrite existing Junk E-mail Filter lists with new lists, open (double-click) Overwrite or Append Junk Mail Import List, choose Enabled and then choose OK.

  7. To specify a path of each Junk E-mail Filter list, open the settings that correspond to each list (for example, Specify path to Safe Senders), choose Enabled and enter a path and file name in the box (for example, in the Specify path to Safe Senders list).

  8. Choose OK or choose Next setting to specify the path for another Junk E-mail Filter list.

  9. Complete other Outlook 2013 or Office 2013 configurations, and on the File menu, choose Save to create the customization file that you can deploy to users.

You can later change an existing Outlook 2013 installation to update the Junk E-mail Filter lists by following the procedure and including more recent Junk E-mail Filter files.

For more information about how to use the Office Customization Tool for configuring an Office installation to deploy files, see Office Customization Tool (OCT) reference for Office 2013.

Configure the Junk E-mail Filter

You can lock down the settings to customize Junk E-mail Filter options by using the Outlook 2013 Group Policy template. Or you can configure default settings by using the OCT. If this is the case, users can change the settings. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

If you decide to configure Junk E-mail Filter settings in the OCT, see the procedure To configure Outlook Junk E-mail Filter settings in the Office Customization Tool later in this article for an additional setting that must be configured.

Use the following procedure to configure Junk E-mail Filter options in Outlook. For the Junk E-mail Filter options that you can configure, see Plan for limiting junk e-mail in Outlook 2010.

To configure Outlook Junk E-mail Filter settings in Group Policy

  1. In Group Policy, load the Outlook 2013 template and open User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Junk E-mail.

  2. Open (double-click) the option that you want to configure. For example, open Junk E-mail protection level.

  3. Choose Enabled.

  4. If appropriate, select a radio button for the option that you want to set, or select an option from a drop-down list.

  5. Choose OK.

  6. To enable the Junk E-mail settings, you must set the Junk E-Mail Import list setting. You can do this by using the OCT.

    1. In the OCT, on the Modify user settings page, under Microsoft Outlook 2013\Outlook Options\Preferences\Junk E-mail, open Trigger to apply junk email list settings.

    2. Choose Enabled.

    3. Choose OK.

    4. Complete other Outlook 2013 or Office 2013 configurations in the OCT, and on the File menu, choose Save to create the customization file that you can deploy to users.

To configure Outlook Junk E-mail Filter settings in the Office Customization Tool

  1. In the OCT, on the Modify user settings page, under Microsoft Outlook 2013\Outlook Options\Preferences\Junk E-mail, open (double-click) Trigger to apply junk email list settings.

  2. Choose Enabled.

  3. Choose OK.

  4. Open and set any other Junk E-mail options that you want to configure.

  5. Complete other Outlook 2013 or Office 2013 configurations, and on the File menu, choose Save to create the customization file that you can deploy to users.

Configure automatic picture download

To help protect users' privacy and to combat web beacons—functionality embedded within items to detect when recipients have viewed an item—Outlook 2013 is configured by default not to automatically download pictures or other content from external servers on the Internet.

You can lock down the settings to customize automatic picture download by using the Outlook 2013 Group Policy template. Or you can configure default settings by using the OCT. If this is the case, users can change the settings. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

To configure options for automatic picture download behavior in Outlook by using Group Policy

  1. In Group Policy, load the Outlook 2013 template.

  2. Under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security, choose Automatic Picture Download Settings.

  3. Open the option that you want to configure. For example, open Do not permit download of content from safe zones.

  4. Choose Enabled.

  5. If appropriate, select a radio button for the option that you want to set, or select an option from a drop-down list.

  6. Choose OK.

To configure options for automatic picture download behavior in Outlook by using the Office Customization Tool

  1. In the OCT, on the Modify user settings page, under Microsoft Outlook 2013\Security\Automatic Picture Download Settings, open the option that you want to configure. For example, open Include Intranet in Safe Zones for Automatic Picture Download.

  2. Select a radio button for the option that you want to set.

  3. Choose OK.

  4. Complete other Outlook 2013 or Office 2013 configurations, and on the File menu, choose Save to create the customization file that you can deploy to users.

See also

Plan for limiting junk e-mail in Outlook 2010
How to deploy junk email settings, such as the Safe Senders list, by using Group Policy


Language in Office 2013

Published: July 16, 2012

Summary: Find articles that will help you plan which languages to install and how to configure Office 2013 for different languages.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The following table lists and describes articles that will help you Configure Office 2013 to work with multiple languages.

Articles about how to deploy Office 2013 in other languages

Article | Description
Plan for multilanguage deployment of Office 2013 | Provides information about how to plan for multilanguage setup, and about customization and proofing tools for Office 2013.
Customize language setup and settings for Office 2013 | Provides information about how to customize languages for Office 2013
Add or remove language packs after deployment of Office 2013 | Provides information about how to add or remove Office 2013 language packs, either by modifying an existing installation or by deploying them as separate products
Language versions and language interface packs in Office 2013 | Provides information about integrating multiple languages in Office 2013 and installing language interface packs
Companion proofing languages for Office 2013 | Provides information about the companion proofing languages that are included with Office 2013 and about downloadable proofing tool packages that are available for Office 2013.
Language identifiers and OptionState Id values in Office 2013 | A reference article that provides information about the language identifier and OptionState ID values that are needed for Office 2013 languages and for customizing language and proofing tools installations.


Plan for multilanguage deployment of Office 2013

Published: October 2, 2012

Summary: Plan for multilanguage setup, and customization and proofing tools for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

To deploy Office 2013 in multiple languages, you must plan carefully. This article discusses the planning considerations for Setup and the customizations that you can make when you install language packs or proofing tools.

Important:

This article describes methods to deploy and manage language packs for the Windows Installer-based (MSI) delivery format of Office 2013, which is available for enterprise organizations through volume licensing. If you have an Office subscription and you are deploying Office 365 ProPlus, which uses the Click-to-Run delivery format, see Plan for multilanguage deployment of Click-to-Run-based Office installations.

In this article:

  • Plan Setup

  • Plan customizations

  • Plan for proofing tools

Plan Setup

The language-neutral design of Office 2013 helps simplify the deployment of Office products in multiple languages. Instead of creating a series of installations, you enable Setup to coordinate a single installation of multiple language versions.

All language-specific components for a particular language are contained in an Office 2013 Language Pack. Each Office 2013 Language Pack includes language-specific folders for all Office 2013 products that are available in that language. Folders are identified by a language tag that is appended to the folder name. For a complete list of language tags, see Language identifiers and OptionState Id values in Office 2013.

Select all the Office 2013 Language Packs that you want and then copy them to a network installation point that contains at least one complete Office 2013 product. By default, Setup automatically installs the language version that matches the Windows user locale that is set on each user's computer. Or, you can override this default behavior and manage the distribution of multiple language versions manually. For example, you can performa any of the following tasks:

  • Install more than one language on a single computer

  • Specify which languages to install on users' computers, regardless of the language of the operating system that is specified by user locale

  • Specify custom settings once and then apply them to all language versions that you deploy in your organization

  • Deploy different languages to different groups of users

  • Deploy the Microsoft Office 2013 Proofing Tools Kit for additional languages

To identify which deployment solution is appropriate for your scenario, see the model poster Deploy Multilanguage Packs for Microsoft Office 2010.

Note:

Although the poster describes how to deploy Multilanguage packs for Office 2010, and the list of languages has changed for Office 2013, the key decision points, tasks, and outputs described in the poster still apply to Office 2013.

Deploy Multilanguage Packs for Office 2010 - Model

To determine which companion proofing languages are included in an Office 2013 Language Pack, see Companion proofing languages for Office 2013.

Each Office 2013 Language Pack contains the proofing tools for one or more additional languages. For example, the Office 2013 Language Pack - Danish contains the proofing tools for English and German, in addition to Danish. All Office 2013 Language Packs contain the proofing tools for English. For more information about proofing tools, see Plan for proofing tools.

Before it installs a language version of an Office 2013 product, Setup determines whether the user has the required operating system support for that language. Setup stops the installation if there is no support. For example, if a user has not enabled support for East Asian languages, Setup does not install the Japanese version of Office 2013.

It is important to determine the languages that you want before you begin your deployment. There are special steps that you must take to include additional languages if you have to change users' configurations after the initial deployment. For more information, see Add or remove language packs after deployment of Office 2013.

Understanding the Setup logic for Shell UI language

Whenever you deploy the Office 2013 from a network installation point that contains more than one language version, Setup must determine which language to use for the Setup user interface. By default, Setup uses that same language for the Office 2013 installation language and for the Shell user interface (Shell UI). The Shell UI includes core elements of Office 2013 that register with the operating system, such file name extensions, Tool Tips, and right-click menu items.

If your objective is to install only one language version of Office 2013 on each client computer and if you do not specify any additional languages in the Config.xml file, Setup uses the following logic to determine which language to use:

  • Setup matches the language of the user locale.

  • If there is no match, Setup looks for a close match. If the user locale is set to English (Canada), for example, Setup might install Office 2013 in English (U.S).

  • If there is no close match, Setup looks for a language in the following subkey in the Windows registry:

    HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources

    If the InstallLanguage entry has not been added to the LanguageResources subkey and set to a particular language (LCID), Setup either prompts the user to select a language during an interactive installation, or it stops a silent installation.

If your objective is to install more than one language version of Office 2013 on each client computer, you should edit the Config.xml file and set the <AddLanguage> element for each language that you want to include. However, when you add more than one language in the Config.xml file, you must specify which of those languages Setup should use for the Shell UI. If the Shell UI language is not specified, the installation will fail.

You specify a language for the Shell UI by setting the ShellTransform attribute of the <AddLanguage> element. In this case, the language of the Setup user interface follows the logic described previously. However, the languages that are installed on the computer and the language of the Shell UI are determined by the entries in the Config.xml file.

Setup always installs Office 2013 in the language of the Shell UI, in addition to any other installation languages. For example, if the Shell UI is set to French, the user can select additional installation languages on the Languages tab. However, the user cannot remove French.

For specific steps on how to customize Setup for different scenarios, see applicable sections in Customize language setup and settings for Office 2013:

  • Deploy a default language version of Office

  • Specify which languages to install

  • Deploy different languages to different groups of users

Plan customizations

When a user starts an Office 2013 application for the first time, Setup applies default settings that match the language that is installed on the computer and the language that is specified by the Windows user locale setting.

Four main language settings affect the way users work with Office 2013:

  • Primary editing language When more than one language version of Office 2013 is installed on the computer, this setting determines the language in which users work with Office applications and documents.

  • Enabled editing languages Users can specify more than one language for editing Office 2013 documents. Depending on the languages selected, this setting might require the user to install additional proofing tools.

  • User interface language This setting determines the language in which the user interface is displayed.

  • Help language This setting determines the language in which users view Help topics.

You can configure these language settings for users in advance. If you specify custom language settings when you install Office, by applying a Setup customization file (.msp file) or by setting policies, Office 2013 does not overwrite your settings with the default settings when users start the applications for the first time.

Methods of customizing language settings

You configure language settings by using one of the following methods:

  • Group Policy Group Policy settings enforce default language settings. Users in your organization cannot permanently change settings that are managed by Group Policy. The settings are reapplied every time that the user logs on.

    The following policy settings help you manage language settings in Office 2013:

    • Display menus and dialog boxes in Located in the Display Language folder under User Configuration\Administrative Templates\Microsoft Office 2013\Language Preferences\Display Language. This policy setting determines the language of the user interface.

    • Display help in Located in the Display Language folder under User Configuration\Administrative Templates\Microsoft Office 2013\Language Preferences\Display Language. This policy setting determines the language of online Help. If this policy setting is not configured, the Help language uses the user interface language.

    • Enabled Editing Languages Located in the Editing Languages folder under User Configuration\Administrative Templates\Microsoft Office 2013\Language Preferences\Editing Languages. This policy setting enables editing languages from the list of languages supported by Office.

    • Primary Editing Language Located in the Editing Languages folder under User Configuration\Administrative Templates\Microsoft Office 2013\Language Preferences\Editing Languages. This policy setting specifies the language in which users work with Office applications and documents when more than one language version is available on the computer.

  • Office Customization Tool (OCT) You use the OCT to create a Setup customization file (.msp file) that Setup applies during the installation. Settings specified in the OCT are the default settings. Users can change the settings after the installation.

  • Language Settings tool If you do not enforce language settings by policy, users who work in Office 2013 applications can use the Language Settings tool to change their language settings.

For specific steps on how to use these tools to customize Office 2013 for multiple language deployments, see Customize language setup and settings for Office 2013.

Enable users to view the new language settings on first open

Typically, after you configure language settings by using one of the methods that are described in this article, Setup applies default settings that match the language that is installed on the computer when a user starts an Office 2013 application for the first time. This means the new language settings will display the next (second) time that the user starts the Office 2013 application.

If you want users to view the new language settings the first time that they open an Office 2013 application, you can deploy the following registry settings to their computers when you deploy an initial Office 2013 installation, or before they have to use an Office 2013 application. You can deploy these registry settings by using a script or batch file, Group Policy, or the OCT. The registry settings to configure are the following DWORD values under the HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\LanguageResources key:

  • UILanguage

  • HelpLanguage

  • FollowSystemUI

For each of these values, for Value name specify the LCID (locale identifier) that corresponds to the language that you want to use. For a list of LCIDs, see Language identifiers and OptionState Id values in Office 2013. LCIDs are decimal values. Therefore, you must also set the Base option to Decimal.

Customize language-specific settings that are related to user locale

In addition to using the Primary Editing Language setting, the Office 2013 also configures language-related settings, such as number format, to match the user locale of the operating system. This behavior is controlled by the LangTuneUp entry in the LanguageResources subkey in the Windows registry. If you do not want user locale to affect default settings, you can reset the value of LangTuneUp when you install Office 2013. If the LangTuneUp entry does not exist, Office 2013 creates the entry the first time that an application starts and sets the value to OfficeCompleted.

The LangTuneUp entry can have one of two values:

  • OfficeCompleted Settings based on user locale are not applied to Office 2013 as a whole. However, individual applications still check for new input method editors (IMEs) and language scripts, and still apply application settings that are specific to the user locale. For example, applications make sure that newly installed keyboards have the appropriate editing languages enabled, and Word uses fonts in Normal.dot, based on user locale.

  • Prohibited No settings related to user locale are changed by Office 2013 or by any individual Office 2013 application.

In some scenarios, ignoring the user locale setting can help maintain a standard configuration across a multilingual organization. Setting the LangTuneUp entry to Prohibited makes sure that language settings remain consistent and macros are more compatible internationally.

For example, if your organization is based in the United States and you want to standardize settings internationally, you can deploy Office 2013 with Primary Editing Language set to en-us (U.S. English) and LangTuneUp set to Prohibited. In this scenario, users receive the same default settings, regardless of their user locale.

Ignoring user locale is not always the best option. For example, users who read and enter Asian characters in Office 2013 documents might not always have the Asian fonts they must have to display characters correctly. If the installation language on the user's computer does not match the language that was used in the document and LangTuneUp is set to Prohibited, Office 2013 does not display fonts in the non-default language. If your Office 2013 installations have to support multiple Asian language user locales, make sure LangTuneUp continues to be set to OfficeCompleted. To help make sure that users do not change the default value, set the corresponding policy.

Plan for proofing tools

Proofing tools let users edit documents in 52 languages. Depending on the language, these editing tools might include spelling and grammar checkers, thesauruses, and hyphenators. Proofing tools might also include language-specific editing features such as Language AutoDetect, AutoSummarize, and Intelligent AutoCorrect.

The Office 2013 Proofing Tools Kit provides a single resource from which you can install any of the proofing tools. You can install proofing tools on a local computer or deploy tools to a group of users. You can also customize and install the tools for one user or all users in your organization.

Determining the method to deploy proofing tools

You can deploy additional proofing tools for users who have to edit documents in languages other than those that are already installed on their computers. You can deploy additional proofing tools from either of these sources:

  • Office 2013 Language Pack Use this option if users want both the user interface and the proofing tools for a specific language. Often, one language pack can provide all the proofing tool languages that you want. The companion proofing tool languages that are contained in a language pack mirror those of what's contained in language versions of Office 2013.

    For a list of companion languages, see Companion proofing languages for Office 2013. If a language pack has all the proofing tool languages that you want, deploy a language pack by using the instructions that fit your scenario in Customize language setup and settings for Office 2013.

  • Office 2013 Proofing Tools Kit This product contains the proofing tools for all languages that are available with Office 2013. Use this option if you have to have proofing tools that are not included in the set of companion languages for any languages that are installed or included in an additional language pack that you could install.

The Office 2013 Multilanguage Pack contains all of the Office 2013 Language Packs. Individual Office 2013 Language Packs, the Office 2013 Multilanguage Pack, and Office 2013 Proofing Tools Kit are available through Microsoft Volume Licensing programs.

The hard disk space requirement to install proofing tools is 1 gigabyte (GB). However, the overall disk space depends on whether you deploy proofing tools from a language pack or from the Office 2013 Proofing Tools Kit. As with most products in the Office 2013, the complete Office 2013 Proofing Tools Kit package is cached to the local installation source (LIS).

Note:

  • Proofing tools do not include bilingual dictionaries or word breakers. Those tools are part of the language version or language pack.

  • Beginning in Office 2013, free downloadable proofing tool packages in 52 languages are available to all customers who have purchased the on-premises (MSI-installed) version of Office 2013, whether or not they are volume license customers. You can download these proofing tool packages in 32-bit or 64-bit versions from Office Proofing Tools. For more information, see Downloadable proofing tool packages in Companion proofing languages for Office 2013.

Customizing Setup for Office 2013 Proofing Tools Kit

To customize the Setup of the Office 2013 Proofing Tools Kit, modify the Config.xml file in the ProofKit.WW folder. For each set of proofing tools that you do not want to install, in the OptionState element, set the State attribute to Absent.

Syntax

<OptionState

Id="optionID"

State="Absent" | "Advertise" | "Default" | "Local"

[Children="force"]

/>

OptionState attributes

The following table shows OptionState attributes, values, and descriptions.

OptionState attributes and values

Attribute | Value | Description
Id | optionID | An item that the user can choose to install. See Proofing Tools Config.xml OptionState Id values in Language identifiers and OptionState Id values in Office 2013.
State | Absent | The feature is not installed.
 | Advertise | The feature is installed the first time that it is used.
 | Default | The feature returns to its default installation state.
 | Local | The feature is installed on the user's computer.
Children | force | All child features of the feature are set to the specified state.
Note:

The default value for the State attribute is Local.

Example: Config.xml file for Office 2013 Proofing Tools Kit

The following Config.xml file example shows every language that has the OptionState element State attribute set to Absent. If you decide to copy this example into the Config.xml file for the Office 2013 Proofing Tools Kit, set the State attribute for each set of proofing tools that you want to deploy to Local (or Default or Advertise, if preferred).

Copy code
<Configuration Product="ProofKit">
  <!-- <Display Level="full" CompletionNotice="yes" SuppressModal="no" AcceptEula="no" /> -->
  <!-- <Logging Type="standard" Path="%temp%" Template="Microsoft Office Proofing Tools Kit Setup(*).txt" /> -->
  <!-- <USERNAME Value="Customer" /> -->
  <!-- <COMPANYNAME Value="MyCompany" /> -->
  <!-- <INSTALLLOCATION Value="%programfiles%\Microsoft Office" /> -->
  <!-- <LIS CACHEACTION="CacheOnly" /> -->
  <!-- <LIS SOURCELIST ="\\server1\share\Office;\\server2\share\Office" /> -->
  <!-- <DistributionPoint Location="\\server\share\Office" /> -->
  <!-- <OptionState Id="OptionID" State="absent" Children="force" /> -->
    <OptionState Id="IMEMain_1028" State="Absent" Children="force"/>
    <OptionState Id="IMEMain_1041" State="Absent" Children="force"/>
    <OptionState Id="IMEMain_1042" State="Absent" Children="force"/>
    <OptionState Id="IMEMain_2052" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1025" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1026" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1027" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1028" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1029" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1030" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1031" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1032" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1033" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1035" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1036" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1037" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1038" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1040" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1041" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1042" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1043" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1044" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1045" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1046" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1048" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1049" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1050" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1051" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1053" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1054" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1055" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1056" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1058" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1060" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1061" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1062" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1063" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1069" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1081" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1087" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1094" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1095" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1097" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1099" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1102" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_1110" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_2052" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_2068" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_2070" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_2074" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_3076" State="Absent" Children="force"/>
    <OptionState Id="ProofingTools_3082" State="Absent" Children="force"/>
  <!-- <Setting Id="Setup_Reboot" Value="IfNeeded" /> -->
  <!-- <Command Path="%windir%\system32\msiexec.exe" Args="/i \\server\share\my.msi" QuietArg="/q" ChainPosition="after" Execute="install" /> -->
</Configuration>

For more information about how to customize Setup for the Office 2013 Proofing Tools Kit, see Customize and install the Office 2013 Proofing Tools Kit in Customize language setup and settings for Office 2013.

Precaching the local installation source for the Office 2013 Proofing Tools Kit

When you deploy the Office 2013 Proofing Tools Kit, Setup creates a local installation source on the user's computer — a copy of the compressed source files for the Office 2013 Proofing Tools Kit. After the files are copied to the user's computer, Setup completes the installation from the local installation source. You can minimize the load on the network by deploying the local installation source separately, before you deploy the Office 2013 Proofing Tools Kit. To precache the local installation source for the Office 2013 Proofing Tools Kit, see Precache the local installation source for the 2007 Office system. Use the Setup.exe and Config.xml files from the ProofKit.WW folder on the Office 2013 Proofing Tools Kit CD.

See also

Language identifiers and OptionState Id values in Office 2013
Companion proofing languages for Office 2013
Customize language setup and settings for Office 2013
Add or remove language packs after deployment of Office 2013
Language in Office 2013
Office Customization Tool (OCT) reference for Office 2013

Precache the local installation source for Office 2010


Customize language setup and settings for Office 2013

Published: October 2, 2012

Summary: Learn how to customize languages for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

To customize and deploy language setup and settings for Office 2013, follow the steps that are described in this article.

Important:

This article describes methods of deploying and managing language packs for the Windows Installer-based (MSI) delivery format of Office 2013, which is available for enterprise organizations through volume licensing. If you have an Office subscription and you are deploying Office 365 ProPlus, which uses the Click-to-Run delivery format, see Plan for multilanguage deployment of Click-to-Run-based Office installations.

In this article:

  • Overview

  • Before you begin

  • Deploy a default language version of Office

  • Specify which languages to install

  • Deploy different languages to different groups of users

  • Identify installed languages

  • Customize language settings

  • Customize and install the Office 2013 Proofing Tools Kit

Overview

By default, Setup automatically installs the language version that matches the Windows user locale that is set on each user's computer. Or, you can override this default behavior and manage the distribution of multiple language versions more precisely. For example, you can perform any of the following tasks:

  • Install more than one language on a single computer.

  • Specify which languages to install on users' computers, regardless of the language of the operating system, which is specified by user locale.

  • Specify custom settings once and then apply them to all language versions that you deploy in your organization.

  • Deploy different languages to different groups of users.

  • Deploy the Office 2013 Proofing Tools Kit for additional languages.

For more information, see Plan Setup in Plan for multilanguage deployment of Office 2013.

When a user starts an Office 2013 application for the first time, Setup applies default settings that match the language that is installed on the computer and the language that is specified by the Windows user locale setting. However, you configure language settings by using Group Policy, the Office Customization Tool (OCT), or the Language Settings tool. For more information, see Plan customizations in Plan for multilanguage deployment of Office 2013.

If users have to edit in a language or a companion proofing language that is not installed, you can customize and install the Office 2013 Proofing Tools Kit. For more information, see Plan for proofing tools in Plan for multilanguage deployment of Office 2013.

Before you begin

To determine which of the following procedures to use for your deployment and which customizations you might have to make, see Plan for multilanguage deployment of Office 2013.

Deploy a default language version of Office

If users in your organization work with Office files that are in the same language, or in a language that matches the language of their operating system, you can deploy a default language version of Office.

The following steps are the same as the standard steps for deploying Office 2013. They are included for testing. The only difference in the steps is that you must copy the language packs to the same network location as the installation files.

To deploy a default language version of Office to every client computer

  1. Create a network installation point for the primary Office 2013 product by copying all the files and folders from the source media to a shared network location.

  2. Copy all the files and folders from the source media for each language pack to the same network location. When you are prompted to overwrite duplicate files, choose No.

  3. Use the Office Customization Tool (OCT) to configure the installation to match your organization's requirements.

    Because most of the customizations apply to the core product, you do not typically have to customize each language separately. Setup applies your customizations during the installation regardless of the language that you are installing. For information about how to customize language settings, see Customize language settings.

    Language packs that are obtained through a volume license agreement do not require a unique product key. Only one volume license key is required for the installation.

  4. On the Setup command line, specify the Config.xml file for the primary Office product that you are deploying.

    For example, the following command line installs Office Professional Plus 2013 in any language:

    \\server\share\Office15\Setup.exe /config \\server\share\Office15\ProPlus.WW\Config.xml

    where Office15 is the root of the network installation point.

  5. Run Setup from the root of the network installation point.

    Setup installs only the language-specific elements that are needed for the Office product that you are installing. Setup does not install the complete language pack unless you deploy the language pack as a separate product.

Specify which languages to install

If users in your organization work with Office files in more than one language, or if they want an Office language that does not match the language of their operating system, you can install all the languages they want at the same time.

The following steps are the same as the standard steps for deploying Office 2013. They are included for testing. The only difference in the steps is that you must copy the language packs to the same network location as your installation files and edit the Config.xml file to specify which languages to install.

To specify one or more languages to install on a client computer

  1. Create a network installation point for your primary Office 2013 product by copying all the files and folders from source media to a shared network location.

  2. Copy all the files and folders from the source media for each language pack to the same network location. When you are prompted to overwrite duplicate files, choose No.

  3. In the core product folder for the product that you are updating, locate the Config.xml file

    For example, if you are adding languages to an installation of Office Professional Plus 2013, find the Config.xml file in the Proplus.WW folder.

  4. Open the Config.xml file by using a text editor, such as Notepad.

  5. Add the <AddLanguage> element.

  6. Set the value of the Id attribute to the language tag that corresponds to the language that you want to install. You can specify more than one language by including additional <AddLanguage> elements and attributes.

  7. Specify which language to use for the Shell user interface (Shell UI) by setting the <ShellTransform> attribute of the <AddLanguage> element.

    For example, to specify that Setup install both English and French, with English as the default installation language, add the following elements:

    Copy code
    <AddLanguage Id="en-us" ShellTransform="yes"/> <AddLanguage Id="fr-fr" />

    If you want the default installation language and the Shell UI to match the operating system language, and you also want every user to have Office in both English and French, the code in the Config.xml file resembles the following example:

    Copy code
    <AddLanguage Id="match" ShellTransform="yes"/>
<AddLanguage Id="en-us" />
<AddLanguage Id="fr-fr" />

    You are required to specify a value for the ShellTransform attribute when you add more than one <AddLanguage> element. Skipping this step causes the installation to fail.

  8. To specify that Setup also match the language of the user's Windows user locale, add another line in the Config.xml file:

    Copy code
    <AddLanguage Id="match" />

    In this case, Setup installs all specified languages plus the language that matches the user locale, if that language is different.

  9. Save the Config.xml file.

  10. Use the Office Customization Tool (OCT) to configure the installation to match your organization's requirements.

    For information about how to customize language settings, see Customize language settings.

  11. Run Setup.exe and specify the path of your changed Config.xml file.

    Note that you must use a fully qualified path. For example: \\server\share\Office15\setup.exe /config\\server\share\Office15\ProPlus.WW\Config.xml where Office15 is the root of the network installation point.

Deploy different languages to different groups of users

You can give different groups of users different sets of Office languages. For example, a subsidiary that is based in Tokyo might have to work with Office 2013 documents in English and Japanese, whereas users in the European subsidiary want English, French, and German. In this scenario, you create a unique Config.xml file for each group of users.

The following steps are the same as the standard steps to deploy the Office 2013. They are included for testing. The only differences in the steps is that you must copy the language packs to the same network location as the installation files, create and edit the Config.xml file for each group to specify which languages to install, and then deploy the appropriate Config.xml file to the different groups.

To deploy different languages to different groups of users

  1. In the core product folder for the product that you are installing, locate the Config.xml file.

    For example, if you are installing Office Professional Plus 2013, find the Config.xml file in the ProPlus.WW folder.

  2. Open the Config.xml file by using a text editor, such as Notepad.

  3. Locate the <AddLanguage> element and specify the set of languages that you want to install for this user group, as described previously.

    Note:

    You must also set the <Shell UI> attribute of the <AddLanguage> element, as described previously.

  4. Save the Config.xml file by using a unique file name.

  5. Repeat these steps for the next user group.

  6. Use the OCT to configure the installation to match your organization's requirements.

    For information about how to customize language settings, see Customize language settings.

  7. Deploy Office to each group of users separately, and in each case specify the correct Config.xml file on the Setup command line. For example:

    \\server\share\Office15\setup.exe /config\\server\share\Office15\ProPlus.WW\SubAConfig.xml, or

    \\server\share\Office15\setup.exe /config\\server\share\Office15\ProPlus.WW\SubBConfig.xml

    where Office15 is the root of the network installation point.

Identify installed languages

You can view a list of languages that are installed for Office 2013 either during the initial installation or during a separate installation of a language pack at the following registry key, which displays the LCID for each enabled language:

HKCU\Software\Microsoft\Office\15.0\Common\LanguageResources\EnabledLanguages

You can view the user interface (UI) language and fallback languages at the following registry key:

HKCU\Software\Microsoft\Office\15.0\Common\LanguageResources

Although all applications in the Office 2013 use a shared set of registry data to determine their UI language, they do not necessarily all appear in the same UI language. Applications in the Office 2013 usually appear with the UI language that is indicated in the UILanguage entry of this registry key. But there are circumstances where this might not be the case. For example, some deployments might have Word 2013 and Excel 2013 installed in French, but another Office application that is installed in a different language. In this case, the other application examines the UIFallback list in this registry key, and uses the first language that works with its installed configuration.

Customize language settings

Use Group Policy to enforce language settings

Group Policy settings can enforce default language settings that users in your organization cannot change. Policy settings are reapplied every time the user logs on. The following procedure provides high-level steps for configuring language preference-related policy settings.

Important:

Before you can configure Office 2013 policy settings, you must load the Office 2013 Administrative Template files (http://go.microsoft.com/fwlink/p/?LinkId=257051). To load the Administrative Template files, download the files and follow the instructions for "Loading the ADMX templates" in Use Group Policy to enforce Office 2010 settings. Although the article is for Office 2010, the Administrative Templates information also applies to Office 2013.

To use Group Policy to manage language settings

  1. Open the Group Policy object (GPO) for which you want to set policy.

  2. In the navigation pane, expand (double-click) Computer Configuration or User Configuration, expand Administrative Templates, and then expand Microsoft Office 2013\Language Preferences, which contains language-related policy settings.

  3. Under Language Preferences, choose either the Display Language or the Editing Language folder, depending on what you want to configure:

    • The Display Language folder contains policy settings that allow you to enable language preferences for UI items such as menu items and Help.

    • The Enable Language folder contains policy settings that allow you to choose and configure editing languages.

    Note:

    Each policy setting provides a description of what it enforces.

  4. In the details pane, open (double-click) the policy setting that you want to configure, choose either Enable or Disable, and then specify any appropriate options that are provided.

  5. Save the GPO.

Use a Setup customization file to specify default language settings

You use the OCT to create a Setup customization file (.msp file) that Setup applies during the installation. Settings that are specified in the OCT are the default settings. Users can modify the settings after the installation.

To use the OCT to customize language settings

  1. Start the OCT by running Setup with the /admin command-line option.

  2. On the Modify User Settings page, expand the tree to Microsoft Office 2013\Language Settings.

  3. Open the folder that you want in the navigation pane. Open (double-click) the setting in the details pane, choose Enable, and then specify a value.

  4. Save the Setup customization file in the Updates folder at the root of the network installation point.

    Setup applies the file automatically when you install Office on users' computers.

For more information about how to use the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Use the Language Preferences tool to change language settings

If you are not enforcing language settings by policy, users who work in Office applications can use the Language Preferences tool to change their language preferences.

To change language preferences by using the Language Preferences tool

  1. Depending on your operating system, do one of the following:

    • If you are running Windows 8, open All Apps (right-click the desktop), and then under Microsoft Office 2013, choose Office 2013 Language Preferences. Or,

    • If you are running Windows 7, choose Start, choose All Programs, choose Microsoft Office, choose Microsoft Office 2010 Tools, and then choose Office 2013 Language Preferences.

  2. Under Choose Editing Languages, in the language list, choose the language that you want to be available for editing, and then choose Add. Repeat this step for each editing language that you want to add.

  3. Under Choose Editing Languages, choose the language that you most often use for Office applications and documents, and then choose Set as Default.

  4. Under Choose Display and Help Languages, and then under Display Language, choose the language that you want to use to view Office application buttons and tabs, and then choose Set as Default.

  5. Under Help Language, select the language that you want to use to view Office application Help, and then choose Set as Default.

    If you do not specify a language for Help, the online Help language uses the display language.

Note:

You can enable functionality for working in languages that are not installed on the computer. For example, if you select Korean as an editing language, you enable Asian and Korean features in Word even if Korean proofing tools are not installed. You must enable support for that language in the operating system.

Customize and install the Office 2013 Proofing Tools Kit

This section covers how to customize and install Office 2013 Proofing Tools Kit.

Note:

If you only want specific proofing languages, the installation of one or two language packs might provide all the proofing tool languages that you have to have. Each language version of Office 2013 includes proofing tools for a set of companion languages. For more information, see Plan for proofing tools in Plan for multilanguage deployment of Office 2013 and Companion proofing languages for Office 2013.

Customize the Office 2013 Proofing Tools Kit

You can specify which proofing tool languages to install by editing the Config.xml file in the ProofKit.WW folder. For more information about OptionState attributes and IDs, see Plan for proofing tools in Plan for multilanguage deployment of Office 2013 and Language identifiers and OptionState Id values in Office 2013.

To customize Setup for proofing tools

  1. In the ProofKit.WW folder, locate the Config.xml file.

  2. Open the Config.xml file by using a text editor, such as Notepad.

  3. For each set of proofing tools that you do not want to install, in the OptionState element, set the State attribute to Absent. For example, if you do not want Catalan proofing tools installed, use this syntax:

    Copy code
    <OptionState Id="ProofingTools_1027" State="Absent" Children="force"/>

  4. Set the State attribute for each set of proofing tools that you want to deploy to Local (or Default or Advertise, if preferred). For example, to deploy Basque proofing tools, you can use this syntax:

    Copy code
    <OptionState Id="ProofingTools_1069" State="Local" Children="force"/>

  5. Save the Config.xml file.

  6. Run Setup.exe, and then specify the path of your changed Config.xml file.

    Note that you must use a fully qualified path. For example,: \\server\share\Office15\ProofKit.WW\setup.exe /config\\server\share\Office15\ProofKit.WW\Config.xml

    where Office15 is the root of the network installation point.

Installing the Office Proofing Tools Kit 2013 on a single computer

If you have only one or two users who want proofing tools, you can install proofing tools from the Office 2013 Proofing Tools Kit to individual computers.

To install the Office Proofing Tools Kit 2013 on a single computer

  1. On the Office 2013 Proofing Tools Kit CD, run Setup.exe.

  2. Read and accept the Microsoft Software License Terms, and then choose Continue.

  3. To install the proofing tools for all available languages, choose Install Now. The installation will begin. Otherwise, to install individual languages, choose Customize.

  4. If you selected Customize, choose the File Location and User Information tabs to change the information as necessary. On the Installation Options tab, choose the node (plus (+) sign) for the languages that you want to install, and then use the drop-down arrows to set the appropriate installation states.

  5. Choose Install.

Note:

Beginning in Office 2013, free downloadable proofing tool packages in 52 languages are available to all customers who have purchased the on-premises (MSI-installed) version of Office 2013, whether or not they are volume license customers. You can download these proofing tool packages in 32-bit or 64-bit versions from Office Proofing Tools. For more information, see Downloadable proofing tool packages in Companion proofing languages for Office 2013.

See also

Plan for multilanguage deployment of Office 2013
Office Customization Tool (OCT) reference for Office 2013


Add or remove language packs after deployment of Office 2013

Published: October 2, 2012

Summary: Add or remove Office 2013 language packs by modifying an existing installation or by deploying them as separate products.

Applies to: Office 2013

Audience: IT Professionals

You can add or remove language packs for an existing Office 2013 installation. This article describes the two methods that you can use to complete these tasks and how to view a list of the languages that are installed.

Important:

This article describes methods to deploy and manage language packs for the Windows Installer-based (MSI) delivery format of Office 2013, available for enterprise organizations through volume licensing. If you have an Office subscription and you are deploying Office 365 ProPlus (which uses the Click-to-Run delivery format), see Plan for multilanguage deployment of Click-to-Run-based Office installations.

In this article:

  • Overview

  • Before you begin

  • Modify an existing installation

  • Deploy language packs

  • Remove language packs

  • Identify installed languages

Overview

Office 2013 language packs enable Office applications to display menus, dialog boxes, Help topics, and other text in the user interface in multiple languages. Although the most frequently deployed languages for Office 2013 are released at the same time as the product is released, many other Office 2013 Language Packs are released over time. The Office 2013 Multi-Language Pack, which includes all available language packs, is not released until after all the individual language packs are released. However, if you upgrade your multilingual organization to Office 2013 before all the language packs are released, you can always add or remove additional languages at any time. The Office 2013 Multi-Language Pack and Office 2013 Proofing Tools Kit CDs for Office 2013 are available through Microsoft Volume Licensing programs.

There are two methods that you can use to add languages after you deploy Office 2013:

  • Modify an existing installation. When you use this recommended method, a language is treated as another feature to add to a deployment of Office 2013. This method involves combining the language resources with the source of the original installed Office 2013 product, changing the Config.xml file to add the appropriate languages, and rerunning Setup.exe from the Office 2013 installation source. This method installs only the necessary language parts for the products that are installed on the user's computer. For example, if you add Japanese to a basic installation of Office 2013 that does not include Visio 2013, the Visio 2013 resources for Japanese are not installed.

    However, if the computer has both Office 2013 and Visio 2013 installed on it, you must add the Japanese resources for each product through two separate operations because there are two separate installation sources, one for Office 2013, and the other for Visio 2013.

  • Deploy language packs as separate products. This method involves running the language pack's Setup file so that the full Language Pack is installed on the computer rather than modifying an existing installation of Office 2013, which is what the first method does. Deploying language packs is appropriate when you want to add languages after a deployment of Office 2013 but do not know which Office 2013 products are currently installed on users' computers. To use this method, you must have at least one Office 2013 product installed on the computer.

Note:

Language-specific elements for Project 2013 and Visio 2013 are installed separately. You must rerun the Language Pack setup for these products. For more information, see Deploy language packs later in this article

Before you begin

It is important to determine which languages will be used at the beginning of your deployment. If you change users' configurations after the initial deployment and include additional languages as part of your customizations, you must first copy all the Office 2013 Language Packs that you want to deploy to the network installation point that contains the Office product files. For example, \\server\share\Office15. A static list of the products that are contained in the installation source is built only during the initial creation of a customization .msp file. If you later add more languages to the installation source, the existing .msp file is not updated to reflect this change. Addressing this issue involves the following steps:

  1. Create a new customization file by using the Office Customization Tool (OCT).

  2. Import your existing customization .msp file by using the File \| Import command in the OCT.

  3. Make any additional customizations that you want and then save the .msp file.

  4. After you update the installation source with additional languages, deploy the new .msp file to users.

Failure to create and deploy a new .msp file might result in unexpected behavior, because the changes to an existing customization .msp file do not apply to the languages that are added. If you do not create a new .msp file and import the existing .msp file into that file, your deployment may test correctly in your lab. But users might not see the new language in their Office 2013 applications, or they might see only a subset of the language features. For more information, see To import a customization .msp file to add languages to an existing installation in the article Import an Office 2010 Setup customization file (although this article was written for Office 2010, the concepts and procedures it provides also apply to Office 2013) and Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013.

For information about how to create a network installation point with multiple languages, see Customize language setup and settings for Office 2013.

Modify an existing installation

The recommended method for adding languages to an existing installation of Office 2013 is to run Setup again and modify the existing Office installation. Because you are only modifying the original installation, no new entry appears in Add or Remove Programs in Control Panel.

You cannot replace the language of the shell user interface (Shell UI) that was installed during the initial installation. The Shell UI includes core elements of Office that register with the operating system, such as file name extensions, Tool Tips, and right-click menu items.

When you update a multilanguage installation, you can specify that the new language matches the user locale that is set on the local computer. For example, if your organization includes both English-speaking and Russian-speaking users, you might first deploy English to everyone. Later, when the Russian language pack becomes available, you can add the following line to Config.xml:

Copy code
<AddLanguage Id="match" />

In this case, Setup installs Russian language elements on any computer that has the user locale set to Russian. Users who have an English user locale are not affected.

To deploy additional languages after Office is installed

  1. Copy the files and folders in the new language packs from the source media to the original network installation point. When you are prompted to overwrite Setup files, choose No.

    Each language pack includes language-specific elements for every product in Office 2013. However, Setup installs language-specific elements only for the Office product that you are updating.

  2. In the core product folder for the product that you are updating, locate the Config.xml file.

    For example, if you are adding languages to an installation of Office Professional Plus 2013, find the Config.xml file in the ProPlus.WW folder.

  3. Open Config.xml in a text editor, such as Notepad.

  4. Find the <AddLanguage> element. Uncomment the line by deleting the opening <!-- and closing --> tags.

  5. Set the value of the Id attribute to the language tag that corresponds to the language that you want to install. You can specify more than one language by including additional <AddLanguage> elements and attributes.

    For example, to add the Russian language pack, the line should resemble the following example:

    Copy code
    <AddLanguage Id="ru-ru" />

  6. If you add more than one language in Config.xml, you must specify one language as the language for the Shell UI. For example:

    Copy code
    <AddLanguage Id="ru-ru" ShellTransform="yes" />
<AddLanguage Id="en-us" />

    You must specify a ShellUI language, even though Setup does not change the ShellUI language that was set for the initial installation.

  7. Save the Config.xml file. Run Setup.exe and specify the path of your modified Config.xml file.

    You must use a full qualified path. For example: \\server\share\Office15\setup.exe /config \\server\share\Office15\ProPlus.WW\Config.xml

    where Office15 is the root of the network installation point.

    Because Setup also recognizes language packs as separate products, make sure that you specify the Config.xml file for the Office product that you are updating, and not the language pack.

To deploy these languages for new Office 2013 installations, see Specify which languages to install in the article Customize language setup and settings for Office 2013 and import existing customization .msp files into a new customization .msp file. A static list of the products contained in the installation source is built only during the initial creation of a customization file. If you later add more languages to the installation source, the existing customization file is not updated to reflect this change. For more information, see To import a customization .msp file to add languages to an existing installation in the article Import an Office 2010 Setup customization file (although this article was written for Office 2010, the concepts and procedures it provides also apply to Office 2013).

Deploy language packs

If you deployed multiple Office 2013 products in your organization and you must add more language support, you can deploy language packs as separate products. In this case, Setup installs language-specific elements for every product in Office 2013. No matter which products users have installed, users can access the additional language versions.

For this deployment method to work, there must be at least one Office 2013 product installed on the computer that you are deploying to.

When you deploy language packs separately, you must consider the disk space that is required on users' computers. Language pack requirements range from 800MB to 1.5 GB of hard disk space that is needed.

Language-specific elements for Project 2013 and Visio 2013 are installed separately. In each language pack, the core product folder for Project 2013 is PMUI.ll-cc. The core product folder for Visio 2013 is VisMUI.ll-cc.

To deploy language packs

  1. Copy all files and folders in the new language pack from the source media to a location on the network. If you are using an Office 2013 Multi-Language Pack, you can copy just the files and folders for the languages that you want to install. When you are prompted to overwrite Setup files, choose No.

  2. In the core product folder for the language pack that you are installing, locate the Config.xml file.

    For example, if you are installing the Russian language pack, find the Config.xml file in the OMUI.ru-ru folder.

  3. Run the language pack Setup from the root of the network installation point for the Office 2013 Multi-Language Pack or Office 2013 Language Pack, and specify the path of the Config.xml file on the command line. For example:

    \\server\share\Office15\LP\Setup.exe /Config\\server\share\Office15\LP\RU\OMUI.ru-ru\Config.xml

    where Office15\LP is the root of the network installation point for the language packs and RU is the language folder name.

    Complete the previous steps for each language that you want to install.

To deploy these languages for new Office 2013 installations, see Specify which languages to install in Customize language setup and settings for Office 2013 and import existing customization .msp files into a new customization .msp file. A static list of the products contained in the installation source is built only during the initial creation of a customization file. If you later add more languages to the installation source, the existing customization file is not updated to reflect this change. For more information, see To import a customization .msp file to add languages to an existing installation in the article Import an Office 2010 Setup customization file (although this article was written for Office 2010, the concepts and procedures it provides also apply to Office 2013).

Remove language packs

If the Office 2013 Language Packs were deployed as separate products, they can be removed by using Windows Add or Remove Programs.

If the Office 2013 Language Packs were deployed with Office 2013 and not as separate products, the procedure to remove them resembles the deployment of the Language Packs. Instead of using the <AddLanguage> tag, use the <RemoveLanguage> tag. See the following procedure for the specific steps.

You must follow these steps for each language that you want to remove.

To remove language packs

  1. If the language was deployed with the Office product (not as a separate product), locate the Config.xml file in the core product folder for the product that you are updating.

    For example, if you are removing languages from an installation of Office Professional Plus 2013, find the Config.xml file in the ProPlus.WW folder.

  2. Open Config.xml in a text editor, such as Notepad.

  3. Find the <Display> element. Uncomment the line by deleting the opening <!-- and closing --> tags.

  4. Set the value of the Level to "basic" or "none", CompletionNotice to "yes", SuppressModal to "yes", and AcceptEula to "yes".

    The line should resemble the following example:

    Copy code
    <Display Level="basic" CompletionNotice="yes" SuppressModal="yes" AcceptEula="yes" />

  5. Find the <AddLanguage> element. If it is in the file, comment out the line by adding opening <!-- and closing --> tags around the element.

    The line should resemble the following example:

    Copy code
    <!-- <AddLanguage Id="ru-ru" /> -->

  6. Add the <RemoveLanguage> element.

  7. Set the value of the Id attribute to the language tag that corresponds to the language that you want to remove.

    For example, to remove the Russian language pack, the line should resemble the following example:

    Copy code
    <RemoveLanguage Id="ru-ru" />

  8. Save the Config.xml file.

  9. If you edited the Config.xml file in the core product folder, run Setup.exe and specify the path of your modified Config.xml file.

    You must use a fully qualified path. For example:

    \\server\share\Office15\Setup.exe /Config\\server\share\Office15\ProPlus.WW\Config.xml

    where Office15 is the root of the network installation point.

    \\server\share\Office15\LP\Setup.exe /Config\\server\share\Office15\LP\RU\OMUI.ru-ru\Config.xml

    where Office15\LP is the root of the network installation point for the language packs and RU is the language folder name.

    You must complete the previous steps for each language that you want to remove.

Identify installed languages

In the registry, you can view a list of languages that are installed for Office 2013 either during the initial installation or during a separate installation of a language pack.

Although all applications in Office 2013 use a shared set of registry data to determine their UI language, they do not necessarily all appear in the same UI language. Applications in Office 2013 usually appear with the UI language indicated in the UILanguage value of this registry key. But there are circumstances where this might not be the case. For example, some deployments might have Word 2013 and Excel 2013 installed in French, but another Office 2013 application installed in a different language. In this case, the other application will look at the UIFallback list in this registry key, and use the first language that works with its installed configuration.

To identify installed languages

  1. Open the registry.

  2. Expand the registry key HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\LanguageResources\EnabledLanguages.

  3. The LCID for the language is displayed. To identify the language, see Language identifiers and OptionState Id values in Office 2013.

  4. To view the UI language, view the following registry key values and refer to Language identifiers and OptionState Id values in Office 2013.

    • HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\LanguageResources\HelpLanguage

    • HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\LanguageResources\UILanguage

  5. To view the fallback languages, view the registry key value for HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\LanguageResources\UIFallback. To identify the language, see Language identifiers and OptionState Id values in Office 2013.

See also

Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013
Language identifiers and OptionState Id values in Office 2013
Customize language setup and settings for Office 2013
Plan for multilanguage deployment of Office 2013

Import an Office 2010 Setup customization file


Language versions and language interface packs in Office 2013

Published: October 2, 2012

Summary: Learn about integrating multiple languages in Office 2013 and installing language interface packs.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

An installation of Office 2013 can include applications or user interface elements in more than one language because some Office 2013 products are not available in every language.

This article describes the language versions that are available for a subset of Office 2013 applications, the Office 2013 applications that will work with Language Interface Packs, and the recommended base languages to install for Office 2013 Language Interface Packs.

Important:

This article describes methods of deploying and managing language packs for the Windows Installer-based (MSI) delivery format of Office 2013, which is available for enterprise organizations through volume licensing. If you have an Office subscription and you are deploying Office 365 ProPlus (which uses the Click-to-Run delivery format), see Plan for multilanguage deployment of Click-to-Run-based Office installations.

In this article:

  • Applications and language availability

  • Language Interface Packs

Applications and language availability

In some non-English language versions of Office 2013, a specific Office 2013 application may not be available. For example, Access 2013 is not available in Hindi. Therefore, the Hindi language version of Office 2013 is installed in English.

Some Office applications are not available in some languages. Project 2013, Visio 2013, and SharePoint Designer 2013 are available in a subset of languages, as shown in the following table.

Language availability for the 2013 versions of Project, Visio, and SharePoint Designer

Language | Project 2013 | Visio 2013 | SharePoint Designer 2013
Arabic | yes | yes | yes
Brazilian | yes | yes | yes
Bulgarian | no | no | yes
Chinese - Simple | yes | yes | yes
Chinese - Traditional | yes | yes | yes
Croatian | no | no | yes
Czech | yes | yes | yes
Danish | yes | yes | yes
Dutch | yes | yes | yes
English | yes | yes | yes
Finnish | yes | yes | yes
French | yes | yes | yes
German | yes | yes | yes
Greek | yes | yes | yes
Hebrew | yes | yes | yes
Hindi | no | no | yes
Hungarian | yes | yes | yes
Italian | yes | yes | yes
Japanese | yes | yes | yes
Korean | yes | yes | yes
Norwegian (Bokmål) | yes | yes | yes
Polish | yes | yes | yes
Portuguese (European) | yes | yes | yes
Romanian | no | no | yes
Russian | yes | yes | yes
Serbian (Latin) | no | no | yes
Slovak | yes | yes | no
Slovenian | yes | yes | no
Spanish | yes | yes | yes
Swedish | yes | yes | yes
Thai | no | no | yes
Turkish | yes | yes | yes
Ukrainian | yes | yes | no

Language Interface Packs

For some languages, Microsoft localizes only some Office 2013 applications and releases them as Language Interface Packs (LIPs). These LIPs localize the user interface only, and not the Help content. Administrators must first install a fully localized base language version (see the table later in this section) of Office 2013, and then install the LIP. Users can then work in their preferred language in the following applications and features:

  • Excel 2013

  • OneNote 2013

  • Outlook 2013

  • PowerPoint 2013

  • Shared Office features

  • Word 2013

The remaining Office applications appear in the base Office 2013 installation language. The following table lists the base language for each LIP language.

Base languages available for Language Interface Packs

LIP language | Base language
Afrikaans | English
Albanian | English
Amharic | English
Armenian | English
Assamese | English
Azerbaijani - Latin script | English
Bangla (Bangladesh) | English
Basque | Spanish
Belarusian | Russian
Bengali - India | English or Hindi
Bosnian - Latin script | English
Catalan | Spanish
Cherokee | English
Dari | English
Filipino | English
Galician | Spanish
Georgian | English
Gujarati | English
Hausa - Latin script | English
Icelandic | English
Igbo | English
Inuktitut - Latin script | English
Irish - Gaelic | English
isiXhosa | English
isiZulu | English
Kannada | English
Khmer | English
Ki'che | Spanish
Kinyarwanda | English
Kiswahili | English
Konkani | English
Kurdish | English
Krygyz | Russian
Luxembourgish | French
Macedonian (FYROM) | English
Malayalam | English
Maltese | English
Maori | English
Marathi | English
Mongolian - Cyrillic script | English
Nepali | English
Norwegian (Nynorsk) | Norwegian (Bokmål)
Odia | English
Persian (Farsi) | English
Punjabi (India) | English
Punjabi (Pakistan) | English
Quechua (Peru) | Spanish
Scottish Gaelic | English
Serbian - Cyrillic script | Serbian (Latin)
Serbian - Cyrillic script (Bosnia and Herzegovina) | English
Sesotho sa Leboa | English
Setswana | English
Sindhi (Pakistan) | English
Sinhala | English
Tajik | Russian
Tamil (India) | English
Tatar | Russian
Telugu | English
Turkmen | Russian
Urdu | English
Uyghur | Chinese (Simplified)
Uzbek - Latin script | English or Russian
Valencian | Spanish
Welsh | English
Wolof | French
Yoruba | English

For information about how to download LIPs, see Office Language Interface Pack (LIP) downloads.

See also

Plan for multilanguage deployment of Office 2013
Customize language setup and settings for Office 2013


Companion proofing languages for Office 2013

Published: October 2, 2012

Summary: Identify the companion proofing languages that are included with Office 2013, and understand Downloadable proofing tool packages for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Each language version of Office 2013 includes proofing tools for a set of companion languages. For example, when you deploy the English version of an Office 2013 product, users receive proofing tools for both Spanish and French in addition to English.

Proofing tools include spelling and grammar checkers, thesauruses, and hyphenators. They might also include language-specific editing features such as Language AutoDetect, AutoSummarize, and Intelligent AutoCorrect.

Depending on the number of user interface languages that you want to deploy and the included companion proofing languages, Office 2013 Language Packs might provide all the proofing tools that you want. For more information about Office 2013 Language Packs, see Plan for multilanguage deployment of Office 2013.

Office 2013 also provides downloadable proofing tool packages for the English, Japanese, and Spanish versions of Office 2013. For more information, see Downloadable proofing tool packages later in this article.

Important:

This article describes methods to deploy and manage language packs for the Windows Installer-based (MSI) delivery format of Office 2013, which is available for enterprise organizations through volume licensing. If you have an Office subscription and you are deploying Office 365 ProPlus, which uses the Click-to-Run delivery format, see Plan for multilanguage deployment of Click-to-Run-based Office installations.

In this article:

  • Identify companion proofing languages

  • Downloadable proofing tool packages

Identify companion proofing languages

The following table lists companion proofing languages for each primary language in Office 2013.

Companion proofing languages for Office 2013

Primary language | Companion proofing languages
Arabic | Arabic, English, French
Brazilian | Brazilian, English, Spanish
Bulgarian | Bulgarian, English, German, Russian
Chinese (Simplified) | Chinese (Simplified), English
Chinese (Traditional) | Chinese (Traditional), English
Croatian | Croatian, English, German, Serbian, Italian
Czech | Czech, English, German, Slovak
Danish | Danish, English, German, Swedish
Dutch | Dutch, English, French, German
English | English, French, Spanish
Estonian | Estonian, English, German, Russian, Finnish,
Finnish | Finnish, English, Swedish, German, Russian
French | French, English, German, Dutch, Arabic, Spanish
German | German, English, French, Italian
Greek | Greek, English, French, German
Hebrew | Hebrew, English, French, Arabic, Russian
Hindi | Hindi, English, Tamil, Telegu, Marathi, Kannada, Guajarati, Punjabi, Urdu
Hungarian | Hungarian, English, German
Indonesian | Indonesian, English
Italian | Italian, English, French, German
Japanese | Japanese, English
Kazakh | Kazakh, English, Russian
Korean | Korean, English
Latvian | Latvian, English, German, Russian
Lithuanian | Lithuanian, English, German, Russian, Polish
Malay | Malay, English, Chinese (Simplified)
Norwegian (Bk) | Norwegian (Bk), English, German, Norwegian (Ny)
Polish | Polish, English, German
Portuguese | Portuguese, English, French, Spanish
Romanian | Romanian, English, French
Russian | Russian, English, Ukrainian, German
Serbian (Latin) | Serbian (Latin), English, German, French, Croatian
Slovak | Slovak, English, Czech, Hungarian, German
Slovenian | Slovenian, English, German, Italian, Croatian
Spanish | Spanish, English, French, Basque, Catalan, Galician, Brazilian
Swedish | Swedish, English, Finnish, German
Thai | Thai, English, French
Turkish | Turkish, English, French, German
Ukrainian | Ukrainian, English, Russian, German
Vietnamese | Vietnamese, English, French

Downloadable proofing tool packages

Beginning in Office 2013, free downloadable proofing tool packages in 52 languages are available to all customers who have purchased the on-premises (MSI-installed) version of Office 2013, whether or not they are volume license customers. You can download these proofing tool packages in 32-bit or 64-bit versions from Office Proofing Tools.

The following proofing languages are available:

  • Arabic

  • Basque

  • Brazilian

  • Bulgarian

  • Catalan

  • Chinese (Simplified)

  • Chinese (Traditional

  • Croatian

  • Czech

  • Danish

  • Dutch

  • English

  • Estonian

  • Finnish

  • French

  • Galician

  • German

  • Greek

  • Gujarati

  • Hebrew

  • Hindi

  • Hungarian

  • Indonesian

  • Italian

  • Japanese

  • Kannada

  • Kazakh

  • Korean

  • Latvian

  • Lithuanian

  • Malay (Malaysia)

  • Marathi

  • Norwegian (Bokmål)

  • Norwegian (Nynorsk)

  • Polish

  • Portuguese

  • Punjabi (India)

  • Romanian

  • Russian

  • Serbian - Cyrillic script

  • Serbian - Latin script

  • Slovak

  • Slovenian

  • Spanish

  • Swedish

  • Tamil (India)

  • Telugu

  • Thai

  • Turkish

  • Ukrianian

  • Urdu

  • Vietnamese

See also

Plan for multilanguage deployment of Office 2013
Customize language setup and settings for Office 2013


Language identifiers and OptionState Id values in Office 2013

Published: October 2, 2012

Summary: Find language identifier and OptionState ID values for identifying and customizing Office 2013 language and proofing tools installations.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Use the values in the Language Identifier and OptionState ID tables to configure Setup for Office 2013 or for the Office 2013 Proofing Tools Kit, or to identify currently installed languages.

This is a reference article. The values provided in the tables are necessary for completing procedures that are described in the following articles:

  • Add or remove language packs after deployment of Office 2013

  • Customize language setup and settings for Office 2013

  • Plan for multilanguage deployment of Office 2013

Important:

This article describes methods of deploying and managing language packs for the Windows Installer-based (MSI) delivery format of Office 2013, which is available for enterprise organizations through volume licensing. If you have an Office subscription and you are deploying Office 365 ProPlus, which uses the Click-to-Run delivery format, see Plan for multilanguage deployment of Click-to-Run-based Office installations.

In this article:

  • Language identifiers

  • Proofing Tools Config.xml OptionState Id values

Language identifiers

Office 2013 is available in many languages. In an international setting, you can deploy multiple language versions of Office 2013 in a single installation process. Setup combines a language-neutral core product with one or more language-specific packages to create a complete product.

On the source media, language-specific packages are organized into separate folders. Each folder name has a language tag appended to it, in the form ll-cc. That tag identifies the language and culture. For example, U.S. English language folders are identified by the folder name extension en-us. The language tags help you determine the folders that you have to copy to the network installation point.

The language folders that are included in a fully localized version of an Office 2013 product are the same as the language folders that are included in the Microsoft Office 2013 Language Pack for a specific language. For example, the same Outlook.ar-sa folder is used in the Arabic language version of Office 2013, the Arabic language version of Outlook 2013, and the Office 2013 Language Pack - Arabic.

Note:

Language tags are also referred to and used as "language IDs" for some procedures.

Office 2013 offers localized versions in all the languages that are listed in the following table. Folders for the language-specific components are identified by the language tag that is shown in the table. The Windows operating system uses locale identifiers (LCIDs) to identify languages in the Windows registry.

In addition to the fully localized languages listed here, Office 2013 provides Language Interface Packs (LIPs), which contain a subset of language-specific components and are designed to be installed together with a logical parent language. Elements that are not localized in the LIP language appear in the parent language. For more information about LIPs, see Language Interface Packs in Language versions and language interface packs in Office 2013.

Language tags (language IDs), and LCIDs available in Office 2013

Language | Geographic area | Language tag (ll-cc) (also sometimes referred to as language ID) | LCID
Arabic | Saudi Arabia | ar-sa | 1025
Bulgarian | Bulgaria | bg-bg | 1026
Chinese (Simplified) | People's Republic of China | zh-cn | 2052
Chinese | Taiwanese | zh-tw | 1028
Croatian | Croatia | hr-hr | 1050
Czech | Czech Republic | cs-cz | 1029
Danish | Denmark | da-dk | 1030
Dutch | Netherlands | nl-nl | 1043
English | United States | en-us | 1033
Estonian | Estonia | et-ee | 1061
Finnish | Finland | fi-fi | 1035
French | France | fr-fr | 1036
German | Germany | de-de | 1031
Greek | Greece | el-gr | 1032
Hebrew | Israel | he-il | 1037
Hindi | India | hi-in | 1081
Hungarian | Hungary | hu-hu | 1038
Indonesian | Indonesia | id-id | 1057
Italian | Italy | it-it | 1040
Japanese | Japan | ja-jp | 1041
Kazakh | Kazakhstan | kk-kh | 1087
Korean | Korea | ko-kr | 1042
Latvian | Latvia | lv-lv | 1062
Lithuanian | Lithuania | lt-lt | 1063
Malay | Malaysia | ms-my | 1086
Norwegian (Bokmål) | Norway | nb-no | 1044
Polish | Poland | pl-pl | 1045
Portuguese | Brazil | pt-br | 1046
Portuguese | Portugal | pt-pt | 2070
Romanian | Romania | ro-ro | 1048
Russian | Russia | ru-ru | 1049
Serbian (Latin) | Serbia | sr-latn-rs | 2074
Slovak | Slovakia | sk-sk | 1051
Slovenian | Slovenia | sl-si | 1060
Spanish | Spain | es-es | 3082
Swedish | Sweden | sv-se | 1053
Thai | Thailand | th-th | 1054
Turkish | Turkey | tr-tr | 1055
Ukrainian | Ukrainian | uk-ua | 1058
Vietnamese | Vietnam | vi-vn | 1066

Proofing Tools Config.xml OptionState Id values

The following table provides the OptionState ID values for the Office 2013 Proofing Tools Kit. It is ordered alphabetically by language. Use these values to modify the Config.xml file in the ProofKit.WW folder when you customize the Setup of the Office 2013 Proofing Tools Kit. For more information about proofing tools, see Plan for proofing tools in Plan for multilanguage deployment of Office 2013.

OptionState IDs for each Proofing Tools language in Office 2013

OptionState ID | Proofing tools language
ProofingTools_1025 | Arabic
ProofingTools_1069 | Basque
ProofingTools_1026 | Bulgarian
ProofingTools_1027 | Catalan
ProofingTools_2052 | Chinese (People's Republic of China)
ProofingTools_3076 | Chinese (Hong Kong)
ProofingTools_1028 | Chinese (Taiwan)
IMEMain_1028 | Chinese Traditional Input Method Editor (IME)
ProofingTools_1050 | Croatian
ProofingTools_1029 | Czech
ProofingTools_1030 | Danish
ProofingTools_1043 | Dutch
ProofingTools_1033 | English
ProofingTools_1061 | Estonian
ProofingTools_1035 | Finnish
ProofingTools_1036 | French
ProofingTools_1110 | Galician
ProofingTools_1031 | German
ProofingTools_1032 | Greek
ProofingTools_1095 | Gujarati
ProofingTools_1037 | Hebrew
ProofingTools_1081 | Hindi
ProofingTools_1038 | Hungarian
ProofingTools_1040 | Italian
ProofingTools_1041 | Japanese
IMEMain_1041 | Japanese IME
ProofingTools_1099 | Kannada
ProofingTools_1087 | Kazakh
ProofingTools_1042 | Korean
IMEMain_1042 | Korean IME
ProofingTools_1062 | Latvian
ProofingTools_1063 | Lithuanian
ProofingTools_1102 | Marathi
ProofingTools_1044 | Norwegian (Bokmål)
ProofingTools_2068 | Norwegian (Nynorsk)
IMEMain_2052 | Pinyin IME
ProofingTools_1045 | Polish
ProofingTools_1046 | Portuguese (Brazil)
ProofingTools_2070 | Portuguese (Portugal)
ProofingTools_1094 | Punjabi
ProofingTools_1048 | Romanian
ProofingTools_1049 | Russian
ProofingTools_2074 | Serbian (Latin)
ProofingTools_1051 | Slovak
ProofingTools_1060 | Slovenian
ProofingTools_3082 | Spanish
ProofingTools_1053 | Swedish
ProofingTools_1097 | Tamil
ProofingTools_1098 | Telugu
ProofingTools_1054 | Thai
ProofingTools_1055 | Turkish
ProofingTools_1058 | Ukrainian
ProofingTools_1056 | Urdu
Note:

Beginning in Office 2013, free downloadable proofing tool packages in 52 languages are available to all customers who have purchased the on-premises (MSI-installed) version of Office 2013, whether or not they are volume license customers. You can download these proofing tool packages in 32-bit or 64-bit versions from Office Proofing Tools. For more information, see Downloadable proofing tool packages in Companion proofing languages for Office 2013.

See also

Plan for multilanguage deployment of Office 2013
Customize language setup and settings for Office 2013
Language versions and language interface packs in Office 2013
Overview of Setup architecture for Office 2013


Identity, authentication, and authorization in Office 2013

Published: March 19, 2013

Summary: Contains a list of articles that will help you understand and plan for Information Rights Management and other identity and authorization requirements.

Applies to: Office 2013

Audience: IT Professionals

The Microsoft account or Organization ID that a user uses to sign in to Office determines what Office apps and documents are available to them, whether they are connecting from behind the corporate firewall or through the cloud. Information Rights Management (IRM) uses permissions and authorization as additional protection, to help prevent sensitive information from being printed, forwarded, or copied by unauthorized people within your organization.

Office 2013 logo The articles that are listed in the following table will help you with plan for identity, authentication, and authorization in Office 2013.

Office 2013 identity, authentication, and authorization articles on TechNet

Article | Description
Content roadmap for Office 2013 identity, authentication, and authorization | Provides a guide to identity and authorization content for IT Pros deploying Office 2013 and Office 365, including articles, blogs, and downloads.
Overview of identity, authentication, and authorization in Office 2013 | Provides about Office 2013 authorization, logon types, and using registry settings to determine which user identities are offered at user logon.
Plan Information Rights Management in Office 2013 | Provides information about how to use Information Rights Management (IRM) in Office 2013 to specify permissions for accessing and using sensitive documents and messages.
Configure Information Rights Management in Office 2013 | Provides information about how to turn on Information Rights Management (IRM), configure license caching, set email expiration, and deploy rights policy templates.
Plan password complexity settings for Office 2013 | Explains how to use the Office 2013 password settings to enforce password requirements.
Remove or reset file passwords in Office 2013 | Explains how to use the Office 2013 DocRecrypt tool to unlock password protected OOXML formatted Word, Excel, and PowerPoint files.


Content roadmap for Office 2013 identity, authentication, and authorization

Published: April 9, 2013

Summary: Provides a guide to identity and authorization content for IT Pros deploying Office 2013 and Office 365, including articles, blogs, and downloads.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Content roadmap for IT professionals (banner image)

Office 2013 has made a fundamental shift to be more user-based, meaning each user's content, resources, most-recently-used lists, settings, links to communities, and personalization now roam with them, whether they're using a desktop, tablet, smartphone, or even a shared or public computer. For the IT admin, user audit trails and compliance are also separated by identity.

The table below shows the resources available to help you plan and configure Office identity and authorization.

Content roadmap for Office 2013 identity and authorization

Getting started

Start here

The Microsoft account or Organization ID that a user logs in with determines what resources are available, both on-premises and in the cloud. To get an introduction, read an article about the identity and authorization methods used in Office 2013, or you can watch a video on the Office IT Pro Blog that explains how identity and authorization work.

If you prefer a more visual representation of identity and authorization concepts, you can view a poster online, or download it to your computer for offline viewing or printing.

Send mail about our documentation

Information Rights Management (IRM)

Information Rights Management (IRM) uses permissions and authorization to help prevent sensitive information from being printed, forwarded, or copied by unauthorized people. Get an introduction to IRM, plan for IRM in your organization, and then learn how to turn IRM on.

Security icon

Passwords

Strong passwords help ensure the security of Office documents that are encrypted with a password. As an IT pro, you can set requirements that all passwords be of a certain length and complexity.

If someone forgets a file password, or leaves your organization without informing you of an important password, you can now remove or reset file passwords thanks to the new escrow key capability in Office 2013.

Chat icon

Ask questions and provide feedback

If you have questions about identity and authorization in Office 365 or Office 365 ProPlus, feel free to ask them in the Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum on TechNet. Or, read blog posts about identity and authorization and leave comments in the Office IT Pro Blog.

See also

Content roadmap for Office 2013 compatibility
Content roadmap for Office 2013 security

Content roadmap for Office 365 ProPlus


Overview of identity, authentication, and authorization in Office 2013

Published: October 16, 2012

Summary: Describes Office 2013 authentication, logon types, and how to use registry settings to determine which user identities are offered at user logon.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Many of the sections in this article are based on the Identity and Authentication in Office 2013 poster, which you can view online or download from the Download Center.

Thumbnail of poster: Identity and Authentication

In the new Office, Office applications are used for both business and non-business activities. A person may use Excel to crunch Q2 widget sales numbers by day and crunch World Cup stats by night, or use Word to write product specifications by day and short stories by night. Because Office is a tool that is used by the same individual in two different roles, the new Office offers two identities with which users can log on to Office 2013:

  • A Microsoft account, which most people use for personal business

  • An organization ID that is assigned by Microsoft, which most people use when doing work for an organization, such as a business, charity, or school.

The credentials that are used to sign in are recognized as either personal or organizational. That sign-in identity becomes the user's "home realm" and determines which documents the user has access to on SharePoint, SkyDrive, or Office 365 Services for a specific session. Each unique sign in identity is saved in a most-recently used list so that it is easy to switch between identities without leaving the Office experience.

For additional convenience, users can choose to mount an online document service to their identities for easy access. For instance, a personal SkyDrive can be mounted to an organization identity so that personal documents can be accessed at work or school without ever switching identities. Also, when a user authenticates by using an identity, this authentication is valid for all Office applications, not just the application he or she signed in to.

The very good news is that all of this just works for users, by default, and out of the box.

Important:

This article is part of the Content roadmap for Office 2013 identity, authentication, and authorization for IT Professionals. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 identity.

Are you looking for help about individual Office 2013 applications? You can find this information by searching on Office.com.

In this article:

  • Office authentication protocols

  • Use registry settings to determine which ID types to offer a user at logon

  • Use a registry setting to prevent a user from connecting to Office 2013 resources on the Internet

  • Delete the Office Profile, and credentials, associated with a removed logon identity

Office authentication protocols

In Office 2010, users are authenticated by using Forms-Based Authentication (FBA), Windows Integrated Authentication (WIA), or Passport Server Side Include (SSI) Authentication, also known as "Passport Tweener." In Office 2013, you can still use FBA or WIA, but instead of SSI, we now use the new open standard, token-based Open Authorization 2.0 (OAuth 2.0). See the following table for an overview of the authentication protocols that you can use with Office, including Office 2013.

Office authentication protocols

Client Office version | Authentication protocol | Server
Office 2010, Office 2013 | Forms-Based Authentication (FBA). Forms based authentication uses client-side redirection to forward unauthenticated users to an HTML form where they can enter their credentials. After the credentials are validated, users are redirected to the resources that they requested. | SharePoint Online
Office 2010, Office 2013 | Windows Integrated Authentication (WIA). This is negotiated, as with the Kerberos protocol or NTLM. In this scenario, the operating system provides authentication. | SharePoint 2010, SharePoint 2013
Office 2010, Office 2013 | SSI, or Passport Tweener, Authentication. When a user provides Windows Live ID credentials or a Microsoft account, the Windows Live ID service returns a passport "ticket" that the client uses to access Windows Live services. | SkyDrive
Office 2013 | Open Authorization 2.0 (OAuth 2.0). OAuth 2.0 provides temporary, redirection-based authorization. A user or a web application that acts on behalf of a user can request authorization to temporarily access specified network resources from a resource owner. For more information, see OAuth 2.0. | SkyDrive
Office 2013 | Microsoft Online Services Sign-in Assistant. The Microsoft Online Services Sign-In Assistant provides end-user sign-in capabilities to Microsoft Online Services, such as Office 365. For more information about Microsoft Online Services Sign-in Assistant and the IT pro, see Microsoft Online Services Sign-In Assistant for IT Professionals RTW. The download is for distribution to managed client systems as part of an Office 365 client deployment, using System Center Configuration Manager (SCCM) or similar software distribution systems. | Office 365 Services (for SharePoint Online 2013, Excel Online 2013, and Lync Online 2013)

Logon types in Office 2013

Two logon types are supported when users sign in to Office 2013, a Microsoft account or an organization ID that is assigned by Microsoft.

Microsoft account (the user's individual account). This account, formerly known as Windows Live ID, is the credential that users use to authenticate with the Microsoft network and is frequently used for personal or non-business work, such as volunteer work. To create a Microsoft account, a user provides a user name and password, certain demographic information, and "account proofs," such as an alternative email address or phone number. For more information about the new Microsoft account, see What is a Microsoft account?.

An organization ID that is assigned by Microsoft / Office 365 account ID that is assigned by Microsoft. This account is created for business use. An Office 365 account can be one of three types: a pure Office 365 ID, an Active Directory ID, or an Active Directory Federation Services ID. These are described below:

  • Office 365 ID. This ID is created when an admin sets up an Office 365 domain and takes the form <user>@<org>.onmicrosoft.com, for example:

    sally@contoso.onmicrosoft.com

  • Organization ID that is assigned by Microsoft that is validated against a user's Active Directory ID. An organization ID that is assigned by Microsoft and validated against Active Directory as follows:

    1. First, a person who has an [on-premise domain]\<user> account attempts to access organization resources.

    2. Next, the resource requests authentication from the user.

    3. Then, the user types in their organization user name and password.

    4. Finally, that user name and password are validated against the organization AD database, the user is authenticated, and is given access to the requested resource.

  • An organization ID that is assigned by Microsoft that is validated against a user's Active Directory Federation Services ID. An organization ID that is assigned by Microsoft and validated against Active Directory Federation Services (ADFS) as follows:

    1. First, one person who has an org.onmicrosoft.com attempts to access partner organization resources.

    2. Then, the resource requests authentication from the user.

    3. Next, the user types in their organization user name and password.

    4. Then, that user name and password are validated against the organization AD database.

    5. Finally, that same user name and password are passed to the partner's federated AD database, the user is authenticated, and is given access to the requested resource.

For on-premises resources, Office 2013 uses the domain\alias user name for authentication. For federated resources, Office 2013 uses the alias@org.onmicrosoft.com user name for authentication.

Use registry settings to determine which ID types to offer a user at logon

By default, when a user attempts to access an Office 2013 resource, Office 2013 includes registry keys that are set to display a user's Microsoft account ID and the organization ID that is assigned by Microsoft. But, you can change this so that only the Microsoft account is displayed, or their organization ID, or neither. This setting is changed in the computer registry.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To change the Office 2013 logon types offered to the user

  1. From Registry Editor, browse to:

    HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\SignIn\SignInOptions

  2. Set the value of SignInOptions to one of the following:

    Office 2013 SignInOptions values

    SignInOptions value Value type Description

    0

    DWORD

    (Default) This displays both the user's Microsoft account ID and the organization ID that is assigned by Microsoft as their logon identity options.

    1

    DWORD

    This only displays their Microsoft account ID.

    2

    DWORD

    This only displays their organization ID.

    3

    DWORD

    This does not display either ID type. The user will be unable to log on. If you set SignInOptions to 3, and a user triggers the logon page, no ID types will be offered to the user. Instead, the message "Sign in has been disabled" is displayed.

Use a registry setting to prevent a user from connecting to Office 2013 resources on the Internet

By default, Office 2013 gives users access to Office 2013 files that reside on the Internet. You can change this setting so that a user can't see those resources.

To allow or prevent a user from connecting to Office 2013 Internet resources

  1. From Registry Editor, browse to:

    Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Internet\UseOnlineContent

  2. Set the value of UseOnlineContent to one of the following:

    Office 2013 UseOnlineContent values

    UseOnlineContent value Value type Description

    0

    DWORD

    Do not allow user to access Office 2013 resources on the Internet.

    1

    DWORD

    Allow user to opt in to access of Office 2013 resources on the Internet.

    2

    DWORD

    (Default) Allows the user to access Office 2013 resources on the Internet.

Delete the Office Profile, and credentials, associated with a removed logon identity

When a user logs into an Office app by using either their Microsoft account ID or their organization ID, a matching Office profile and credentials for that identity are created in the registry. The logon page gives the user the option of removing that identity, just under the "Not user name?" question near the user avatar or photo and name. If users choose to remove one of their identity options, it will be removed from the logon page. But, that corresponding Office profile and credentials will actually remain in the cache for a short time. If this is a security issue, such as when a user is fired from your organization, you should immediately delete that Office profile setting from the registry. To do that, browse to that user's Office profile in the registry, and delete it.

To delete an Office profile that may still be cached

  1. From Registry Editor, browse to:

    HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Identity\Identities

  2. Choose the Office profile that you want to delete, and then choose Delete.

  3. From the Identity hive, navigate to the Profiles node, choose that same identity, open the shortcut menu (right-click), and then choose Delete.

See also

Content roadmap for Office 2013 identity, authentication, and authorization

Security overview for Office 2013
What is a Microsoft account?
OAuth 2.0
Microsoft Online Services Sign-In Assistant for IT Professionals RTW


Plan Information Rights Management in Office 2013

Updated: May 7, 2013

Summary: Use Information Rights Management (IRM) in Office 2013 to specify permissions for accessing and using sensitive documents and messages.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

This article contains a summary of IRM technology and how it works in Office applications, together with links to more information about how to set up and install the required servers and software to implement IRM in Office 2013.

Important:

This article is part of the Content roadmap for Office 2013 identity, authentication, and authorization for IT Professionals. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 identity.

Are you looking for help about individual Office 2013 applications? You can find this information by searching on Office.com.

In this article:

  • IRM overview

  • How IRM works in Office 2013

  • Setting up IRM for Office 2013

  • Configuring IRM settings for Office 2013

  • Configuring IRM settings for Outlook 2013

IRM overview

Information Rights Management (IRM) is a persistent file-level technology from Microsoft. It uses permissions and authorization to help prevent sensitive information from being printed, forwarded, or copied by unauthorized people. After permission for a document or message is restricted by using this technology, the usage restrictions travel with the document or email message as part of the contents of the file.

Note:

The ability to create content or email messages that have restricted permission by using IRM is available in Office Professional Plus 2013, and in the stand-alone versions of Excel 2013, Outlook 2013, PowerPoint 2013, InfoPath 2013, and Word 2013. IRM content that is created in Office 2013 can be viewed in Office 2003, Office 2007, Office 2010, or Office 2013.

For more information about IRM and Active Directory Rights Management Services (AD RMS) features that are supported in Office 2013, Office 2010, Office 2007, and Office 2003, see AD RMS and Microsoft Office Deployment Considerations.

IRM support in Office 2013 helps organizations and knowledge workers address two fundamental needs:

  • Restricted permission for sensitive information IRM helps prevent sensitive information from unauthorized access and reuse. Organizations rely on firewalls, logon security-related measures, and other network technologies to help protect sensitive intellectual property. A basic limitation of using these technologies is that legitimate users who have access to the information can share it with unauthorized people. This could lead to a potential breach of security policies.

  • Information privacy, control, and integrity Information workers often work with confidential or sensitive information. By using IRM, employees do not have to depend on the discretion of other people to ensure that sensitive materials remain inside the company. IRM eliminates users' ability to forward, copy, or print confidential information by helping to disable those functions in documents and messages that use restricted permission.

For information technology (IT) managers, IRM helps enable the enforcement of existing corporate policies about document confidentiality, workflow, and email retention. For CEOs and security officers, IRM reduces the risk of having key company information fall into the hands of the wrong people, whether by accident, thoughtlessness, or malicious intent.

How IRM works in Office 2013

Office users apply permissions to messages or documents by using options on the ribbon; for example, by using the Restrict Editing command, under Info, Protect Document. The protection options that are available are based on permission policies that you customize for your organization. Permission policies are groups of IRM rights that you package together to apply as one policy. Office 2013 also provides several predefined groups of rights, such as Do Not Forward in Outlook 2013.

Note:

To IRM protect a document in Office 2013, you have to have an on-premises RMS server or Office 365 with RMS Online. You can still open IRM protected content created with a Microsoft Account in earlier versions of Office and edit those documents if you have permission, but you can't create new protected documents by using a Microsoft Account.

Using IRM with an RMS server

Enabling IRM in your organization typically requires access to a rights management server that runs Windows Rights Management Services (RMS) for Windows Server 2003, or Active Directory Rights Management Services (AD RMS) for Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. It is also possible to use IRM by using an individual's Microsoft account to authenticate permissions, as described later in this article. The permissions are enforced by using authentication, typically by using Active Directory directory service (AD DS). A Microsoft account can be used to authenticate and grant permission if Active Directory is not implemented.

Users do not have to have a Microsoft account to read protected documents and messages. For users who run Windows XP or earlier versions, the Excel viewer and Word viewer enable Windows users who have the correct permission to read some documents that have restricted permission, without using Office software. Users who run Windows XP or earlier versions can use Outlook Web App or the Rights Management Add-on for Internet Explorer to read email messages that have restricted permissions, without using Outlook software. This functionality is already available for users who run, Windows 7, Windows 8, Windows Vista Service Pack 1, Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012. The Active Directory Rights Management Services client software is included with these operating systems.

In Office 2013, organizations can create the permissions policies that appear in Office applications. For example, you might define a permission policy named Company Confidential, which specifies that documents or email messages that use the policy can only be opened by users inside the company domain. There is no limit to the number of permission policies that can be created.

Note:

SharePoint Foundation supports use of IRM on documents that are stored in document libraries. By using IRM, you can control which actions users can take on documents when they open them from libraries in SharePoint Foundation. This differs from IRM applied to documents stored on client computers, where the owner of a document can choose which rights to assign to each user of the document. For more information about how to use IRM with document libraries, see Document library planning (SharePoint Foundation 2010).

With AD RMS on Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012, users can share rights-protected documents between companies that have a federated trust relationship. For more information, see Active Directory Rights Management Services Overview and Federating AD RMS.

Also with AD RMS, Exchange Server 2012 offers IRM-protected email functionality including AD RMS protection for Unified Messaging voice mail messages and Outlook protection rules that can automatically apply IRM-protection to messages in Outlook 2013 before they leave the Outlook client. For more information, see What's New in Exchange 2013 and Understanding Information Rights Management.

For more information about Active Directory Rights Management Services.

Using IRM without a local RMS server

In a typical installation, Windows Server 2003 that is deployed with RMS or Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 that is deployed with AD RMS enables use of IRM permissions with Office 2013. If an RMS server is not configured on the same domain as the users, users' Microsoft accounts can be used to authenticate permission, instead of Active Directory. Users must have access to the Internet to connect to the Microsoft account servers.

You can use Microsoft accounts when you assign permissions to users who need access to the contents of a restricted file. When you use Microsoft accounts for authentication, each user must specifically be granted permission to a file. Groups of users cannot be assigned permission to access a file.

Setting up IRM for Office 2013

Applying IRM permissions to documents or email messages requires the following:

  • Access to RMS for Windows Server 2003, or AD RMS for Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012, to authenticate permissions. Or, authentication can be managed by using the Microsoft account service on the Internet.

  • Rights Management (RM) client software. RM client software is included in Windows Vista and later versions or available as an add-in for Windows XP and Windows Server 2003.

  • Microsoft Office 2003, 2007 Microsoft Office system, Office 2010, or Office 2013. Only specific versions of Office enable users to create IRM permissions.

Setting up RMS server access

Windows RMS or AD RMS manages licensing and other administrative server functions that work with IRM to provide rights management. An RMS-enabled client program, such as Office 2013, lets users create and view rights-protected content.

To learn more about how RMS works and how to install and configure an RMS server, see, Active Directory Rights Management Services.

Installing the Rights Management client software

RM client software is included in Windows Vista, Windows 7, and Windows 8. Separate installation and configuration of the necessary RMS client software is required on Windows XP and Windows Server 2003 to interact with RMS or AD RMS on the computer that is running Windows or the Microsoft account service on the Internet.

Download the RMS Client Service Pack to enable users on Windows XP and Windows Server 2003 to run applications that restrict permission based on RMS technologies.

Defining and deploying permissions policies for Office 2013

As in Office 2003, Office 2007 and Office 2010, Office 2013 includes predefined groups of rights that users can apply to documents and messages, such as Read and Change in Word 2013, Excel 2013, and PowerPoint 2013. You can also define custom IRM permissions policies to provide different packages of IRM rights for users in your organization.

You create and manage rights policy templates by using the administration site on your RMS or AD RMS server. For information about how to create, configure, and post custom permissions policy templates, see AD RMS Rights Policy Templates Deployment Step-by-Step Guide. For Exchange Server 2010Outlook protection rules, see Understanding Outlook Protection Rules.

The rights that you can include in permissions policy templates for Office 2013 are listed in the following sections.

Permissions rights

Each IRM permissions right that is listed in the following table can be enforced by Office 2013 applications that are configured on a network that includes a server that runs RMS or AD RMS.

IRM permissions rights

IRM right | Description
Full Control | Gives the user every right that is listed in this table, and the right to change permissions that are associated with content. Expiration does not apply to users who have Full Control.
View | Allows the user to open IRM content. This corresponds to Read Access in the Office 2013 user interface.
Edit | Allows the user to configure the IRM content.
Save | Allows the user to save a file.
Extract | Allows the user to make a copy of any part of a file and paste that part of the file into the work area of another application.
Export | Allows the user to save content in another file format by using the Save As command. Depending on the application that uses the file format that you select, the content might be saved without protection.
Print | Allows the user to print the contents of a file.
Allow Macros | Allows the user to run macros against the contents of a file.
Forward | Allows an email recipient to forward an IRM email message and to add or remove recipients from the To: and Cc: lines.
Reply | Allows email recipients to reply to an IRM email message.
Reply All | Allows email recipients to reply to all users on the To: and Cc: lines of an IRM email message.
View Rights | Gives the user permission to view the rights associated with a file. Office ignores this right.

Predefined groups of permissions

Office 2013 provides the following predefined groups of rights that users can choose from when they create IRM content. The options are available in the Permission dialog box for Word 2013, Excel 2013, and PowerPoint 2013. In the Office application, select the File tab, choose Info, choose the Protect Document button, select Restrict Access, and then choose from the options listed, which are populated by the Digital Rights Management server template. The following table lists the predefined permission groups.

Predefined read/change permissions groups

IRM predefined group | Description
Read | Users who have Read permission have View rights.
Change | Users who have Change permission have rights to View, Edit, Extract, and Save.

In Outlook 2013, users can select the following predefined group of rights when they create an email item. To access the option from the email item, choose File, Info, and then Set Permissions. Choose from the listed options, which are populated by the Digital Rights Management server template. The following table lists the predefined email permission groups.

Predefined "Do not forward" group

IRM predefined group | Description
Do Not Forward | In Outlook, the author of an IRM email message can apply Do Not Forward permission to users on the To:, Cc:, and Bcc: lines. This permission includes the View, Edit, Reply, and Reply All rights.

Advanced permissions

Other IRM permissions can be specified in Word 2013, Excel 2013, and PowerPoint 2013. From Info, Protect Document, choose Editing Restrictions. For even more restriction options, choose Restrict permission at the bottom of the Restrict Editing panel. For example, users can specify an expiration date, restrict other users from printing or copying content, and so on.

By default, Outlook enables messages to be viewed by a browser that supports Rights Management.

Deploying rights policy templates

When the rights policy templates are complete, post them to a server share where all users can access the templates or copy them to a local folder on the user's computer. The IRM policy settings that are available in the Office Group Policy template (Office15.admx) file can be configured to point to the location where the rights policy templates are stored (either locally or on an available server share). For information, see Office 2013 Administrative Template files (ADMX, ADML) and Office Customization Tool.

Configuring IRM settings for Office 2013

You can lock down many settings to customize IRM by using the Office Group Policy template (Office15.admx). You can also use the Office Customization Tool (OCT) to configure default settings, which enables users to configure the settings. In addition, there are IRM configuration options that can only be configured by using registry key settings.

Office 2013 IRM settings

The settings that you can configure for IRM in Group Policy and by using the OCT are listed in the following table. In Group Policy, these settings are under User Configuration\Administrative Templates\Microsoft Office 2013\Manage Restricted Permissions. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

IRM settings for Group Policy or the OCT

IRM option | Description
Active Directory time-out for querying one entry for group expansion | Specify the time-out value for querying an Active Directory entry when you expand a group.
Additional permissions request URL | Specify the location where a user can obtain more information about how to access the IRM content.
Allow users with earlier versions of Office to read with browsers… | Enable users without Office 2013 to view rights-that are managed content by using the Rights Management Add-in for Windows Internet Explorer.
Always expand groups in Office when restriction permission for documents | Group name is automatically expanded to display all the members of the group when users apply permissions to a document by selecting a group name in the Permission dialog box.
Always required users to connect to verify permission | Users who open a rights-managed Office document must connect to the Internet or local area network to confirm by RMS, or through their Microsoft account, that they have a valid IRM license.
Never allow users to specify groups when restricting permission for documents | Return an error when users select a group in the Permission dialog box: ''You cannot publish content to Distribution Lists. You may only specify email addresses for individual users.''
Prevent users from changing permission on rights managed content | If enabled, users can consume content that already includes IRM permissions, but cannot apply IRM permissions to new content nor configure the rights on a document.
Turn off Information Rights Management user interface | Disable all Rights Management-related options within the user interface of all Office applications.

For more information about how to customize these settings, see Configure Information Rights Management in Office 2013.

Office 2013 IRM registry key options

The settings that you can configure for IRM in the registry are listed in the following tables.

The following IRM registry settings are located in HKCU\Software\Microsoft\Office\15.0\Common\DRM.

IRM registry key options

Registry entry | Type | Value | Description
RequestPermission | DWORD | 1 = The box is checked. 0 = The box is cleared. | This registry key toggles the default value of the Users can request additional permissions from check box.
DoNotUseOutlookByDefault | DWORD | 0 = Outlook is used 1 = Outlook is not used | The Permission dialog box uses Outlook to validate email addresses that are entered in that dialog box. This causes an instance of Outlook to be started when restricting permissions. Disable the option by using this key.

The following IRM registry setting is located in HKCU\Software\Microsoft\Office\15.0\Common\DRM\LicenseServers. There is no corresponding Group Policy setting.

IRM registry setting for license servers

Registry entry | Type | Value | Description
LicenseServers | Key/Hive. Contains DWORD values that have the name of a license server. | Set to the server URL. If the value of the DWORD is 1, Office will not prompt to obtain a license, it will only get the license. If the value is zero or there is no registry entry for that server, Office prompts for a license. | Example: If 'http://contoso.com/_wmcs/licensing = 1' is a value for this setting, a user who tries to obtain a license from that server to open a rights-managed document will not be prompted for a license.

The following IRM registry setting is located in HKCU\Software\Microsoft\Office\15.0\Common\Security. There is no corresponding Group Policy setting.

IRM registry settings for security

Registry entry | Type | Value | Description
DRMEncryptProperty | DWORD | 1 = The file metadata is encrypted. 0 = The metadata is stored in plaintext. The default value is 0. | Specify whether to encrypt all metadata that is stored inside a rights-managed file.

For Open XML Formats (for example, docx, xlsx, pptx, and so on), users can decide to encrypt the Office metadata that is stored inside a rights-managed file. Users can encrypt all Office metadata. This includes hyperlink references, or leave content as not encrypted so other applications can access the data.

Users can choose to encrypt the metadata by setting a registry key. You can set a default option for users by deploying the registry setting. There is no option for encrypting some of the metadata: all metadata is encrypted or none is encrypted.

In addition, the DRMEncryptProperty registry setting does not determine whether non-Office client metadata storage, such as the storage that is created in SharePoint 2013, is encrypted.

This encryption choice does not apply to Microsoft Office 2003 or other previous file formats. Office 2013 handles earlier formats in the same manner as it does in Office 2007 and Microsoft Office 2003.

Configuring IRM settings for Outlook 2013

In Outlook 2013, users can create and send email messages that have restricted permission to help prevent messages from being forwarded, printed, or copied and pasted. Office 2013 documents, workbooks, and presentations that are attached to messages that have restricted permission are also automatically restricted.

As an Outlook administrator, you can configure several options for IRM email, such as disabling IRM or configuring local license caching.

The following IRM settings and features can be useful when you configure rights-managed email messaging:

  • Configure automatic license caching for IRM.

  • Help enforce an email message expiration period.

  • Do not use Outlook for validating email addresses for IRM permissions.

Note:

To disable IRM in Outlook, you must disable IRM for all Office applications. There is no separate option to disable IRM only in Outlook.

Outlook 2013 IRM settings

You can lock down most settings to customize IRM for Outlook by using the Outlook Group Policy template (Outlk15.admx) or the Office Group Policy template (Office15.admx). Or, you can configure default settings for most options by using the Office Customization Tool (OCT), which enables users to configure the settings. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Outlook IRM options

Location | IRM option | Description
Microsoft Outlook 2013\Miscellaneous | Do not download rights permissions license information for IRM email during Exchange folder sync | Enable to prevent license information from being cached locally. If enabled, users must connect to the network to retrieve license information to open rights-managed email messages.
Microsoft Outlook 2010\Outlook Options\Email Options\ Advanced Email Options | When sending a message | To enforce email expiration, enable and enter the number of days before a message expires. The expiration period is enforced only when users send rights-managed email and then the message cannot be accessed after the expiration period.

For more information about how to customize these settings, see Configure Information Rights Management in Office 2013.

Outlook 2013 IRM registry key options

The Permission dialog box uses Outlook to validate email addresses that are entered in that dialog box. This causes an instance of Outlook to start when permissions are restricted. You can disable this option by using the registry key that is listed in the following table. There is no corresponding Group Policy or OCT setting for this option.

The following IRM registry setting is located in HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\DRM.

Outlook IRM registry key options

Registry entry | Type | Value | Description
DoNotUseOutlookByDefault | DWORD | 0 = Outlook is used 1 = Outlook is not used | Disable the option by using this key.

See also

Content roadmap for Office 2013 identity, authentication, and authorization

Active Directory Rights Management Services
Understanding Information Rights Management
Plan document libraries (Windows SharePoint Services)

Change History

Date | Description
May 07, 2013 | Added an alert that you can no longer apply IRM by using a Microsoft Account.
October 16, 2012 | Initial publication


Configure Information Rights Management in Office 2013

Published: November 6, 2012

Summary: Learn how to turn on Information Rights Management (IRM), configure license caching, set email expiration, and deploy rights policy templates.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Users can restrict permission to content documents and email messages in Office 2013 by using Information Rights Management (IRM). You, the IT admin, can configure which IRM options are available to your organization by using Group Policy or the Office Customization Tool (OCT).

Important:

This article is part of the Content roadmap for Office 2013 identity, authentication, and authorization for IT Professionals. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 identity.

Are you looking for help about individual Office 2013 applications? You can find this information by searching on Office.com.

In this article:

  • Overview for configuring IRM in Office 2013

  • Before you begin

  • Turn off Information Rights Management in Office 2013

  • Configure automatic license caching for Outlook 2013

  • Enforce email expiration in Outlook 2013

  • Deploy IRM policy templates in Office 2010

Overview for configuring IRM in Office 2013

You can lock many settings to customize IRM by using the Office 2013 Administrative Template files (Office15.admx) and Outlook Group Policy template (Outlk15.admx). You can also use the Office Customization Tool (OCT) to configure default settings. This enables users to change the settings. The OCT settings are in corresponding locations on the Modify user settings page of the OCT. In addition, there are IRM configuration options that you can only configure by using registry key settings. For a list of IRM settings, see Plan Information Rights Management in Office 2013.

Note:

IRM settings are not configurable for OfficeClick-to-Run streaming and virtualization deployments.

In Outlook 2013, users can create and send email messages that have restricted permission to help prevent messages from being forwarded, printed, or copied and pasted. Office 2013 documents, workbooks, and presentations that are attached to messages that have restricted permission are also automatically restricted.

As an Outlook administrator, you can configure several options for IRM email, such as disabling IRM or configuring local license caching. You can also design custom IRM permissions for users, in addition to the default Do Not Forward permissions group. For more information, see Setting up IRM for Office 2013 in Plan Information Rights Management in Office 2013.

For information about how to manage IRM in Office for Mac, see the Information Rights Management in Office for Mac 2011 Deployment Guide.

Before you begin

Before you start deployment, review Plan Information Rights Management in Office 2013 to determine the settings that you might have to configure for IRM.

You can download the Office 2013 and Outlook 2013 templates from the Microsoft Download Center, Office 2013 Administrative Template files (ADMX, ADML) and Office Customization Tool. For more information about how to use the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

Turn off Information Rights Management in Office 2013

You can turn off IRM for all Office applications. To turn off IRM in Outlook 2013, you must turn off IRM for all Office applications. There is no separate option to turn off IRM only in Outlook.

To turn off IRM in Office 2013 by using Group Policy

  1. In Group Policy, load the Office 2013 template (Office15.admx) and locate User Configuration\Administrative Templates\Microsoft Office 2013\Manage Restricted Permissions.

  2. Choose Turn Off Information Rights Management User Interface.

  3. Choose Enabled.

  4. Choose OK.

Configure automatic license caching for Outlook 2013

By default, Outlook 2013 automatically downloads the IRM license for rights-managed email when Outlook synchronizes with Exchange Server. You can configure Outlook 2013 to prevent license information from being cached locally. This forces users to connect to the network to retrieve license information before they can open rights-managed email messages.

To disable automatic license caching for IRM by using Group Policy

  1. In Group Policy, load the Outlook 2013 template (Outlk15.admx) and locate User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous.

  2. Choose Do not download rights permission license information for IRM email during Exchange folder sync.

  3. Choose Enabled.

  4. Choose OK.

Enforce email expiration in Outlook 2013

You can also use IRM to help enforce an email expiration period that you configure for Outlook 2013. When a user specifies the number of days before an IRM-enabled message expires, the message cannot be accessed after the expiration period.

As an administrator, you can specify an expiration period for all Outlook email messages in your organization. The expiration period is enforced only when users send rights-managed email messages.

To configure an expiration period for email messages by using Group Policy in Outlook 2013

  1. In Group Policy, load the Outlook 2013 template (Outlk15.admx) and locate User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Email Options\Advanced Email Options.

  2. Choose When sending a message.

  3. Choose Enabled.

  4. In the Messages expire after (days) box, enter a number of days.

  5. Choose OK.

Deploy IRM policy templates in Office 2010

The IRM policy settings that are available in the Office Group Policy template (Office14.admx) can be configured to point to the location where the rights policy templates are stored (either locally or on an available server share).

To configure the IRM rights policy templates location in Group Policy

  1. In Group Policy, load the Office 2013 template (Office14.admx) and locate User Configuration\Administrative Templates\Microsoft Office 2010\Manage Restricted Permissions.

  2. Choose Specify Permission Policy Path.

  3. Choose Enabled.

  4. In the Enter path to policy templates for content permission box, type the full path of the IRM permission policy templates.

  5. Choose OK.

See also

Content roadmap for Office 2013 identity, authentication, and authorization
Plan Information Rights Management in Office 2013


Plan password complexity settings for Office 2013

Published: February 19, 2013

Summary Explains how to use the Office 2013 password settings to enforce password requirements.

Applies to: Office 365 ProPlus

Audience: IT Professionals

The Encrypt with Password feature in Excel 2013, PowerPoint 2013, and Word 2013 contains settings that enable you to enforce strong passwords, such as password length and complexity rules. By using these settings, you can require Office 2013 applications to enforce local password requirements or the domain-based requirements that are specified in the Password Policy settings in Group Policy.

Important:

This article is part of the Content roadmap for Office 2013 identity, authentication, and authorization for IT Professionals. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 identity.

Are you looking for help about individual Office 2013 applications? You can find this information by searching on Office.com.

In this article:

  • About planning password length and complexity settings

  • Enforce password length and complexity

  • Related password length and complexity settings

About planning password length and complexity settings

By default, there are no restrictions on password length or password complexity for the Encrypt with Password feature, which means that users can encrypt a document, presentation, or workbook without specifying a password. But, we recommend that organizations change this default setting and enforce password length and complexity to help to make sure that that strong passwords are used with the Encrypt with Password feature.

Many organizations enforce strong passwords for log on and authentication by using domain-based group policies. If this is the case, we recommend that the organization use the same password length and complexity requirements for the Encrypt with Password feature. For more information about strong passwords, including recommendations for determining password length and complexity, see Creating a Strong Password Policy.

Caution:

When you establish password policies, you must balance the need for strong security against the need to make the password policy easy for users to implement. If a password is forgotten or an employee leaves an organization without providing the passwords used to save and encrypt the data, the data is inaccessible until the correct password is available to decrypt the data.

Enforce password length and complexity

When you configure the password settings that Office 2013 provides to enforce password length and complexity, you have the option to use the settings that are included with Office 2013 or in combination with the password settings that are available in the domain-based Group Policy object. If you already enforce strong passwords for domain logon and authentication, we recommend that you configure the password length and complexity settings for Office 2013 the same as they are configured for the Password Policy Group Policy Object (GPO) for the domain.

The following password settings are included in Office 2013:

  • Set minimum password length

  • Set password rules level

  • Set password rules domain time-out

You can configure the Office 2013 password settings by using the Office Customization Tool (OCT) or the Office 2013 Administrative Templates for local or domain-based group policies. For information about how to configure security settings in the OCT and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

The following password settings are available for the Password Policy GPO:

  • Enforce password history

  • Maximum password age

  • Minimum password age

  • Minimum password length

  • Password must meet complexity requirements

  • Store passwords using reversible encryption

You can use Group Policy to configure the domain-based Password Policy settings. For more information, see Group Policy Settings Reference for Windows and Windows Server.

The Set password rules level setting in Office 2013 determines the password complexity requirements and whether the Password Policy Group Policy object for the domain is used.

To enforce password length and complexity for the Encrypt with Password feature, determine the following:

  • The minimum password length that you want to enforce locally.

  • The password rules level.

  • The password time-out value for domain-based password enforcement. This is an optional task. You should consider setting a password time-out if both of the following are true:

    • There is a custom password filter installed on your domain controller

    • Contacting the domain controller takes longer than the default 4 seconds

Determine minimum password length requirement

To enforce password length and complexity, first determine the minimum password length that you want to enforce locally. The Set minimum password length setting lets you do this. When you enable this setting, you can specify a password length between 0 and 255. But, specifying a minimum password length doesn't enforce password length. To enforce password length or complexity, you must change the Set password rules level setting, which is discussed in the following section.

Caution:

When you establish password policies, you must balance the need for strong security against the need to make the password policy easy for users to implement. If a password is forgotten or an employee leaves an organization without providing the passwords used to save and encrypt the data, the data is inaccessible until the correct password is available to decrypt the data.

Determine the password rules level

After you set a minimum password length for local enforcement, you must determine the rules by which password length and complexity are enforced. The Set password rules level setting lets you do this. When you enable this setting, you can select one of the following four levels:

  • No password checks Password length and complexity isn't enforced. This is the same as the default configuration.

  • Local length check Password length is enforced but not password complexity. In addition, password length is enforced only on a local basis according to the password length requirement that is specified in the Set minimum password length setting.

  • Local length and complexity checks Password length is enforced on a local basis according to the password length requirement that is specified in the Set minimum password length setting. Password complexity is also enforced on a local basis, which means that passwords must contain characters from at least three of the following character sets:

    • Lowercase a-z

    • Uppercase A-Z

    • Digits 0-9

    • Non-alphabetical characters

    This setting works only if you specify a password length of at least six characters in the Set minimum password length setting.

  • Local length, local complexity, and domain policy checks Password length and complexity is enforced according to the domain-based Password Policy settings that are set in Group Policy. If a computer is offline or can't contact a domain controller, the local password length and complexity requirements are enforced exactly as they are described for the Local length and complexity checks setting.

If you want to enforce password length and password complexity by using domain-based settings, you must configure Password Policy settings in Group Policy. Domain-based enforcement has several advantages over local enforcement. Some of the advantages include the following:

  • Password length and complexity requirements are the same for log on and authentication as they are for the Encrypt with Password feature.

  • Password length and complexity requirements are enforced the same way throughout the organization.

  • Password length and complexity requirements can be enforced differently according to organizational units, sites, and domains.

To learn more about enforcing password length and complexity by using domain-based Group Policy, see Enforcing strong password usage throughout your organization.

Determine domain time-out value

If you use domain-based Group Policy settings to enforce password length and complexity for the Encrypt with Password feature and there is a custom password filter installed on your domain controller, you might have to configure the Set password rules domain time-out setting. The domain time-out value determines how long an Office 2013 application waits for a response from a domain controller before it uses the local password length and complexity settings for enforcement. You can use the Set password rules domain time-out setting to change the domain time-out value. By default, the time-out value is 4000 millisecond (4 seconds), which means that an Office 2013 application will use local password length and complexity settings for enforcement if a domain controller doesn't respond within 4000 milliseconds.

Note:

The domain time-out value has no effect unless you enable the Set minimum password length setting, enable the Set password rules level setting, and then select the Local length, local complexity, and domain policy checks option.

Related password length and complexity settings

The following settings are often used when an organization enforces password length and complexity:

  • Cryptographic agility settings These settings let you specify the cryptographic providers and algorithms that are used to encrypt documents, presentations, and workbooks.

Note:

For the latest information about policy settings, refer to the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 identity, authentication, and authorization
Overview of security in Office 2013
Configure security by using OCT or Group Policy for Office 2013


Remove or reset file passwords in Office 2013

Published: January 22, 2013

Summary: Explains how to use the Office 2013 DocRecrypt tool to unlock password protected OOXML formatted Word, Excel, and PowerPoint files.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Use Group Policy to push registry changes that associate a certificate with password-protected documents. This certificate information is embedded in the file header. Later, if the password is forgotten or lost, use the DocRecrypt command line tool and the private key to unlock the file and, optionally, assign a new password.

Important:

This article is part of the Content roadmap for Office 2013 identity, authentication, and authorization for IT Professionals. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 identity.

Are you looking for help about individual Office 2013 applications? You can find this information by searching on Office.com.

In this article

  • Overview: removing or resetting a file password in Office 2013 using the DocRecrypt tool

  • Set up client computers for password protection removal

  • Set up the IT admin computer that has the key and DocRecrypt tool

  • Use the Office DocRecrypt tool

Overview: removing or resetting a file password in Office 2013 using the DocRecrypt tool

There are many reasons why users may want or have to password protect a Word, Excel, or PowerPoint document. For example:

  • Multiple people in an immediate organization want to work on a group budget, but don't want those numbers to be visible to the greater organization until they are finished.

  • Consultants work with clients who require, through a service level agreement, that their sensitive data remain protected when it leaves client control.

  • Teachers want to make sure tests that are created in Word cannot be compromised.

  • Media professionals, and scientists who work on presentations to key researchers in their fields, want to make sure their breakthroughs do not leak to the public before their major announcements.

Previously, if the original creator of a file password either forgot the password or left the organization, the file was rendered unrecoverable. By using Office 2013 and an escrow key, which is generated from your company or organization's private key certificate store, an IT admin can "unlock" the file for a user and then either leave the file without password protection, or assign a new password to the file. You, the IT admin, are the keeper of the escrow key which is generated from your company or organization's private key certificate store. You can silently push the public key information to client computers one time through a registry key setting that you can manually create or you can create it through a Group Policy script. When a user later creates a password-protected Office 2013Word, Excel, or PowerPoint file, this public key is included in the file header. Later, an IT pro can use the Office DocRecrypt tool to remove the password that is attached to the file, and then, optionally, protect the file by using a new password. To do this, the IT pro must have all the following:

  • The new Office DocRecrypt tool

  • The Word, Excel, or PowerPoint file that has an embedded public key

  • Permission and access to public and private keys that are associated with the certificate

Keep the private key safe

This feature does not prescribe a corporate process for managing and distributing a private key, where that key is stored, any permissions and authorization that are required to request that a password be cracked or reset, or where the file should be located after it is restored. These decisions should be guided by your organization's standards and processes.

That said, to maintain a high level of security on password-protected files, we recommend that your organization adopt these policies:

  • Never push the private key to a client computer! This is our most important recommendation.

  • Lock the certificate store that has the private key and the certificate that was used to generate the escrow key and public keys.

  • Make sure that no single individual can compromise public key infrastructure (PKI) services. Also, we recommend that you distribute certificate management roles across different people in your organization.

If you do not follow these recommendations consistently, the security of all new password-protected files can be compromised. Your company or organization should already have a well-defined Active Directory Certificate Services (AD CS) administration model and certification authority (CA) infrastructure strategy that includes, for example, off-site storage of the private key and certificates. For more information, see Implement Role-Based Administration.

Note:

There are no special requirements regarding the type of certificate you use for DocRecrypt. The certificate can be a regular user certificate with User Authentication as the intended purpose. The main goal of the certificate is to be able to encrypt the document.

How is the correct certificate located?

Because many private key certificates may be located on an IT computer, it's fair to wonder how the correct certificate can be discovered. In Certificate Manager (certmgr.msc), the Office 2013 DocRecrypt tool first searches the Logical store, then the Current User store. In each of these stores, the tool first searches through the certificates that do not require a Windows System enforcement PIN. Then, it searches those that do require one.

Special considerations

Open Office XML files only The Office DocRecrypt tool only works on Office Open XML format documents such as docx, pptx, and xlsx files.

Other ways to protect Word, Excel, and PowerPoint files For other ways to protect Word, Excel, and PowerPoint files, see Protect your document, workbook, or presentation with passwords, permission, and other restrictions.

Be aware that users can independently apply any of these protection methods. If a password is removed by an IT admin, any other protection settings will remain. Removing the password does not affect these other settings.

There are some factors that may affect your ability to remove the password on a file. For details and advice, see the following table.

Considerations when removing the password on a file

Issue | Advice
File is marked as read-only or hidden. | The Office DocRecrypt tool does not work on files that are marked as read-only or hidden. But, you can remove the setting, decrypt the file, and then set it back to Read-only or Hidden after the search.
File is stored in multiple places. | The Office DocRecrypt tool only removes password protection on the specific instance of the file that you reference. But, you should remove password-protection on files referenced on RAID or other hard disk configurations also.
File is located in a shared workbook. | The Office DocRecrypt tool does not work on co-authored files that contain embedded files.
File is digitally signed. | Removing the password protection from a digitally signed file doesn't compromise the validity of the digital signature.
Filename begins with a hyphen ("-"). | If the name of the file that you want to search by using the Office DocRecrypt tool contains a hyphen, enclose the file name in quotation marks.
Requestor doesn't have permissions to open the file. | The IT admin determines whether the person who requests that a file be decrypted actually has the authority to view the contents of the file when the password is removed or reassigned. Similarly, if a password-protected file has an access control list associated with it, the decryption process removes the association. You must reinstate it afterward.
File or destination location is read-only. | Make sure that both the password-protected file and the destination location are read/write.
Certificate was revoked or is expired. | Your IT department must make sure that your private key certificates are valid and up-to-date. Also, be aware that the Office DocRecrypt tool does not check for private key certificate revocation status.
Password-protected file is located in the cloud. | The file must be copied to a hard disk or a read/write UNC share before it can be decrypted.

Set up client computers for password protection removal

To enable your IT department to remove a password from a password-protected Word, PowerPoint, or Excel file, when you deploy Office 2013 to your organization, you must first push the certificate public keys and do some registry work on the client computers. There are two ways to achieve this:

  • Through a Group Policy Administrative template, which is the best choice for multiple or enterprise client computers, or

  • By manually changing a client computer's registry, which is the best choice for a single computer or a few client computers.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To set up multiple client computers for password protection by using a group policy object

  1. Download the Group Policy Administrative template (ADMX/ADML), which is available in the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool

  2. Open the template in the Local Group Policy Editor and navigate to the escrow key settings. Open the User Configuration branch, then choose Administrative Templates, Microsoft Office 2013, Security Settings, and then Escrow Certificates.

    20 escrow keys are available to configure, each named Escrow Key #n.

  3. Select an escrow key, and then from the shortcut menu (right-click), choose Edit to configure an escrow key.

    The Escrow Key #n dialog appears.

  4. To set up and enable this key, select the Enabled button. If you want to disable this key later, return to Escrow Key #n dialog box and select the Disabled button.

  5. In the Certificate Hash box, enter the certificate hash that is used as the certificate unique identifier, also known as a "thumbprint." For example, if your certificate thumbprint is 9131517191121d94d143117fc126213c1781d21c, set the certificate hash value to that number. This hash can include spaces if you want to make it more readable.

  6. Enter a comment to provide more details about this particular certificate, if it is necessary. This is optional.

  7. Choose OK.

For more information about the templates, the Office Customization Tool, Group Policy, and Group Policy startup scripts, see the following topics:

  • Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool

  • Use Group Policy to enforce Office 2010 settings

  • Deploy Office 2010 by using Group Policy computer startup scripts

To set up a single client computer for password protection with new registry settings

To be able to remove a password from a Word, PowerPoint, or Excel file, you must create a registry key to indicate the public key certificates that you want to make available for password protecting files.

Note:

For specific directions about how to create a registry key, refer to the Help that is available from the Registry Editor (regedit.exe) Help menu.

  1. In Registry Editor, create a key in the client computer registry in the following registry path:

    Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0 \common\Security\Crypto\EscrowCerts

    Create this new key either manually or through a .reg batch file. To create a .reg file by using regedit.exe, see Creating a .reg File.

    Create a key in the client computer registry

    Registry element Description

    Key Name

    This must be EscrowCerts.

    Data Type

    key

    Parent

    Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\ common\Security\Crypto\

  2. In the new key that you created in step 1, add public key certificate information as shown in the following table. Create one entry for each public key certificate that you want to make available for password protecting files.

    Add public key certificate information

    Registry element Description

    Key Name

    Unique user-defined name that describes the public key certificate. For example, EscrowCert01, EscrowCert02, and so on.

    Type

    STRING

    Value

    The hash that is used as the certificate unique identifier, also known as a "thumbprint" in the Windows Certificate dialog box. For example, if your certificate thumbprint is 9131517191121d94d143117fc126213c1781d21c, set this value to that number. This hash can include spaces if you want to make it more readable.

  3. When the registry entries are in place, push the certificate to the client computer. The public key certificate should be stored in Windows Certificate Manager (certmgr.msc) in the Certificates - Current User or Logical, Personal store. For details about pushing public key certificates to client computers through Group Policy, see Distribute Certificates to Client Computers by Using Group Policy.

    Important:

    The IT admin must make sure that the certificate that was used for this process is valid and has not expired.

When users decide to password protect the files that they create in Office 2013Word, PowerPoint, or Excel, the appropriate public key information is saved in the file header. The administrator can use this public key and matching private key later if asked to remove the password protection.

Set up the IT admin computer that has the key and DocRecrypt tool

The IT admin computer does not have to have key and subkey in the registry, nor does it have to have a copy of the public key certificate. But, the IT admin computer does need the following:

  • The matching private key/certificate pair

  • The Office DocRecrypt tool

To set up the IT computer

  1. Use the Certificate Import Wizard to import the matching private key to the certificate in the Windows Certificate Manager.

  2. Download and install the Office DocRecrypt tool. This tool is available in the Microsoft Download Center.

    When you install the Office DocRecrypt tool on a 64-bit computer, it is installed in the following location:

    • %programfiles(x86)%\Microsoft Office\DOCRECRYPT

    When you install the Office DocRecrypt tool on a 32-bit computer, it is installed in the following location:

    • %programfiles%\Microsoft Office\DOCRECRYPT

That's it. All the pieces are in place and you are ready to remove the password on a Word, Excel, or PowerPoint file the next time that a user asks you to do it.

Use the Office DocRecrypt tool

Use the DocRecrypt tool, which is now installed on the IT admin computer, to remove the file password and assign a new password.

Note:

When files are decrypted, they are stored in memory. They are never stored on disk and never stored in a temporary directory.

To use the DocRecrypt tool

Follow these instructions to use the DocRecrypt tool from the command line. You can also run DocRecrypt commands silently from a batch file or script.

  • Navigate to and open the Office DocRecrypt tool command line by using the following syntax:

    DocRecrypt [-p <new_password>] -i <inputfile_or_folder> [-o <outputfile_or_folder>] [-q]

    The DocRecrypt tool options are described in the following table.

    DocRecrypt tool options

    Parameter Description

    -p <new_password>

    (Optional) This is the new password that will be assigned to the input file, or the output file if an output file name is supplied.

    -i <inputfile_or_folder>

    This is the file or folder that contains files that are locked because the password is unknown. If you specify a folder, the Office DocRecrypt tool will ignore any files that are not Office Open XML format.

    -o <outputfile_or_folder>

    (Optional) This is the name of a new output file or folder for files that will be created from the input files. Again, any files that are not Office Open XML format are ignored.

    -q

    (Optional) Indicates that you want to run the Office DocRecrypt tool in quiet mode, usually in a script. Quiet mode does not show a UI and it fails if a certificate requires the IT admin to enter a PIN. If your certificate requires a PIN, do not use quiet mode.

    For example:

    To remove the password from a file, use this code:

    DocRecrypt -i lockedfile

    To remove the password and assign a new password of 12345, use this code:

    DocRecrypt -p 12345 -i lockedfile

    To remove the password, create a new file, and assign a new password of 12345 to that file, use this code:

    DocRecrypt -p 12345 -i lockedfile -o newfile

See also

Content roadmap for Office 2013 identity, authentication, and authorization

DocRecrypt tool on the Microsoft Download Center


Secure Office 2013

Updated: March 19, 2013

Summary: Lists and describes articles that will help you work with the security controls that are available in Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

New security controls are available in Office 2013 to help you plan a robust defense against threats while maintaining information worker productivity.

An organization's success often depends on the productivity of its information workers and the integrity and confidentiality of its intellectual property. Many IT departments find it difficult to satisfy these business needs because protection often comes at the expense of productivity.

Office 2013 logo The articles that are listed in the following table describe the security controls that are available in Office 2013.

Office 2013 security articles on TechNet

Article | Description
Content roadmap for Office 2013 security | Provides a guide to security-related articles, blogs, and downloads for IT pros deploying Office 2013.
Overview of security in Office 2013 | Provides information about new security features in Office 2013: authentication, identity, Web App Catalog, and extension, escrow key, and more.
Compare security features in Office 365 and Office 2013 SKUs | Provides information that makes it easy for IT professionals to see which security features are in which SKUs, The information applies to both Office 365 and Office 2013.
Understand security threats and countermeasures for Office 2013 | Explains how Office 2013 security features can mitigate risks and threats to your organization's Office assets, documents, and processes.
Configure security by using OCT or Group Policy for Office 2013 | Provides information about how to configure Office security by using the Office Customization Tool (OCT), Administrative Templates and Group Policy, or the Trust Center.
Protection settings for Office 2013 | Contains articles that will help you plan the protection settings that you will need when you deploy Office 2013.
Trust Center settings for Office 2013 | Contains articles that will help you plan and configure the Trust Center settings for Office 2013.

Change History

Date | Description
March 19, 2013 | Added the articles, "Content roadmap for Office 2013 security," Protection settings in Office 2013," and "Trust Center settings in Office 2013."
February 19, 2013 | Added links to and descriptions of four new articles.
February 5, 2013 | Initial publication


Content roadmap for Office 2013 security

Published: March 19, 2013

Summary: Provides a guide to security-related articles, blogs, and downloads for IT pros deploying Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Content roadmap for IT professionals (banner image)

The following table describes resources that are available to IT Professionals who are assessing Office security.

Office 2013 security roadmap for IT pros

Getting started

Start here

Office 2013 provides many security features to help safeguard your organization's intellectual property. To get started, check out the security overview and learn about security threats and countermeasures.

If you're deciding whether to deploy one of the cloud-based Office 365 SKUs or on-premises Office 2013, you can compare the security features for each Office SKU, and you can also download a white paper about security in Office 365 for more details.

123 steps

Configure security using Group Policy and OCT

IT pros can configure Office security by using the Office Customization Tool (OCT), Administrative Templates and Group Policy, or the Trust Center.

If your organization includes Macs, you can also deploy security preferences for Mac 2011.

Behind the scenes icon

Protect Office file integrity

Protection settings help you choose encryption methods, enable digital signatures, and decide which types of COM objects are allowed to run.

  • Learn about cryptography and encryption settings available in Office 2013, such as which settings affect compatibility with earlier versions of Office.

  • Use digital signature settings to enable XAdES digital signatures in Office documents.

  • Use file block settings to prevent users from opening specific file format types.

  • Use COM object categorization to prevent certain types of COM objects from running while allowing others.

Behind the scenes icon

Use Trust Center settings to guard against external threats

Trust Center settings let you minimize the threats posed by add-ins, VBA macros, ActiveX controls and other content from sources you haven't granted trusted status to.

You can also use Protected View settings to control the behavior of the sandbox preview, a feature that lets you open and examine files in a restricted environment before you enable all content.

Use Trusted Locations settings and Trusted Publishers settings to grant trusted status to specific folders and people so that trust doesn't have to be granted explicitly every time a document is opened.

Security icon

Opt out of the Microsoft Customer Experience Improvement Program

The Microsoft Customer Experience Improvement Program (CEIP) automatically sends information to Microsoft about how you use certain products. Microsoft uses the data to resolve problems and improve its products and features. Participation is voluntary, and no personal information is collected about the user. But, you can opt out of the Customer Experience Improvement Program if you want.

For more information about Microsoft privacy policies, see the Privacy Statement for Microsoft Office 2013.

Downloads

Downloads

Here are the downloads that are related to Office security:

  • DocRecrypt tool (See Remove or reset file passwords in Office 2013 for more information)

  • Security in Office 365 white paper

Stack of books

Reference

  • Privacy Statement for Microsoft Office 2013

  • Microsoft Office Personalized Experience Program

  • Microsoft Customer Experience Improvement Program

Chat icon

Ask questions and provide feedback

If you have questions about how to configure security in Office 365 or Office 365 ProPlus, feel free to ask them in the Office 2013 and Office 365 ProPlus - Planning, Deployment, and Compatibility forum on TechNet. Or, read blog posts about the security features and leave comments in the Office IT Pro Blog.

See also

Content roadmap for Office 2013 identity, authentication, and authorization
Content roadmap for Office 2013 compatibility

Content roadmap for Office 365 ProPlus


Overview of security in Office 2013

Published: July 16, 2012

Summary: Describes new security features of Office 2013: authentication, identity, Web app catalog and extension, escrow key, and more.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 includes new authentication functionality. Now users create a profile, sign in one time, and then seamlessly work on and access local and cloud Office files without re-identifying themselves. Users can connect multiple services, such as an organization's SkyDrive or a user's personal SkyDrive account, to their Office profile. After that, they'll have instant access to all their files and associated storage. Users authenticate one time for all Office apps including SkyDrive. This is true regardless of the identity provider, whether the Microsoft account or the user ID that you use to access Office 365, or the authentication protocol that is used by the app. Protocols include, for example, OAuth, forms based, claims based, and Windows Integrated Authentication. From a user perspective, it all just works. From the IT perspective, these connected services can easily be managed.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

Authentication and Identity in Office 2013

Protection starts with authentication and identity. By using this release, Office makes a fundamental change from computer centered identity and authentication to user centered identity and authentication. This shift enables content, resources, most-recently-used lists, settings, links to communities, and personalization to roam seamlessly with users as they move from desktop, to tablet, to smartphone, or to a shared or public computer. For the IT admin, user audit trails and compliance are also separated by identity.

In this new environment, users sign in to Office 365 by using one of these identities:

  • Their Microsoft-managed, organization-owned, user ID. For Office 365 business use, where Microsoft hosted enterprise and smaller organization user IDs are stored in the cloud. This scenario also supports multiple linked user IDs and single sign on.

    —or—

    Their federated, org-owned user ID. For Office 365 business use, where enterprise user IDs are stored on premises).

  • Their Windows Live ID. Typically, users use this identity to sign in to Office 365 for non-business purposes. Users can have multiple Windows Live IDs that are linked and then sign in one time, get authenticated, and then switch from one Windows Live ID to another during the same session. They don't have to be re-authenticated.

From an IT admin's perspective, Active Directory is at the heart of this new paradigm. IT admins can do the following:

  • Control user password policies across devices and services

  • Use Group Policies to configure the operating environment

  • Manage with Forefront Identity Manager (FIM) or Active Directory Federation Services (ADFS)

The cloud makes it all possible:

  • User accounts can be cloud-managed by using a web portal Setup is simple. You can provision users manually for greatest control. No servers are required. Microsoft manages all that for you.

  • Any on-premises directories are Active Directory synchronized to the web portal Provisioning can be automated and can co-exist with the cloud managed accounts.

  • Users have single-sign-on capability by using ADFS Provisioning can be automated, and multi-factor authentication is supported.

As shown in the following figure, when identity and authentication are handled completely in the cloud without affinity to any on-premises Active Directory store, IT admins can still provision or de-provision IDs and user access to services through a management portal or PowerShell cmdlets.

Figure: Office 365 identity and authentication managed completely in the cloud—without local Active Directory interaction.

Cloud managed identity and authentication.

The next figure shows identity provisioning by using the Microsoft Online Directory Synchronization service. Authentication is managed in the cloud.

Figure: Identity provisioning populated by using the Microsoft Online Directory Synchronization service. This is cloud managed authentication.

Identity provisioning using Online Directory Sync.

The following figure shows the addition of federated authentication through Active Directory Federation Server 2.0 for large organizations.

Figure: Identity provisioning that is populated by using the Microsoft Online Directory Synchronization service; Active Directory Federation Server 2.0 and cloud managed authentication.

Identity provisioning with ADFS 2.0.

In the user experience, identity is surfaced when the user signs in.

The client user interface At the start of each session, a user can choose to connect either to their personal cloud by using their Microsoft account, or to their on-premises corporate server or Microsoft-managed cloud for services such as Office 365 and for their documents, pictures, or other data.

If a user chooses to connect by using their Windows Live ID, they sign in by using their by using their Microsoft account (formerly called Passport or Windows Live ID) or they can choose to connect by using the user ID they use to access Office 365.

After they are signed in, that user is also free to switch identities at any time from the Backstage of any Office app.

The client infrastructure Behind the scenes, client authentication APIs enable users to sign in and out and switch the active user identity. More APIs keep track of roaming settings (preferences and most-recently-used documents) and the services available to each identity.

Other cloud identity services Users are automatically logged into these native services:

  • SkyDrive, for a Microsoft account sign on, or SharePoint Online for a corporate identity)

  • Roaming most-recently-used files and settings

  • Personalization

  • Microsoft account activities

Users can also log on to third-party cloud services after they sign in by using a Microsoft account. For example, if they sign in to LinkedIn or Facebook, the connection will roam with that identity.

Use Group Policy settings to control desktops configurations

With more than 4,000 Group Policy control objects at your disposal, you can use Group Policy to mandate user settings for Office.This means that you can create a range of lightly-managed to highly-restricted desktop configurations for your users. Your Group Policy settings always have precedence over Office Customization Tool (OCT) settings. You can also use Group Policy settings to disable particular file formats that are not secure over the network.

A word about Microsoft Data Centers

The Microsoft Data Center Security Program is risk-based and multi-dimensional. It takes people, processes, and technology into consideration. The Privacy Program makes sure that consistent global standard "high bar" privacy practices are followed for data handling and data transfer. The Microsoft data centers are also physically secure. All 700,000+ square feet and tens of thousands of servers are guarded 24 hours a day, 7 days a week. If there is a power failure, days of ancillary power are available. These data centers are geographically redundant and located in North America, Europe, and Asia.

Office 365 never scans your email messages or documents to build analytics, mine data, advertise, or improve our own service. Your data always belongs completely to you or your company and you can remove it from our data center servers at any time

Office 365 complies with the following important and business essential industry standards:

  • ISO 27001 certified Office 365 meets or exceeds the rigorous set of physical, logical, process, and management controls defined by ISO/TEC 27001:2005.

  • EU model clauses Office 365 is compliant with and able to sign standard contractual clauses that relate to the EU model clauses and EU Safe Harbor framework.

  • HIPAA-Business Associate Agreement Office 365 can sign requirements for HIPAA with all customers. HIPAA governs the use, disclosure, and safeguarding of protected health information.

Catalogs and web Extensions

Office 2013 includes a new extensibility model for Office clients that enables web developers to create apps for Office, which are web extensions that use the power of the web to extend Office clients. An app for Office is a region inside an Office application that contains a web page that can interact with the document to augment content and provide new interactive content types and functionality. apps for Office can be obtained by users from the new Office marketplace or from a private catalog in the form of stand-alone apps or subcomponents of a document template solution, or a SharePoint application.

In the Trust Center, under Trusted App Catalogs, you can control apps for Office, including the following:

  • Disabling all apps

  • Disabling apps from the Office Store only

  • Adding or removing trusted catalogs from the Trusted Catalogs Table

Reset a document's password with an escrow key and the new DocRecrypt tool

Office 2013 provides a new escrow key capability. This allows the IT admin of an organization to decrypt password-protected documents by using a private escrow key. For example, if a document was encrypted by using Word, Excel, or PowerPoint and the original owner of the document has either forgotten the password or has left the organization, it would be possible for the IT admin to retrieve the data by using the private escrow key.

The escrow key capability only works with files that are saved and encrypted by using next generation cryptography. This is the default encryption that is used in Office 2010 and Office 2013. If, for compatibility reasons, the default behavior was changed to use the legacy format, escrow key functionality will not be available. For details about this new feature, see Remove or reset file passwords in Office 2013.

Digital signatures

Improvements to digital signatures in Office 2013 include the following:

  • Support for Open Document Format (ODF v1.2) file formats

  • Enhancements to XAdES (XML Advanced Electronic Signatures)

Support for ODF v1.2 file formats enables people to digitally sign ODF documents in Office 2013 by using invisible digital signatures. These digitally-signed documents do not support signature lines or stamps. In addition, Office 2013 provides digital signature verification of ODF documents that are signed from inside other applications but that are opened in Office 2013.

XAdES improvements in Office 2013 include an improved user experience when creating an XAdES digital signature. Users are given more detailed information about the signature.

Information Rights Management (IRM)

Office 2013 includes a new IRM client, which has a new UI to help simplify identity selection. It also supports automatic service discovery of Rights Management Services (RMS) servers. In addition, Office 2013 has read-only IRM support for Microsoft Office Web Application Companions (WACs). WACs can view IRM-protected documents in a SharePoint library or IRM-protected documents that are attached to messages in Outlook Web Access (OWA).

Protected view

Office 2013 provides an improved protected view, a "sandbox" technology, when Office 2013 is used with Windows 2012 as the operating system. Office 2013 uses the Windows 2012 AppContainer feature, which provides stronger process isolation and also blocks network access from the sandbox. Protected view was introduced in Office 2010. Protected view helps reduce exploits to computers by opening files in a restricted environment, referred to as a lowbox, so that they can be examined before they are opened for editing in Excel, PowerPoint, or Word.

Office 2013, Designed with security top of mind—from the beginning

At Microsoft, security is considered during every step of the software life-cycle. Every employee who contributes to an Office feature or product is required to take security training and continue to learn as the industry and threats evolve. When designing a feature or product, the team is required to consider user data security and privacy from the beginning, and how threats to these can be reduced by using encryption or authentication or other methods. Their decisions are based on the environment, expected or potential exposure, and data sensitivity. The team performs multiple attack surface reviews and creates an incident response plan before an Office product is ever released.

Microsoft doesn't just rely on employees to make sure user data is safe. It also uses tools and automated quality assurance tests. These fall into three general categories:

  • Functional testing where every piece of the user interface is verified to make sure that user input, output, and action is as intended and advertised.

  • Fuzz testing where large amounts of random or unexpected data are injected into the software to reveal security problems. Fuzz testing was a big part of the Office 2007 release and continues to be with this latest release.

  • For web applications dynamic or web scanning tools are used to test for potential security bugs like cross-site scripting (XSS) or SQL injection.

The testing never stops. The Microsoft Security Response Center (MSRC) is responsible for handling security issues that are uncovered after a product has released. This team can quickly mobilize and deliver swift fixes to customers.

A quick review of security progress over the last several Office releases

Security controls that were introduced in Office XP, Office 2003, Office 2007, and Office 2010 reduced attacks, improved the user experience, hardened, and reduced the attack surface, and made it easier for IT admins to build a robust defense against threats while maintaining user productivity. Here's how:

Introduction of the following features has mitigated attacks on Office:

  • Protected view

  • Document flow protection

  • Patch management

  • Cryptographic agility

The following features have improved the user experience:

  • The Trust Center and message bar, trusted locations, trusted publishers, and sticky trust decisions

  • Actionable security prompts

  • Improvements to the Encrypt with Password feature

  • Document Inspector

  • XML file format support

Office has hardened the attack surface through the following features:

  • Data Execution Prevention (DEP) support

  • Group Policy enforcement

  • Trusted time-stamping support for digital signatures

  • Domain-based password complexity checking and enforcement

  • Encryption-strengthening improvements

  • CryptoAPI suppor

Office has reduced the attack surface through the following features:

  • Office file validation

  • Expanded file block settings

  • ActiveX control security

  • ActiveX "kill bit"

  • Integrity checking of encrypted files

  • Macro security levels

More on file fuzzing

File fuzzing is used to identify previously unknown vulnerabilities in various file formats. The Office team has fuzzed millions of files tens of millions of times and discovered, and fixed, hundreds of vulnerabilities.

More on Data Execution Prevention

This hardware and software technology, which was built into Windows and extended to all Office applications starting with Office 2010, identifies files that attempt to run code in reserved memory. This protection is always on for 64-bit versions, and is configurable by using Group Policy settings in 32-bit versions. If rogue code is detected, the affected application shuts down automatically.

More on Protected View

Protected view, which enables safe viewing of suspicious files, was introduced in Office 2010. Now, with the Windows 2012 AppContainer, which is restricted from network access, process isolation is further improved.

See also

Content roadmap for Office 2013 security
Overview of identity, authentication, and authorization in Office 2013
Compare security features in Office 365 and Office 2013 SKUs
Plan Information Rights Management in Office 2013
Plan digital signature settings for Office 2013


Compare security features in Office 365 and Office 2013 SKUs

Updated: March 12, 2013

Summary: Compares the security features that are available in the Office 365 and Office 2013 SKUs.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

This article gives you a quick way to see which SKUs provide specific security features. It covers both the cloud-based Office 365 SKUs and the on-premises Office 2013. For Office 365 customers, the physical and logical security of your organization's business data is ensured, whether you use the cloud for all or just part of your data storage. This includes:

  • Office application streaming through Click-to-Run virtualization technology

  • Identity and access management through Windows Azure Active Directory or Windows Azure Active Directory Federated Service (including in a hybrid on-premises/cloud scenario)

For details, download the Security in Office 365 white paper.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

Office 365 Professional Plus and Office 2013 security features by SKU

The following table will help you determine which Office SKUs support the security features that are important to your organization.

Office security features by SKU

SKU | Information Rights Management (IRM) | Support for blocking cloud-based file storage | Compliance and archiving | Group Policy support | Office Add-in, ActiveX, and Internet Explorer Browser Help Object support
Office 365 Small Business | No | No | No | No | No
Office 365 Small Business Premium | No | No | No | No | Yes
Office 365 Midsize Business | Yes (Customers can open and read, but cannot create IRM-protected documents.) | Yes | No | Yes | Yes
Office 365 Enterprise (E1), Government (G1), Education (A2) | Yes (Customers can open and read, but cannot create IRM-protected documents.) | No | No | No | No
Office 365 Enterprise (E3 or E4), Government (G3 or G4), Education (A3 or A4) | Yes (Windows Azure Rights Management Service is not available for Government (G3 or G4) customers.) | Yes | Yes | Yes | Yes
Office 365 Kiosk (K1) | Yes (Customers can open and read, but cannot create IRM-protected documents.) | No | No | No | No
Office 365 ProPlus | Yes | Yes | Yes | Yes | Yes
Office Professional Plus 2013 | Yes (Requires an on-premises Rights Management Service (RMS) server.) | Yes | Yes | Yes | Yes

See also

Content roadmap for Office 2013 security
Secure Office 2013

Content roadmap for Office 365 ProPlus
Security in Office 365 white paper

Change History

Date | Description
March 12, 2013 | Updated some service descriptions and added some caveats.
December 18, 2012 | Initial publication


Understand security threats and countermeasures for Office 2013

Published: February 5, 2013

Summary: Explains how Office 2013 security features can mitigate risks and threats to your organization's Office assets, documents, and processes.

Applies to: Office

Audience: IT Professionals

A secure desktop configuration is an important part of any organization's defense-in-depth strategy. This article begins with a short overview of the various general security risks and vulnerabilities to your organization's business documents and assets, and then outlines the security features that are available in Office 2010 and Office 2013 and that can help mitigate these threats. Be sure to review these settings to determine which default and optional Office security features your organization should use.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Information security risks

  • Threats to desktop productivity applications

  • Default security mitigations in Office 2013

Information security risks

Most IT professionals and IT security specialists categorize information security risks into three broad categories:

  • Confidentiality risks These risks represent threats to an organization's intellectual property. They come from unauthorized users and from malicious code that can attempt to access what is said, written, and created in an organization.

  • Integrity risks These risks represent threats to your business resources. They come from unauthorized users and from malicious code that can attempt to corrupt the business data that your organization relies on. Integrity risks jeopardize any business asset that contains critical information for an organization, such as database servers, data files, and email servers.

  • Availability risks These risks represent threats to business processes. They come from unauthorized users and from malicious code that can attempt to disrupt the way that you do business and the way users complete their work. Business intelligence processes, application features and capabilities, and document workflow processes can all be threatened by availability risks.

To help make sure that your organization is protected from all three of these risk categories, we recommend a defense-in-depth security strategy. This strategy should include multiple overlapping layers of defense against unauthorized users and malicious code. Layers typically include the following:

  • Perimeter network protection, such as firewalls and proxy servers.

  • Physical security measures, such as physically secure data centers and server rooms.

  • Desktop security tools, such as personal firewalls, virus scanning programs, and spyware detection.

By default, the Office 2013 security model helps an organization mitigate all three kinds of risk. But, every organization has different infrastructure capabilities, different productivity demands, and different desktop security requirements. To determine exactly how your organization can mitigate these business risks, you have to evaluate the threats and vulnerabilities that exploit these risks.

Threats to desktop productivity applications

The security model for Office 2013, as with Office 2010, helps you mitigate five kinds of productivity software security threats. Each of these threat types include vulnerabilities that can be exploited by various security attacks. The following illustration shows the security threats and examples of the most common threat agents.

Security threat types

Most organizations face some potential risk from these security threats. But, most organizations also deal with unique combinations of vulnerabilities and potential security attacks or exploits. Therefore, it is important to understand the risks and map a mitigation plan that fits your organization.

Default security mitigations in Office 2013

Office 2013 provides many countermeasures that help mitigate threats to your business assets and business processes. A countermeasure is a security feature or a security control that mitigates one or more security threats. You can usually change the behavior of countermeasures by configuring settings in the Office Customization Tool (OCT) or through Group Policy by using the Office 2013Administrative Templates.

Many of the countermeasures in Office 2013 mitigate a specific kind of threat in one particular application. For example, InfoPath 2013 includes a countermeasure that warns users about the possible presence of web beacons in forms. You can change the behavior of this countermeasure by configuring the Beaconing UI for forms opened in InfoPath setting in the OCT or through Group Policy.

Other countermeasures mitigate broader kinds of threats that are common to several applications. For example, the Protected View feature enables users to view the content of untrusted documents, presentations, and workbooks without enabling unsafe content or malicious code to harm the computer. This countermeasure is used by Excel 2013, PowerPoint 2013, Word 2013, and Outlook 2013 when you preview attachments for Excel 2013, PowerPoint 2013, Visio 2013, and Word 2013. You can change its behavior by configuring several settings in the OCT or through Group Policy. For details, see the Plan Protected View settings for Office 2013 article.

The following sections describe the most frequently used countermeasures in Office 2013.

ActiveX control settings in Office 2013

You can use ActiveX control settings to disable ActiveX controls and change the way ActiveX controls are loaded into Office 2013 applications. By default, trusted ActiveX controls are loaded in safe mode with persistent values and users aren't notified that the ActiveX controls are loaded. Untrusted ActiveX controls load differently, depending on how the ActiveX control is marked and whether a VBA project exists in the file together with the ActiveX control. The default behavior of untrusted ActiveX controls is as follows:

  • If an ActiveX control is marked Safe for Initialization (SFI) and it is contained in a document that does not contain a VBA project, the ActiveX control is loaded in safe mode with persistent values. The Message Bar does not appear and users aren't notified about the presence of the ActiveX control. All ActiveX controls in the document must be marked SFI for this behavior to occur.

  • If an ActiveX control is marked Unsafe for Initialization (UFI) and it is contained in a document that does not contain a VBA project, users are notified in the Message Bar that ActiveX controls are disabled. But, users can select the Message Bar to enable ActiveX controls. If a user enables ActiveX controls, all ActiveX controls (those marked UFI and SFI) are loaded in safe mode with persistent values.

  • If an ActiveX control marked UFI or SFI is contained in a document that also contains a VBA project, users are notified in the Message Bar that ActiveX controls are disabled. But, users can select the Message Bar to enable ActiveX controls. If a user enables ActiveX controls, all ActiveX controls (those marked SFI and UFI) are loaded in safe mode with persistent values.

Important:

If a kill bit is set in the registry for an ActiveX control, the control isn't loaded and can't be loaded in any circumstance. The Message Bar does not appear and users aren't notified about the presence of the ActiveX control. If you want to learn much more about the broader subject of kill bits, see the three-part TechNet blog The Kill-Bit FAQ.

To change the default behavior of ActiveX controls, see Plan security settings for ActiveX controls for Office 2013.

Office 2013 Add-in settings

You can use add-in settings to disable add-ins, require add-ins be signed by a trusted publisher, and disable notifications for add-ins. By default, installed and registered add-ins can run without requiring user intervention or warning. To change this default behavior, see Plan security settings for add-ins for Office 2013.

Control user access to apps for Office 2013

Use Group Policy or the Trust Center to restrict or deny access for users in your organization to the apps from the Office Store or your corporate catalog of apps for Office. These apps for Office are web extensions that extend Office client applications to enhance Office content and provide new interactive content types and functionality.

Office 2013 document recovery after lost/forgotten password

Security precautions, such as password protection for a document or spreadsheet, work well, until the owner forgets the password or leaves the company. Now the IT admin, can set up an organization's client computers to include certificate metadata in these Office password-protected documents. Later, if the password is lost or forgotten, you can use the DocRecrypt tool to either remove or change the password on the document. See the article Remove or reset file passwords in Office 2013 for detailed information.

Digital signature settings in Office 2013

You can use the digital signature settings in the OCT to configure the XML Advanced Electronic Signature (XAdES) level of the signature. By default, Office 2013 creates an XAdES-Explicit Policy Electronic Signature (EPES) signature. An IT admin can also restrict signing certificates by the issuer name. IT admins can also configure which hashing algorithms and public key sizes are allowed in valid digital signatures. Configure these settings in the OCT tool. See the article Plan digital signature settings for Office 2013 for detailed information.

External content settings in Office 2013

You can use external content settings to change the way Office 2013 applications access external content. External content is any kind of content that is accessed remotely, such as data connections and workbook links, hyperlinks to web sites and documents, and links to images and media. By default, when a user opens a file that contains links to external content, the Message Bar notifies the user that the links are disabled. Users can enable the links by clicking or tapping the Message Bar. We recommend that you not change these default settings. For more information about blocking or unblocking external content in Office documents, see Block or unblock external content in Office documents.

File Block settings in Office 2013

You can use File Block settings to prevent specific file types from being opened or saved. You can also use these settings to prevent certain file types from opening in Protected View or force certain file types to open in Protected View. By default, Excel 2013, PowerPoint 2013, and Word 2013 force several kinds of files to open only in Protected View. Users can't open these file types for editing. For details, see Plan file block settings for Office 2013.

Office File Validation settings in Office 2013

You can use Office File Validation settings to disable the Office File Validation feature and change how the Office File Validation feature handles files that don't pass validation. You can also use these settings to prevent the Office File Validation feature from prompting users to send validation information to Microsoft. By default, the Office File Validation feature is enabled. Files that don't pass validation are opened in Protected View and users can edit files after they are opened in Protected View. For more information about Office File Validation settings, see Plan Office File Validation settings for Office 2013.

Password complexity settings in Office 2013

You can use password complexity settings to enforce password length and complexity for passwords that are used with the Encrypt with Password feature. Password complexity settings let you enforce password length and complexity at the domain level if the organization has established password complexity rules through domain-based Group Policy. Or, you can do this at a local level if the organization has not implemented domain-based password complexity Group Policy. By default, Office 2013 applications don't check password length or complexity when a user encrypts a file by using the Encrypt with Password feature. See the article Plan password complexity settings for Office 2013 for detailed information.

Privacy options in Office 2013

You can use privacy options to prevent the Welcome to Microsoft Office 2013 dialog box from appearing the first time that a user starts Office 2013. This dialog box lets users enroll in various Internet-based services that help protect and improve Office 2013 applications. You can also use privacy options to enable the Internet-based services that appear in the Welcome to Microsoft Office 2013 dialog box. By default, the Welcome to Microsoft Office 2013 dialog box appears when a user starts Office 2013 for the first time, and users can enable the recommended Internet-based services, enable a subset of these services, or make no configuration changes. If a user makes no configuration changes, the following default settings take effect:

  • Office 2013 applications do not download small programs that help diagnose problems and error message information isn't sent to Microsoft.

  • Users aren't enrolled in the Customer Experience Improvement Program.

To change this default behavior, or to suppress the Welcome to Microsoft Office 2013 dialog box, see Plan privacy options for Office 2013.

Protected View settings in Office 2013

You can use Protected View settings to prevent files from opening in Protected View and force files to open in Protected View. You can also specify whether you want scripts and programs that run in Session 0 to open in Protected View. By default, Protected View is enabled and all untrusted files open in Protected View. Scripts and programs that run in Session 0 don't open in Protected View.

Also, improvements to Protected View include a new "sandbox" technology when Office 2013 is used with Windows 8 as the operating system. As part of these improvements, Protected View now works in RunAs or remoteApp scenarios in Windows 8.

For more information about Protected View settings, see Plan Protected View settings for Office 2013.

Note:

You can also use File Block settings to prevent or force specific file types from opening in Protected View.

Trusted Documents settings in Office 2013

You can use Trusted Documents settings to disable the Trusted Documents feature and prevent users from trusting documents that are stored on network shares. Trusted documents bypass most security checks when they are opened and all active content is enabled. Note that antivirus checking and ActiveX kill-bit checking are the two checks that can't be bypassed. By default, the Trusted Documents feature is enabled, which means users can designate safe files as trusted documents. In addition, users can designate files on network shares as trusted documents. We recommend that you not change these default settings.

Trusted Locations settings in Office 2013

You can use Trusted Locations settings to designate safe locations for files. Files that are stored in trusted locations bypass most security checks when they are opened and all content in the file is enabled (antivirus checking and ActiveX kill bit checking are the two checks that can't be bypassed). By default, several locations are designated as trusted locations. Also, trusted locations that are on a network, such as shared folders, are disabled. To change this default behavior, and discover which locations are designated as trusted locations by default, see Plan and configure Trusted Locations settings for Office 2013.

Trusted Publishers settings in Office 2013

You can use Trusted Publishers settings to designate certain kinds of active content as being safe, such as ActiveX controls, add-ins, and VBA macros. When a publisher signs active content with a digital certificate, and you add the publisher's digital certificate to the Trusted Publishers list, the active content is considered trusted. By default, there are no publishers on the Trusted Publishers list. You must add publishers to the Trusted Publishers list to implement this security feature. To implement the Trusted Publishers feature, see Plan and configure Trusted Publishers settings for Office 2013.

VBA macro settings in Office 2013

You can use VBA macro settings to change the way VBA macros behave, disable VBA, and change the way VBA macros behave in applications that are started programmatically. By default, VBA is enabled and trusted VBA macros can run without notification. Trusted VBA macros include VBA macros that are signed by a trusted publisher, stored in a trusted document, or stored in a document that is in a trusted location. Untrusted VBA macros are disabled, but a notification in the Message Bar lets users enable untrusted VBA macros. In addition, VBA macros can run in applications that are started programmatically.

To change this default behavior, see Plan security settings for VBA macros for Office 2013.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Plan file block settings for Office 2013
Plan privacy options for Office 2013
Plan Office File Validation settings for Office 2013
Plan Protected View settings for Office 2013
Plan security settings for add-ins for Office 2013
Plan security settings for ActiveX controls for Office 2013
Plan security settings for VBA macros for Office 2013
Plan and configure Trusted Locations settings for Office 2013
Plan and configure Trusted Publishers settings for Office 2013
Overview of security and protection settings for Outlook 2013
Configure junk email settings in Outlook 2013


Configure security by using OCT or Group Policy for Office 2013

Published: November 6, 2012

Summary: Configure Office security by using the Office Customization Tool (OCT), Administrative Templates and Group Policy, or the Trust Center.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

You can configure security settings for enterprise .MSI deployment by using the Office Customization Tool (OCT), and by using the Office 2013 Administrative Template files together with Group Policy. You can also configure some security settings in the Trust Center, which can be accessed through the user interface of every Office 2013 application. However, from an administration and deployment standpoint, Trust Center settings are useful only for troubleshooting installation and configuration problems on individual computers. You can't use the Trust Center to deploy or centrally manage security settings.

Note:

Security settings are not configurable for Click-to-Run streaming and virtualization deployments.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Office 2013 security process overview

  • Before you begin the Office 2013 security process

  • Configure Office 2013 security settings by using the OCT

  • Configure Office 2013 security settings by using Group Policy

Office 2013 security process overview

When you use the OCT to configure security settings, the settings are not permanent. The OCT establishes the initial value for the setting. After Office 2013 is installed, users can use the Trust Center to configure some, but not all, security settings. If you must enforce and prevent users from changing security settings, use Group Policy.

For information about how to manage security for Office for Mac, see Deploy Office for Mac 2011 security preferences.

Before you begin the Office 2013 security process

Before you configure security settings, review the following information about planning, permissions, and tool requirements.

Plan security settings for Office 2013

You must follow these steps in the security planning process before you configure security settings:

  • Read Overview of security in Office 2013. This article describes the new security architecture in Office 2013 and explains how the new security features work together to help provide a layered defense. We recommend that you do not change any security settings until you understand how all of the security features work.

  • Read Understand security threats and countermeasures for Office 2013. This article describes the security risks and threats that are relevant to Office 2013. This article also helps you determine which of those security risks and threats poses a risk to the business assets or processes of your organization.

Review the required permissions to configure security

The following table lists the administrative credentials that are required to configure security settings by using various deployment and administration tools.

Required security settings administrative credentials

To perform these actions… | You must be a member of these groups
Run the OCT. | Administrators group on the local computer
Configure local Group Policy settings by using the Local Group Policy Editor. | Administrators group on the local computer
Configure domain-based Group Policy settings by using the Group Policy Management Console. | Domain Admins, Enterprise Admins, or Group Policy Creator Owners group

Security configuration tool prerequisites

You can use several different tools to configure security settings. Before you use these tools, make sure that you have met the following prerequisites:

  • You understand how to use the OCT to customize Office 2013. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013 and Customization overview for Office 2013.

  • You have created a network installation point from which you can run the OCT. For more information about network installation points, see Deploy Office 2013 from a network installation point.

  • You understand how to use the Office 2013 Administrative Template files. For more information about Administrative Templates, see Overview of Group Policy for Office 2013.

  • You have loaded the Group Policy Office 2013 Administrative Templates to the central store, or to the Local Group Policy editor, depending on whether you plan to configure just one computer or multiple computers on the domain.

The OCT is available only with volume licensed versions of Office 2013 and the 2007 Microsoft Office system. To determine whether an Office 2013 installation is a volume licensed version, check the Office 2013 installation disk to see whether it contains a folder named Admin. If the Admin folder exists, the disk is a volume license edition. If the Admin folder does not exist, the disk is a retail edition.

Configure Office 2013 security settings by using the OCT

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

The following procedure shows how to use the OCT to configure security settings.

To use the OCT to configure Office 2013 security settings

  1. Open a Command Prompt window and navigate to the root of the network installation point that contains the Office 2013 source files.

  2. At the command prompt, type setup.exe /admin, and then choose ENTER.

  3. In the navigation pane of the OCT, choose Office security settings.

  4. In the details pane, change the security settings that you want to configure.

Configure Office 2013 security settings by using Group Policy

The following procedure shows how to use Group Policy to configure security settings.

To use Group Policy to configure Office 2013 security settings

  1. If you want to configure local Group Policy settings, open the Local Group Policy Editor.

    To do this, at the Run command, type gpedit.msc, and then choose ENTER.

  2. Or, open the Group Policy Management Editor on a domain controller if you want to configure domain-based Group Policy settings.

    To do this, open the Group Policy Management Console snap-in, choose (right-click) the Group Policy object (GPO) that you want to configure, and then choose Edit.

  3. In the Local Group Policy Editor tree or the Group Policy Management Editor tree, find the security setting that you want to configure in one of the following locations:

    • User Configuration/Policies/Administrative Templates/Microsoft Access 2013/Application Settings/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Excel 2013/Excel Options/Security

    • User Configuration/Policies/Administrative Templates/Microsoft InfoPath 2013/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Office 2013/Security Settings

    • User Configuration/Policies/Administrative Templates/Microsoft OneNote 2013/OneNote Options/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Outlook 2013/Security

    • User Configuration/Policies/Administrative Templates/Microsoft PowerPoint 2013/PowerPoint Options/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Project 2013/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Publisher 2013/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Visio 2013/Visio Options/Security

    • User Configuration/Policies/Administrative Templates/Microsoft Word 2013/Word Options/Security

  4. From the list, open (double-click) the security setting that you want to configure, and then make your changes.

Tip:

If you can't find the security setting that you want to configure, try searching in the previously listed locations within the Computer Configuration/Policies/Administrative Templates node.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013


Protection settings for Office 2013

Published: March 19, 2013

Summary: Contains articles that will help you plan the protection settings you will need when you deploy Office 2013.

Applies to: Office 2013

Audience: IT Professionals

Protection settings help you choose encryption methods, enable digital signatures, and decide which types of COM objects are allowed to run.

Office 2013 logo The articles that are listed in the following table will help you understand and implement the Office 2013 protection settings that are best for your organization.

Office 2013 protection setting articles on TechNet

Article | Description
Plan COM object categorization settings for Office 2013 | Explains how to use COM object categorization to control the behavior of certain COM objects in Office 2013.
Plan cryptography and encryption settings for Office 2013 | Explains the settings that you can use to encrypt data in Office 2013, and provides information about compatibility with earlier versions of Office.
Plan digital signature settings for Office 2013 | Provides information about how to support XAdES digital signatures in Excel 2013, PowerPoint 2013, and Word 2013 documents.
Plan Office File Validation settings for Office 2013 | Explains how Office File Validation settings can help prevent file format attacks in Office 2013.


Plan COM object categorization settings for Office 2013

Published: February 19, 2013

Summary Explains how to use COM object categorization to control the behavior of certain COM objects in Office 2013.

Applies to: Office 365 ProPlus

Audience: IT Professionals

COM objects can include ActiveX, Object Linking and Embedding (OLE), Excel RealTimeData (RTD) servers, and Office Web Components (OWC) data source providers. You can control the behavior of certain COM objects in Office 2013 by using COM object categorization. For example, you can create a security allow list, which will only allow the specified COM objects to load or you could choose to override the Internet Explorer kill bit.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • About COM object categorization

  • Configure Group Policy security settings for COM object categorization

  • Add COM object categorization in registry

About COM object categorization

Office 2013 first checks whether any of the Group Policy settings for COM object categorization are configured. If any of the settings are enabled to use COM object categorization, Office 2013 verifies that the specified COM objects are categorized correctly within the registry.

To enable COM object categorization within your organization, first determine which Group Policy security settings fit the needs of your organization. Then, add the category ID for the targeted COM objects within the registry.

Configure Group Policy security settings for COM object categorization

There are four COM object categorization Group Policy settings:

  • Check OWC data source providers

  • Check Excel RTD servers

  • Check OLE objects

  • Check ActiveX objects

You can configure Check OWC data source providers and Check Excel RTD servers to be either enabled or disabled. If you enable these settings, Office 2013 will load only the COM objects that are categorized correctly.

When you select Enabled, you'll notice that Check OLE objects and Check ActiveX objects have additional options. These options are listed in the following table.

Options for Check OLE objects and Check ActiveX objects settings

Option | Description
Do not check | Office loads (OLE/ActiveX) objects without checking if they are categorized correctly before loading.
Override IE kill bit list (default behavior) | Office uses the category list to override Internet Explorer kill bit checks.
Strict allow list | Office loads only Active X objects that are categorized correctly.

The Override IE kill bit list option lets you specifically list which OLE or ActiveX controls will be allowed to load within Office 2013 as long as they are categorized correctly, even if they are on the Internet Explorer kill bit list. Use this control when you want to allow a COM object that is designated as unsafe to load in Internet Explorer but which you know is safe to load in Office. Office also checks whether the Office COM kill bit is enabled. For more information about the Office COM kill bit and how it affects ActiveX control settings, see Plan security settings for ActiveX controls for Office 2013. If the Office COM kill bit is enabled and there is no alternate CLSID, also known as a "Phoenix bit," the COM object won't load. For more information about kill bit behavior, see the How to stop an ActiveX control from running in Internet Explorer article.

Use the Strict allow list option when you want to create a security allow list that only allows the specified controls to load and disallows any OLE or ActiveX objects that aren't on the list.

If you enable any of the COM object categorization settings within Group Policy, the next step is to add the COM object categorization in the registry.

Add COM object categorization in registry

Each Group Policy setting has a corresponding COM object categorization setting within the registry. These settings are listed in the following table.

Group Policy settings and Category IDs

Group Policy setting | Category ID (CATID)
Check OWC data source providers | {A67A20DD-16B0-4831-9A66-045408E51786}
Check Excel RTD servers | {8F3844F5-0AF6-45C6-99C9-04BF54F620DA}
Check OLE objects | {F3E0281E-C257-444E-87E7-F3DC29B62BBD}
Check ActiveX objects | {4FED769C-D8DB-44EA-99EA-65135757C156}

To add the corresponding COM object category ID in the registry

  1. Add a correct CATID for the designated COM objects, except when the Group Policy setting is either set to disabled or enabled | Do not check. In the registry, look for a key named Implemented Categories. If it doesn't already exist, add it to the CLSID of the COM object. Then, add a subkey that contains the CATID to the Implemented Categories key.

    For example, if you create an allow list and allow only the OLE object to be used in Office, you should first look up the CLSID for that COM object in the following location in the registry:

    HKEY_CLASSES_ROOT\CLSID

    Then, if you are looking for the OLE object Microsoft Graph Chart, you can expect the CLSID {00020803-0000-0000-C000-000000000046}. After finding it, either verify that the Implemented Categories key already exists or create one if it doesn't exist. The path in this example is:

    HKEY_CLASSES_ROOT\CLSID\{00020803-0000-0000-C000-000000000046}\Implemented Categories

  2. Finally, add a new subkey for the CATID that corresponds to the Check OLE object Group Policy setting to the Implemented Categories key.

    The final path and values for this example: HKEY_CLASSES_ROOT\CLSID\{00020803-0000-0000-C000-000000000046}\Implemented Categories\{F3E0281E-C257-444E-87E7-F3DC29B62BBD}

Note:

For more information, refer to the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Group Policy and Office Customization Tool settings in Office 2013 for OpenDocument and Office Open XML formats

How to stop an ActiveX control from running in Internet Explorer
Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool


Plan cryptography and encryption settings for Office 2013

Published: February 19, 2013

Summary: Explains the settings that you can use to encrypt data in Office 2013, and provides information about compatibility with previous versions of Office.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 contains settings that let you control the way that data is encrypted when you use Access 2013, Excel 2013, OneNote 2013, PowerPoint 2013, Project 2013, and Word 2013.

This article discusses cryptography and encryption in Office 2013, describes the settings that you can use to encrypt data, and provides information about compatibility with previous versions of Office. For information about Outlook 2013, see Plan for e-mail messaging cryptography in Outlook 2010.

As you plan your encryption settings, consider the following:

  • We recommend that you do not change the default encryption settings unless your organization's security model requires encryption settings that differ from the default settings.

  • We recommend that you enforce password length and complexity to help ensure that strong passwords are used when you encrypt data. For more information, see Plan password complexity settings for Office 2013.

  • We recommend that you do not use RC4 encryption. For more information, see Compatibility with previous versions of Office later in this article.

  • There isn't an administrative setting that forces users to encrypt documents. However, there is an administrative setting that prevents users from adding passwords to documents and, therefore, prevent documents from being encrypted. For more information, see Cryptography and encryption settings later in this article.

  • Saving documents in trusted locations doesn't affect encryption settings. If a document is encrypted and it is saved in a trusted location, a user still must provide a password to open the document.

  • If you do allow users to password protect documents, and they later forget or lose the password, you can use the DocRecrypt tool to reset or remove the password. For more information, see the Remove or reset file passwords in Office 2013 article.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • About cryptography and encryption in Office 2010

  • Cryptography and encryption settings

  • Compatibility with previous versions of Office

About cryptography and encryption in Office 2010

The encryption algorithms that are available for you to use with Office depend on the algorithms that can be accessed through the APIs (application programming interface) in the Windows operating system. Office 2013, in addition to maintaining support for Cryptography API (CryptoAPI), also includes support for CNG (CryptoAPI: Next Generation), which was first made available in the 2007 Microsoft Office system with Service Pack 2 (SP2).

CNG allows for more agile encryption, where encryption and hashing algorithms that are supported on the host computer can be specified for use during the document encryption process. CNG also allows for better extensibility encryption, where third-party encryption modules can be used.

When Office uses CryptoAPI, the encryption algorithms depend on those that are available in a Crypto Service Provider (CSP), which is part of the Windows operating system. The following registry key contains a list of CSPs that are installed on a computer:

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Cryptography/Defaults/Provider

The following CNG encryption algorithms, or any other CNG cipher extension installed on the system, can be used with the 2007 Office system SP2, Office 2010, or Office 2013:

AES, DES, DESX, 3DES, 3DES_112, and RC2

The following CNG hashing algorithms, or any other CNG cipher extension that is installed on the system, can be used with the 2007 Office system SP2, Office 2010, or Office 2013:

MD2, MD4, MD5, RIPEMD-128, RIPEMD-160, SHA-1, SHA256, SHA384, and SHA512

Although there are Office 2013 settings to change how encryption is performed, when you encrypt Open XML Format files (.docx, .xslx, .pptx, and so on) the default values — AES (Advanced Encryption Standard), 128-bit key length, SHA1, and CBC (cipher block chaining) — provide strong encryption and should be fine for most organizations. AES encryption is the strongest industry-standard algorithm that is available and was selected by the National Security Agency (NSA) to be used as the standard for the United States Government. AES encryption is supported on Windows XP SP2, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012.

Cryptography and encryption settings

The following table lists the encryption algorithm settings you can use with Office versions that access CryptoAPI. This includes Office versions up to and including Office 2013.

Encryption algorithm settings for use with CryptoAPI

Setting | Description
Encryption type for password-protected Office Open XML files | This setting lets you specify an encryption type for Open XML files from the available cryptographic service providers (CSP). This setting is required when you use a custom COM encryption add-in. For more information, see the "2007 Office System Encryption Developers Guide," which is available as part of the SharePoint Server 2007 SDK. This setting is also required if you use the 2007 Office system SP1 or use a version of the Compatibility Pack that is older than the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint File Formats and you want to change the encryption algorithm to something other than the default.
Encryption type for password-protected Office 97-2003 files | This setting lets you specify an encryption type for Office 97-2003 (binary) files from the available cryptographic service providers (CSP). The only supported encryption algorithm with this setting is RC4, which, we don't recommend.

In Office 2013, if you must change the Encryption type for password-protected Office Open XML files setting, first enable the Specify encryption compatibility setting and select the Use legacy format option. The Specify encryption compatibility setting is available for Access 2013, Excel 2013, PowerPoint 2013, and Word 2013.

The following table lists the settings that are available to change the encryption algorithms when you use Office 2013. These settings apply to Access 2013, Excel 2013, OneNote 2013, PowerPoint 2013, Project 2013, and Word 2013.

Note:

All the following settings, except Set parameters for CNG context and Specify CNG random number generator algorithm, are applicable, even when you use a supported operating system for Office 2013, such as Windows XP SP3, which doesn't include support for CNG. In this case, Office 2013 uses CryptoAPI instead of CNG. These settings apply only when you use Office 2013 for encryption of Open XML files.

Settings that change the encryption algorithm

Setting | Description
Set CNG cipher algorithm | Lets you configure the CNG cipher algorithm that is used. The default is AES.
Configure CNG cipher chaining mode | Lets you configure the cipher chaining mode that is used. The default is Cipher Block Chaining (CBC).
Set CNG cipher key length | Lets you configure the number of bits to use when you create the cipher key. The default is 128 bits.
Specify encryption compatibility | Lets you specify the compatibility format. The default is Use next generation format.
Set parameters for CNG context | Lets you specify the encryption parameters that should be used for the CNG context. To use this setting, a CNG context first has to be created by using CryptoAPI: Next Generation (CNG). For more information, see CNG Cryptographic Configuration Functions.
Specify CNG hash algorithm | Lets you specify the hash algorithm that is used. The default is SHA1.
Set CNG password spin count | Lets you specify the number of times to spin (rehash) the password verifier. The default is 100000.
Specify CNG random number generator algorithm | Lets you configure the CNG random number generator to use. The default is RNG (Random Number Generator).
Specify CNG salt length | Lets you specify the number of bytes of salt that should be used. Salt is additional input to the password and hash. The default is 16.

The following table lists additional CNG settings that can be configured for Excel 2013, PowerPoint 2013, and Word 2013.

Excel 2013, PowerPoint 2013, and Word 2013 specific CHG setting

Setting | Description
Use new key on password change | Lets you specify if a new encryption key should be used when the password is changed. The default is not to use a new key on password changes.

You can use the setting that is listed in the following table to prevent users from adding passwords to documents. This prevents users from encrypting documents.

Setting used to prevent users from password protecting a document

Setting | Description
Disable password to open UI | This setting controls whether Office 2013 users can add passwords to documents. By default users can add passwords.

Note:

For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

Compatibility with previous versions of Office

If you have to encrypt Office documents, we recommend that you save the documents as Open XML Format files (.docx, .xlsx, .pptx, and so on) instead of Office 97-2003 format (.doc, .xls, .ppt, and so on). The encryption that is used for binary documents (.doc, .xls, .ppt) uses RC4. It isn't recommended, as discussed in Security Considerations sections 4.3.2 and 4.3.3 of the Office Document Cryptography Structure Specification. Documents that are saved in the older Office binary formats can only be encrypted by using RC4 to maintain compatibility with older versions of Office. AES, the default and recommended encryption algorithm, is used to encrypt Open XML Format files.

Office 2013, Office 2010, and the 2007 Office system let you save documents as Open XML Format files. In addition, if you have Office XP or Office 2003, you can use the Compatibility Pack to save documents as Open XML Format files.

Documents that are saved as Open XML Format files and encrypted by using Office 2013 can only be read by Office 2013, Office 2007 SP2, and Office 2003 with the Office 2007 SP2 compatibility pack. To ensure compatibility with all previous versions of Office, you can create a registry key (if it doesn't already exist) under HKCU\Software\Microsoft\Office\14.0\<application>\Security\Crypto\ called CompatMode and disable it by setting it to 0. The values that you can enter for <application> represent the specific Office application that you are configuring this registry key for. For example, you can enter Access, Excel, PowerPoint, or Word. It is important to realize that, when you set CompatMode to 0, Office 2013 uses an Office 2007 compatible encryption format, instead of the enhanced security that is provided by default when you use Office 2013 to encrypt Open XML Format files. If you have to configure this setting for compatibility reasons, we recommend that you also use a third-party encryption module that allows for enhanced security, such as AES encryption.

If your organization uses the Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint File Formats to encrypt Open XML Format files, you should review the following information:

  • By default, the Compatibility Pack uses the following settings to encrypt Open XML Format files:

    • Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype),AES 128,128 (on the Windows XP Professional operating system).

    • Microsoft Enhanced RSA and AES Cryptographic Provider,AES 128,128 (on Windows Server 2003 and Windows Vista operating systems).

  • Users aren't notified that the Compatibility Pack uses these encryption settings.

  • The graphical user interface on earlier versions of Office might display incorrect encryption settings for Open XML Format files if the Compatibility Pack is installed.

  • Users can't use the graphical user interface in earlier versions of Office to change the encryption settings for Open XML Format files.

Note:

For the latest information about policy settings, refer to the Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013 article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Configure security by using OCT or Group Policy for Office 2013
Remove or reset file passwords in Office 2013

Office Document Cryptography Structure Specification


Plan digital signature settings for Office 2013

Published: November 6, 2012

Summary: Explains how to support XAdES digital signatures in Excel 2013, PowerPoint 2013, and Word 2013 documents.

Applies to: Office 2013

Audience: IT Professionals

Users can digitally sign an Office 2013Excel, PowerPoint, or Word document for many of the same reasons that they might place a handwritten signature on a paper document. A digital signature is used to help authenticate the identity of the creator of digital information, such as documents, email messages, and macros, by using cryptographic algorithms.

Digital signatures are based on digital certificates. Digital certificates are verifiers of identity that are issued by a trusted third party, which is known as a certification authority (CA). This works similarly to the use of printed identity documents. For example, a trusted third party, such as a government entity or employer, issues identity documents such as driver licenses, passports, and employee ID cards. Other people rely on those documents to verify that a person is who he or she claims to be.

This article includes digital signature registry keys that are new to Office 2013.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for help with digital signature settings in Office 2013 on your desktop? You may be looking for one of these articles, which will help you secure Office 2013 on your desktop.

  • Digital signatures and certificates

  • Add or remove a digital signature in Office files

  • Get a digital ID

In this article:

  • Introduction to digital signatures and how they are used in Office 2013

  • Choosing digital certificate types for Office 2013

  • Planning digital signature levels in Office 2013 documents

Introduction to digital signatures and how they are used in Office 2013

Digital signatures help establish the following authentication measures:

  • Authenticity The digital signature and its underlying digital certificate helps make sure that the signer is the person he or she claims to be. This helps prevent other people from pretending to be the originator of a particular document, the equivalent of forgery on a printed document.

  • Integrity The digital signature helps make sure that the content has not been changed or tampered with since it was digitally signed. This helps prevent documents from being intercepted and changed without the document originator's knowledge.

  • Non-repudiation The digital signature helps prove to all parties the origin of the signed content. "Repudiation" refers to a signer's denial of any association with signed content. The digital signature helps prove that the originator of the document is the true originator and not someone else, regardless of the claims of the signer. A signer cannot repudiate the signature on that document without repudiating his or her digital key and, therefore, other documents signed by using that key.

Requirements for digital signatures in Office 2013

To establish these conditions, the content creator must digitally sign the content by creating a signature that satisfies the following criteria:

  • The digital signature is valid. A CA that is trusted by the operating system must sign the digital certificate on which the digital signature is based.

  • The certificate that is associated with the digital signature is not expired or contains a time stamp that indicates the certificate was valid at the time of signing.

  • The certificate that is associated with the digital signature is not revoked.

  • The signing person or organization (known as the publisher) is trusted by the recipient.

Word 2013, Excel 2013, and PowerPoint 2013 detect these criteria and warn the user if there is a problem with the digital signature. Information about problematic certificates can easily be viewed in a certificate task pane that appears in the Office 2013 application. Office 2013 applications let you add multiple digital signatures to the same document.

Digital signatures in the Office 2013 business environment

The following scenario shows how you can use digital signatures on documents in a business environment:

  1. An employee uses Excel 2013 to create an expense report. The employee then creates three signature lines: one for herself, one for her manager, and one for the accounting department. The signatures serve to:

    • identify that the employee is the originator of the document

    • indicate that no changes will occur in the document as it moves to the manager and the accounting department

    • demonstrate that there is proof that both the manager and the accounting department have received and reviewed the document

  2. The manager receives the document and adds her digital signature to the document, confirming that she has reviewed and approved it. She then forwards it to the accounting department for payment.

  3. A representative in the accounting department receives the document and signs it, which confirms receipt of the document.

This example demonstrates the ability to add multiple signatures to a single Office 2013 document. In addition to the digital signature, the signer of the document can add a graphic of her actual signature, or use a Tablet PC to actually write a signature into the signature line in the document.

Compatibility issues with Office documents prior to Office 2013

Office 2013, just as Office 2010 and Office 2007, uses the XML-DSig format for digital signatures. In addition, Office 2013 has support for XAdES (XML Advanced Electronic Signatures). XAdES is a set of tiered extensions to XML-DSig, the levels of which build upon the previous levels to provide more reliable digital signatures. For more information about the levels of XAdES that are supported in Office 2013, see Planning digital signature levels in Office 2013 documents later in this article. For more information about the details of XAdES, see the specification for XML Advanced Electronic Signatures (XAdES).

It is important to be aware that digital signatures that are created in Office 2013 are incompatible with versions of Office that are earlier than the 2007 Office system. For example, if a document is signed by using an application in Office 2013, Office 2010, or Office 2007, and then opened by using an application in Office, 2003 that has the Office Compatibility Pack installed, the user is informed that the document was signed in a newer version of Office and that the digital signature is lost.

The following figure shows the warning that the user sees after opening a document in a version of Office that is earlier than Office 2007.

Digital signature warning for documents originally signed in Office 2003 or earlier versions.

Figure 1 Compatibility Issues

Also, if you use XAdES for a digital signature in Office 2013, the digital signature will not be compatible with Office 2010 or 2007 Office system unless you configure the Group Policy setting, Do not include XAdES reference object in the manifest, and set it to Enabled. For more information about the digital signature Group Policy settings, see Plan signature settings for Office 2013 later in this article.

If you want digital signatures that you create in Office 2013 to be compatible with Office 2003 and earlier versions, you can configure the Group Policy setting, Legacy format signatures, and set it to Enabled. This Group Policy setting is located under User Configuration\Administrative Templates\Microsoft Office 2013\Signing. After you change this setting to Enabled, the Office 2013 applications use the Office 2003 binary format to apply digital signatures to Office 97-2003 binary documents that you created in Office 2013. For more information see, Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool

Choosing digital certificate types for Office 2013

Digital certificates can be either self-signed or issued by CAs in an organization, such as a Windows Server 2012 or Windows Server 2008 computer that is running Active Directory Certificate Services, or a public CA, such as VeriSign or Thawte. Self-signed certificates are typically used by people and small businesses that do not want to set up a public key infrastructure (PKI) for their organizations and do not want to purchase a commercial certificate.

The primary drawback of using self-signed certificates is that they are only useful if you exchange documents with those who know you personally and are confident that you are the actual originator of the document. By using self-signed certificates, there is no third party that validates the authenticity of your certificate. Each person who receives your signed document must manually decide whether to trust your certificate.

For larger organizations, two primary methods for obtaining digital certificates are available: certificates that are created by using an organization or corporation PKI and commercial certificates. Organizations that want to share signed documents only among other employees in the organization might prefer a corporate PKI to reduce costs. Organizations that want to share signed documents with people outside their organization might prefer to use commercial certificates.

Certificates that are created by using an organization or corporation PKI

Organizations have the option to create their own PKI. In this scenario, the company sets up one or more certification authorities (CAs) that can create digital certificates for computers and users throughout the company. When combined with the Active Directory directory service (AD DS), a company can create a complete PKI solution so that all organization or corporate-managed computers have the organization or corporate CA chain installed and that both users and computers are automatically assigned digital certificates for document signing and encryption. This allows for all employees in a company to automatically trust digital certificates (and, therefore, valid digital signatures) from other employees in the same company.

For more information, see Active Directory Certificate Services.

Commercial certificates

You can purchase commercial certificates from a company whose line of business is to sell digital certificates. The main advantage of using commercial certificates is that the commercial certificate vendor's root CA certificate is automatically installed on the organization's Windows operating systems. This enables these computers to automatically trust the CAs. Unlike the organization or corporate PKI solution, commercial certificates enable you to share your signed documents with users who do not belong to your organization.

There are three kinds of commercial certificates:

  • Class 1 Class 1 certificates are issued to people who have valid email addresses. Class 1 certificates are appropriate for digital signatures, encryption, and electronic access control for non-commercial transactions where proof of identity is not required.

  • Class 2 Class 2 certificates are issued to people and devices. Class 2 individual certificates are appropriate for digital signatures, encryption, and electronic access control in transactions where proof of identity that is based on information in the validating database is sufficient. Class 2 device certificates are appropriate for device authentication; message, software, and content integrity; and confidentiality encryption.

  • Class 3 Class 3 certificates are issued to people, organizations, servers, devices, and administrators for CAs and root authorities (RAs). Class 3 individual certificates are appropriate for digital signatures, encryption, and access control in transactions where proof of identity must be assured. Class 3 server certificates are appropriate for server authentication; message, software, and content integrity; and confidentiality encryption.

For more information about commercial certificates, see Digital ID.

Planning digital signature levels in Office 2013 documents

Users can digitally sign documents by using Excel 2013, PowerPoint 2013, and Word 2013. They can also use Excel 2013, InfoPath 2013, or Word 2013 to add a signature line or signature stamp. Digitally signing a document that has a digital certificate but does not have a signature line or stamp is known as creating an invisible digital signature. Visible and invisible digital signatures both use a digital certificate for signing the document. The difference is the graphical representation in the document when a visible digital signature line is used. For more information about how to add a digital signature, see Add or remove a digital signature in Office files.

By default, Office 2013 creates XAdES-EPES digital signatures, when either a self-signed certificate or a certificate signed by a CA is used during the creation of the digital signature.

The XAdES digital signature levels, which are based on the XML-DSig digital signature standard and available in Office 2013, are listed in the following table. Each of the levels builds upon the previous level and contains all the capabilities of the previous levels. For example, XAdES-X also contains all of the capabilities of XAdES-EPES, XAdES-T, and XAdES-C, in addition to the new functionality that is introduced in XAdES-X.

XAdES digital signature levels in Office 2013

Signature level | Description
XAdES-EPES (Base) | Adds information about the signing certificate to the XML-DSig signature. This is the default for Office 2013 signatures.
XAdES-T (Timestamp) | Adds a time stamp to the XML-DSig and XAdES-EPES sections of the signature, which helps protect against certificate expiration.
XAdES-C (Complete) | Adds references to certification chain and revocation status information.
XAdES-X (Extended) | Adds a time stamp to the XML-DSig SignatureValue element, and the -T and -C sections of the signature. The additional time stamp protects the additional data from repudiation.
XAdES-X-L (Extended Long Term) | Stores the actual certificate and certificate revocation information in addition to the signature. This allows for certificate validation even if the certificate servers are no longer available.

Planning for time stamped digital signatures in Office 2013

When users add a time stamp to a digital signature, they help to extend the lifespan of that digital signature. For example, if a revoked certificate has previously been used to create a digital signature, the digital signature contains a time stamp from a trusted time stamp server, and the time stamp occurred before the revocation of the certificate, the digital signature can still be considered valid. To use the time stamp functionality with digital signatures, you must complete the following tasks:

  • Set up a time stamp server that is compliant with RFC 3161

  • Use the Group Policy setting, Specify server name, to enter the location of the time stamp server on the network.

You can also configure additional time stamp parameters by configuring one or more of the following Group Policy settings:

  • Configure time stamping hashing algorithm

  • Set time stamp server time-out

If you do not configure and enable Configure time stamping hashing algorithm, the default value of SHA1 will be used. If you do not configure and enable Set time stamp server time-out, Office 2013 will wait 5 seconds for the time stamp server to respond to a request.

Plan signature settings for Office 2013

In addition to the Group Policy settings for configuring time stamp related-settings, there are other Group Policy settings to configure how digital signatures are configured and controlled in an organization. The setting names and descriptions are listed in the following table. These are located in software\policies\microsoft\office\15.0\common\signatures!

Digital signature Group Policy configuration settings

Group Policy Setting | Description
Require OCSP at signature generation time | This policy setting lets you determine whether Office 2013 requires OCSP (Online Certificate Status Protocol) revocation data for all digital certificates in a chain when digital signatures are generated.
Specify minimum XAdES level for digital signature generation | This policy setting lets you specify a minimum XAdES level that Office 2013 applications must reach in order to create an XAdES digital signature. If the Office 2013 applications are unable to reach the minimum XAdES level, the Office application does not create the signature.
Check the XAdES portions of a digital signature | This policy setting lets you specify whether Office 2013 checks the XAdES portions of a digital signature when validating a digital signature for a document.
Do not allow expired certificates when validating signatures | This policy setting lets you configure whether Office 2013 applications accept expired digital certificates when verifying digital signatures.
Do not include XAdES reference object in the manifest | This policy setting lets you determine whether an XAdES reference object will appear in the manifest. You must configure this setting to Enabled if you want the 2007 Office system to be able to read Office 2013 signatures that contain XAdES content. Otherwise, the 2007 Office system will consider signatures that contain XAdES content invalid.
Select digital signature hashing algorithm | This policy setting lets you configure the hashing algorithm that Office 2013 applications use to confirm digital signatures.
Set signature verification level | This policy setting lets you set the verification level that is used by Office 2013 applications when validating a digital signature.
Requested XAdES level for signature generation | This policy setting lets you specify a requested or desired XAdES level in creating a digital signature.

The following additional Group Policy settings are related to digital signatures and are also located in \software\policies\microsoft\office\15.0\common\signatures!:

  • Set default image directory

  • EKU filtering

  • Legacy format signatures

  • Suppress Office Signing Providers

  • Suppress external signature services command

For more information about each Group Policy setting, see the Help files that are contained with the Administrative Template files for Office 2013.

Note:

For the latest information about policy settings, refer to the Excel workbook Office2013GroupPolicyAndOCTSettings_Reference.xls, which is available in the Files in this Download section of the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool download page.

Registry settings that apply to digital signatures

The following table shows Windows registry settings that are specific to digital signatures and the certificates that are used to encrypt them. These registry settings are located in HKEY_CURRENT_USER\software\policies\Microsoft\Office\15.0\common\signatures. There is no corresponding Group Policy.

Digital signature registry settings

Registry entry | Type | Value | Description
FilterIssuer | WZ | Empty | Reduces the set of available certificates to those that have the FilterIssuer value in their name.
MinSigningDSABits | DWORD | Empty | Specifies the minimum number of bits that are allowed to create a DSA digital signature in Office.
InvalidDSABits | DWORD | Empty | Specifies the maximum number of bits that will be read in a DSA digital signature. Any bits beyond the InvalidDSABits value are ignored.
InvalidHashAlg | WZ | Empty | Specifies the hash algorithms that were previously used by your organization to create digital signatures in previous releases of Office (Office 2007, Office 2010, for example) that you want to make invalid now. If a hash is specified here, validation will fail for any documents or emails that use that hash to validate a digital signature.
InvalidRSABits | DWORD | Empty | Specifies the maximum number of bits that will be read in an RSA digital signature. Any bits beyond the InvalidRSABits value are ignored.
LegacyDSABits | DWORD | Empty | Specifies the minimum number of bits that will be processed in a legacy DSA digital signature, where legacy refers to a digital signature created for a document or email using Office 2007 or Office 2010 and where the hash algorithm was specified in the LegacyHashAlg registry key setting.
LegacyHashAlg | WZ | MD5 | Specifies the hash algorithms used by your organization to create digital signatures in previous releases of Office (Office 2007, Office 2010, for example) that you want to make available to validate legacy documents and emails that were digitally signed.
LegacyRSABits | DWORD | Empty | Specifies the minimum number of bits that will be processed in a legacy RSA digital signature. Legacy refers to a digital signature that was created for a document or email by using Office 2007 or Office 2010 and where the hash algorithm was specified in the LegacyHashAlg registry key setting.
MinSigningRSABits | DWORD | Empty | Specifies the minimum number of bits that will be used to create a digital signature in Office 2013.

See also

Content roadmap for Office 2013 security

XML Advanced Electronic Signatures (XAdES)
Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool
Active Directory Certificate Services
Digital ID
Add or remove a digital signature in Office files


Plan Office File Validation settings for Office 2013

Published: February 5, 2013

Summary: Explains how Office File Validation settings can help prevent file format attacks in Office 2013.

Applies to: Office | Office 365 ProPlus

Audience: IT Professionals

Office File Validation is a security feature in Office 2013 that helps prevent file format attacks by scanning Office binary file formats before they are opened in Excel 2013, PowerPoint 2013, or Word 2013. You can change how Office 2013 validates files that are stored in Microsoft Office binary file formats by configuring Office File Validation settings.

In this article:

  • Plan Office File Validation settings in Office 2013

  • Turn off Office File Validation in Office 2013

  • Change document behavior when validation fails in Office 2013

  • Turn off Office File Validation reporting in Office 2013

Plan Office File Validation settings in Office 2013

Office File Validation helps detect and prevent a kind of exploit known as a file format attack or file fuzzing attack. File format attacks exploit the integrity of a file. They occur when someone modifies the structure of a file with the intent of adding malicious code. Usually the malicious code is run remotely and is used to elevate the privilege of restricted accounts on the computer. As a result, an attacker could gain access to a computer that they did not previously have access to. This could enable an attacker to read sensitive information from the computer's hard disk drive or install malware, such as a worm or a key logging program. The Office File Validation feature helps prevent file format attacks by scanning and validating files before they are opened. To validate files, Office File Validation compares a file's structure to a predefined file schema, which is a set of rules that determine what a readable file looks like. If Office File Validation detects that a file's structure does not follow all rules that are described in the schema, the file does not pass validation.

File format attacks occur most frequently in files that are stored in Office binary file formats. For this reason, Office File Validation scans and validates the following kinds of files:

  • Excel 97-2003 Workbook files. These files have an .xls extension and include all Binary Interchange File Format 8 (BIFF8) files.

  • Excel 97-2003 Template files. These files have an .xlt extension and include all BIFF8 files.

  • Microsoft Excel 5.0/95 files. These files have an .xls extension and include all BIFF5 files.

  • PowerPoint 97-2003 Presentation files. These files have a .ppt extension.

  • PowerPoint 97-2003 Show files. These files have a .pps extension.

  • PowerPoint 97-2003 Template files. These files have a .pot extension.

  • Word 97-2003 Document files. These files have a .doc extension.

  • Word 97-2003 Template files. These files have a .dot extension.

Office 2013 provides several settings that let you change how the Office File Validation feature behaves. You can use these settings to do the following:

  • Disable Office File Validation.

  • Specify document behavior when a file fails validation.

  • Prevent Office 2013 from sending Office File Validation information to Microsoft.

Note:

For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

By default, Office File Validation is enabled in Excel 2013, PowerPoint 2013, and Word 2013. Any files that fail validation are opened in Protected View. Users can choose to enable editing for these files. Also, users are prompted to send Office File Validation information to Microsoft. If users grant permission, only information for files that fail validation is collected and sent to Microsoft.

We recommend that you do not change the default settings for Office File Validation. However, some organizations might have to configure Office File Validation settings to suit special security requirements. Specifically, the following types of organizations have security requirements that might require a change to the default settings for the Office File Validation feature:

  • Organizations that restrict access to the Internet. Office File Validation prompts users to send validation error information to Microsoft approximately every two weeks. This could violate an organization's Internet access policies. In this case, you might choose to prevent Office File Validation from sending the information to Microsoft. For more information, see Turn off Office File Validation reporting in Office 2013 later in this article.

  • Organizations that have highly restrictive security environments. You can configure Office File Validation so that files that fail validation cannot be opened or can only be opened in Protected View. This is more restrictive than the default settings for Office File Validation and might be suitable to organizations that have a locked-down security environment. For more information about how to change document behavior, see Change document behavior when validation fails in Office 2013 later in this article.

  • Organizations that do not want their files sent to Microsoft. If users allow it, Office File Validation sends a copy of all files that fail validation to Microsoft. You can configure Office File Validation so that users are not prompted to send validation information to Microsoft.

Turn off Office File Validation in Office 2013

You can use the Turn off file validation setting to disable Office File Validation. This setting must be configured on a per-application basis for Excel 2013, PowerPoint 2013, and Word 2013. This setting prevents files that are stored in the Office binary file format from being scanned and validated. For example, if you enable the Turn off file validation setting for Excel 2013, Office File Validation does not scan or validate Excel 97-2003 Workbook files, Excel 97-2003 Template files, or Microsoft Excel 5.0/95 files. If a user opens one of those file types, and the file contains a file format attack, the attack will not be detected or prevented unless some other security control detects and prevents such an attack.

We recommend that you do not turn off Office File Validation. Office File Validation is a key part of the layered defense strategy in Office 2013 and should be enabled on all computers throughout an organization. If you want to prevent files from being validated by the Office File Validation feature, we recommend that you use the Trusted Locations feature. Files that are opened from trusted locations skip Office File Validation checks. You can also use the Trusted Documents feature to prevent a file from being validated by Office File Validation. Files that are considered to be trusted documents do not undergo Office File Validation checks.

Change document behavior when validation fails in Office 2013

You can use the Set document behavior if file validation fails Group Policy setting to change how documents behave when they fail validation. When you enable this setting, you can select one of the following two options:

  • Block files Files that fail validation do not open in Protected View and users cannot open files for editing.

    If you select the Open files in Protected View option, when a file fails validation, users see the following text in the Message Bar:

    PROTECTED VIEW Office has detected a problem with this file. Click for more details.

    If a user clicks the Message Bar, the Microsoft Office Backstage view appears, which provides a more lengthy description of the problem and lets users enable the file for editing.

  • Open files in Protected View Files open in Protected View so users can see the content of the file, but users cannot open files for editing. This option represents the default behavior of the Office File Validation feature.

    If you select the Block files option, users see the following text in a dialog box when a file fails validation:

    Office has detected a problem with this file. To help protect your computer this file cannot be opened.

    Users can expand the dialog box and see a more detailed explanation of why the file does not open, or they can close the dialog box by selecting OK.

Turn off Office File Validation reporting in Office 2013

You can use the Turn off error reporting for files that fail file validation Group Policy setting to suppress the dialog box that prompts users to send information to Microsoft. This setting also prevents validation information from being sent to Microsoft.

Every time that a file fails validation, Office 2013 collects information about why the file failed validation. Approximately two weeks after a file fails validation, Office 2013 prompts users to send Office File Validation information to Microsoft. The validation information includes such things as the file types, file sizes, how long it took to open the files, and how long it took to validate the files. Copies of the files that failed validation are also sent to Microsoft. Users see the list of files when they are prompted to send validation information to Microsoft. Users can decline to send validation information to Microsoft, which means no information about failed validations is sent to Microsoft and no files are sent to Microsoft. If an organization restricts Internet access, has restrictive Internet access policies, or does not want files sent to Microsoft, you might have to enable the Turn off error reporting for files that fail file validation Group Policy setting.

Important:

The Office File Validation feature can occasionally indicate that a file failed validation when in fact the file is valid. The validation reporting feature helps Microsoft improve the Office File Validation feature and minimize the occurrence of false positive results.

Note:

For the latest information about Group Policy settings, refer to the Office 2013 Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool article.

See also

Overview of security in Office 2013
Understand security threats and countermeasures for Office 2013
Plan file block settings for Office 2013
Plan Office File Validation settings for Office 2013
Plan Protected View settings for Office 2013
Configure security by using OCT or Group Policy for Office 2013


Trust Center settings for Office 2013

Published: March 19, 2013

Summary: Contains articles that will help you plan and configure the Trust Center settings for Office 2013.

Applies to: Office 2013

Audience: IT Professionals

Use Trust Center settings to guard against external threats like those sometimes posed by add-ins, VBA macros, ActiveX controls and other content from sources you haven't granted trusted status to.

Office 2013 logo The articles that are listed in the following table contain information that will help you plan and implement the Trust Center settings you want in Office 2013.

Office 2013 security articles on TechNet

Article | Description
Plan and configure Trusted Publishers settings for Office 2013 | Explains how to use the Trusted Publishers list in Office 2013 to designate content publishers that you trust.
Plan and configure Trusted Locations settings for Office 2013 | Explains how to use the Trusted Locations feature in Office 2013 to differentiate safe files from potentially harmful files.
Plan security settings for add-ins for Office 2013 | Explains how to control the way that add-ins behave in Office 2013, and how to prevent users from running add-ins.
Plan security settings for ActiveX controls for Office 2013 | Explains how to change settings to make Microsoft ActiveX controls safer in Office 2013 and how to Use Office 2013Telemetry Dashboard to investigate ActiveX control warnings.
Plan security settings for VBA macros for Office 2013 | Explains how VBA and VBA macros settings control the way Visual Basic for Applications (VBA) and VBA macros behave in Office 2013.
Plan Protected View settings for Office 2013 | Explains how to configure Protected View settings in Office 2013.
Plan file block settings for Office 2013 | Provides information about the settings to block specific file format types for Excel 2013, PowerPoint 2013, and Word 2013 users.
Plan privacy options for Office 2013 | Explains how Office 2013 privacy settings let you control the disclosure of private information.


Plan and configure Trusted Publishers settings for Office 2013

Published: February 19, 2013

Summary: Explains how to use the Trusted Publishers list in Office 2013 to designate content publishers that you trust.

Applies to: Office 365 ProPlus

Audience: IT Professionals

You can use the Trusted Publishers list to designate content publishers that you trust. This can be helpful if your organization uses published content, such as Microsoft ActiveX controls, add-ins, and Visual Basic for Applications (VBA) macros.

A publisher is any developer, software company, or organization that has created and distributed a digitally signed ActiveX control, add-in, or VBA macro. A trusted publisher is any publisher that was added to the Trusted Publishers list. When a user opens a file, and the file contains active content that is created by a trusted publisher, the trusted publisher's content is enabled and users are not notified about any potential risks that might be contained in the file.

For information about how to add trusted publishers, see Add, remove, or view a trusted publisher.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Plan Trusted Publishers settings in Office 2013

  • Obtain certificates from known publishers

  • Determine which certificates must be added to the Trusted Publishers list

  • Related Trusted Publishers settings for Office 2013

Plan Trusted Publishers settings in Office 2013

To designate a publisher as a trusted publisher, you have to add the publisher's certificate to the Trusted Publishers list. In this context, the publisher's certificate is the digital certificate (.cer file) that the publisher used to digitally sign its published content. In most cases, you can obtain the .cer file from the publisher, or you can export it from the .cab, .dll, .exe, or .ocx file that is associated with the published content. If you are unsure which published content the organization uses, you might also have to determine whether any other published content runs with the organization's Office 2013 applications and then obtain certificates for that published content.

There are two methods that you can use to add a publisher's certificate to the Trusted Publishers list: the Office Customization Tool (OCT) or Group Policy. The OCT provides no settings for managing certificates other than adding a trusted publisher's certificate to the Trusted Publishers list. If you want to manage certificate trust or if you want to establish specific trust relationships to satisfy business scenarios, you must use Group Policy. For more information about how to add trusted publishers to the Trusted Publishers list and how to manage trusted root certificates, see Manage Trusted Root Certificates and Manage Trusted Publishers.

Obtain certificates from known publishers

You can usually obtain a certificate for published content by asking the publisher to send it to you. If you can't get the certificate in this manner, and you know the name of the digitally signed .cab, .dll, .exe, or .ocx file that contains the published content, you can take the following steps to export the certificate file.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

Important:

To use this procedure, your computer must be running the Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012 operating system.

To export a certificate from a .dll file

  1. Select the file that the publisher has signed, open its shortcut menu (right-click), and then choose Properties.

  2. Choose the Digital Signatures tab.

  3. In Signature list, choose the certificate, and then choose Details.

  4. In the Digital Signature Details dialog box, choose View Certificate.

  5. Choose the Details tab, and then choose Copy to File.

  6. On the Certificate Explore Wizard welcome page, choose Next.

  7. On the Export File Format page, choose DER encoded binary X.509 (.CER), and then choose Next.

  8. On the File to Export page, type a path and name for the .cer file, choose Next, and then choose Finish.

Make sure that you save all of the .cer files on a network share that can be accessed by client computers during installation.

Determine which certificates must be added to the Trusted Publishers list

In some cases, you might not know whether an organization uses published content or you might not know which published content to add to the Trusted Publishers list. This is usually relevant only if you have a highly restrictive environment and you require that all published content be signed. You can test Office 2013 applications for digitally signed content by using the following procedure.

To identify published content and add the content publisher to the Trusted Publishers list

  1. On a test computer, or a client computer that is running the standard configuration for the organization (including any add-ins that users need), enable the Require Application Add-Ins to be signed by Trusted Publisher setting in the Trust Center by doing the following:

    1. Choose the File tab.

    2. Choose Options.

    3. Choose Trust Center.

    4. Choose Trust Center Settings.

    5. Choose Add-ins.

    6. Choose Require Application Add-ins to be signed by Trusted Publisher.

    7. Choose OK.

  2. Exit and restart the Office application. If add-ins are installed, the Message Bar displays the following message: Security Warning Some active content has been disabled. Click here for more details.

  3. On the Message Bar, choose Some active content has been disabled. Click for more details.

  4. Choose the File tab and, in the Backspace View, choose Enable Content, and then choose Advanced Options.

  5. In the Security Alerts - Multiple Issues dialog box, install each certificate to the Trusted Publishers list by following these steps for each add-in that shows a valid digital signature:

    1. Choose Show Signature Details.

    2. In the Digital Signature Details window, choose View Certificate.

    3. In the Certificate window, choose Install Certificate.

    4. In the Certificate Import Wizard, choose Next, choose Place all certificates in the following store, choose Browse, choose Trusted Publishers, choose OK, choose Next, and then choose Finish.

  6. Prepare the certificate files for distribution:

    1. Choose the File tab, choose Options, choose Trust Center, choose Trust Center Settings, and then choose Trusted Publishers.

    2. For each certificate, select the certificate, choose View, and then follow these steps:

      1. In the Certificate window, on the Details tab, choose Copy to File.

      2. In the Certificate Export Wizard, choose Next, and then choose Next again to accept the default file format, enter a file name, select a location to store the file, and then choose Finish.

Related Trusted Publishers settings for Office 2013

The following Group Policy and Trust Center settings are often used with Trusted Publishers settings:

  • Require that application add-ins are signed by Trusted Publisher

    This setting restricts add-ins to only those that are signed by a trusted publisher. This is a per application setting.

  • Disable Trust Bar notification for unsigned application add-ins and block them

    This setting prevents users from seeing Message Bar warnings about add-ins that are not signed by a trusted publisher. This is a per application setting.

  • VBA macro notification settings

    This setting restricts VBA macros to only those that are signed by a trusted publisher. This is a per application setting.

  • Disable All ActiveX

    This setting restricts ActiveX controls to only those that are signed by a trusted publisher. This is a global setting, not per application.

Note:

For the latest information about policy settings, refer to the Excel 2013 workbook Office2013GroupPolicyAndOCTSettings_Reference.xlsx that is included in the Office 2013 Administrative Template files. For more information, see the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Configure security by using OCT or Group Policy for Office 2013
Understand security threats and countermeasures for Office 2013
Plan and configure Trusted Locations settings for Office 2013


Plan and configure Trusted Locations settings for Office 2013

Published: February 5, 2013

Summary Explains how to use the Trusted Locations feature in Office 2013 to differentiate safe files from potentially harmful files.

Applies to: Office 365 ProPlus

Audience: IT Professionals

If you want to differentiate safe files from potentially harmful files, you can use the Trusted Locations feature in Office 2013. The Trusted Locations feature lets you designate trusted file sources on the hard disks of users' computers or on a network share. When a folder is designated as a trusted file source, any file that is saved in the folder is assumed to be a trusted file. When a trusted file is opened, all content in the file is enabled and active, and users aren't notified about any potential risks that might be contained in the file. These can include, for example, unsigned add-ins and Microsoft Visual Basic for Applications (VBA) macros, links to content on the Internet, or database connections.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Plan Trusted Locations settings in Office 2013

  • Implement Trusted Locations in Office 2013

  • Disable Trusted Locations in Office 2013

Plan Trusted Locations settings in Office 2013

Office 2013 provides several settings that let you control the behavior of the Trusted Locations feature. By configuring these settings, you can do the following:

  • Specify Trusted Locations globally or on a per-application basis.

  • Allow a network share to be a trusted location.

  • Prevent users from designating Trusted Locations.

  • Disable the Trusted Locations feature.

The Trusted Locations feature is available in the following applications: Access 2013, Excel 2013, InfoPath 2013, PowerPoint 2013, Visio 2013, and Word 2013.

The following list describes the default configuration for the Trusted Locations feature:

  • Trusted Locations is enabled.

  • Users can't designate network shares as Trusted Locations. But, users can change this setting in the Trust Center. See View my options and settings in the Trust Center for user instructions on trusted locations and other user options in the Trust Center.

  • Users can add folders to the Trusted Locations list.

  • Both user-defined and policy-defined Trusted Locations can be used to specify Trusted Locations.

In addition, several folders are designated as Trusted Locations in a default installation of Office 2013. The default folders for each application are listed in the following tables. (InfoPath 2013 and Visio 2013 have no default Trusted Locations.)

Access 2013 Trusted Locations

The following table lists the default trusted location for Access 2013.

Default Trusted Location for Access 2013

Default trusted location | Folder description | Are subfolders trusted also?
Program Files\Microsoft Office 15\Root\Office15\ACCWIZ | Wizard databases | No (Disallowed)

Excel 2013 Trusted Locations

The following table lists the default Trusted Locations for Excel 2013.

Default Trusted Locations for Excel 2013

Default Trusted Locations | Folder description | Are subfolders trusted also?
Program Files\Microsoft Office 15\Root\Templates | Application templates | Yes (Allowed)
Users\user_name\Appdata\Roaming\Microsoft\Templates | User templates | No (Disallowed)
Program Files\Microsoft Office 15\Root\Office15\XLSTART | Excel startup | Yes (Allowed)
Users\user_name\Appdata\Roaming\Microsoft\Excel\XLSTART | User startup | No (Disallowed)
Program Files\Microsoft Office 15\Root\Office15\STARTUP | Office startup | Yes (Allowed)
Program Files\Microsoft Office 15\Root\Office15\Library | Add-ins | Yes (Allowed)

PowerPoint 2013 Trusted Locations

The following table lists the default Trusted Locations for PowerPoint 2013.

Default Trusted Locations for PowerPoint 2013

Default Trusted Locations | Folder description | Are subfolders trusted also?
Program Files\Microsoft Office 15\Root\Templates | Application templates | Yes (Allowed)
Users\user_name\Appdata\Roaming\Microsoft\Templates | User templates | Yes (Allowed)
Users\user_name\Appdata\Roaming\Microsoft\Addins | Add-ins | No (Disallowed)
Program Files\Microsoft Office 15\Root\Document Themes 15 | Application themes | Yes (Allowed)

Word 2013 Trusted Locations

The following table lists the default Trusted Locations for Word 2013.

Default Trusted Locations for Word 2013

Default Trusted Locations | Folder description | Are subfolders trusted also?
Program Files\Microsoft Office 15\Root\Templates | Application templates | Yes (Allowed)
Users\user_name\Appdata\Roaming\Microsoft\Templates | User templates | No (Disallowed)
Users\user_name\Appdata\Roaming\Microsoft\Word\Startup | User startup | No (Disallowed)
Note:

For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

Implement Trusted Locations in Office 2013

To implement Trusted Locations, you must determine the following:

  • The applications for which you want to configure Trusted Locations.

  • The folders that you want to designate as Trusted Locations.

  • The folder sharing and folder security settings that you want to apply to your Trusted Locations.

  • The restrictions that you want to apply to Trusted Locations.

Determine the applications that you want to configure Trusted Locations for

Use the following guidelines to help determine the applications for which you want to configure Trusted Locations:

  • Trusted Locations affect all content in a file. This includes add-ins, ActiveX controls, hyperlinks, links to data sources and media, and VBA macros. Moreover, files that are opened from Trusted Locations skip file validation checks, File Block checks, and don't open in Protected View.

  • Each application provides the same settings for configuring Trusted Locations. This means that you can independently customize Trusted Locations for each application.

  • You can disable Trusted Locations for one or more applications, and implement Trusted Locations for other applications.

Determine the folders to designate as Trusted Locations

Use the following guidelines to help determine the folders that you want to designate as Trusted Locations:

  • You can specify Trusted Locations on a per-application basis or globally.

  • One or more applications can share a trusted location.

  • To prevent malicious users from adding files to a trusted location or from modifying files that are saved in a trusted location, you must apply operating system security settings to any folder that you designate as a trusted location.

  • By default, only Trusted Locations that are on users' hard disks are allowed. To enable Trusted Locations on network shares, you must enable the Allow Trusted Locations on my network (not recommended) setting.

  • We don't recommend that you specify root folders, such as drive C, or the whole Documents or My Documents folder as Trusted Locations. Instead, create a subfolder within those folders and specify only that folder as a trusted location.

In addition, you must use the guidelines in the following sections if you want to:

  • Use environment variables to specify Trusted Locations.

  • Specify web folders (that is, http://paths) as Trusted Locations.

Use environment variables to specify Trusted Locations

You can use environment variables by using Group Policy and the OCT to specify Trusted Locations. But, for environment variables to work correctly when you use them within the OCT, you must change the value type that is used to store Trusted Locations in the registry. If you use an environment variable to specify a trusted location, and you don't make the necessary registry modification, the trusted location appears in the Trust Center, but it's unavailable and it's listed as a relative path that contains the environment variables. After you change the value type in the registry, the trusted location appears in the Trust Center as an absolute path and is available.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To use environment variables to specify Trusted Locations

  1. Use Registry Editor to locate the trusted location that is represented by an environment variable.

    To open Registry Editor, click Start, click Run, type regedit, and then click OK.

    Or, if you are using Windows 8, swipe from the right to reveal the charms, choose the Search charm, and type regedit.

    Trusted Locations that are configured by using the OCT are stored in the following location:

    HKEY_CURRENT_USER/Software/Microsoft/Office/15.0/application_name/Security/Trusted Locations

    Where application_name can be Access, Excel, PowerPoint, Visio, or Word.

    Trusted Locations are stored in registry entries named Path, and they are stored as String Value (REG_SZ) value types. Be sure to locate each Path entry that uses environment variables to specify a trusted location.

  2. Change the Path value type.

    Applications in the Office 2013 can't recognize environment variables that are stored as String Value (REG_SZ) value types. For applications to recognize environment variables, you must change the value type of the Path entry so that it is an Expandable String Value (REG_EXPAND_SZ) value type. To do this, follow these steps:

    1. Write down or copy the value of the Path entry. This should be a relative path that contains one or more environment variables.

    2. Delete the Path entry.

    3. Create a Path entry of type Expandable String Value (REG_EXPAND_SZ).

    4. Change the new Path entry so that it has the same value that you wrote down or copied in the first step.

    Be sure to make this change for each Path entry that uses environment variables to specify a trusted location.

Specify web folders as Trusted Locations

You can specify web folders (that is, http://paths) as Trusted Locations. But, only those web folders that support Web Distributed Authoring and Versioning (WebDAV) or FrontPage Server Extensions Remote Procedure Call (FPRPC) protocols are recognized as Trusted Locations. Use the following guidelines if you aren't sure whether a web folder supports the WebDAV or FPRPC protocols:

  • If you open an application in Internet Explorer, check the most recently used files list. If the most recently used files list indicates that the file is located on a remote server, instead of in the Temporary Internet Files folder, it is likely that the web folder supports WebDAV in some form. For example, if you open a document while browsing Internet Explorer, and it opens in Word 2013, the most recently used files list should show that the document is located on the remote server and not in the local Temporary Internet Files folder.

  • Try to use the Open dialog box to browse to the web folder. If the path supports WebDAV, you probably can browse to the web folder or you are prompted for credentials. If the web folder doesn't support WebDAV, navigation fails and the dialog box closes.

Note:

Sites that are created with SharePoint Server 2013 can be designated as Trusted Locations.

Determine folder sharing and folder security settings for trusted location folders

All folders that you specify as Trusted Locations must be secured. Use the following guidelines to determine which sharing settings and security settings that you have to apply to each trusted location:

  • If a folder is shared, configure sharing permissions so that only authorized users have access to the shared folder. Be sure to use the principle of least privilege and grant permissions that are appropriate to a user. That is, grant Read permission to those users who don't have to change trusted files, and grant Full Control permission to those users who have to change trusted files.

  • Apply folder security permissions so that only authorized users can read or change the files in Trusted Locations. Make sure to use the principle of least privilege and to grant permissions that are appropriate to a user. That is, grant Full Control permissions to only those users who have to change files. Then, grant more-restrictive permissions to those users who need only to read files.

Determine restrictions for Trusted Locations

Office 2013 provides several settings that enable you to restrict or control the behavior of Trusted Locations. Use the following guidelines to determine how to configure these settings.

Group Policy Setting name: Allow mix of policy and user locations

  • Description: This setting controls whether Trusted Locations can be defined by users, the OCT, and Group Policy, or if they must be defined by Group Policy alone. By default, users can designate any location as a trusted location and a computer can have any combination of user-created, OCT-created, and Group Policy-created Trusted Locations.

  • Impact: If this setting is disabled, all Trusted Locations that aren't created by Group Policy are disabled and users can't create new Trusted Locations in the Trust Center. Disabling this setting will cause some disruption for users who have defined their own Trusted Locations in the Trust Center. Applications treat such locations as they treat any other untrusted locations, which means that users see Message Bar warnings about content such as ActiveX controls and VBA macros when they open files, and they have to choose whether to enable controls and macros or leave them disabled This is a global setting that applies to all applications for which you configure Trusted Locations.

  • Guidelines: Organizations that have a highly restrictive security environment typically disable this setting. Organizations that manage their desktop configurations through Group Policy typically disable this setting.

Group Policy Setting name: Allow Trusted Locations on the network

  • Description: This setting controls whether Trusted Locations on the network can be used. By default, Trusted Locations that are network shares are disabled. But users can still select the Allow Trusted Locations on my network (not recommended) check box in the Trust Center, which will enable users to designate network shares as Trusted Locations. This isn't a global setting. You must configure this setting on a per-application basis for Access 2013, Excel 2013, PowerPoint 2013, Visio 2013, and Word 2013.

  • Impact: Disabling this setting disables all Trusted Locations that are network shares and prevents users from selecting the Allow Trusted Locations on my network (not recommended) check box in the Trust Center. Disabling this setting will cause some disruption for users who have defined their own Trusted Locations in the Trust Center. If you disable this setting, and a user attempts to designate a network share as a trusted location, a warning informs the user that the current security settings don't allow them to create Trusted Locations that are remote paths or network paths. If an administrator designates a network share as a trusted location through Group Policy or by using the OCT, and this setting is disabled, the trusted location is disabled. Applications treat such locations like any other untrusted locations, which means that users see Message Bar warnings about content such as ActiveX controls and VBA macros when they open files. They have to choose whether to enable controls and macros or leave them disabled.

  • Guidelines: Organizations that have a highly restrictive security environment typically disable this setting.

Note:

You can also use the Remove all Trusted Locations written by the OCT during installation setting to delete all Trusted Locations that were created by configuring the OCT.

Disable Trusted Locations in Office 2013

Office 2013 provides a setting that enables you to disable the Trusted Locations feature. This setting must be configured on a per-application basis for Access 2013, Excel 2013, PowerPoint 2013, Visio 2013, and Word 2013. Use the following guidelines to determine whether you should use this setting.

Group Policy Setting name: Disable all Trusted Locations

  • Description: This setting lets you disable the Trusted Locations feature on a per-application basis. By default, the Trusted Locations feature is enabled and users can create Trusted Locations.

  • Impact: Enabling this setting disables all Trusted Locations. This includes Trusted Locations that are as follows:

    • Created by default during Setup.

    • Created by using the OCT.

    • Created by users through the Trust Center.

    • Created by using Group Policy.

    Enabling this setting also prevents users from configuring Trusted Locations settings in the Trust Center. If you enable this setting, make sure that you notify users that they can't use the Trusted Locations feature. If users have been opening files from Trusted Locations, and you enable this setting, users might start seeing warnings in the Message Bar and they might be required to respond to Message Bar warnings to enable content, such as ActiveX controls, add-ins, and VBA macros.

  • Guidelines: Organizations that have a highly restrictive security environment typically enable this setting.

Note:

For the latest information about policy settings, refer to the Excel 2013 workbook Office2013GroupPolicyAndOCTSettings_Reference.xlsx that is included in the Office 2013 Administrative Template files. For more information, see the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Configure security by using OCT or Group Policy for Office 2013
Understand security threats and countermeasures for Office 2013
Plan and configure Trusted Publishers settings for Office 2013


Plan security settings for add-ins for Office 2013

Published: February 5, 2013

Summary: Explains how to control the way that add-ins behave in Office 2013, and how to prevent users from running add-ins.

Applies to: Office | Office 365 ProPlus

Audience: IT Professionals

Modify Office 2013 add-in settings to reduce the potential security risks that are posed by unknown or untrusted add-ins to Office 2013 applications.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Plan add-in settings in Office 2013

  • Disable add-ins on a per-application basis in Office 2013

  • Require that Office 2013 application add-ins are signed by trusted publisher

  • Disable notifications for unsigned add-ins

Plan add-in settings in Office 2013

Office 2013 provides several settings that enable you to control the behavior of add-ins. By configuring these settings, you can do the following:

  • Disable add-ins on a per-application basis.

  • Require that add-ins are signed by a trusted publisher.

  • Disable notifications for unsigned add-ins.

You can configure add-in settings only on a per-application basis. There are no global add-in settings.

For detailed information about the settings that are discussed in this article, see Security policies and settings in Office 2010. For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

By default, any add-in that is installed and registered can run without requiring user intervention or warning. Installed and registered add-ins can include the following:

  • Component Object Model (COM) add-ins

  • Visual Studio Tools for Office (VSTO) add-ins

  • Automation add-ins

  • RealTimeData (RTD) servers

  • Application add-ins (for example, .wll, .xll, and .xlam files)

  • XML expansion packs

  • XML style sheets

This default behavior is the same as selecting the Trust all installed add-ins and templates setting in Office 2003 or an earlier Office system.

Disable add-ins on a per-application basis in Office 2013

Office 2013 provides a setting that enables you to disable add-ins. Use the following guidelines to determine whether to use this setting.

Group Policy setting name: Disable all application add-ins

  • Description: This setting disables all add-ins. By default, all installed and registered add-ins can run.

  • Impact: If you enable this setting, add-ins are disabled and users are not notified that add-ins are disabled. Enabling this setting could cause significant disruptions for users who work with add-ins. If users have business-critical add-ins installed, you might be unable to enable this setting.

  • Guidelines: Most organizations use the default configuration for this setting and do not change it.

Require that Office 2013 application add-ins are signed by trusted publisher

Office 2013 provides a setting that enables you to require that all add-ins be signed by a trusted publisher. Use the following guidelines to determine whether to use this setting.

Group Policy setting name: Require that application add-ins are signed by trusted publisher

  • Description: This setting controls whether add-ins must be digitally signed by a trusted publisher. By default, the publisher of an add-in does not have to be on the Trusted Publishers list for an add-in to run.

  • Impact: When you enable this setting, add-ins that are signed by a publisher that is on the Trusted Publishers list will run without notification. Unsigned add-ins and add-ins that are signed by a publisher that is not on the Trusted Publishers list will be disabled, but users are prompted to enable the add-ins, even though they won't be able to enable unsigned and untrusted add-ins. Enabling the Require that application add-ins are signed by trusted publisher setting could cause disruptions for users who rely on add-ins that are not signed by trusted publishers. These users will either have to obtain signed versions of such add-ins or stop using them.

  • Guidelines: Organizations that have a highly restrictive security environment typically enable this setting.

Disable notifications for unsigned add-ins

Office 2013 provides a setting that enables you to prevent users from seeing Message Bar warnings when unsigned add-ins can't run. Use the following guidelines to determine whether to use this setting.

Group Policy setting name: Disable Trust Bar Notification for unsigned application add-ins

  • Description: This setting controls whether to notify users when unsigned application add-ins are loaded or silently disable such add-ins without notification. By default, a warning appears in the Message Bar when an unsigned add-in attempts to run.

  • Impact: If you enable this setting, users won't see a warning in the Message Bar when an unsigned add-in attempts to run. Users won't be able to enable the unsigned add-in. Enabling this setting could cause disruptions for users who rely on add-ins that are not signed by trusted publishers. These users will either have to obtain signed versions of such add-ins or stop using them.

  • Guidelines: Organizations that have a highly restrictive security environment typically enable this setting if they require that all add-ins be signed by a trusted publisher.

Note:

For the latest information about policy settings, refer to the Office 2013 Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Understand security threats and countermeasures for Office 2013
Plan security settings for ActiveX controls for Office 2013
Plan security settings for VBA macros for Office 2013


Plan security settings for ActiveX controls for Office 2013

Published: February 5, 2013

Summary: Explains how to change settings to make Microsoft ActiveX controls safer in Office 2013 and how to Use Office 2013 Telemetry Dashboard to investigate ActiveX control warnings.

Applies to: Office 365 ProPlus

Audience: IT Professionals

Active content threats are common security threats. Typical threat risks include ActiveX controls, add-ins, and VBA macros. These threat vulnerabilities can be exploited by programmers who write malicious code or create malicious programs that then run on users' computers. Active content threats pose a potential risk to any size organization. This article describes ways that Office 2013 can help you make ActiveX controls safer. Add-in and VBA macro safety are covered in other articles.

Office 2013 provides several security settings that let you change the way ActiveX controls behave and change how users are notified about potentially unsafe ActiveX controls. By configuring these settings, you can:

  • Disable ActiveX controls

  • Change how ActiveX controls are initialized based on the safe mode parameters and the Safe for Initialization (SFI) and Unsafe for Initialization (UFI) parameters

For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Plan settings for ActiveX controls in Office 2013

  • Disable ActiveX controls in Office 2013

  • Change the way ActiveX controls are initialized in Office 2013

  • Related ActiveX control settings for Office 2013

Plan settings for ActiveX controls in Office 2013

A trusted ActiveX control is any ActiveX control that is signed by a trusted publisher or contained in a document that is opened from a trusted location or considered a trusted document. By default, trusted ActiveX controls are loaded in safe mode with persistent values and users aren't notified that the ActiveX controls are loaded. Untrusted ActiveX controls load differently, depending on how the ActiveX control is marked and whether a VBA project exists in the file together with the ActiveX control. The default behavior of untrusted ActiveX controls is as follows:

  • If an ActiveX control is marked Safe for Initialization (SFI) and it is contained in a document that doesn't contain a VBA project, the ActiveX control is loaded in safe mode with persistent values. The Message Bar doesn't appear and users aren't notified about the presence of the ActiveX control. All ActiveX controls in the document must be marked SFI for this behavior to occur.

  • If an ActiveX control is marked Unsafe for Initialization (UFI) and it is contained in a document that doesn't contain a VBA project, users are notified in the Message Bar that ActiveX controls are disabled. But, users can click or tap the Message Bar to enable ActiveX controls. If a user enables ActiveX controls, all ActiveX controls (those marked UFI and SFI) are loaded in safe mode with persistent values.

  • If an ActiveX control marked UFI or SFI is contained in a document that also contains a VBA project, users are notified in the Message Bar that ActiveX controls are disabled. But, users can select the Message Bar to enable ActiveX controls. If a user enables ActiveX controls, all ActiveX controls (those marked SFI and UFI) are loaded in safe mode with persistent values.

Important:

If a kill bit is set in the registry for an ActiveX control, the control isn't loaded and can't be loaded under any circumstance. In addition, the Message Bar doesn't appear and users aren't notified about the presence of the ActiveX control.

Use Office 2013 Telemetry Dashboard to see ActiveX control data

You can easily get some visibility into ActiveX control usage in your organization by reviewing data in Office 2013Telemetry Dashboard. There is a built-in report named "Inventory" that collects and displays unique instance data about each Office solution that is monitored. This includes use of ActiveX controls in Office documents.

The following procedure assumes that you have already deployed and configured OfficeTelemetry Dashboard. For information about OfficeTelemetry Dashboard in general, see Overview of Office Telemetry. For details about how to deploy Office Telemetry, see Deploy Telemetry Dashboard.

To view ActiveX control usage in an Office 2013 Telemetry Dashboard report

  1. Open Telemetry Dashboard and connect to your telemetry database.

  2. In the navigation pane of Telemetry Dashboard, select Custom report.

  3. When the Custom report page opens, choose Create custom report.

  4. In the PivotTable Fields list, Inventory section, find and select Has ActiveX. Review the report for any ActiveX related warnings. If you need to investigate further, select additional fields in the Inventory table.

  5. Save the data if you'd like, then close the Telemetry Dashboard.

Disable ActiveX controls in Office 2013

Office 2013 provides a setting that enables you to disable ActiveX controls. Disabling ActiveX controls prevents all ActiveX controls in a file from initializing (that is, loading) when a file is opened. It also prevents users from adding ActiveX controls to a document. In some cases, a disabled ActiveX control might appear in a file as a red x or some other symbol. But, the control is disabled and no action occurs if a user selects the symbol. When you disable ActiveX controls, users aren't notified that the controls are disabled.

Use the following guidelines to determine whether to disable ActiveX controls.

Group Policy setting name: Disable All ActiveX

  • Description: This setting controls whether ActiveX controls are disabled in Office 2013. This is a global setting and can't be configured on a per-application basis.

  • Impact: If you enable this setting, ActiveX controls do not initialize and users aren't notified that the ActiveX controls are disabled. Also, users can't insert ActiveX controls into documents. ActiveX controls can provide additional functionality in documents. Therefore, disabling them can reduce functionality for users. You should make sure that users are aware that this setting is enabled, because they aren't notified by the application that ActiveX controls are disabled. It is also important to determine whether ActiveX controls are used to provide business-critical functionality before you enable this setting.

  • Guidelines: Organizations that have a highly restrictive security environment typically enable this setting.

Note:

If you enable this setting, ActiveX controls are disabled in files that are saved in trusted locations.

You can also use the Office COM kill bit, which was introduced in Office 2013, to prevent specific COM objects from running within Office 2013 applications. . This includes ActiveX controls. This capability was available in the 2007 Office system. But, it was dependent on the Internet Explorer ActiveX kill bit setting. Now, in Office 2013, you can use the registry to independently control which COM objects won't be able to run when they use Office 2013. If, for example, the kill bit is set for the same ActiveX control in both Office and Internet Explorer, and there is a conflict between the two settings, the Office COM kill bit has precedence. A common scenario where you would see the Office COM kill bit set is when you apply an update that is included in a Microsoft Security Bulletin to address a specific Office 2013 security issue.

Warning:

We do not recommend unkilling a COM object. If you undo the kill action, you might create security vulnerabilities. The kill bit is typically set for a reason that might be critical, and because of this, you must use extreme care when you unkill an ActiveX control.

It is possible to add an AlternateCLSID (also known as a "Phoenix bit") when you need to correlate the CLSID of a new ActiveX control. This is necessary when an Office COM kill bit has been applied to the CLSID of an ActiveX control to mitigate a security threat. Office 2013 supports using the AlternateCLSID only together with ActiveX control COM objects. For more information about kill bit behavior, including AlternateCLSID, see How to stop an ActiveX control from running in Internet Explorer.

Important:

Don't change registry settings unless you are highly experienced and understand the ramifications. Serious problems might occur if you change the registry incorrectly. For added protection, back up the registry before you change it. Then, you can restore the registry if a problem occurs.

The location for setting the Office COM kill bit in the registry is HKLM/Software/Microsoft/Office/Common/COM Compatibility/{CLSID}, where CLSID is the class identifier of the COM object. To enable the Office COM kill bit, you must add the registry key, including the CLSID of the ActiveX control, and add the value of 0x00000400 to the Compatibility Flags REG_DWORD.

Note:

The behavior of the kill bit (both Internet Explorer and Office COM) can be affected by enabling COM categorization in Office 2013. For more information, see Plan COM object categorization settings for Office 2013.

Controls that you may want to consider putting onto the Office deny list:

  • Microsoft HTA Document 6.0 - 3050F5C8-98B5-11CF-BB82-00AA00BDCE0B

  • htmlfile - 25336920-03F9-11CF-8FD0-00AA00686F13

  • htmlfile_FullWindowEmbed - 25336921-03F9-11CF-8FD0-00AA00686F13

  • mhtmlfile - 3050F3D9-98B5-11CF-BB82-00AA00BDCE0B

  • Web Browswer Control - 8856F961-340A-11D0-A96B-00C04FD705A2

  • DHTMLEdit - 2D360200-FFF5-11d1-8d03-00a0c959bc0a

Change the way ActiveX controls are initialized in Office 2013

Office 2013 provides a setting that enables you to control the way ActiveX controls are initialized based on SFI, UFI, and safe mode parameters. SFI, UFI, and safe mode are parameters that developers can configure when they create ActiveX controls. ActiveX controls that are marked SFI use safe data sources when they are initialized. A safe data source is one that is trusted, known, and doesn't cause a security breach. Controls that aren't marked SFI are considered UFI.

Safe mode is another security mechanism that developers can use to help ensure the safety of ActiveX controls. When a developer creates an ActiveX control that implements safe mode, the control can be initialized in two ways: in safe mode or in unsafe mode. When an ActiveX control is initialized in safe mode, certain restrictions that limit functionality are imposed on the control. Conversely, when an ActiveX control is initialized in unsafe mode, there are no restrictions on its functionality. For example, an ActiveX control that reads and writes files might only be able to read files if it is initialized in safe mode, and it might be able to read and write files when it is initialized in unsafe mode. Only ActiveX controls that are SFI can be initialized in safe mode. ActiveX controls that are UFI are always initialized in unsafe mode.

If the default initialization for ActiveX controls is insufficient for your organization but you do not want to disable ActiveX controls, use the following guidelines to determine how you can change the way ActiveX controls are initialized.

Group Policy setting name: ActiveX Control Initialization

  • Description: This setting specifies how ActiveX controls are initialized for all Office 2013 applications. This is a global setting and can't be configured on a per-application basis. You can select one of six possible initialization security levels for this setting:

    • Security level 1 Regardless of how the control is marked, load it and use persistent values (if any). This setting prevents users from being prompted.

    • Security level 2 If the control is marked SFI, load the control in safe mode and use persistent values (if any). If the control isn't marked SFI, load in unsafe mode with persistent values (if any), or use the default (first-time initialization) settings. This level resembles the default configuration, but unlike the default configuration, this setting prevents users from being notified.

    • Security level 3 If the control is marked SFI, load the control in unsafe mode and use persistent values (if any). If the control isn't marked SFI, prompt the user and advise them that it is marked unsafe. If the user decides No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings.

    • Security level 4 If the control is marked SFI, load the control in safe mode and use persistent values (if any). If the control isn't marked SFI, prompt the user and advise them that it is marked unsafe. If the user decides No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings.

    • Security level 5 If the control is marked SFI, load the control in unsafe mode and use persistent values (if any). If the control isn't marked SFI, prompt the user and advise them that it is marked unsafe. If the user decides No at the prompt, do not load the control. Otherwise, load it with persistent values.

    • Security level 6 If the control is marked SFI, load the control in safe mode and use persistent values (if any). If the control isn't marked SFI, prompt the user and advise them that it is marked unsafe. If the user decides No at the prompt, do not load the control. Otherwise, load it with persistent values.

  • Impact: If a control isn't marked SFI, the control could adversely affect a computer, or it could mean that the developers didn't test the control in all situations and can't know for sure whether it might be compromised in the future. In addition, some ActiveX controls do not respect the safe mode registry setting, and might load persistent data even though you configure this setting. In such cases, ActiveX controls initialize in safe mode. If you enable this setting and select security level 2, 4, or 6, security is increased only for ActiveX controls that are accurately marked as SFI. In situations that involve malicious or poorly designed code, an ActiveX control might be inaccurately marked as SFI.

  • Guidelines: Most organizations enable this setting and select security level 2, which uses the same initialization criteria as the default configuration but doesn't notify users in the Message Bar. Organizations that have a highly restrictive security environment typically disable this setting. Disabled is the default configuration.

Related ActiveX control settings for Office 2013

Several other settings affect how ActiveX controls behave in Office 2013 applications. If you are changing ActiveX control settings because you have a special security environment, you might want to evaluate the following settings:

  • Load Controls in Forms3 This setting determines how ActiveX controls are initialized in UserForms.

  • Disable all Trust Bar notifications for security issues This setting prevents users from seeing Message Bar warnings, including warnings about unsafe ActiveX controls.

Note:

For the latest information about policy settings, refer to the Excel 2013 workbook, Office2013GroupPolicyAndOCTSettings_Reference.xls, which is included in the Office 2013 Administrative Template files. For more information, see the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Configure security by using OCT or Group Policy for Office 2013
Understand security threats and countermeasures for Office 2013
Plan security settings for add-ins for Office 2013
Plan security settings for VBA macros for Office 2013


Plan security settings for VBA macros for Office 2013

Published: February 5, 2013

Summary Explains how VBA and VBA macros settings control the way Visual Basic for Applications (VBA) and VBA macros behave in Office 2013.

Applies to: Office 365 ProPlus

Audience: IT Professionals

If you want to control the way Visual Basic for Applications (VBA) and VBA macros behave, you can change Office 2013 VBA and VBA macros settings for the following applications: Access 2013, Excel 2013, PowerPoint 2013, Publisher 2013, Visio 2013, and Word 2013.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Plan VBA and VBA macro security settings

  • Change the Office 2013 security warning settings for VBA macros

  • Disable VBA in Office 2013

  • Change how Office 2013 VBA macros behave in applications that are started programmatically

  • Change how encrypted VBA macros are scanned for viruses in Office 2013

  • Related Office 2013 VBA macro settings

Plan VBA and VBA macro security settings

Office 2013 provides several settings that enable you to control the behavior of VBA and VBA macros. By configuring these settings, you can do the following:

  • Change the security warning settings for VBA macros. This includes disabling VBA macros, enabling all VBA macros, and changing the way that users are notified about VBA macros.

  • Disable VBA.

  • Change how VBA macros behave in applications that are started programmatically through Automation.

  • Change how antivirus software scans encrypted VBA macros.

For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

By default, VBA is enabled and trusted VBA macros are allowed to run. This includes VBA macros in documents that are saved in a trusted location, VBA macros in trusted documents, and VBA macros that meet the following criteria:

  • The macro is signed by the developer who uses a digital signature.

  • The digital signature is valid.

  • This digital signature is current (not expired).

  • The certificate associated with the digital signature was issued by a reputable certification authority (CA).

  • The developer who signed the macro is a trusted publisher.

Note:

The default security setting for macros is different in Outlook 2013. For more information, see the Outlook 2013 security documentation.

VBA macros that aren't trusted aren't allowed to run until a user clicks the Message Bar and selects to enable the VBA macro.

Use Office 2013 Telemetry Dashboard to see VBA macro usage data

You can easily get some visibility into VBA macro usage in your organization by reviewing data in Office 2013Telemetry Dashboard. There is a built-in report named "Inventory" that collects and displays unique instance data about each Office solution that is monitored. This includes whether an Office document uses VBA macros.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To use the following procedure you must have already deployed and configured OfficeTelemetry Dashboard. For information about OfficeTelemetry Dashboard in general, see Overview of Office Telemetry. For details about how to deploy Office Telemetry, see Deploy Telemetry Dashboard.

To view VBA macro usage in an Office 2013 Telemetry Dashboard report

  1. Open Telemetry Dashboard and connect to your telemetry database.

  2. In the navigation pane of Telemetry Dashboard, choose Custom report.

  3. When the Custom report page opens, choose Create custom report.

  4. In the PivotTable Fields list, Inventory section, find and select Has VBA. Review the report for any VBA related warnings. If you need to investigate more, select additional fields in the Inventory table.

  5. Save the data if you'd like, then close the Telemetry Dashboard.

Change the Office 2013 security warning settings for VBA macros

Office 2013 provides a setting that enables you to change the security warning settings and the behavior of VBA macros. Use the following guidelines to determine how to configure this setting if you want to change how users are notified about untrusted VBA macros or change the default behavior of VBA macros.

Group Policy setting name: VBA Macro Notification Settings

  • Description: This setting controls how applications warn users about Visual Basic for Applications (VBA) macros. You configure this setting on a per-application basis for Access 2013, Excel 2013, PowerPoint 2013, Publisher 2013, Visio 2013, and Word 2013. You can select one of four possible options for this setting:

    • Disable all with notification The application displays the Trust Bar for all macros, whether signed or unsigned. This is the default setting.

    • Disable all except digitally signed macros The application displays the Trust Bar for digitally signed macros. This allows users to enable them or leave them disabled. Any unsigned macros are disabled, and users aren't notified or given the ability to enable the unsigned macros.

    • Disable all without notification The application disables all macros, whether signed or unsigned, and doesn't notify users.

    • Enable all macros (not recommended; potentially dangerous code can run) All macros are enabled, whether signed or unsigned. This option can significantly reduce security by letting dangerous code to run undetected.

  • Impact: If you enable this setting and select the Disable all except digitally signed macros option, documents and templates that contain unsigned macros lose all functionality supplied by those macros. To prevent this loss of functionality, users can put files that contain macros in a trusted location.

    Important:

    If Disable all except digitally signed macros is selected, users can't open unsigned Access 2013 databases.

    If you select Disable all without notification, documents and templates that contain unsigned and signed macros lose all functionality that is supplied by those macros. This is true even if a macro is signed and the publisher is listed in the Trusted Publisher list.

  • Guidelines: Organizations that have a highly restrictive security environment typically enable this setting and select the Disable all except digitally signed macros option. Organizations that don't let users run macros typically enable this setting and select Disable all without notification.

Disable VBA in Office 2013

Office 2013 provides a Group Policy setting that enables you to disable VBA. By default, VBA is enabled. Use the following guidelines to determine how to configure this setting if you want to disable VBA.

Note:

You can only disable VBA by using Group Policy. There isn't a Trust Center equivalent.

Group Policy setting name: Disable VBA for Office applications

  • Description: This setting disables VBA in Excel 2013, Outlook 2013, PowerPoint 2013, Publisher 2013, SharePoint Designer 2013, and Word 2013, and prevents any VBA code from running in these applications. You can't configure this setting on a per-application basis. It's a global setting. Enabling this setting doesn't install or remove any VBA-related code from a user's computer.

  • Impact: If you enable this setting, VBA code doesn't run. If your organization has business-critical requirements for using documents that have VBA code, don't enable this setting.

  • Guidelines: Organizations that have highly restrictive security environments typically enable this setting.

Change how Office 2013 VBA macros behave in applications that are started programmatically

Office 2013 provides a setting that enables you to change the way VBA macros behave in applications that are started programmatically through Automation. By default, when a separate program is used to programmatically start Excel 2013, PowerPoint 2013, or Word 2013, any macros can run in the application that was programmatically started. Use these guidelines to determine how to configure this setting if you want to do the following:

  • Prevent macros from running in applications that are programmatically started through Automation.

  • Allow VBA macros to run according to the VBA macro security settings that are configured for the applications that are programmatically started through Automation.

Group Policy setting name: Automation Security

  • Description: This setting controls whether macros can run in an application that is opened programmatically by another application. This setting is a global setting and applies to Excel 2013, PowerPoint 2013, and Word 2013. You can't configure this setting on a per-application basis. You can choose one of three options for this setting:

    • Disable macros by default All macros are disabled in the programmatically opened application.

    • Macros enabled (default) Macros are allowed to run in the programmatically opened application. This option enforces the default configuration.

    • Use application macro security level Macro functionality is determined according to how you configure the VBA macro warning settings setting for each application.

  • Impact: If you enable this setting and select the Disable macros by default option, macros won't run in applications that are programmatically started. This can be a problem if an application is started programmatically and then opens a document or a template that contains macros. In this case, the functionality that is provided by the macros is not available. The same situation might occur if you select the Use application macro security level option and you disable macros using the VBA macro warning settings setting.

  • Guidelines: Most organizations enable this setting and select the Use application macro security level option. But, organizations that have a highly restrictive security environment typically enable this setting and select the Disable macros by default option.

Change how encrypted VBA macros are scanned for viruses in Office 2013

Office 2013 provides a setting that enables you to change the way encrypted VBA macros are scanned by antivirus software in Excel 2013, PowerPoint 2013, and Word 2013. By default, if a document, presentation, or workbook is encrypted and contains VBA macros, the VBA macros are disabled unless antivirus software is installed on the client computer. In addition, encrypted VBA macros are scanned by the client computer's antivirus software when a user opens a document that contains encrypted macros. Use these guidelines to determine how to configure this setting if you want to do the following:

  • Allow all encrypted VBA macros to run without being scanned by antivirus software.

  • Scan encrypted VBA macros if antivirus software is installed, but enable encrypted VBA macros if no antivirus software is installed.

Group Policy setting names: Scan encrypted macros in Excel Open XML documents, Scan encrypted macros in PowerPoint Open XML documents, Scan encrypted macros in Word Open XML documents

  • Description: This setting controls the way encrypted VBA macros undergo virus scanning. This setting is a per-application setting and can be configured for Excel 2013, PowerPoint 2013, and Word 2013. You can choose one of three options for this setting:

    • Scan encrypted macros (default). All encrypted VBA macros are disabled unless they are scanned by antivirus software. This option enforces the default configuration.

    • Scan if anti-virus software available. Encrypted VBA macros are disabled unless they are scanned by antivirus software. However, if no antivirus software is installed on the client computer, all encrypted VBA macros are enabled.

    • Load macros without scanning. Encrypted VBA macros are enabled and aren't scanned, regardless of whether antivirus software is installed on the client computer.

  • Impact: If you enable this setting and select the Load macros without scanning option, security could be significantly reduced by encrypted macros that have not been scanned for viruses. The same is true if the client computer doesn't have antivirus software installed and you enable this setting and select the Scan if anti-virus software available option

  • Guidelines: Most organizations use the default configuration for this setting and don't change this setting.

Related Office 2013 VBA macro settings

Two other settings affect how VBA macros behave in Office 2013 applications. If you are changing VBA macro settings because you have a special security environment, you might want to evaluate the following settings:

Group Policy setting name: Trust access to Visual Basic project

Description: This setting determines whether automation clients can access the VBA project. This setting is a per application setting and can be set individually for Excel 2013, PowerPoint 2013, and Word 2013.

Group Policy setting name: Disable all Trust Bar notifications for security issues

Description: This setting prevents users from seeing Message Bar warnings, such as warnings about unsafe VBA macros. This is a global setting that applies to Excel 2013, PowerPoint 2013, and Word 2013. You can't configure this setting on a per-application basis.

Note:

For the latest information about policy settings, refer to the Excel 2013 workbook Office2013GroupPolicyAndOCTSettings_Reference.xls that is included in the Office 2013 Administrative Template files. For more information, see the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool Technet article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Understand security threats and countermeasures for Office 2013
Plan security settings for add-ins for Office 2013
Plan security settings for ActiveX controls for Office 2013


Plan Protected View settings for Office 2013

Published: February 5, 2013

Summary: Explains how to configure Protected View settings in Office 2013.

Applies to: Office | Office 365 ProPlus

Audience: IT Professionals

Change how the sandbox preview feature in Office 2013 behaves by configuring Protected View settings. Protected View is a security feature in Office 2013 that helps reduce exploits to your computer by opening files in a restricted environment so they can be examined before they are opened for editing in Excel 2013, PowerPoint 2013, or Word 2013.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Plan Protected View settings in Office 2013

  • Prevent files from opening in Protected View in Office 2013

  • Force files to open in Protected View in Office 2013

  • Add files to the list of unsafe files

Plan Protected View settings in Office 2013

Protected View helps mitigate several kinds of exploits by opening documents, presentations, and workbooks in a sandbox environment. A sandbox is a piece of computer memory or a specific computer process that is isolated from certain operating system components and applications. Because of this isolation, programs and processes that run in a sandbox environment are considered less dangerous. Sandbox environments are frequently used to test new applications and services that might otherwise make a computer unstable or fail. Sandbox environments are also used to prevent applications and processes from harming a computer.

When a file is opened in Protected View, users can view the file content but they can't edit, save, or print the file content, or view the details of any digital signatures in the file. Active file content, such as ActiveX controls, add-ins, database connections, hyperlinks, and Visual Basic for Applications (VBA) macros, is not enabled. Users can however, copy content from the file and paste it into another document.

Default behavior of Protected View in Office 2013

By default, Protected View is enabled in Excel 2013, PowerPoint 2013, and Word 2013, but files open in Protected View only under certain conditions. In some cases, files bypass Protected View and are opened for editing. For example, files that are opened from trusted locations and files that are trusted documents bypass several security checks and are not opened in Protected View.

By default, files open in Protected View if any one of the following conditions is true:

  • A file skips or fails Office File Validation Office File Validation is a security feature that scans files for file format exploits. If Office File Validation detects a possible exploit or some other unsafe file corruption, the file opens in Protected View.

  • AES zone information determines that a file is not safe Attachment Execution Services (AES) adds zone information to files that are downloaded by Outlook, Internet Explorer, and some other applications. If a file's zone information indicates that the file originated from an untrusted website or the Internet, the downloaded file opens in Protected View.

  • A user opens a file in Protected View Users can open files in Protected View by choosing Open in Protected View in the Open dialog box, or by holding down the SHIFT key, choosing a file name, and, from its shortcut menu (right-click), choosing Open in Protected View.

  • A file is opened from an unsafe location By default, unsafe locations include the user's Temporary Internet Files folder and the downloaded program files folder. But, you can use Group Policy settings to designate other unsafe locations.

In some cases, Protected View is bypassed even if one or more of the previously listed conditions are met. Specifically, files do not open in Protected View if either of the following is true:

  • A file is opened from a trusted location.

  • A file is considered a trusted document.

Change Protected View behavior in Office 2013

We recommend that you do not change the default behavior of Protected View. Protected View is an important part of the layered defense strategy in Office 2013, and is designed to work with other security features such as Office File Validation and File Block. But, we recognize that some organizations might have to change Protected View settings to suit special security requirements. Office 2013 provides several settings that let you change how the Protected View feature behaves. You can use these settings to do the following:

  • Prevent files that are downloaded from the Internet from opening in Protected View.

  • Prevent files that are stored in unsafe locations from opening in Protected View.

  • Prevent attachments opened in Outlook 2013 from opening in Protected View.

  • Add locations to the list of unsafe locations.

In addition, you can use File Block settings and Office File Validation settings to force files to open in Protected View. For more information, see Force files to open in Protected View in Office 2013 later in this article.

Note:

For detailed information about the settings that are discussed in this article, see Security policies and settings in Office 2013. For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

Prevent files from opening in Protected View in Office 2013

You can change Protected View settings so that certain files bypass Protected View. To do so, disable the following settings in the Trust Center:

  • Enable Protected View for files originating from the Internet Disable this setting to force files to bypass Protected View if the AES zone information indicates that the file was downloaded from the Internet zone. This setting applies to files that are downloaded by using Internet Explorer and Outlook.

  • Enable Protected View for files that are located in potentially unsafe locations Disable this setting to force files to bypass Protected View if the files are opened from an unsafe location. You can add folders to the unsafe locations list by using the Specify list of unsafe locations setting, which is discussed later in this article.

  • Enable Protected View Outlook attachments Disable this setting to force Excel 2013, PowerPoint 2013, and Word 2013 files that are opened as Outlook 2013 attachments to bypass Protected View.

These settings do not apply if File Block settings force the file to open in Protected View. Also, these settings do not apply if a file fails Office File Validation. You can configure each of these settings on a per-application basis for Excel 2013, PowerPoint 2013, and Word 2013.

Force files to open in Protected View in Office 2013

The File Block and Office File Validation features have settings that let you force files to open in Protected View when certain conditions are met. You can use these settings to determine the circumstances under which files open in Protected View.

Use File Block to force Office 2013 files to open in Protected View

The File Block feature lets you prevent users from opening or saving certain file types. When you use File Block settings to block a file type, you can choose one of three file block actions:

  • Blocked and not allowed to open.

  • Blocked and opened only in Protected View (users can't enable editing).

  • Blocked and opened in Protected View (users can enable editing).

By selecting the second or third option, you can force blocked file types to open in Protected View. You can configure File Block settings only on a per-application basis for Excel 2013, PowerPoint 2013, and Word 2013. For more information about File Block settings, see Plan file block settings for Office 2013.

Use Office File Validation settings to force Office 2013 files to open in Protected View

Office File Validation is a security feature that scans files for file format exploits before they are opened by an Office 2013 application. By default, files that fail Office File Validation are opened in Protected View and users can enable editing after previewing the file in Protected View. But, you can use the Group Policy Protected View setting Set document behavior if file validation fails to change this default behavior. You can use this setting to select one of two possible options for files that fail Office File Validation:

  • Block completely Files that fail Office File Validation can't be opened in Protected View or opened for editing.

  • Open in Protected View Files that fail Office File Validation are opened in Protected View but users can't edit the files. This is the default.

By selecting the second option, you can restrict Protected View behavior for files that fail Office File Validation. You can configure this Office File Validation setting only on a per-application basis for Excel 2013, PowerPoint 2013, and Word 2013. For more information about Office File Validation settings, see Plan Office File Validation settings for Office 2013.

Add files to the list of unsafe files

You can use the Specify list of unsafe locations setting to add locations to the unsafe locations list. Files that are opened from unsafe locations are always opened in Protected View. The unsafe locations feature does not prevent users from editing a document. It only forces a document to open in Protected View before it is edited. This is a global setting that applies to Excel 2013, PowerPoint 2013, and Word 2013.

Note:

For the latest information about policy settings, refer to the Office 2013 Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool article.

See also

Content roadmap for Office 2013 security
Overview of security in Office 2013
Understand security threats and countermeasures for Office 2013
Plan file block settings for Office 2013
Plan Office File Validation settings for Office 2013


Plan file block settings for Office 2013

Published: February 5, 2013

Summary: Provides information about the settings to block specific file format types for Excel 2013, PowerPoint 2013, and Word 2013 users.

Applies to: Office | Office 365 ProPlus

Audience: IT Professionals

You can block specific types of files from being opened or saved in Excel 2013, PowerPoint 2013, and Word 2013 by configuring settings in either Group Policy or the Office Customization Tool (OCT).

File block settings are most frequently used to:

  • Force an organization to use specific file formats.

  • Mitigate zero-day security attacks by temporarily preventing users from opening specific types of files. Zero-day security attacks are attacks that occur between the time that vulnerability becomes publicly known and a software update or service pack becomes available.

  • Prevent an organization from opening files that were saved in earlier and pre-release Office formats.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • Planning considerations for configuring file block settings

  • Group Policy and OCT settings

Planning considerations for configuring file block settings

Here are some things to think about as you plan your file block settings:

  • Decide whether you want users to be able to change your configurations.

    • If you do not want users to be able to change your configurations, use Group Policy to configure file block settings policies.

    • If you do want users to be able to change your configurations, use the OCT to set file block settings preferences. If you use the OCT to set file block settings, users can change these settings by using the Trust Center. The Trust Center is available to them from the File tab in Word, Excel, or PowerPoint. From the File tab, they choose Options, then Trust Center. From the Trust Center, they choose Trust Center Settings and then File Block Settings.

  • Block open settings do not apply to files that are opened from trusted locations.

  • Block file format settings are application specific. You can't prevent users from using other applications to open or save file types or formats that are blocked. For example, you can enable block file format settings that prevent users from opening .dot files in Word 2013, but users will still be able to open .dot files by using Publisher 2013 because Publisher 2013 uses a converter to read the .dot file.

  • If Message Bar notifications are disabled, the block file format warning dialog box will still appear if the user tries to open a blocked file type. Examples of file types that you can block from opening are Word 2007 or later documents or templates, or PowerPoint outline files, among many other files types.

Group Policy and OCT settings

This section describes how to find the settings in Group Policy and the OCT, and lists the settings for Excel 2013, PowerPoint 2013, and Word 2013.

How to find the settings

  • Group Policy settings are available under the User Configuration/Administrative Templates node of the Local Group Policy Editor.

    Note:

    The locations in the Group Policy Editor that are presented in this article apply when you open the Group Policy Editor to edit a GPO. To edit local Group Policy, use the Local Group Policy Editor. To edit domain-based Group Policy, use the Group Policy Management Console (GPMC). Either tool opens the Group Policy Editor when you edit a GPO. For more information, see Overview of Group Policy for Office 2013.

  • OCT policy settings are available on the OCT Modify user settings page.

In both Group Policy and the OCT, the specific path of the folder that contains the file block settings for Excel 2013, PowerPoint 2013, and Word 2013 is the same, except for the application name:

  • Excel 2013 file block settings:

    Microsoft Excel 2013\Excel Options\Security\Trust Center\File Block Settings

  • PowerPoint 2013 file block settings:

    Microsoft PowerPoint 2013\PowerPoint Options\Security\Trust Center\File Block Settings

  • Word 2013 file block settings:

    Microsoft Word 2013\Word Options\Security\Trust Center\File Block Settings

Note:

By default, users can set default file block settings in the Trust Center for Excel 2013, PowerPoint 2013, and Word 2013. In Word 2013, for example, on the File tab, users can choose Options, Trust Center, Trust Center Settings, and then choose File Block Settings.

You can disable the file block options in Trust Center options by configuring the settings through Group Policy. If you configure the settings through the OCT, users can change file type behavior through the Trust Center. For more information, see What is File Block?

About the Set default file block behavior setting

The Set default file block behavior setting specifies any of the following:

  • How blocked files open

  • How they don't open

  • How they open in protected view but can't be edited

  • How they open in protected view and can be edited

If you enable this setting, the default file block behavior that you specify applies to any file format that users block by using the Trust Center. The Set default file block setting can also apply to a specific file format if you enable that file format setting and select the Open/Save blocked, use open policy option. For more information about individual file format settings, see the tables in this article. Otherwise, if you configure a single file format setting, that setting overrides the Set default file block behavior setting configuration for that file type.

Note:

The options under Open behavior for selected types in the Trust Center, under File Block Settings, correspond directly to the options in the Set default file block behavior setting. You can disable these UI options for users by enabling the Set default file block behavior setting in Group Policy.

Excel 2013 Group Policy and OCT settings

The following table lists the file block settings in Group Policy and the OCT that you can configure for Excel 2013 users. With the exception of the Set default file block behavior setting, file setting names correspond to the file types that they can block.

Excel 2013 settings

Setting name File extension If you enable this setting, you can select one of the following options: If you disable or do not configure this setting

Set default file block behavior

Users can set blocked file formats in the Trust Center.

See the section About the Set default file block behavior setting for details.

Do not open selected file types.

Open selected types in Protected View.

Open selected types in Protected View and allow editing.

Blocked files aren't opened (users can't open blocked files).

Excel 2007, Excel 2010, and Excel 2013 versions of workbooks and templates

*.xlsx

*.xltx

Do not block: The file type isn't blocked.

Save blocked: Users can't save this file type.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 2007, Excel 2010, and Excel 2013 versions of macro-enabled workbooks and templates

*.xlsm

*.xltm

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 2007, Excel 2010, and Excel 2013 versions of add-in files

*.xlam

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Excel 2007, Excel 2010, and Excel 2013 versions of binary workbooks

*.xlsb

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

OpenDocument Spreadsheet files

*.ods

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 97-2003 add-in files

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Excel 97-2003 workbooks and templates

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 95-97 workbooks and templates

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 95 workbooks

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 4 workbooks

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 4 worksheets

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 3 worksheets

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 2 worksheets

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 4 macrosheets and add-in files

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 3 macrosheets and add-in files

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Excel 2 macrosheets and add-in files

*.xls

*.xla

*.xlt

*.xlm

*.xlw

*.xlb

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Web pages and Excel 2003 XML spreadsheets

*.mht

*.mhtml

*.htm

*.html

*.xml

*.xlmss

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

XML files

*.xml

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Text files

*.txt

*.csv

*.prn

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Excel add-in files

*.xll (.dll)

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

dBase III / IV files

*.dbf

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Microsoft Office query files

*.iqy

*.dqy

*.oqy

*.rqy

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Microsoft Office data connection files

*.odc

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Other data source files

*.udl

*.dsn

*.mdb

*.mde

*.accdb

*.accde

*.dbc

*.uxdc

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Offline cube files

*.cub

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Dif and Sylk files

*.dif

*.slk

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Legacy converters for Excel

All file formats that are opened through a converter

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Microsoft Office Open XML converters for Excel

All file formats that are opened through an OOXML converter

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

PowerPoint 2013 Group Policy and OCT settings

The following table lists the file block settings in Group Policy and the OCT that you can configure for PowerPoint 2013 users. With the exception of the Set default file block behavior setting, file setting names correspond to the file types that they can block.

PowerPoint 2013 settings

Setting name File format extension If you enable this setting, you can select one of the following options If you disable or do not configure this setting

Set default file block behavior

Users can set blocked file formats in the Trust Center.

See the section About the Set default file block behavior setting for details.

Do not open selected file types.

Open selected types in Protected View.

Open selected types in Protected View and allow editing.

Blocked files aren't opened (users can't open blocked files).

PowerPoint 2007, PowerPoint 2010, and PowerPoint 2013 versions of presentations, shows, templates, themes, and add-ins

*.pptx

*.pptm

*.potx

*.ppsx

*.ppam

*.thmx

*.xml

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

OpenDocument Presentation files

*.odp

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

PowerPoint 97-2003 presentations, shows, templates and add-in files

*.ppt

*.pot

*.pps

*.ppa

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Web pages

*.mht

*.mhtml

*.htm

*.html

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Outline files

*.rtf

*.txt

*.doc

*.wpd

*.docx

*.docm

*.wps

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Legacy converters for PowerPoint

Presentation files older than PowerPoint 97

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Graphic Filters

*.jpg

*.png

*.tif

*.bmp

*.wmf

*.emf

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

File format type isn't blocked.

Microsoft Office Open XML converters for PowerPoint

All file formats that are opened through an OOXML converter

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 2013 Group Policy and OCT settings

The following table lists the file block settings in Group Policy and the OCT that you can configure for Word 2013 users. With the exception of the Set default file block behavior setting, file setting names correspond to the file types that they can block.

Word 2013 settings

Setting name File format extension If you enable this setting, you can select one of the following options If you disable or do not configure this setting

Set default file block behavior

Users can set blocked file formats in the Trust Center.

See the section About the Set default file block behavior setting for details.

Do not open selected file types.

Open selected types in Protected View.

Open selected types in Protected View and allow editing.

Blocked files aren't opened (users can't open blocked files).

Word 2007, Word 2010, and Word 2013 versions of documents and templates

*.docx

*.dotx

*.docm

*.dotm

*.xml (Word Flat Open XML)

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

OpenDocument text files

*.odt

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 2007, Word 2010, and Word 2013 versions of binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 2003 binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 2003 and plain XML documents

*.xml

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 2002 binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 200 binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 97 binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 95 binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 6.0 binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Word 2.0 and earlier binary documents and templates

*.doc

*.dot

Do not block: The file type isn't blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Web pages

*.htm

*.html

*.mht

*.mhtml

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

RTF files

*.rtf

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Plain text files

*.txt

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

File format type isn't blocked.

Legacy converters for Word

All file formats that are opened through a converter

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

Office Open XML converters for Word

All file formats that are opened through an OOXML converter

Do not block: The file type isn't blocked.

Save blocked: Saving of the file type is blocked.

Open/Save blocked, use open policy: Both opening and saving of the file type is blocked. The file opens based on the configuration of the Set default file block behavior setting.

Block: Both opening and saving of the file type is blocked, and the file doesn't open.

Open in Protected View: Both opening and saving of the file type is blocked, and the option to edit the file type is disabled.

Allow editing and open in Protected View: Both opening and saving of the file type is blocked, and the option to edit is enabled.

File format type isn't blocked.

See also

Content roadmap for Office 2013 security
Understand security threats and countermeasures for Office 2013
Plan privacy options for Office 2013
Plan Office File Validation settings for Office 2013
Plan Protected View settings for Office 2013
Overview of Group Policy for Office 2013
Office Customization Tool (OCT) reference for Office 2013


Plan privacy options for Office 2013

Published: February 19, 2013

Summary: Explains how Office 2013 privacy settings let you control the disclosure of private information.

Applies to: Office 2013 | Office 365 ProPlus

The Welcome to Office experience lets users enable or disable several Internet-based services that help protect and improve Office 2013 applications. For more information about the Welcome to Office experience, see the Privacy Statement for Microsoft Office 2013 Office.com article.

Important:

This article is part of the Content roadmap for Office 2013 security. Use the roadmap as a starting point for articles, downloads, posters, and videos that help you assess Office 2013 security.

Are you looking for security information about individual Office 2013 applications? You can find this information by searching for "2013 security" on Office.com.

In this article:

  • About planning privacy options for Office 2013

  • Suppress the Welcome to Office experience

  • Configure privacy options in Office 2013

  • Related privacy options

About planning privacy options for Office 2013

The first time that users start Office 2013, they go through the Welcome to Office first run experience.

If users choose to Install important and recommended updates for Office and other products:

  • Recommended and important updates are automatically installed for the Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 and Windows Server 2008 R2 operating systems and Office 2013 applications. Users are notified about new optional software.

  • Applications can connect to Office.com for updated Help content and can receive targeted Help content for the Office 2013 applications that are installed.

  • Applications can periodically download small files that help determine system problems and prompt users to send error reports to Microsoft.

  • Users can sign up for the Customer Experience Improvement Program or the Office Personalized Experience Program (OPEP), depending on the SKU they have installed. For more information about OPEP, see the Microsoft Office Personalized Experience Program Office.com article. For more information about CEIP, see Microsoft Customer Experience Improvement Program.

If users choose Install Updates Only, recommended and important updates are automatically installed for the Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 operating systems and Office 2013 applications. Users are notified about new optional software. But, privacy options aren't changed in Office 2013 applications, which means that the default privacy options take effect. If users choose Don't Make Changes, automatic updating isn't changed in the Windows Security Center and privacy options aren't changed in Office 2013. The default privacy options take effect.

The default privacy options for Office 2013 applications are as follows:

  • Office 2013 applications don't connect to Office.com for updated Help content and Office applications aren't detected on users' computers. Users won't experience optimal results when they search for Help.

  • Office 2013 applications don't download small programs that help diagnose problems and error message information isn't sent to Microsoft.

  • Users aren't enrolled in the Customer Experience Improvement Program.

Because the Welcome to Office experience lets users enable or disable several Internet-based services, you might want to prevent the dialog box from appearing and, instead, configure these services individually. If you suppress the dialog box, we recommend that you enable all Internet-based services, which you can do by configuring privacy options.

Note:

For information about how to configure security settings in the Office Customization Tool (OCT) and the Office 2013 Administrative Templates, see Configure security by using OCT or Group Policy for Office 2013.

Suppress the Welcome to Office experience

You can suppress the Welcome to Office experience by enabling the Suppress recommended settings dialog setting. This Group Policy setting is located in the Group Policy Object Editor under User Configuration\Administrative Templates\(ADM\ADMX)\Microsoft Office 2013\Miscellaneous. This setting prevents the Welcome to Office experience from appearing the first time that a user starts Office 2013. If you enable this setting, the automatic updating feature remains unchanged and the privacy options that control Internet-based services aren't enabled.

If you suppress the Welcome to Office experience without enabling certain privacy options, you disable several features that improve Office 2013 applications and you could expose a computer to security threats. Therefore, if you enable this setting we recommend that you also enable all the privacy options that are discussed in Configure privacy options in Office 2013.

Most organizations enable this setting, including organizations that have a highly restrictive security environment or a security environment that restricts Internet access.

Configure privacy options in Office 2013

Office 2013 provides several settings that let you control the disclosure of private information. These settings are often known as privacy options. You can enable or disable each of these settings to suit your organization's security requirements. But, if you suppress the Welcome to Office experience, we recommend that you also enable all the following settings:

Group Policy setting name: Online content options. This Group Policy setting is located in the Group Policy Object Editor under User Configuration\Administrative Templates\(ADM\ADMX)\Microsoft Office 2013\ Tools | Options | General | Service Options… \ Online Content.

  • Description: This setting controls whether the Office 2013 Help system can download Help content from Office.com. You can choose one of three options for this setting:

    • Never show online content or entry points. The Help system doesn't connect to Office.com to download content. This is the default setting if you suppress the Welcome to Office experience or if users select Don't make changes or Install Updates Only.

    • Search only offline content whenever available. The Help system doesn't connect to Office.com to download content.

    • Search online content whenever available. The Help system connects to Office.com for content when the computer is connected to the Internet.

  • Impact: If you enable this setting and select Never show online content or entry points or Search only offline content whenever available, users can't access updated Help topics through the Help system and you can't get templates from Office.com.

  • Guidelines: Most organizations enable this setting and select Search online content when available. This is the recommended configuration for this setting. But, organizations that have a highly restrictive security environment, or a security environment that restricts Internet access, typically enable this setting and select Never show online content or entry points.

Group Policy setting name: Automatically receive small updates to improve reliability. This Group Policy setting is located in the Group Policy Object Editor under User Configuration\Administrative Templates\(ADM\ADMX)\Microsoft Office 2013\ Privacy\Trust Center.

  • Description: This setting controls whether client computers periodically download small files that enable Microsoft to diagnose system problems.

  • Impact: If you enable this setting, Microsoft collects information about specific errors and the IP address of the computer. No personally identifiable information is transmitted to Microsoft other than the IP address of the computer requesting the update.

  • Guidelines: Most organizations enable this setting, which is the recommended configuration. Organizations that have a highly restrictive security environment, or a security environment that restricts Internet access, typically disable this setting.

Group Policy setting name: Enable Customer Experience Improvement Program (CEIP). This Group Policy setting is located in the Group Policy Object Editor under User Configuration\Administrative Templates\(ADM\ADMX)\Microsoft Office 2013\Privacy\Trust Center.

  • Description: This setting controls whether users participate in the CEIP to help improve Office 2013. When users participate in the CEIP, Office 2013 applications automatically send information to Microsoft about how the applications are used. This information is combined with other CEIP data to help Microsoft solve problems and improve the products and features customers use most often. CEIP doesn't collect users' names, addresses, or any other identifying information except the IP address of the computer that is used to send the data.

  • Impact: If you enable this setting, users participate in the CEIP.

  • Guidelines: Most organizations enable this setting, which is the recommended configuration. Organizations that have a highly restrictive security environment, or a security environment that restricts Internet access, typically don't enable this setting.

Group Policy setting name: Improve Proofing Tools. This Group Policy setting is located in the Group Policy Object Editor under User Configuration\Administrative Templates\(ADM\ADMX)\Microsoft Office 2013\Tools\Options\Spelling.

  • Description: This setting controls whether the Help Improve Proofing Tools feature sends usage data to Microsoft. The Help Improve Proofing Tools feature collects data about how users use the proofing tools, such as additions to the custom dictionary, and sends the data to Microsoft. After about six months, the feature stops sending data to Microsoft and deletes the data collection file from the user's computer. By default, this feature is enabled if users choose to participate in the Customer Experience Improvement Program (CEIP).

    If your organization has policies that govern the use of external resources, such as the CEIP, people who use the Help Improve Proofing Tools feature might be violating these policies. If you disable this policy setting, the Help Improve Proofing Tools feature doesn't collect proofing tool usage information and doesn't transmit it to Microsoft. If you don't configure this policy setting, the behavior is of the same as setting the policy to "Enabled."

  • Impact: If you enable this setting, users participate in the CEIP. Although this feature doesn't intentionally collect personal information, some content that is sent could include items that were marked as spelling or grammar errors, such as proper names and account numbers. But, any numbers such as account numbers, street addresses, and telephone numbers are converted to zeros when the data is collected. Microsoft uses this information only to improve the effectiveness of the Office Proofing Tools, not to identify users.

  • Guidelines: Most organizations enable this setting, which is the recommended configuration. Organizations that have a highly restrictive security environment, or a security environment that restricts Internet access, typically don't enable this setting.

Related privacy options

Several other settings are related to privacy disclosure in Office 2013 applications. If you are changing privacy options because you have a special security environment, you might want to evaluate the following settings:

  • Protect document metadata for password protected files This setting determines whether metadata is encrypted when you use the Encrypt with Password feature.

  • Protect document metadata for rights managed Office Open XML files This setting determines whether metadata is encrypted when you use the Restrict Permission by People feature.

  • Warn before printing, saving, or sending a file that contains tracked changes or comments This setting determines whether users are warned about comments and tracked changes before they print, save, or send a document.

  • Make hidden markup visible This setting determines whether all tracked changes are visible when you open a document.

  • Prevent document inspectors from running This setting lets you disable Document Inspector modules. Document Inspector modules, available in various Office applications since Office 2007, allows users to remove hidden and personal information from their Office documents.

Note:

For the latest information about policy settings, refer to the Office 2013 Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool TechNet article.

See also

Content roadmap for Office 2013 security
Understand security threats and countermeasures for Office 2013
Overview of security in Office 2013
Configure security by using OCT or Group Policy for Office 2013

Privacy Statement for Microsoft Office 2013


Group Policy for Office 2013

Published: October 16, 2012

Summary: Find articles that will help you use Group Policy to configure and enforce settings for Office 2013 applications.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Group Policy is an infrastructure that is used to deliver and apply one or more desired configurations or policy settings to a set of targeted users and computers in an Active Directory directory service environment. When you have Office 2013 installed, you can use Group Policy to:

  • Control entry points to the Internet from Office 2013 applications.

  • Manage security in the Office 2013 applications.

  • Hide settings and options that are unnecessary for users to perform their jobs and that might distract them or result in unnecessary support calls.

  • Create a highly managed standard configuration on users' computers.

Office 2013 logo The following table lists and describes articles that will be useful for IT administrators who plan to use Group Policy to configure and enforce settings for Office 2013 applications.

Articles about how to use Group Policy with Office 2013

Article | Description
Overview of Group Policy for Office 2013 | Provides information about how to use Group Policy to apply and enforce settings for Office 2013.
Plan Group Policy for Office 2013 | Provides information about how to plan for using Group Policy to manage Office 2013.
Use Group Policy to disable user interface items and shortcut keys in Office 2013 | Provides information about how to use Group Policy to disable user interface items and shortcut keys in Office 2013.


Overview of Group Policy for Office 2013

Updated: June 18, 2013

Summary: Use Group Policy to apply and enforce settings for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Group Policy enables administrators to apply configurations or policy settings to users and computers in an Active Directory directory service environment. Administrators who plan to use Group Policy to manage Office 2013 applications can review this article for a brief overview of Group Policy concepts. For more information about Group Policy, see Windows Server article Group Policy overview.

In this article:

  • Local and Active Directory-based Group Policy

  • Group Policy processing

  • Changing how Group Policy processes GPOs

  • Administrative Templates

  • True policies vs. user preferences

  • Group Policy management tools

  • Office Customization Tool and Group Policy

Local and Active Directory-based Group Policy

Group Policy is an infrastructure that is used to deliver and apply one or more desired configurations or policy settings to a set of targeted users and computers in an Active Directory directory service (AD DS) environment.

Group Policy settings are contained in Group Policy objects (GPOs), which are linked to selected Active Directory containers such as sites, domains, or organizational units (OUs). When a GPO is created, it is stored in the domain. When the GPO is linked to an Active Directory container, such as an OU, the link is a component of that Active Directory container. The link is not a component of the GPO. The settings within GPOs are evaluated by the affected targets by using the hierarchical nature of Active Directory. For example, you can create a GPO named Office 2013 settings that contains only configurations for Office 2013 applications. You can then apply that GPO to a specific site so that users who are contained in that site receive the Office 2013 configurations that you specified in the Office 2013 settings GPO.

Every computer has a local GPO that is always processed, regardless of whether the computer is a member of a domain or a stand-alone computer. The local GPO cannot be blocked by domain-based GPOs. However, settings in domain GPOs always take precedence, because they are processed after the local GPO.

Note:

Windows Vista, Windows 7, and Windows 8, Windows Server 2008, and Windows Server 2012 provide support for managing multiple local GPOs on stand-alone computers. For more information, see Step-by-Step Guide to Managing Multiple Local Group Policy Objects (http://go.microsoft.com/fwlink/p/?LinkId=182215).

Although you can configure local GPOs on individual computers, maximum benefits of Group Policy are obtained in a Windows Server 2003, Windows Server 2008, or Windows Server 2012-based network that has Active Directory installed.

Group Policy processing

Group Policy for computers is applied at computer startup. Group Policy for users is applied when users log on. In addition to the initial processing of Group Policy at startup and logon, Group Policy is later applied in the background periodically. During a background refresh, a client-side extension reapplies the policy settings only if it detects that a change occurred on the server in any of its GPOs or its list of GPOs. For software installation and folder redirection, Group Policy processing occurs only during computer startup or user logon.

Group Policy settings are processed in the following order:

  • Local GPO Each computer has a GPO that is stored locally. This GPO processes for both computer and user Group Policy.

  • Site GPOs that are linked to the site to which the computer belongs are processed next. Processing is completed in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the site in Group Policy Management Console (GPMC). The GPO that has the lowest link order is processed last and has the highest precedence. For information about how to use GPMC, see Group Policy management tools later in this article.

  • Domain Multiple domain-linked GPOs are processed in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the domain in GPMC. The GPO that has the lowest link order is processed last and has the highest precedence.

  • Organizational units GPOs that are linked to the OU that is highest in the Active Directory hierarchy are processed first, and then GPOs that are linked to its child OU are processed, and so on. GPOs that are linked to the OU that contains the user or computer are processed last.

The processing order is subject to the following conditions:

  • Windows Management Instrumentation (WMI) or security filtering that is applied to GPOs.

  • Any domain-based GPO (not local GPO) can be enforced by using the Enforce option so that its policy settings cannot be overwritten. Because an Enforced GPO is processed last, no other settings can write over the settings in that GPO. If more than one Enforced GPO exists, the same setting in each GPO can be set to a different value. In this case, the link order of the GPOs determines which GPO contains the final settings.

  • At any domain or OU, Group Policy inheritance can be selectively designated as Block Inheritance. However, because Enforced GPOs are always applied and cannot be blocked, blocking inheritance does not prevent the application of policy settings from Enforced GPOs.

Policy inheritance

Policy settings that are in effect for a user and computer are the result of the combination of GPOs applied at a site, domain, or OU. When multiple GPOs apply to users and computers in those Active Directory containers, the settings in the GPOs are aggregated. By default, settings that are deployed in GPOs that are linked to parent containers that are in Active Directory are inherited by child containers and combine with settings that are deployed in GPOs that are linked to the child containers. If multiple GPOs attempt to set a policy setting that has conflicting values, the GPO that has the highest precedence sets the setting. GPOs that are processed later have precedence over GPOs that are processed earlier.

Synchronous and asynchronous processing

Synchronous processes can be described as a series of processes in which one process must finish running before the next one begins. Asynchronous processes can run on different threads at the same time, because their outcome is independent of other processes. Administrators can use a policy setting for each GPO to change the default processing behavior so that processing is asynchronous instead of synchronous.

Under synchronous processing, there is a time limit of 60 minutes for all Group Policy to finish processing on the client computer. Client-side extensions that have not finished processing after 60 minutes are signaled to stop. In this case, the associated policy settings might not be fully applied.

Fast Logon Optimization feature

By default, the Fast Logon Optimization feature is set for both domain and workgroup members. The result is the asynchronous application of policy when the computer starts and the user logs on. This application of policy is similar to a background refresh. It can reduce the length of time it takes for the logon dialog box to appear and the length of time it takes for the desktop to become available to the user.

Administrators can disable the Fast Logon Optimization feature by using the Always wait for the network at computer startup and logon policy setting, which is accessed in the Computer Configuration\Administrative Templates\System\Logon node of Group Policy Object Editor.

Slow links processing

Some Group Policy extensions are not processed when the connection speed falls below specified thresholds. The default value for what Group Policy considers a slow link is any rate slower than 500 Kilobits per second (Kbps).

Group Policy refresh interval

By default, Group Policy is processed every 90 minutes, with a randomized delay of up to 30 minutes, for a total maximum refresh interval of 120 minutes.

After you edit security policy settings, the policy settings on the computers in the OU to which the GPO is linked are processed on the following schedule:

  • When a computer restarts.

  • Every 90 minutes on a workstation or server and every 5 minutes on a domain controller.

Note:

By default, security policy settings that are delivered by Group Policy are also applied every 16 hours (960 minutes), even if a GPO has not changed.

Triggering a Group Policy refresh

Changes that are made to the GPO must first replicate to the appropriate domain controller. Therefore, changes to Group Policy settings might not be immediately available on users' desktops. In some scenarios, such as application of security policy settings, you might have to apply policy settings immediately.

Administrators can trigger a policy refresh manually from a local computer without waiting for the automatic background refresh. To do this, administrators can type gpupdate at the command line to refresh the user or computer policy settings. You can't use GPMC to trigger a policy refresh.

The gpupdate command triggers a background policy refresh on the local computer from which the command is run. The gpupdate command is used in Windows XP, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, and Windows Server 2012 environments.

The application of Group Policy cannot be pushed to clients on demand from the server.

Changing how Group Policy processes GPOs

The primary method for specifying which users and computers receive the settings from a GPO is by linking the GPO to sites, domains, and OUs.

You can change the default order by which GPOs are processed by using any of the following methods:

  • Change the link order.

  • Block inheritance.

  • Enforce a GPO link.

  • Disable a GPO link.

  • Use security filtering.

  • Use Windows Management Instrumentation (WMI) filtering.

  • Use loopback processing.

Change the link order

The GPO link order in a site, domain, or OU controls when links are applied. Administrators can change the precedence of a link by changing the link order, that is, by moving each link up or down in the list to the appropriate location. The link that has the higher order (1 is the highest order) has the higher precedence for a site, domain, or OU.

Block inheritance

Applying block inheritance to a domain or OU prevents GPOs that are linked to higher sites, domains, or organizational units from being automatically inherited by the child-level Active Directory container.

Enforce a GPO link

You can specify that the settings in a GPO link take precedence over the settings of any child object by setting that link to Enforced. GPO links that are enforced cannot be blocked from the parent container. If GPOs contain conflicting settings and do not have enforcement from a higher-level container, the settings of the GPO links at the higher-level parent container are overwritten by settings in GPOs that are linked to child OUs. By using enforcement, the parent GPO link always has precedence. By default, GPO links are not enforced.

Disable a GPO link

You can completely block how users apply a GPO for a site, domain, or OU by disabling the GPO link for that domain, site, or OU. This does not disable the GPO. If the GPO is linked to other sites, domains, or OUs, they will continue to process the GPO if the links are enabled.

Use security filtering

You can use security filtering to narrow the scope of a GPO so that the GPO applies only to a single group, user, or computer. Security filtering cannot be used selectively on different settings in a GPO.

The GPO applies to a user or computer only if that user or computer has both Read and Apply Group Policy permissions on the GPO, either explicitly or effectively through group membership. By default, all GPOs have Read and Apply Group Policy set to Allowed for the Authenticated Users group, which includes users and computers. This is how all authenticated users receive the settings of a new GPO when the GPO is applied to an OU, domain, or site.

By default, Domain Admins, Enterprise Admins, and the local system have full control permissions, without the Apply Group Policy access-control entry (ACE). Administrators are also members of Authenticated Users. This means that, by default, administrators receive the settings in the GPO. These permissions can be changed to limit the scope to a specific set of users, groups, or computers within the OU, domain, or site.

The Group Policy Management Console (GPMC) manages these permissions as a single unit and displays the security filtering for the GPO on the GPO Scope tab. In GPMC, groups, users, and computers can be added or removed as security filters for each GPO.

Use Windows Management Instrumentation filtering

You can use Windows Management Instrumentation (WMI) filtering to filter the application of a GPO by attaching a WMI Query Language (WQL) query to a GPO. The queries can be used to query WMI for multiple items. If a query returns true for all queried items, the GPO is applied to the target user or computer.

A GPO is linked to a WMI filter and applied on a target computer, and the filter is evaluated on the target computer. If the WMI filter evaluates to false, the GPO is not applied (except if the client computer is running Windows 2000. In this case, the filter is ignored and the GPO is always applied). If the WMI filter evaluates to true, the GPO is applied.

The WMI filter is a separate object from the GPO in the directory. A WMI filter must be linked to a GPO to apply, and a WMI filter and the GPO to which it is linked must be in the same domain. WMI filters are stored only in domains. Each GPO can have only one WMI filter. The same WMI filter can be linked to multiple GPOs.

Note:

WMI is the Microsoft implementation of the Web-Based Enterprise Management industry initiative that establishes management infrastructure standards and lets you combine information from various hardware and software management systems. WMI exposes hardware configuration data such as CPU, memory, disk space, and manufacturer, and also software configuration data from the registry, drivers, file system, Active Directory, the Windows Installer service, networking configuration, and application data. Data about a target computer can be used for administrative purposes, such as WMI filtering of GPOs.

Use loopback processing

You can use this feature to make sure that a consistent set of policy settings is applied to any user who logs on to a specific computer, regardless of the user's location in Active Directory.

Loopback processing is an advanced Group Policy setting that is useful on computers in some closely managed environments, such as servers, kiosks, laboratories, classrooms, and reception areas. Setting loopback causes the User Configuration policy settings in GPOs that apply to the computer to be applied to every user who logs on to that computer, instead of (in Replace mode) or in addition to (in Merge mode) the User Configuration settings of the user.

To set loopback processing, you can use the User Group Policy loopback processing mode policy setting, which is accessed under Computer Configuration\Administrative Templates\System\Group Policy in Group Policy Object Editor.

To use the loopback processing feature, both the user account and the computer account must be in a domain that runs Windows Server 2003, Windows Server 2008, or Windows Server 2012. Loopback processing does not work for computers that are joined to a workgroup.

Administrative Templates

The Administrative Templates extension of Group Policy consists of an MMC server-side snap-in that is used to configure policy settings and a client-side extension that sets registry keys on target computers. Administrative Templates policy is also known as registry-based policy or registry policy.

Administrative Template files

Administrative Template files are XML files that consist of a hierarchy of categories and subcategories to define how options are displayed through the Group Policy Object Editor and GPMC. They also indicate the registry locations that are affected by policy setting configurations, which include the default (not configured), enabled, or disabled values of the policy setting. The templates are available in two file versions:.admx, and .adml. The .adml files are the language-specific versions of .admx files. You can use the .admx and .adml files on computers that run Windows Vista, Windows 7, Windows 8, Windows Server 2008, or Windows Server 2012.

The functionality of the administrative template files is limited. The purpose of.admx or .adml template files is to enable a user interface to configure policy settings. Administrative Template files do not contain policy settings. The policy settings are contained in Registry.pol files that are located in the Sysvol folder on domain controllers.

The Administrative Templates server-side snap-in provides an Administrative Templates node that appears in Group Policy Object Editor under the Computer Configuration node and under the User Configuration node. The settings that are under Computer Configuration manipulate registry settings for the computer. Settings that are under User Configuration manipulate registry settings for users. Although some policy settings require simple UI elements such as text boxes to enter values, most policy settings contain only the following options:

  • Enabled The policy is enforced. Some policy settings provide additional options that define the behavior when the policy is activated.

  • Disabled Enforces the opposite behavior as the Enabled state for most policy settings. For example, if Enabled forces a feature's state to Off, Disabled forces the feature's state to On.

  • Not configured The policy is not enforced. This is the default state for most settings.

The Administrative Template files are stored in the locations on the local computer, as shown in the following table.

File type | Folder
.admx | %systemroot%\PolicyDefinitions
.adml | %systemroot%\PolicyDefinitions\<language-specific folder, e.g., en-us>

You can also store and use .admx and .adml files from a central store in the folders on the domain controller, as shown in the following table.

File type | Folder
.admx | %systemroot%\sysvol\domain\policies\PolicyDefinitions
.adml | %systemroot%\sysvol\domain\policies\PolicyDefinitions\<language-specific folder, for example, en-us>

For more information about how to store and use the templates from a central store, see "Group policy and sysvol" in the Group Policy Planning and Deployment Guide.

Administrative Template files for Office 2013

Administrative Template files specifically for Office 2013 are available as a separate download and let you do the following:

  • Control entry points to the Internet from Office 2013 applications.

  • Manage security in the Office 2013 applications.

  • Hide settings and options that are unnecessary for users to perform their jobs and that might distract them or result in unnecessary support calls.

  • Create a highly managed standard configuration on users' computers.

To download the Office 2013 Administrative Templates, see Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013.

The Office 2013 Administrative Templates are as shown in the following table.

Application | Administrative Template files
Access 2013 | access14.admx, access14.adml
Excel 2013 | excel14.admx, excel14.adml
InfoPath 2013 | inf14.admx, inf14.adml
Lync 2013 | lync15.admx, lync15.adml
Office 2013 | office14.admx, office14.adml
OneNote 2013 | onent14.admx, onent14.adml
Outlook 2013 | outlk14.admx, outlk14.adml
PowerPoint 2013 | ppt14.admx, ppt14.adml
Project 2013 | proj14.admx, proj14.adml
Publisher 2013 | pub14.admx, pub14.adml
SharePoint Designer 2013 | spd14.admx, spd14.adml
Visio 2013 | visio14.admx, visio14.adml
Word 2013 | word14.admx, word14.adml
Important:

Using Group Policy to manage Office 2013 is supported only in Office 365 ProPlus, in volume licensed versions of Office 2013, and in individual Office 2013 applications that are sold through retail stores or through volume licensing.

True policies vs. user preferences

Group Policy settings that administrators can fully manage are known as true policies. Settings that users can configure (but might reflect the default state of the operating system at installation time) are known as preferences. Both true policies and preferences contain information that changes the registry on users' computers.

True policies

Registry values for true policies are stored under the approved registry keys for Group Policy. Users can't change or disable these settings.

For computer policy settings:

  • HKEY_LOCAL_MACHINE\Software\Policies (the preferred location)

  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies

For user policy settings:

  • HKEY_CURRENT_USER\Software\Policies (the preferred location)

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

For Office 2013, true policies are stored in the following registry locations.

For computer policy settings:

  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\15.0

For user policy settings:

  • HKEY_CURRENT_USER\Software\Policies\ Microsoft\Office\15.0

Preferences

Preferences are set by users or by the operating system at installation time. The registry values that store preferences are located outside the approved Group Policy keys. Users can change their preferences.

If you configure preference settings by using a GPO, it does not have system access control list (SACL) restrictions. Therefore, users can change these values in the registry. When the GPO goes out of scope (if the GPO is unlinked, disabled, or deleted), these values are not removed from the registry.

To view preferences in Group Policy Object Editor, choose the Administrative Templates node, choose View, choose Filtering, and then clear the Only show policy settings that can be fully managed check box.

Group Policy management tools

Administrators use the following tools to administer Group Policy:

  • Group Policy Management Console Manage most Group Policy management tasks.

  • Group Policy Object Editor Configure policy settings in GPOs.

Group Policy Management Console

Group Policy Management Console (GPMC) simplifies the management of Group Policy by providing a single tool to manage core aspects of Group Policy, such as scoping, delegating, filtering, and manipulating inheritance of GPOs. GPMC can also be used to back up (export), restore, import, and copy GPOs. Administrators can use GPMC to predict how GPOs will affect the network and to determine how GPOs have changed settings on a computer or user. GPMC is the preferred tool for managing most Group Policy tasks in a domain environment.

GPMC provides a view of GPOs, sites, domains, and OUs across an enterprise, and can be used to manage either Windows Server 2003, Windows Server 2008, Windows Server 2012 domains. Administrators use GPMC to perform all Group Policy management tasks, except for configuring individual policy settings in Group Policy objects. This is performed with Group Policy Object Editor, which you open within GPMC.

Administrators use GPMC to create a GPO and has no initial settings. An administrator can also create a GPO and link the GPO to an Active Directory container at the same time. To configure individual settings in a GPO, an administrator edits the GPO by using Group Policy Object Editor from inside GPMC. Group Policy Object Editor is displayed with the GPO loaded.

An administrator can use GPMC to link GPOs to sites, domains, or OUs in Active Directory. Administrators must link GPOs to apply settings to users and computers in Active Directory containers.

GPMC includes the following Resultant Set of Policies (RSoP) features that are provided by Windows:

  • Group Policy Modeling Simulates the policy settings that are applied under circumstances that are specified by an administrator. Administrators can use Group Policy Modeling to simulate the RSoP data that would be applied for an existing configuration, or they can analyze the effects of simulated, hypothetical changes to the directory environment.

  • Group Policy Results Represents the actual policy data that is applied to a computer and user. Data is obtained by querying the target computer and retrieving the RSoP data that was applied to that computer. The Group Policy Results capability is provided by the client operating system and requires Windows XP, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, or Windows Server 2012.

Group Policy Object Editor

Group Policy Object Editor is an MMC snap-in that is used to configure policy settings in GPOs. The Group Policy Object Editor is contained in gpedit.dll, and is installed with Windows XP, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, and Windows Server 2012 operating systems.

To configure Group Policy settings for a local computer that is not a member of a domain, use Group Policy Object Editor to manage a local GPO (or multiple GPOs in computers that are running Windows Vista, Windows 7, Windows 8, Windows Server 2008, or Windows Server 2012). To configure Group Policy settings in a domain environment, GPMC (which invokes Group Policy Object Editor) is the preferred tool for Group Policy management tasks.

Group Policy Object Editor gives administrators a hierarchical tree structure for configuring Group Policy settings in GPOs, and consists of the following two main nodes:

  • User Configuration Contains settings that are applied to users when users log on and periodic background refresh.

  • Computer Configuration Contains settings that are applied to computers at startup and periodic background refresh.

These two main nodes are divided into folders that contain the different kinds of policy settings that you can set. These folders include the following:

  • Software Settings Contains software installation settings

  • Windows Settings Contains Security settings and Scripts policy settings

  • Administrative Templates Contains registry-based policy settings

System requirements for GPMC and Group Policy Object Editor

The Group Policy Object Editor is part of GPMC and is invoked when you edit a GPO. You can run GPMC on Windows XP, Windows Vista, Windows 7, Windows 8, Windows Server 2003, Windows Server 2008, and Windows Server 2012. The requirements vary per Windows operating system as follows:

  • GPMC is part of the Windows Vista operating system. But, if you have installed Service Pack 1 or Service Pack 2 on Windows Vista, GPMC is removed. To reinstall it, install the Microsoft Remote Server Administration Tools for Windows Vista.

  • The GPMC is included with Windows Server 2008 and Windows Server 2012. However, this feature is not installed together with the operating system. Use Server Manager to install the GPMC. For information about how to install GPMC, see Install the GPMC.

  • To install GPMC on Windows 7, install the Remote Server Administration Tools for Windows 7.

  • To install GPMC on Windows 8, install the Remote Server Administration Tools for Windows 8.

  • To install GPMC on Windows XP or Windows Server 2003, install the Group Policy Management Console with Service Pack 1.

For more information about how to use GPMC and the Group Policy Object Editor, see Enforce settings by using Group Policy in Office 2010.

Office Customization Tool and Group Policy

Administrators can use either the Office Customization Tool (OCT) or Group Policy to customize user configurations for Office 2013 applications:

  • Office Customization Tool (OCT) Use the OCT to create a Setup customization file (.msp file). Administrators can use the OCT to customize features and configure user settings. Users can change most of the settings after the installation. This is because the OCT configures settings in publicly available parts of the registry, such as HKEY_CURRENT_USER/Software/Microsoft/Office/15.0. This tool is typically used in organizations that do not manage desktop configurations centrally. For more information, see Office Customization Tool (OCT) reference for Office 2013.

  • Group Policy Use Group Policy to configure the Office 2013 policy settings that are contained in Administrative Templates. The operating system enforces those policy settings. In an Active Directory environment, administrators can apply policy settings to groups of users and computers in a site, domain, or OU to which a Group Policy object is linked. True policy settings are written to the approved registry keys for policy, and these settings have SACL restrictions that prevent users who are not administrators from changing them. Administrators can use Group Policy to create highly managed desktop configurations. They can also create lightly managed configurations to address the business and security requirements of their organizations. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

See also

Plan Group Policy for Office 2013
Use Group Policy to disable user interface items and shortcut keys in Office 2013
Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013

Windows Server Group policy
Group Policy Planning and Deployment Guide
Security policies and settings in Office 2013

Change History

Date | Description
June 18, 2013 | Added a note that describes which editions of Office can be managed by using Group Policy, and added lync15.admx to the list of Office 2013 Administrative Templates.
October 23, 2012 | Initial publication


Plan Group Policy for Office 2013

Published: October 16, 2012

Summary: Plan for using Group Policy to manage Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

This article will help IT administrators who plan to manage Microsoft Office 2013 applications by using Group Policy. To be successful, they must understand their business requirements, security, network, and IT requirements, and their current Office application management practices.

  • Planning for Group Policy

  • Defining business objectives and security requirements

  • Evaluating your current environment

  • Designing managed configurations based on business and security requirements

  • Determining the scope of application

  • Testing and staging Group Policy deployments

  • Involving key stakeholders

Planning for Group Policy

Group Policy enables IT administrators to apply configurations or policy settings to users and computers in an Active Directory directory service (AD DS)_environment. Configurations can be made specifically to Office 2013. For more information, see Overview of Group Policy for Office 2013.

Planning for the deployment of Group Policy-based solutions includes several steps:

  1. Define your business objectives and security requirements.

  2. Evaluate your current environment.

  3. Design managed configurations based on your business and security requirements.

  4. Determine the scope of application of your solution.

  5. Plan for testing, staging, and deploying your Group Policy solution.

  6. Involve key stakeholders in planning and deploying the solution.

Defining business objectives and security requirements

Identify your specific business and security requirements and determine how Group Policy can help you manage standard configurations for the Office 2013 applications. Identify the resources (groups of users and computers) for which you are managing Office settings by using Group Policy and define the scope of your project.

Evaluating your current environment

Examine how you currently perform management tasks that are related to configurations for Office applications. This will help you to determine which kinds of Office policy settings to use. Document the current practices and requirements. You will use this information to help you design managed configurations in the next step. Include the following items:

  • Existing corporate security policies and other security requirements. Identify the locations and publishers that are considered secure. Evaluate your requirements for managing Internet Explorer feature control settings, document protection, privacy options, and blocking file format settings.

  • Messaging requirements for the organization. Evaluate requirements for configuring user interface settings, virus-prevention, and other security settings for Outlook 2013 by using Group Policy. For example, Group Policy provides settings for limiting the size of .pst files, which can improve performance on the workstation.

  • User requirements for Office applications for the various kinds of user roles. This depends largely on users' job requirements and the organization's security requirements.

  • Default file save options to use for Access 2013, Excel 2013, PowerPoint 2013, and Word 2013.

  • Access restrictions to set for Office 2013 user interface items. For example, include disabling commands, menu items, and keyboard shortcuts.

  • Software installation issues, if you are considering this deployment method. Although Group Policy can be used to install software applications in small-sized organizations that have Active Directory installed, there are some limitations, and you must determine whether it is an appropriate solution for your deployment requirements. For more information, see "Identifying issues pertaining to software installation" in Group Policy Planning and Deployment Guide.

    If you manage lots of clients in a complex or fast changing environment, Microsoft System Center 2012 Configuration Manager is the recommended method for installing and maintaining Office 2013 in medium- and large-sized organizations. System Center 2012 Configuration Manager offers additional functionality, such as inventory, scheduling, and reporting features.

    Another option for deployment of Office 2013 in Active Directory environments is to use Group Policy computer startup scripts.

  • The choice between Group Policy and the OCT. Although both Group Policy and the OCT can be used to customize user configurations for the Office 2013 applications, there are important differences:

    • Group Policy is used to configure Office 2013 policy settings that are contained in Administrative Templates. The operating system enforces those policy settings. These settings have system access control list (SACL) restrictions that prevent non-administrator users from changing them. Use Group Policy for configuring settings that you want to enforce.

    • The OCT is used to create a Setup customization file (.msp file). Administrators can use the OCT to customize features and configure user settings. Users can change most of the settings after the installation. We recommend that you use the OCT for preferred or default settings only. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

  • The decision about whether to use local Group Policy to configure Office settings. You can use local Group Policy to control settings in environments that include stand-alone computers that are not part of an Active Directory domain. For more information, seeOverview of Group Policy for Office 2013.

Designing managed configurations based on business and security requirements

Understanding your business requirements, security, network, IT requirements, and your organization's current Office application management practices helps you identify appropriate policy settings for managing the Office applications for users in your organization. The information that you collect during the evaluation of your current environment setup helps you design your Group Policy objectives.

When you define your objectives for using Group Policy to manage configurations for Office applications, determine the following:

  • The purpose of each Group Policy object (GPO).

  • The owner of each GPO — the person who is responsible for managing the GPO.

  • The number of GPOs to use. Keep in mind that the number of GPOs that are applied to a computer affects startup time, and the number of GPOs applied to a user affects the time that is needed to log on to the network. The greater the number of GPOs that are linked to a user, especially the greater the number of settings within those GPOs, the longer it takes to process the GPOs when a user logs on. During the logon process, each GPO from the user's site, domain, and organizational unit (OU) hierarchy is applied, provided both the Read and Apply Group Policy permissions are set for the user.

  • The appropriate Active Directory container to which to link each GPO (site, domain, or OU).

  • The location of Office applications to install, if you are deploying the Office 2013 with Group Policy Software Installation.

  • The location of computer startup scripts to run, if you are deploying Office 2013 by assigning Group Policy computer startup scripts.

  • The kinds of policy settings that are contained in each GPO. This depends on your business and security requirements and how you currently manage settings for Office applications. We recommend that you configure only settings that are considered extremely important for stability and security and that you keep configurations to a minimum. Also consider using policy settings that can improve performance on the workstation, such as controlling Outlook .pst file size, for example.

  • Whether to set exceptions to the default processing order for Group Policy.

  • Whether to set filtering options for Group Policy to target specific users and computers.

To help you plan for ongoing administration of GPOs, we recommend that you establish administrative procedures to track and manage GPOs. This helps make sure that that all changes are implemented in a prescribed manner.

Determining the scope of application

Identify Office 2013 policy settings that apply to all corporate users (such as any application security settings that are considered extremely important to the security of your organization) and those that are appropriate for groups of users, based on their roles. Plan your configurations according to the requirements that you identify.

In an Active Directory environment, you assign Group Policy settings by linking GPOs to sites, domains, or OUs. Most GPOs are typically assigned at the organizational unit level. Therefore, make sure that your OU structure supports your Group Policy-based management strategy for Office 2013. You might also apply some Group Policy settings at the domain level, such as security-related policy settings or Outlook settings that you want to apply to all users in the domain.

Testing and staging Group Policy deployments

Planning for testing and staging is an important part of any Group Policy deployment process. This step includes creating standard Group Policy configurations for Office 2013 applications and testing the GPO configurations in a non-production environment before you deploy Office to users in the organization. If necessary, you can filter the scope of application of GPOs and define exceptions to Group Policy inheritance. Administrators can use Group Policy Modeling (in Group Policy Management Console) to evaluate which policy settings would be applied by a specific GPO, and Group Policy Results (in Group Policy Management Console) to evaluate which policy settings are in effect.

Group Policy provides the ability to affect configurations across hundreds and even thousands of computers in an organization. Consequently, it is very important that you use a change management process and rigorously test all new Group Policy configurations or deployments in a non-production environment before you move them into your production environment. This process makes sure that the policy settings that are contained in a GPO produce the expected results for the intended users and computers in Active Directory environments.

As a best practice for managing Group Policy implementations, we recommend that you stage Group Policy deployments by using the following pre-deployment process:

  • Deploy new GPOs in a test environment that reflects the production environment as closely as possible.

  • Use Group Policy Modeling to evaluate how a new GPO will affect users and interoperate with existing GPOs.

  • Use Group Policy Results to evaluate which GPO settings are applied in the test environment.

For more information, see "Using Group Policy Modeling and Group Policy Results to evaluate Group Policy settings" in the Group Policy Planning and Deployment Guide.

Involving key stakeholders

Group Policy deployments in enterprises are likely to have cross-functional boundaries. As part of preparing for your deployment, it is important to talk to key stakeholders from the various functional teams in your organization and make sure that they participate during the analysis, design, test, and implementation phases, as appropriate.

Make sure that you conduct reviews of the policy settings that you plan to deploy for managing the Office 2013 applications together with your organization's security and IT operations teams to make sure that that the configurations suit the organization and that you apply a set of policy settings that are as strict as necessary to protect the network resources.

See also

Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013

Security policies and settings in Office 2013


Use Group Policy to disable user interface items and shortcut keys in Office 2013

Updated: February 26, 2013

Summary: Explains how to disable user interface commands, menu items, and keyboard shortcuts for Office 2013 by using Group Policy.

Applies to: Office 2013

Audience: IT Professionals

Administrators can configure Group Policy settings to disable Office 2013 user interface (UI) items and keyboard shortcuts either by using control IDs and virtual key codes, or by configuring policy settings that contain predefined commands and shortcuts.

Important:

Before performing any of the procedures in this article, make sure that you have loaded the Office 2013 Administrative Template files. To load the Administrative Template files, download the files and follow the instructions in the "Loading the ADMX templates" section of the Use Group Policy to enforce Office 2010 settings article. Although the article is for Office 2010, the Administrative Templates information also applies to Office 2013.

In this article:

  • Using Group Policy to disable UI items and keyboard shortcuts

  • Disabling commands by using control IDs

  • Disabling shortcut keys by using virtual key codes

  • Disabling predefined user interface items and shortcut keys

Using Group Policy to disable UI items and keyboard shortcuts

You can use Group Policy settings to disable UI commands, menu items, and keyboard shortcuts for Office 2013 applications.

Several Office 2013 applications have policy settings that predefine user interface commands and keyboard shortcut that you can disable. You do not have to use control IDs or virtual key codes for these predefined items. For more information, see Disabling predefined user interface items and shortcut keys later in this article.

For UI commands and keyboard shortcuts that it does not predefine, Group Policy provides two policy settings in which you can by specify the toolbar control ID (TCID) for the UI controls or virtual key codes for keyboard shortcuts.

The Custom | Disable commands and Disable shortcut keys policy settings are available for the following Office 2013 applications:

  • Access 2013

  • Excel 2013

  • Outlook 2013

  • PowerPoint 2013

  • Project 2013

  • Visio 2013

  • Word 2013

The Custom | Disable commands policy settings are also available for the following Office 2013 applications:

  • InfoPath 2013

  • Publisher 2013

  • SharePoint Designer 2013

Policy settings for the Office 2013 applications are accessed under the User Configuration\Administrative Templates node in the Group Policy Management Editor. To disable user interface items and shortcut keys, administrators can enable one of the following policy settings under the [Office 2013 application name]\Disable items in User Interface\Custom node for a specific Office application:

  • Disable commands Allows you to specify the control ID for the command that you want to disable. If you disable a TCID, that TCID is disabled everywhere the toolbar control is used. To disable a tab, you can disable the controls on the tab. For more information, see Disabling commands by using control IDs later in this article.

  • Disable shortcut keys Allows you to specify the virtual key code and modifier (as key,modifier) for the keyboard shortcut that you want to disable. A virtual key code is a hardware-independent number that uniquely identifies a key on the keyboard (for example, K) in Windows, and modifier is the value of either a modifier key (such as ALT, CONTROL, or SHIFT) or a combination of modifier keys in Windows. For more information, see Disabling shortcut keys by using virtual key codes later in this article.

Disabling commands by using control IDs

You must first obtain the control IDs for the Office 2013 application controls that you want to disable by using the custom Disable commands policy setting. For a list of the control IDs for built-in UI commands and menu items in all applications that use the Office Fluent UI, see Office 2013 Help Files: Office Fluent User Interface Control Identifiers.

For information about how to use Group Policy tools, see Group Policy management tools in Overview of Group Policy for Office 2013.

To disable commands by using control IDs

  1. Verify that you have the necessary security permissions for the GPO: either Edit settings or Edit settings, delete, and modify security. For more information about permissions that are needed to manage Group Policy, see "Delegating administration of Group Policy" in the Group Policy Planning and Deployment Guide.

  2. Open GPMC.

  3. In the Group Policy Management Editor navigation pane, open (double-click) User Configuration, open Administrative Templates, and then open the application for which you want to disable commands (for example, open Microsoft Excel 2013).

  4. Open Disable items in User Interface, choose Custom, and then, in the details pane, open Disable commands.

  5. Choose Enabled, and then choose Show.

  6. In the Show Contents dialog box, under Value, enter the control ID for the command that you want to disable. You can add multiple control IDs, one per line.

    For example, to disable the Check for Updates button in Excel (assuming you had previously added this command to the Excel Quick Access Toolbar), you would enter 9340, which is the control ID for the CheckForUpdates control.

  7. When you have finished entering control IDs, choose OK, and then choose OK again to exit the Disable commands dialog box.

Disabling shortcut keys by using virtual key codes

To disable shortcut keys by using virtual key codes, you set the Disable shortcut keys policy setting under the [Office 2013 application name]\Disable items in User Interface\Custom node and add the virtual key code and modifier for the user interface item that you want to disable. Key is the numeric value for a key (such as V) in Windows. Modifier is the value of either a modifier key such as CONTROL, or a combination of modifier keys in Windows.

The following articles provide information about Office combination shortcut keys, function keys, and other common shortcut keys, together with descriptions of their functionality. You need the shortcut key information to use the Custom |Disable shortcut keys policy settings.

  • Keyboard shortcuts for Access

  • Keyboard shortcuts in Excel

  • Outlook keyboard shortcuts

  • Keyboard shortcuts for use while creating a presentation in PowerPoint 2013

  • Keyboard shortcuts for use while delivering a presentation in PowerPoint 2013

  • Keyboard shortcuts for Project 2013

  • Keyboard shortcuts for Visio

  • Keyboard shortcuts for Microsoft Word

The following table provides values for keys and modifiers.

Values for shortcut keys and modifiers in Office 2013

Key or modifier | Value (decimal)
ALT | 16
CONTROL | 8
SHIFT | 4
A | 65
B | 66
C | 67
D | 68
E | 69
F | 70
G | 71
H | 72
I | 73
J | 74
K | 75
L | 76
M | 77
N | 78
O | 79
P | 80
Q | 81
R | 82
S | 83
T | 84
U | 85
V | 86
W | 87
X | 88
Y | 89
Z | 90

The following table lists the values for the function keys used by the system.

Values for function keys in Office 2013

Function key | Value (decimal)
F1 | 112
F2 | 113
F3 | 114
F4 | 115
F5 | 116
F6 | 117
F7 | 118
F8 | 119
F9 | 120
F10 | 121
F11 | 122
F12 | 123

For a more complete list of symbolic constant names, hexadecimal values, and mouse or keyboard equivalents for the virtual-key codes used by the system, see Virtual-Key Codes.

To disable shortcut keys by using virtual key codes

  1. Verify that you have the necessary security permissions for the GPO: either Edit settings or Edit settings, delete, and modify security. For more information about permissions that are needed to manage Group Policy, see "Delegating administration of Group Policy" in the Group Policy Planning and Deployment Guide.

  2. Open GPMC.

  3. In the Group Policy Management Editor navigation pane, open (double-click) User Configuration, open Administrative Templates, and then open the application for which you want to disable commands (for example, open Microsoft Excel 2013).

  4. Open Disable items in User Interface, choose Custom, and then, in the details pane, open Disable shortcut keys.

  5. Choose Enabled, and then choose Show.

  6. In the Show Contents dialog box, under Value, enter the values for the keyboard shortcuts that you want to disable as [key],[modifier]. You can add multiple value combinations to disable multiple keyboard shortcuts, adding them one on each line.

    For example, to disable the shortcut keys ALT+F11 in Excel, which opens the Microsoft Visual Basic Editor where you can create a macro, enter 122,16 in the Value dialog box (where F11 key = 122 and modifier = 16).

    Note:

    If there are multiple modifier keys for the keyboard shortcut, add the values of the modifier keys together to determine the modifier value that you should enter. For example, for the ALT+SHIFT combination, you would use the sum of their assigned values, 16+4 = 20.

  7. When you have finished entering control IDs, choose OK, and then choose OK again to exit the Disable shortcut keys dialog box.

Disabling predefined user interface items and shortcut keys

Policy settings are also available to disable predefined user interface items and shortcut keys for the Office 2013 applications. You can disable these items directly from the policy setting without having to use control ids or key codes. These policy settings are available in User Configuration\Administrative Templates\[Office 2013 application name], under the Disable items in user interface\Predefined node of the Group Policy Management Editor. Policy settings for disabling user interface items are available for the following applications:

  • Access 2013

  • Excel 2013

  • PowerPoint 2013

  • Word 2013

  • SharePoint Designer 2013

  • Publisher 2013

  • Visio 2013

To disable predefined commands

  1. Verify that you have the necessary security permissions for the GPO: either Edit settings or Edit settings, delete, and modify security. For more information about permissions that are needed to manage Group Policy, see "Delegating administration of Group Policy" in the Group Policy Planning and Deployment Guide.

  2. Open GPMC.

  3. In Group Policy Management Editor navigation pane, open (double-click) User Configuration, open Administrative Templates, open the application for which you want to disable commands (for example, open Microsoft Excel 2013), open Disable items in User Interface, and then choose Predefined.

  4. In the details pane, open Disable commands, and then, in the Disable commands dialog box, choose Enabled.

  5. Choose the commands that you want to disable, and then choose OK.

To disable predefined shortcut keys

  1. Verify that you have the necessary security permissions for the GPO: either Edit settings or Edit settings, delete, and modify security. For more information about permissions that are required for managing Group Policy, see "Delegating administration of Group Policy" in the Group Policy Planning and Deployment Guide.

  2. In Group Policy Management Editor navigation pane, open (double-click) User Configuration, open Administrative Templates, open the application for which you want to disable commands (for example, open Microsoft Excel 2013), open Disable items in User Interface, and then choose Predefined.

  3. In the details pane, open Disable shortcut keys, and then, in the Disable shortcut keys dialog box, choose Enabled.

  4. Choose the commands that you want to disable, and then choose OK.

See also

Overview of Group Policy for Office 2013
Plan Group Policy for Office 2013

Change History

Date | Description
February 26, 2013 | Updated the "Disabling commands by using control IDs" section to provide a link to the download for Office 2013 control IDs for built-in UI commands and menu items in all applications that use the Office Fluent UI.
October 30, 2012 | Initial publication


Manage Office 2013

Published: July 16, 2012

Summary: Contains articles that will help you apply updates and manage user configurations for Office 2013.

Applies to: Office 2013

Audience: IT Professionals

Office 2013 logo The following table contains links to articles that will help you support and manage installations of Office 2013 in your organization.

Manage Office 2013 articles on TechNet

Article | Description
Overview of apps for Office 2013 | Provides information about apps for Office and how to obtain and manage apps for Office.
Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013 | Provides information about Administrative Template and Office Customization Tool (OCT) files for Office 2013.
Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013 | Provides instructions for updating an existing Office 2013 installation by running the Office Customization Tool (OCT) and creating a Setup customization file (.msp file).
Add or remove language packs after deployment of Office 2013 | Provides information about how to add or remove Office 2013 language packs, either by changing an existing installation or by deploying them as separate products
Distribute updates for Office 2013 products | Explains the software updates process and how to deploy updates for Windows Installer-based Office 2013, Project 2013, and Visio 2013.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


Overview of apps for Office 2013

Updated: June 25, 2013

Summary: Learn about apps for Office and how to obtain and manage apps for Office for users in your organization.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

The new apps for Office enable users to run the same solutions across applications, platforms, and devices, and provide an improved experience within Office applications by integrating rich content and services from the web. In this article, you can learn more about the types of apps for Office and the applications that support them. You can also learn how to make apps for Office available to users, how to manage them by using Group Policy settings or the registry, and how to monitor them by using Telemetry Dashboard.

Important:

This article provides content for administrators who configure and deploy Office 2013 for their organizations. Are you looking for how to use apps for Office? Search office.com for apps for Office.

In this article:

  • What is apps for Office?

  • Anatomy of an app for Office

  • Types of apps for Office

  • Supported applications for apps for Office

  • Privacy and security for apps for Office

  • Managing access to apps for Office

  • Monitoring apps for Office

  • Managing the performance of apps for Office

What is apps for Office?

Developers use apps for Office to create engaging new consumer and enterprise experiences that run within supported Office 2013 applications by using the power of the web and standard web technologies such as HTML5, XML, CSS3, JavaScript, and REST APIs.

An app for Office is basically a webpage that is hosted inside an Office client application. You can use apps to extend the functionality of a document, email message, meeting request, or appointment. Apps can run in multiple environments and clients. These include rich Office desktop clients, Office Web Apps, mobile browsers, and also on-premises and in the cloud. Developers can publish apps to the Office Store or to an onsite catalog, where they can be available to users from their Office 2013 applications. As the IT Administrator of your organization, you can control how the apps for Office become available to users.

Anatomy of an app for Office

The basic components of an app for Office are an XML manifest file and a webpage. The manifest defines various settings and points to the webpage that implements the app UI and custom logic, as shown in the following figure.

Manifest + webpage = an app for Office

Manifest plus webpage equals app for Office

The manifest specifies settings and capabilities of the app, such as the following:

  • The URL of the webpage that implements the app UI and programming logic.

  • The app display name, description, ID, version, and default locale.

  • Whether the app can be shown as a task pane, in line with document content, or started contextually in an email message, meeting request, or appointment.

  • The kinds of client applications (including rich and web App clients) that an app supports.

  • The permission level and data access requirements for the app.

Types of apps for Office

The three basic types of apps for Office are task pane, content, and mail apps for Outlook.

Task pane apps

Task pane apps enable users to see the app for Office side-by-side with an Office document, and provide app for Office developers with the opportunity to supply contextual information and functionality to enhance the document viewing and authoring experience. For example, a task pane app can look up and retrieve product information from a web service, based on the product name or part number that a user selects in a document. An example of a task pane app for Word 2013 that uses the Bing Translator service is shown in the following figure.

Task pane app

Task Pane apps

Content apps

Content apps integrate web-based features as content that can be shown in line with the document. Content apps enable users to integrate rich, web-based data visualizations, embedded media such as integrating a YouTube video player or a picture gallery as part of a document, and also other external content. The following figure shows an example of a content app for Excel 2013 that uses a web service to generate a geographical sales heat map.

Content app

Mail apps

Mail apps are displayed next to the currently viewed Outlook items: email message, meeting request, meeting response, meeting cancellation, or appointment. They can access contextual information from the item and use that data to access additional information about the server and from web services to create compelling user experiences. In most cases, a mail app runs without modification on the Outlook 2013 rich client and Outlook Web App for Exchange Server 2013. This user experience is seamless, whether on the desktop, the web, or on tablet and mobile devices.

Note:

The mail apps require Exchange Server 2013. POP and IMAP email accounts are not supported.

The following figure shows an example of a mail app that uses the Bing Maps service.

Mail app

app for Outlook

Supported applications for apps for Office

One big benefit of apps for Office is that they can be supported both on Office 2013 rich clients and some corresponding Web Apps. To the developer, this means that, in many scenarios, they do not have to create separate apps for different environments or applications. To the user, it means a consistent user experience across the desktop and web browser. And for the IT Professional, it means that it's easy to manage apps for Office across environments and applications.

For task pane apps, this means the same app can run on Excel 2013, Excel Web App, Word 2013, and Project 2013. For apps for Outlook, it means that the same app can work for Outlook 2013 on the desktop, tablet, and mobile devices.

Supported app types

Application Supported types

Excel 2013

  • Task pane

  • Content

Excel Web App

  • Content

Word 2013

  • Task pane

Outlook 2013

  • Mail

Outlook Web App

  • Mail

Project Professional 2013

  • Task pane

PowerPoint 2013

  • Task pane

Privacy and security for apps for Office

Privacy and security for apps for Office are covered in the following two MSDN topics:

  • Privacy and security for apps for Office

  • Privacy and security for mail apps for Outlook

See Using Group Policy to manage how users can install and use apps for Office to learn more about the Group Policy settings that can help you manage privacy and security for apps for Office.

Managing access to apps for Office

As the IT Administrator of your organization, you can control how the apps for Office become available to users. You can choose the type of hosting option that's appropriate for your organization. For example, if you don't want users to access apps for Office from the Office Store, you can disable that capability by using Group Policy. Then, you can make apps for Office available to users by hosting them internally in a SharePoint App Catalog, an Exchange catalog, or a file catalog share. These distribution methods are described in the following sections.

Supported distribution points for apps for Office

After an app for Office is created by a developer, the developer can decide how to publish it so that it is available to the users within your organization. In Office 2013, the following distribution points are supported for publishing apps for Office:

  • Office Store Hosted and regulated by Microsoft, the Office Store is where developers around the world can publish and sell their custom Office solutions. End users and IT professionals can download these custom Office solutions for personal or corporate use. Office Store handles the consumer download experience from discovery to purchase, upgrades, and updates.

  • SharePoint App Catalog For task pane and content apps, IT departments can deploy private app catalogs to provide the same app acquisition experience that the Office Store provides. This new catalog and development platform enables IT departments to use a streamlined method to distribute apps for Office and SharePoint to managed users from a central location.

    App Catalog is available to all SharePoint customers (including Office 365 and SharePoint on-premises). App Catalog enables publishing and administration of both internally created apps and apps that are available in the Office Store and licensed for corporate use. For more information, see Manage the App Catalog.

  • Exchange catalog This is a private catalog that is managed by an Exchange administrator for mail apps that are available to users of the Exchange Server on which it resides. It enables publication and administration of corporate mail apps, such as internally created apps and apps that are available in the Office Store and licensed for corporate use.

  • File-based app catalog IT departments and developers can deploy task pane and content apps to a central file share, where the manifest files will be stored and managed. Users can then obtain apps by specifying this file share as a trusted catalog, or an IT administrator can configure this file share as a trusted catalog by using Group Policy.

Using Group Policy to manage how users can install and use apps for Office

You can manage and enforce apps for Office settings by using Group Policy settings that are available in the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool. The settings are found under User Configuration\Administrative Templates\Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs. The OCT settings are in corresponding locations on the Modify user settings page of the OCT.

The following table describes the Group Policy settings that manage apps for Office.

Group Policy settings for apps for Office

Setting name | Description
Allow Unsecure Apps and Catalogs | Allows users to run nonsecure apps for Office, which are apps that have webpage or catalog locations that are not SSL-secured (https://), and are not in users' Internet zones.
Default Shared Folder Location | Allows you to set the URL for the Shared Folder from which users can insert apps into their Office documents.
Default SharePoint Catalog Location | Allows you to set the location of the SharePoint Catalog that is designated as Default. The apps for Office that are contained in the Default Catalog can be inserted into Office documents by users.
Block Apps for Office | Allows you to prevent users from using apps for Office.
Block the Office Store | Allows you to prevent users from using or inserting apps that come from the Office Store.
Trusted Catalog Location (#1-#10) | Sets the URL location of a Trusted SharePoint Catalog or Shared Folder Catalog. All apps for Office at this location are trusted so that users can work with these apps in their documents. However, the user cannot insert these apps into an Office document.

Monitoring apps for Office

Telemetry Dashboard helps IT professionals monitor client computers to learn what Office solutions, add-ins, and documents are being used in an organization. You can use Telemetry Dashboard to monitor loads and load failures for apps for Office in Word, Excel, and Outlook. This information will tell you which apps for Office are frequently used in your organization and which apps for Office are experiencing errors. For more information, see Deploy Telemetry Dashboard.

Managing the performance of apps for Office

You can control the performance of apps for Office by adding or changing performance-related threshold registry settings.

There are three ways for an administrator to set these registry keys, listed in the following tables. The following is the order that a host application checks for the existence of these keys:

  1. If the host application supports group policy for app resource usage, the host application first looks for a group policy key.

  2. In the absence of a group policy key, the host application looks for an application-specific registry key.

  3. If an application-specific key is absent, the host application looks for a global registry key.

  4. If the host application does not find a global registry key, the host application uses the corresponding default value.

For apps for Office, the settings in the following table can be added or changed in the registry. You can add these registry keys in the general Office hive UNDER HKLM:

HKEY_LOCAL_MACHINE\Software\Microsoft\Office\15.0\OSF

The global registry keys in the following table apply to all apps for Office, running on any Office rich client that supports apps for Office on the local computer.

These registry keys are not present by default in the Windows registry. Administrators create them initially if they want to fine-tune the performance of apps for Office Also, users must restart the corresponding host application for that application to recognize such settings.

Note:

Only the Outlook 2013 rich client and mail apps support application-specific settings. You can create those in the Outlook hive:

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\WEF\Outlook

However, it is better to use the Outlook 2013 group policy settings.

Performance-related registry settings for apps for Office

Value name Data type Value data

AlertInterval

DWORD

The number of seconds of the interval to check memory and CPU core usages. The default value is 5 seconds.

  • Maximum value = 600 seconds.

  • Minimum value = 5 seconds.

This setting governs how often a host application, like Word, checks memory and CPU core usage for a running app three times in a row. For example, if you use the default value of 5 seconds, the host application checks memory and CPU core usage 3 times, once every 5 seconds for a total duration of 15 seconds. The default threshold for CPU core usage is 90%.

If the app for Office requires more than the specified memory or CPU core usage when a memory or CPU core check occurs, the host application will:

  • Display a warning to the user if the app for Office is either a content app, or a task pane app.

  • Disable the app if the app for Office is a mail app.

MemoryAlertThreshold

DWORD

The physical memory usage limit, in MB, for an app for Office. Setting a key to 0 disables the check for that type of device.

  • Maximum value = 1,500 MB.

  • Minimum value = 0 MB.

By default, the host application determines the threshold based on the available physical memory on the device and does not use an absolute limit. When a host application detects that physical memory usage on a device exceeds 80% of the available memory, the client computer starts to monitor the memory usage of an app for Office. The memory usage is monitored at a document level for content and task pane apps, and at a mailbox level for mail apps. At an interval set by the AlertInterval setting, the client computer warns the user if physical memory usage for a set of apps for Office at the document or mailbox level exceeds 50%.

You can, however, explicitly use Group Policy to specify absolute MemoryAlertThreshold settings for client computers.

If the app for Office requires more than the specified memory alert threshold when a memory check occurs, the host application of a content or task pane app will display a warning to the user, and the host application of a mail app will automatically disable the app.

RestartManagerRetryLimit

DWORD

Tolerance for crashes. Specifies the maximum number of restart attempts for an app for Office that has crashed. The default is 4.

  • Maximum value= 11.

  • Minimum value = 2.

This setting governs the number of restarts that are used for a running app.

If the app requires more than the specified number of restarts during a session, the host application will automatically disable the app.

Outlook 2013 provides Group Policy settings to help you manage mail apps for Outlook. You can find them under User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Trust Center. If you are using the Windows based-installer (MSI) delivery format of Office 2013, you can use the OCT to set default settings that users can later change. OCT settings are in corresponding locations on the Modify user settings page of the OCT.

Performance-related Group Policy settings for mail apps

Important:

These settings do not apply to Outlook Web App. However, if the activation limit causes a mail app for Outlook to be disabled in Outlook 2013, it will also be disabled in Outlook Web App.

The following table describes the Group Policy settings that manage mail apps for Outlook. The term "web extension" in the policy setting name refers to mail apps for Outlook.

Performance-related Group Policy settings for mail apps

Setting name | Description
Specify activation disabling threshold for web extensions | Lets you specify the threshold that Outlook refers to before disabling a mail app for Outlook during activation.
Specify activation manager retry limit for web extensions | Lets you specify the retry limit Outlook uses before disabling a mail app for Outlook during activation.
Specify alert interval for web extensions | Lets you specify the alert interval Outlook uses before disabling a mail app for Outlook during initialization. The alert interval controls how often Office checks on memory and CPU usage for a running a mail app for Outlook.
Specify Outlook memory alert threshold for web extensions | Lets you specify the memory usage limit Outlook uses before disabling a mail app for Outlook during initialization. The memory alert threshold controls the maximum amount of virtual memory that can be used by a running mail app for Outlook.
Specify the number of restarts attempted for a running web extension. | Lets you specify the number of restart Outlook attempts for a running a mail app for Outlook.

Change History

Date | Description
June 25, 2013 | Added a section about managing the performance of apps for Office.
July 16, 2012 | Initial publication


Group Policy Administrative Template files (ADMX, ADML) and Office Customization Tool (OCT) files for Office 2013

Published: September 4, 2012

Summary: Provides information about Group Policy Administrative Template files and Office Customization Tool (OCT) files for Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 includes Administrative Template files (ADMX, ADML) and the Office Customization Tool download package. IT professionals can learn more about the new templates in this article. The Group Policy settings apply to both Windows Installer-based (MSI) and Click-to-Run Office 2013 installations.

In this article:

  • New Group Policy and OCT settings for Office 2013

  • Loading the Administrative Template files

  • Preventing conflicts with earlier versions of Group Policy settings

  • Updating the OCT

  • Files that are included in this download

New Group Policy and OCT settings for Office 2013

The tables in this section list the new Group Policy and OCT settings that are included in the download package for Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool. The download includes an Excel spreadsheet (office2013grouppolicyandoctsettings_reference.xlsx) that describes all the Group Policy and OCT settings. This article focuses on new settings related to security, performance, Telemetry Dashboard, Outlook, OneNote synchronization, Office templates, and Add-in management.

The following table lists the Group Policy and OCT settings that control users' access to apps for Office.

Apps for Office settings

Setting name UI location Registry path and value name Description

Block Apps for Office

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs

OCT location in Modify user settings: Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\WEF\trustedcatalogs!disableallcatalogs

OCT registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\WEF\trustedcatalogs!disableallcatalogs

Allows you to prevent users from using apps for Office. Other settings in Trusted Catalogs determine which specific app sources are allowed.

Block the Office Store

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs

OCT location in Modify user settings: Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\wef\trustedcatalogs!disableomexcatalogs

OCT registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\wef\trustedcatalogs!disableomexcatalogs

Allows you to prevent users from using or inserting apps that come from the Office Store, if the Block Apps for Office setting is not enabled.

Allow Unsecure Apps and Catalogs

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs

OCT location in Modify user settings: Microsoft Office 2013\Security Settings\Trust Center\Trusted Catalogs

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\wef\trustedcatalogs!requireserververification

OCT registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\wef\trustedcatalogs!requireserververification

Allows apps that have webpage or catalog locations that are not SSL-secured (https://), and are not in users' Intranet zones. You must also configure the Trusted App Catalog settings for users to be able to insert apps.

The following table lists the escrow key setting. Although there are a total of 20 settings available (Escrow Key #1 through Escrow Key #20), only 1 is listed because the information for each of the settings is the same. For each certificate that you want to use as an escrow key, you would use one of the Escrow Certificate #n policy settings. For example, if you want to specify 10 certificates, you would use the consecutive Escrow Key #1 through Escrow Key #10 settings.

Escrow Key setting

Setting name UI location Registry path and value name Description

Escrow Key #n

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Security Settings\Escrow Certificates

OCT location in Modify user settings: Microsoft Office 2013\Security Settings\Escrow Certificates

Group Policy registry location: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\security\crypto\escrowcerts!

OCT registry location: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\security\crypto\escrowcerts!

This policy setting allows you to specify a certificate to use as an escrow key for password protected files. If you enable this policy setting, the certificate you specify is used as an escrow key for all password protected files that are created on this machine. If you disable or do not configure this policy setting, an escrow key is not configured.

The following table lists Group Policy settings for managed add-ins. The policy settings that are listed here are for add-ins that do not have a corresponding OCT setting.

Managed Add-ins settings

Setting name | UI location | Registry path and value name | Description
List of managed add-ins (Access) | Group Policy location: User Configuration\Administrative Templates\Microsoft Access 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\access\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (Excel) | Group Policy location: User Configuration\Administrative Templates\Microsoft Excell 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\excel\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (InfoPath) | Group Policy location: User Configuration\Administrative Templates\Microsoft InfoPath 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\infopath\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (OneNote) | Group Policy location: User Configuration\Administrative Templates\Microsoft OneNote 2013\OneNote Options\Add-ins | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\onenote\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (Outlook) | Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (PowerPoint) | Group Policy location: User Configuration\Administrative Templates\Microsoft PowerPoint 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\powerpoint\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (Project) | Group Policy location: User Configuration\Administrative Templates\Microsoft Project 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ms project\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (Publisher) | Group Policy location: User Configuration\Administrative Templates\Microsoft Publisher 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER \software\policies\microsoft\office\15.0\publisher\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (Visio) | Group Policy location: User Configuration\Administrative Templates\Microsoft Visio 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER \software\policies\microsoft\office\15.0\visio\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
List of managed add-ins (Word) | Group Policy location: User Configuration\Administrative Templates\Microsoft Word 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER \software\policies\microsoft\office\15.0\word\resiliency!addinlist | Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user. To block add-ins that are not managed by this policy setting, you must also configure the Block all unmanaged add-ins policy setting.
Block all unmanaged add-ins (Access) | Group Policy location: User Configuration\Administrative Templates\Microsoft Access 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\access\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (Excel) | Group Policy location: User Configuration\Administrative Templates\Microsoft Excel 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\excel\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (InfoPath) | Group Policy location: User Configuration\Administrative Templates\Microsoft InfoPath 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\infopath\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (OneNote) | Group Policy location: User Configuration\Administrative Templates\Microsoft OneNote 2013\OneNote Options\Add-ins | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\onenote\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (Outlook) | Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (PowerPoint) | Group Policy location: User Configuration\Administrative Templates\Microsoft PowerPoint 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\powerpoint\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (Project) | Group Policy location: User Configuration\Administrative Templates\Microsoft Project 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ms project\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (Publisher) | Group Policy location: User Configuration\Administrative Templates\Microsoft Publisher 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\publisher\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (Visio) | Group Policy location: User Configuration\Administrative Templates\Microsoft Visio 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\visio\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-ins policy setting.
Block all unmanaged add-ins (Word) | Group Policy location: User Configuration\Administrative Templates\Microsoft Word 2013\Miscellaneous | Group Policy registry key: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\word\resiliency!restricttolist | Blocks all add-ins that are not managed by the List of managed add-inspolicy setting.

The following table lists Group Policy and OCT settings for managing the Office Start screen.

Office Start settings

Setting name UI location Registry path and value name Description

Disable the Office Start screen for Access

Group Policy: User Configuration\Administrative Templates\Microsoft Access 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Access 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\access\settings!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\access\settings!disableboottoofficestart

Controls whether the Office Start screen appears on boot for Access.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

Disable the Office Start screen for Excel

Group Policy: User Configuration\Administrative Templates\Microsoft Excel 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Excel 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\excel\options!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\excel\options!disableboottoofficestart

Controls whether the Office Start screen appears on boot for Excel.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

Disable the Office Start screen for all Office applications

Group Policy: User Configuration\Administrative Templates\Microsoft Office 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Office 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\general!disableboottoofficestart

OCT registry path: HKCU\software\microsoft\office\15.0\common\general!disableboottoofficestart

Controls whether the Office Start screen appears on boot for all Office applications.

Disable the Office Start screen for PowerPoint

Group Policy: User Configuration\Administrative Templates\Microsoft PowerPoint 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft PowerPoint 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\powerpoint\options!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\powerpoint\options!disableboottoofficestart

Controls whether the Office Start screen appears on boot for PowerPoint.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

Disable the Office Start screen for Project

Group Policy: User Configuration\Administrative Templates\Microsoft Project 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Project 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ms project\options\general!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ms project\options\general!disableboottoofficestart

Controls whether the Office Start screen appears on boot for Project.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

Disable the Office Start screen for Publisher

Group Policy: User Configuration\Administrative Templates\Microsoft Publisher 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Publisher 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\publisher\preferences!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\publisher\preferences!disableboottoofficestart

Controls whether the Office Start scren appears on boot for Publisher.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

Disable the Office Start screen for Visio

Group Policy: User Configuration\Administrative Templates\Microsoft Visio 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Visio 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\visio\application!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\visio\application!disableboottoofficestart

Controls whether the Office Start screen appears on boot for Visio.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

Disable the Office Start screen for Word

Group Policy: User Configuration\Administrative Templates\Microsoft Word 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Word 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\word\options!disableboottoofficestart

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\word\options!disableboottoofficestart

Controls whether the Office Start screen appears on boot for Word.

Note:

This policy setting is overridden by the Disable the Office Start screen for all Office applications policy setting if that policy setting is set.

The following table lists Group Policy and OCT settings for OneNote.

OneNote settings

Setting name UI location Registry path and value name Description

Embedded File Size Limit

Group Policy: User Configuration\Administrative Templates\Microsoft OneNote 2013\OneNote Options\Other

OCT location in Features\Modify User Settings: Microsoft OneNote 2013\OneNote Options\Other

Group Policy registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\onenote\general!insertedfilesdisallowembeddingsizethreshold

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\onenote\general!insertedfilesdisallowembeddingsizethreshold

Enables you to specify the maximum embedded file size that users can insert directly into a OneNote notebook on a SharePoint Server.

Notebook Presence

Group Policy: User Configuration\Administrative Templates\Microsoft OneNote 2013\OneNote Options\Other

OCT location in Features\Modify User Settings: Microsoft OneNote 2013\OneNote Options\Other

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\onenote\options!disablepresence

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\onenote\options!disablepresence

Enables or disables the Notebook Presence feature in OneNote, which broadcasts user presence in a notebook and enables real-time synchronization for users who are editing the same page.

Note:

Changes to this policy do not take effect until OneNote is restarted.

Days all Version History items are "safe" from pruning

Group Policy location: User Configuration\Administrative Templates\Microsoft OneNote 2013\OneNote Options\Versions and Recycle Bin

OCT location in Features\Modify User Settings: Microsoft OneNote 2013\OneNote Options\Versions and Recycle Bin

Group Policy registry path: HKEY_CURRENT_USER \software\policies\microsoft\office\15.0\onenote\options\versions!DaysOfAllVersions

OCT registry path: HKEY_CURRENT_USER \software\microsoft\office\15.0\onenote\options\versions!DaysOfAllVersions

Allows you to specify a period of time during which OneNote maintains comprehensive version history pages. After the time specified, OneNote maintains more basic version history pages, which uses less storage space.

Note:

This is an Office 2010 setting that was updated for the current release.

The following table lists Group Policy and OCT settings for Outlook.

Outlook settings

Setting name UI location Registry path and value name Description

Disable shared mail folder caching

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Delegates

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Delegates

Group Policy registry path: HKEY_CURRENT_USERsoftware\policies\microsoft\office\15.0\outlook\cached mode!cacheothersmail

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!cacheothersmail

Allows you to control the caching of shared mail folders.

Disable Hybrid Searching

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Search Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Search Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\search!disablehybrid

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\search!disablehybrid

Controls whether searches in Cached Exchange Mode can also be run on the Exchange server.

Display Sender Picture

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\mail!showcontactpicture

OCT registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\mail!showcontactpicture

Controls whether Outlook displays pictures in email headers for senders of email messages and meeting requests.

Disable AutoPreview

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options\Advanced E-mail Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options\Advanced E-mail Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\preferences!disableautopreview

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\preferences!disableautopreview

Enabling this policy permanently disables the item preview. Users cannot turn it back on and the ribbon UI to change it is disabled.

Disable Mail Tips

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\E-mail Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\mail!disablemailtips

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\mail!disablemailtips

Determines whether users can view Mail Tips.

Enable down-level meeting text

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!enablemeetingdownleveltext

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!enablemeetingdownleveltext

Controls whether Outlook automatically displays the meeting time and location in the meeting request body.

Weather Service URL

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!weatherserviceurl

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!weatherserviceurl

Allows you to configure the weather service URL for Outlook.

Weather Bar Update Frequency

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!weatherupdatefrequency

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!weatherupdatefrequency

Allows you to set the update frequency (in minutes) for the Weather Bar.

Disable Weather Bar

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options

Group Policy registry path: HKEY_CURRENT_USER software\policies\microsoft\office\15.0\outlook\options\calendar!disableweather

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!disableweather

Allows you to turn on or turn off the Weather Bar.

Specify total number of days in a recurring meeting or appointment

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options\ Recurrent item configuration

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options\Recurrent item configuration

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\calendar!recurrencesdefault

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\calendar!recurrencesdefault

Allows you to specify the default number of days after which a recurring meeting or appointment (but not a task) ends.

Disable the "No end date" option for recurring items

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options\Recurrent item configuration

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Preferences\Calendar Options\Recurrent item configuration

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\preferences!disablerecurnoend

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\preferences!disablerecurnoend

Allows you to disable the "No end date" option for the recurrence range in appointments, meetings, and tasks.

Internet and network paths into hyperlinks

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\options\autoformat!pgrfafo_25_1

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\options\autoformat!pgrfafo_25_1

Specifies whether Outlook automatically turns text that represents Internet and network paths into hyperlinks.

Sort folders alphabetically

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Other

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Other

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\preferences!sortfoldersalphabetically

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\preferences!sortfoldersalphabetically

Controls whether users can rearrange their folders in Outlook.

Change the criteria that Outlook uses to archive different item types

Group Policy location Features\Modify User Settings: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Other\AutoArchive

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Other\AutoArchive

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\preferences!archiveignorelastmodifiedtime

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\preferences!archiveignorelastmodifiedtime

If this policy setting is enabled, Outlook ignores the last modified date and archives items based on a date that is specific for the item type, as follows:

  • Email message: The received date.

  • Calendar item: The actual date that an appointment, event, or meeting is scheduled for.

  • Task: The completion date. Tasks that are not marked as completed are not archived. Tasks that are assigned to other users are archived only if the status is completed.

  • Note: The last modified date and time.

  • Journal entry: The date when the journal entry is created.

  • Contact: Not archived.

Configure Simple MAPI sending prompt

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptsimplemapisend

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\security!promptsimplemapisend

Allows you to specify what occurs when a program attempts to send mail programmatically by using Simple MAPI.

Configure Simple MAPI name resolution prompt

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptsimplemapinameresolve

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\security!promptsimplemapinameresolve

Allows you to specify what occurs when a program attempts to gain access to an Address Book by using Simple MAPI.

Configure Simple MAPI message opening prompt

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Security\Security Form Settings\Programmatic Security

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!promptsimplemapiopenmessage

OCT registry path: HKEY_CURRENT_USER\oftware\microsoft\office\15.0\outlook\security!promptsimplemapiopenmessage

Allows you to specify what occurs when a program attempts to gain access to a recipient field, such as the "To" field by using Simple MAPI.

Use UserIssuerSerialNumber

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Security\Cryptography

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Security\Cryptography

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\security!useissuerserialnumber

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\security!useissuerserialnumber

Determines whether Outlook uses IssuerSerialNumber as the SignerIdentifier, which enables third-party email client software applications to read encrypted Outlook email messages.

Use the Online Global Address List for Nickname Resolution

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange\Cached Exchange Mode

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange\Cached Exchange Mode

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\cached mode!anr include online gal

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!anr include online gal

Allows you to force Outlook to use the Online Global Address List for ambiguous name resolution when composing messages in Outlook, instead of using the Offline Address Book when it is available.

Cached Exchange Mode Sync Settings

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange\Cached Exchange Mode

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange\Cached Exchange Mode

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\cached mode!syncwindowsetting

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\cached mode!syncwindowsetting

Allows you to configure the amount (by date) of user email Outlook synchronizes locally using Cached Exchange Mode.

RPC Proxy Authentication Setting

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\rpc!proxyauthenticationservice

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\rpc!proxyauthenticationservice

Determines the RPC proxy authentication setting for Outlook Anywhere.

RPC Proxy Server Name

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\rpc!proxyservername

OCT registry path: software\microsoft\office\15.0\outlook\rpc!proxyservername

Determines the RPC proxy server that Outlook Anywhere uses when it connects to Exchange.

Only connect if Proxy Server certificate has this principal name

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook!rpcproxyserverprincipalname

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\rpc!proxyserverprincipalname

Specifies the required certificate principal name for the RPC proxy server for Outlook Anywhere.

RPC/HTTP Connection Flags

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT location in Features\Modify User Settings

: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\rpc!proxyserverflags

OCT registry path: software\microsoft\office\15.0\outlook\rpc!proxyserverflags

Configures connection options for Outlook Anywhere..

Disable connection fallback between protocols

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\rpc!disablerpctcpfallback

OCT registry path: software\microsoft\office\15.0\outlook\rpc!disablerpctcpfallback

Allows you to control the connection transport fallback behavior in Outlook when it attempts to connect to a Microsoft Exchange Server.

Do not create new OST file on upgrade

Group Policy location : User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\ost!donotcreatenewostonupgrade

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\ost!donotcreatenewostonupgrade

Controls whether Outlook creates a new OST file when you upgrade to Outlook 15. The new OST file uses less space on the disk. When a new OST file is created, the contents from the earlier version of Outlook are downloaded from the Exchange Server.

PST Null Data on Delete

Group Policy location in Features\Modify User Settings: User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous\PST Settings

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\pst!pstnullfreeondelete

Allows you to force Outlook to fully nullify deleted data in users' Personal Folder files (.pst) at the time that the data is deleted.

Block all unmanaged add-ins

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\resiliency!restricttolist

Blocks all add-ins that are not managed by the "List of managed add-ins" policy setting.

List of managed add-ins

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\resiliency!addinlist

Allows you to specify which add-ins are always enabled, always disabled (blocked), or configurable by the user.

Disable AutoDiscover

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Account Settings\Exchange

OCT locationOCT location in Features\Modify User Settings: Microsoft Outlook 2013\Account Settings\Exchange

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\autodiscover!excludelastknowngoodurl

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\autodiscover!excludelastknowngoodurl

Allows you to disable AutoDiscover. You can enable this policy setting and select one or more of the following options to disable in the AutoDiscover feature:

  • Exclude the last known good URL Outlook does not use the last known good Autodiscover URL.

    • Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\AutoDiscover

    • DWORD: ExcludeLastKnownGoodUrl

    • Value: 1

  • Exclude the SCP object lookup Outlook does not perform Active Directory queries for Service Connection Point (SCP) objects that have Autodiscover information.

    • Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\AutoDiscover

    • DWORD: ExcludeScpLookup

    • Value: 1

  • Exclude the root domain query based on your primary SMTP address Outlook does not use the root domain of your primary SMTP address to locate the AutoDiscover service. For example, you select this optionOutlook does not use the following URL: https://<smtp-address-domain>/autodiscover/autodiscover.xml.

    • Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\AutoDiscover

    • DWORD: ExcludeHttpsRootDomain

    • Value: 1

  • Exclude the query for the AutoDiscover domain Outlook does not use the Autodiscover domain to locate the Autodiscover service. For example, Outlook does not use the following URL: https://autodiscover.<smtp-address-domain>/autodiscover/autodiscover.xml

    • Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\AutoDiscover

    • DWORD: ExcludeHttpsAutoDiscoverDomain

    • Value: 1

  • Exclude the HTTP redirect method Outlook does not use the HTTP redirect method in the event it cannot reach the AutoDiscover service via either of the HTTPS URLs: https://<smtp-address-domain>/autodiscover/autodiscover.xml or https://autodiscover.<smtp-address-domain>/autodiscover/autodiscover.xml.

    • Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\AutoDiscover

    • DWORD: ExcludeHttpRedirect

    • Value: 1

  • Exclude the SRV record query in DNS Outlook does not use an SRV record lookup in DNS to locate the AutoDiscover service.

    • Key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\AutoDiscover

    • DWORD: ExcludeSrvRecord

    • Value: 1

Disable Reading Pane Compose

Group Policy location: User Configuration\Administrative Templates\Microsoft Outlook 2013\Outlook Options\Mail\Compose Messages

OCT location in Features\Modify User Settings: Microsoft Outlook 2013\Outlook Options\Mail\Compose Messages

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\outlook\message!disablereadingpanecompose

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\outlook\message!disablereadingpanecompose

Allows you to control whether user's responses to emails are composed inline on the reading pane or in a new window.

For more information about Outlook 2013 settings, see Plan feature customizations in Outlook 2013.

The following table lists a Group Policy setting that specifies the label that is displayed when the Save to SharePoint form in the backstage view is used.

Save to SharePoint label setting

Setting name UI location Registry path and value name Description

Change label of Save to SharePoint

Group Policy location: User Configuration\Administrative Templates \Microsoft Office 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Office 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\sharepointintegration!productname

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\sharepointintegration!productname

Allows you to change all instances of the SharePoint label that is displayed in the Open and Save As places in all Office applications.

The following table lists the Group Policy and OCT setting that controls access to services that are used by online services.

Services for online Office 2013 features setting

Setting name UI location Registry path and value name Description

Service Level Options

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Tools | Options | General | Service Options…\Online Content

OCT location in Modify User Settings: Microsoft Office 2013\Tools | Options | General | Service Options…\Online Content

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\internet!serviceleveloptions

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\internet!serviceleveloptions

Controls the types of services that the online features of Office 2013 can use.

The following table lists sign-in settings that apply to all Office 2013 applications.

Sign-in settings

Setting name | UI location | Registry path and value name | Description
Block signing into Office | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Miscellaneous OCT location in Features\Modify User Settings: Microsoft Office 2013\Miscellaneous | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\signin!signinoptions OCT registry path: HKEY_CURRENT_USER\ software\microsoft\office\15.0\common\signin!signinoptions | Controls whether users can provide credentials to Office using either their Windows Live ID or the user ID assigned by your organization for accessing Office 365.
Use local user name and initials values regardless of signed-in user | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Privacy\Trust Center OCT location in Features\Modify User Settings: Microsoft Office 2013\Privacy\Trust Center | Group Policy registry path: HKEY_CURRENT_USER\ software\policies\microsoft\office\common\userinfo!uselocal OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\common\userinfo!uselocal | Controls whether Office uses the user name and initials of the user currently signed-in, or the user name and initials that are specified in the Options dialog box.

The following table lists the Group Policy and OCT settings for subscription activation.

Subscription activation settings

Setting name UI location Registry path and value name Description

Automatically activate Office with federated organization credentials

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Subscription activation

OCT location in Features\Modify User Settings: Microsoft Office 2013\Subscription activation

Group Policy registry path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Common!AutoOrgIDGetKey

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common!AutoOrgIDGetKey

Activates Office on users' computers without prompting them to sign in to their Office 365 accounts.

Do not show "Manage Account" link for subscription licenses

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Subscription activation

OCT location in Features\Modify User Settings: Microsoft Office 2013\Subscription activation

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\licensing!hidemanageaccountlink

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\licensing!hidemanageaccountlin

Controls whether a Manage Account link is exposed in the Account tab of the File menu for subscription

The following table lists Group Policy and OCT settings for Telemetry Dashboard.

Telemetry Dashboard policy settings

Setting name | UI location | Registry path and value name | Description
Turn on telemetry data collection | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\osm!enablelogging OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm!enablelogging | Enables runtime telemetry and static scanning. This allows the agent to collect telemetry data.
Turn on data uploading for the Office Telemetry Agent | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\osm!enableupload OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm!enableupload | Turns on the data uploading feature in the Telemetry Agent so that the agent can periodically upload telemetry data to the shared folder that is specified in CommonFileShare.
Specify the UNC path of store Office telemetry data | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\osm!commonfileshare OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm!commonfileshare | Specifies the UNC path of the shared folder for storing telemetry data. Value: \\server\share
Specify custom tags for Office telemetry data | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm! OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm! Value names are: tag1, tag2, tag3, and tag4. | Adds custom tags to the Office telemetry data that is sent by Telemetry Agent. If you enable this policy setting, the specified custom tags are shown in Telemetry Dashboard, where you can filter the collected data by the tag name. You can replace tag1, tag2, tag3, and tag4 value names with custom strings to categorize and filter the collected data. For example, replace tag1 with a department name, replace tag2 with the location of the users, and so on.
Turn on privacy settings in Office Telemetry Agent | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\osm!enablefileobfuscation OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm!enablefileobfuscation | Configures the Telemetry Agent to disguise, or obfuscate, certain file properties that are reported in telemetry data. If you enable this policy setting, the Telemetry Agent obfuscates the file name, file path, and title of Office documents before uploading telemetric data to the shared folder.
Office applications to exclude from Office Telemetry Agent reporting | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\osm!preventedapplications OCT registry path: HKEY_CURRENT_USER \software\microsoft\office\15.0\osm!preventedapplications | Prevents telemetry data for specific Office applications from being reported to Telemetry Dashboard.
Office solutions to exclude from Office Telemetry Agent reporting | Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013\Telemetry Dashboard OCT location in Features\Modify User Settings: Microsoft Office 2013\Telemetry Dashboard | Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\osm!preventedsolutiontypes OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\osm!preventedsolutiontypes | Prevents telemetry data for specific Office applications from being reported to Telemetry Dashboard.

The following table lists Group Policy and OCT settings that manage Office templates and backgrounds.

Templates and backgrounds settings

Setting name UI location Registry path and value name Description

Show custom templates tab by default in Access on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft Access 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Access 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Access\Settings!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\access\settings!officestartdefaulttab

Controls whether custom templates (when they exist) show as the default tab in Access on the Office Start screen and in File | New.

Show custom templates tab by default in Excel on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft Excel 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Excel 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\excel\options!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\excel\options!officestartdefaulttab

Controls whether custom templates (when they exist) show as the default tab in Excel on the Office Start screen and in File | New.

Show custom templates tab by default in PowerPoint on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft PowerPoint 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft PowerPoint 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\powerpoint\options!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\HKCU\software\microsoft\office\15.0\powerpoint\options!officestartdefaulttab

Controls whether custom templates (when they exist) show as the default tab in PowerPoint on the Office Start screen and in File | New.

Show custom templates tab by default in Project on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft Project 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Project 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ms project\options\general!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ms project\options\general!officestartdefaulttab

Controls whether custom templates (when they exist) show as the default tab in Project on the Office Start screen and in File | New.

Default tab to show in Publisher on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft Publisher 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Publisher 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\publisher\preferences!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\publisher\preferences!officestartdefaulttab

Controls what displays as the default tab in Publisher on the Office Start screen and in File | New.

Default tab to show in Visio on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft Visio 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Visio 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\visio\application!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\visio\application!officestartdefaulttab

Controls what displays as the default tab in Visio on the Office Start screen and in File | New.

Show custom templates tab by default in Word on the Office Start screen and in File | New

Group Policy location: User Configuration\Administrative Templates\Microsoft Word 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Word 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\word\options!officestartdefaulttab

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\word\options!officestartdefaulttab

Controls whether custom templates (when they exist) show as the default tab in Word on the Office Start screen and in File | New.

Personal templates path for Access

Group Policy location: User Configuration\Administrative Templates\Microsoft Access 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Access 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\access\settings!personaltemplatesaccess

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\access\settings!personaltemplatesaccess

Specifies the location of a user's personal templates.

Personal templates path for Excel

Group Policy location: User Configuration\Administrative Templates\Microsoft Excel 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Excel 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\excel\options!personaltemplates

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\excel\options!personaltemplates

Specifies the location of a user's personal templates.

Personal templates path for PowerPoint

Group Policy location: User Configuration\Administrative Templates\Microsoft PowerPoint 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft PowerPoint 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\powerpoint\options!personaltemplates

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\powerpoint\options!personaltemplates

Specifies the location of a user's personal templates.

Personal templates path for Project

Group Policy location: User Configuration\Administrative Templates\Microsoft Project 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Project 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\ms project\options\save!personaltemplates

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\ms project\options\save!personaltemplates

Specifies the location of a user's personal templates.

Personal templates path for Publisher

Group Policy location: User Configuration\Administrative Templates\Microsoft Publisher 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Publisher 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\publisher\preferences!personaltemplates

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\publisher\preferences!personaltemplates

Specifies the location of a user's personal templates

Personal templates path for Visio

Group Policy location: User Configuration\Administrative Templates\Microsoft Visio 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Visio 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\visio\application!personaltemplates

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\visio\application!personaltemplates

Specifies the location of a user's personal templates.

Personal templates path for Word

Group Policy location: User Configuration\Administrative Templates\Microsoft Word 2013\Miscellaneous

OCT location in Modify User Settings: Microsoft Word 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\word\options!personaltemplates

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\word\options!personaltemplates

Specifies the location of a user's personal templates.

Disable Office Backgrounds

Group Policy location: User Configuration\Administrative Templates\Microsoft Office 2013 (Machine)\Miscellaneous

OCT location in Modify User Settings: Microsoft Office 2013\Miscellaneous

Group Policy registry path: HKEY_CURRENT_USER\software\policies\microsoft\office\15.0\common\general!disablebackgrounds

OCT registry path: HKEY_CURRENT_USER\software\microsoft\office\15.0\common\general!disablebackgrounds

Turns on and off the ability of users to select an Office background.

Loading the Administrative Template files

To load the Administrative Template files, download the files and follow the instructions for "Loading the ADMX templates" in Use Group Policy to enforce Office 2010 settings. Although the article is for Office 2010, the Administrative Templates information also applies to Office 2013.

For information about managing ADMX files and using a central store for Administrative Templates files, see Managing Group Policy ADMX Files Step-by-Step Guide. For Group Policy planning information, see Group Policy Planning and Deployment Guide.

To obtain information about the policy settings that are currently in effect for the Group Policy object (GPO) that is linked to the domain or organizational unit that contains a specific computer or user, you can use Group Policy Results in Group Policy Management Console (GPMC). To access Group Policy Results data for a user or computer, you must have Read Group Policy Results data permission on the domain or organizational unit that contains the user or computer, or you must be a member of the Administrators group on the targeted local computer. For information about GPMC, see Group Policy Management Console.

For more information about how to report by using Group Policy Results, see "Using Group Policy Results to determine Resultant Set of Policy" in the Group Policy Planning and Deployment Guide.

Preventing conflicts with earlier versions of Group Policy settings

Note:

This section applies only to Group Policy. It does not apply to the OCT.

Group Policy settings information for Office 2013, and Office 2010 and Office 2007 is stored in version-specific locations in the Windows registry, as shown in the following table.

Version-specific policy settings

Type of setting | Office 2013 subkey | Office 2010 subkey | Office 2007 subkey
User policy settings | HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0 | HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\14.0 | HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0
Computer policy settings | HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\15.0 | HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\14.0 | HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\12.0

Updating the OCT

To update the OCT, replace the /Admin folder in your Office 2013 installation files or installation image with the new /Admin folder that is included in the download package.

Files that are included in this download

The download package for the Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool contains the following folders and files:

  • AdminTemplates32.exe

  • AdminTemplates64.exe

  • office2013grouppolicyandoctsettings_reference.xlsx

\ADMX: The ADMX folder contains XML-based versions (.admx or .adml files) of the Administrative Template files for Windows 7, Windows 8, Windows Server 2008 R2, or Windows Server 2012. Administrative Template files are divided into ADMX (language-neutral) and ADML (language-specific) files. By default, the %systemroot%\PolicyDefinitions folder on a local computer stores all ADMX files. ADML files are stored in language-specific folders under the %systemroot%\PolicyDefinitions folder. Each language subfolder contains the .adml files for that language. For example, the English language ADML files would be stored in the %systemroot%\PolicyDefinitions\en-us folder. The following languages are included: Chinese Simplified (People's Republic of China), Chinese (Hong Kong SAR), English, French, German, Italian, Japanese, Korean, Portuguese (Brazil), Russian, and Spanish. The following files are stored in the \ADMX folder:

access15.admx

excel15.admx

inf15.admx

lync15.admx

office15.admx

onent15.admx

outlk15.admx

ppt15.admx

proj15.admx

pub15.admx

spd15.admx

visio15.admx

word15.admx

\de-de: Contains the German language version of the .adml files.

\en-us: Contains the English language version of the .adml files.

access15.adml

excel15.adml

inf15.adml

lync15.adml

office15.adml

onent15.adml

outlk15.adml

ppt15.adml

proj15.adml

pub15.adml

spd15.adml

visio15.adml

word15.adml

\es-es: Contains the Spanish language version of the .adml files.

\fr-fr: Contains the French language version of the .adml files.

\it-it: Contains the Italian language version of the .adml files.

\ja-jp: Contains the Japanese language version of the .adml files.

\ko-kr: Contains the Korean language version of the .adml files.

\pt-br: Contains the Portuguese (Brazil) language version of the files in the \en-us subfolder.

\ru-ru: Contains the Russian language version of the files in the \en-us subfolder.

\zh-cn: Contains the Chinese Simplified (People's Republic of China) language version of the .adml files.

\zh-tw: Contains the Chinese (Hong Kong SAR) language version of the .adml files.

\Admin: Contains the OPAX and OPAL files, oct.dll, and octca.dll files. Language neutral resources are included in the OPAX files and language-specific resources are included in the OPAL files. Each of the language subfolders contains the .opal files for that language, the Office Customization Help file (OCT.chm), and octres.dll files. For example, the en-us subfolder contains the English-US version of these files. Languages included are Chinese Simplified (People's Republic of China), Chinese (Hong Kong SAR), English, French, German, Italian, Japanese, Korean, Portuguese, Russian, and Spanish.

oct.dll

octca.dll

\de-de: Contains the German language version of the files in the \en-us subfolder.

\en-us: Contains the .opal files, oct.chm Help file, and octres.dll files.

access15.opal

excel15.opal

inf15.opal

office15.opal

onent15.opal

outlk15.opal

ppt15.opal

proj15.opal

pub15.opal

spd15.opal

visio15.opal

word15.opal

oct.chm Help file

octres.dll

\es-es: Contains the Spanish language version of the .opal, oct.chm, and octres.dll files.

\fr-fr: Contains the French language version of the .opal, oct.chm, and octres.dll files.

\it-it: Contains the Italian language version of the .opal, oct.chm, and octres.dll files.

\ja-jp: Contains the Japanese language version of the .opal, oct.chm, and octres.dll files.

\ko-kr: Contains the Korean language version of the .opal, oct.chm, and octres.dll files.

\pt-br: Contains the Portuguese (Brazil) language version of the files in the \en-us subfolder.

\ru-ru: Contains the Russian language version of the files in the \en-us subfolder.

\zh-cn: Contains the Chinese Simplified (People's Republic of China) language version of the .opal, oct.chm, and octres.dll files.

\zh-tw: Contains the Chinese (Hong Kong SAR) language version of the .opal, oct.chm, and octres.dll files.


Use Office Customization Tool (OCT) to change users' configurations after installing Office 2013

Published: September 25, 2012

Summary: Explains how to update an existing Office 2013 installation by running the Office Customization Tool and creating a Setup customization file (.msp file).

Applies to: Office 2013

Audience: IT Professionals

The instructions in this article show how to use the Office Customization Tool (OCT) to change an existing installation of Office 2013.

In this article:

  • Overview

  • Customize an existing Office installation

  • How customization works

Overview

After you install Office 2013 on users' computers, you can change the installation by using the same tool that you used to customize the installation originally. By running the Office Customization Tool (OCT) and creating or changing a Setup customization file (.msp file), you can customize the Office installation. For example, you can add or remove features, change user settings, or add or remove files or registry entries.

In Office 2013, two architecture-specific versions of the OCT are available: one for 32-bit Office 2013 and one for 64-bit Office 2013. The 64-bit version of the OCT supports 64-bit client editions of Office 2013, and provides the same user interface, capabilities, and configurable settings as the 32-bit version. You use the same command to run the 32-bit or 64-bit version of the OCT. For instance, if you want to run the 32-bit OCT, run the setup.exe /admin command line from the x86 (32-bit) folder as shown in the following example: \\server\share\Office14\x86\setup.exe /admin. To run the 64-bit OCT, run the setup.exe /admin command line from the x64 (64-bit) folder. For more information about 64-bit Office 2013, see 64-bit editions of Office 2013. For more information about the OCT, see Office Customization Tool (OCT) reference for Office 2013.

Note:

If you have created an initial Setup customization file (.msp file) for an Office 2013 product (for example, Office Professional Plus 2013) and you later want to modify the installation to add language packs, you can do so by using the Import feature in the OCT. In such cases, you first add the language packs to the network installation point that contains the Office product source files. Then, you run the OCT from the root of the network installation point and create a new Setup customization file for the same product and import the original customization .msp file that you created previously for Office Professional Plus 2013. For information about the network installation point, see Create a network installation point.

Customize an existing Office installation

Use the following procedure to customize an existing installation of Office 2013.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To customize the installation

  1. From the root of the network installation point that contains the source files, run the following command line to start the OCT: \\server\share\setup.exe /admin

  2. In the Select Product dialog box, select the product that you want to customize, and then choose OK.

  3. In the navigation pane, choose an area of customization, choose the option that you want to customize, and then customize the installation in the details pane.

    For example, to remove Access 2013 from the installation, locate Features in the navigation pane, and then choose Set feature installation states. In the details pane, expand Microsoft Office, and use the shortcut menu (right-click) to choose Microsoft Office Access. Then select Not Available.

  4. On the File menu, choose Save As after you finish customizing the installation.

  5. Specify a unique name for the customization file by using an .msp file name extension, and then choose Save.

  6. Deploy and apply the Setup customization file (.msp) to users' computers. For more information, see Applying Setup customization .msp files to existing installations.

If you decide later that you want to make additional changes to an existing installation, you can use the OCT to create a new maintenance customization .msp file. For example, you might want to change existing feature installation states.

As a best practice for changing existing feature installation states on an existing installation of Office 2013, we recommend that you create a new Setup customization .msp file to make only the changes that you want to implement. To avoid unexpected results, you must specify only the changes that you want to make. For example, to create a Setup customization .msp file to add the Access feature after an initial installation, start the OCT and create a new customization .msp file for the product. In the navigation pane of the OCT, locate Features, and then choose Set feature installation states. In the details pane, expand Microsoft Office, use the shortcut menu (right-click) to choose Microsoft Office Access, and then select Run from My Computer. On the File menu, choose Save As, and specify a path and file name for the .msp customization file.

How customization works

Because the Setup customization file that is created by the OCT is a Windows Installer package (.msp), you can apply the file to users' computers as you would apply a software update. The Office installation is modified by using the customizations defined in the .msp file. The following sections describe how to deploy customization .msp files to existing Office installations and show customization patch sequencing.

Applying Setup customization .msp files to existing installations

To apply the Setup customization (.msp) file to existing installations, you must apply the .msp file directly to the user's computer. You cannot apply the customization file to existing installations by placing the .msp file in the Updates folder and running Setup again on the user's computer, or by running Setup with the customization file specified in the command line.

For example, users can apply the Setup customization .msp file by double-clicking the .msp file or by running msiexec with the /p option, at a command prompt as shown in the following example:

msiexec.exe /p \\server\share\custom.msp

For information about Windows Installer command-line options, see Windows Installer Command-Line Options (http://go.microsoft.com/fwlink/p/?LinkId=162945).

You can also use a deployment management program, such as Microsoft System Center 2012 Configuration Manager, to deploy Setup customization files. For more information, see the System Center Configuration Manager TechCenter website (http://go.microsoft.com/fwlink/p/?LinkID=162933).

Note:

Although you can use Windows Server Update Services (WSUS) to deploy software updates, you cannot use WSUS to deploy Setup customization .msp files.

Setup customization patch sequencing

Every time that you save a customization .msp file in the OCT, the tool updates the customization file's patch sequencing number by applying the current computer date and time stamp and it generates a new patch globally unique identifier (GUID). The OCT .msp files are applied chronologically according to their time stamps.

To show the sequencing behavior, assume that you created the following .msp maintenance files:

  1. An OCT .msp file that is named uninstall-access.msp, in which you set Microsoft Office Access to Not Available. This file is saved first. Therefore, it has a lower patch sequence number and an older date and time stamp. This .msp file is sequenced first and Access is set to Not Available on users' computers.

  2. An OCT .msp file that is named install-access.msp, in which you set Microsoft Office Access to Run all from My Computer. This file is saved last. Therefore, it has a higher patch sequence number and a newer date and time stamp. This .msp file is sequenced later than the first OCT .msp file, uninstall-access.msp. Therefore, Access is set to Run all from My Computer on users' computers.

See also

Office Customization Tool (OCT) reference for Office 2013
Customize Setup before installing Office 2013
64-bit editions of Office 2013
Overview of Setup architecture for Office 2013


Distribute updates for Office 2013 products

Published: December 18, 2012

Summary: Explains the software updates process and how to deploy updates for Windows Installer-based (MSI) Office 2013, Project 2013, and Visio 2013.

Applies to: Office 2013

Audience: IT Professionals

After a new release of Office, Microsoft makes available a series of software updates to help improve application security, performance, and reliability. This article lists and describes the types of software updates that are available for Windows Installer-based Office and the deployment methods that are used to deploy software updates for Office 2013, Project 2013, and Visio 2013 clients.

In this article:

  • Windows Installer versions

  • Maintaining existing Office 2013 installations

  • Using enterprise deployment tools to deploy updates

  • Choosing an update strategy

Microsoft releases the kinds of software updates that are listed in the following table.

Types of software updates for Office

Update Definition

Service pack

A tested, cumulative set of hotfixes, security updates, critical updates, and software updates. Service packs might also contain a limited number of customer-requested design changes or features. A service pack represents a new baseline version of the product.

Security update

A widely released fix for a product-specific, security-related vulnerability. Security-related vulnerabilities are rated based on their severity, which is indicated in the Microsoft security bulletin as critical, important, moderate, or low.

General update

A widely released fix for a specific problem that addresses a very important issue that is not security-related.

Hotfix

A single, cumulative package that is made up of one or more files that address a problem in a product. Hotfixes address a specific customer situation and might not be distributed outside the customer organization.

Office Cumulative Updates are released every two months. There are overall KB articles that are routinely updated with the latest Office cumulative updates. Note that hotfixes and cumulative updates cannot be deployed by using either Windows Software Update Services or Microsoft Update.

For information about the latest updates for Office 2013 and related products, see the Update Center for Microsoft Office, Office Servers, and Related Products.

Software updates are released as full-file updates that replace all files that are changed by an update. Because complete files are installed, full-file updates typically do not require access to the original Office installation source.

Note that service packs for Office products are available only as updates to the installed product. They are not integrated with the base Office system products.

Windows Installer versions

The minimum version of Windows Installer that is required for Office 2013 update deployment is Windows Installer 3.1. Note that Windows Installer 4.5 was released with Windows Server 2008 with Service Pack 2 (SP2). Windows Installer 5.0 was released with Windows Server 2008 R2 and Windows 7. For more information about Windows Installer, see the following resources on the MSDN website:

  • Windows Installer

  • Released versions of Windows Installer

  • Standard Installer Command-Line Options

Maintaining existing Office 2013 installations

Deployment features in Office 2013 simplify the process of selecting an updating strategy. You distribute all updates directly to the client to make sure that your existing Office 2013 system installations have the latest software updates.

Users can apply multiple full-file updates directly to client computers. For example, a user can apply a full-file security update, followed by a full-file critical update, and so on. Full-file updates completely replace all files that are affected by the update. Users can apply the update in most cases, even if they do not have access to the source. Office 2013 Setup creates a local installation source on users' computers as part of the default installation process. Setup installs all Office 2013 products in a two-step process. Setup first copies the compressed installation source files to users' computers, and then Setup calls Windows Installer to perform the actual installation from the local installation source. After the installation, the local installation source remains available for any Setup maintenance operations that require access to the original source, such as applying software updates, for example.

Administrative or elevated rights are required to install Office 2013 and product updates. Elevated rights refers to an account or process that is operating or logged into the computer that has full administrator rights or permissions. The recommended approach in enterprise environments is to use a software distribution tool such as Microsoft System Center 2012 Configuration Manager to deploy the updates. System Center 2012 Configuration Manager uses elevated rights. For more information about Office 2013 deployment, see Deployment methods for Office 2013.

Note:

In Office 2003, large organizations typically installed the product from an administrative installation point. Installing the product from a local installation source was optional. In Office 2013 and in Office 2010 and Office 2007, the administrative installation option does not exist. The local installation source is required. Because you apply all updates directly to clients, the network source remains unchanged. Client installations remain synchronized with the original source.

Distributing updates locally

Setup copies installation files to a hidden folder on the local computer when users install Office 2013. Windows Installer uses this local installation source to install Office at first and to repair and update Office later. For more information about the local installation source, see Required local installation source in Overview of Setup architecture for Office 2013.

We recommend that you use a local update strategy in most cases, especially if you:

  • Distribute software updates to different groups of users or at different times.

  • Have network bandwidth limitations.

  • Support users who have limited or unreliable network access, for example, traveling users.

Because a local installation source is always available, offline users can perform any action that requires access to the source.

Supported baselines

The original release of the Office 2013 represents the initial baseline of the product, and each successive service pack represents a new baseline.

Full-file updates are typically supported on the two most recent baselines. For example, you can deploy an update that is released after Office 2013 Service Pack 2 (SP2) becomes available to users who have updated to Service Pack 1 (SP1).

Note:

The previous baseline is supported for only 12 months after release of the latest service pack. For example, software updates are supported on SP1 for 12 months after Office 2013 SP2 is released. After the 12-month period, full-file updates target only client computers that are updated with SP2. For more information about the Microsoft Support Lifecycle, see Microsoft Support Lifecycle policy.

Using enterprise deployment tools to deploy updates

You can use any of the following methods to distribute software updates to users in your enterprise environment:

  • Microsoft Update

  • Windows Server Update Services

  • System Center 2012 Configuration Manager

  • Microsoft Self-Extractor files

  • Updates folder

    Note:

    The Updates folder method is used only for deployment of software updates when you are performing an initial installation of Office 2013.

Microsoft Update

Microsoft Update (Windows Update on computers that are running Windows 7) allows users who connect directly to the Internet to manage their own computers and download the latest software updates. Users can set up an automatic schedule to periodically check for and retrieve updates. We recommend that users use Microsoft Update, which provides a centralized and automated software update solution for Microsoft products, such as Windows and Office. For more information about Microsoft Update, see Microsoft Update Home.

In an Active Directory managed environment, you can control access to Office.com and Microsoft Update from Office applications by using the Disable commands under File tab | Help Group Policy setting. This setting is available in the User Configuration\Administrative Templates\Microsoft Office 2013\Disable Items in User Interface node in the Group Policy Management Console Microsoft Management Console (MMC) snap-in.

The Disable commands under File tab | Help policy does not prevent users from searching the Microsoft Download Center for updates or from directly using the Microsoft Update site, which also provides Office software updates. For information about Group Policy and how to configure Group Policy settings, see Overview of Group Policy for Office 2013.

Windows Server Update Services

Windows Server Update Services (WSUS) is a free tool that you can use to deploy the latest Microsoft product updates within your organization's network. WSUS connects to Microsoft Update to retrieve the latest software updates and synchronizes the updates with your organization's WSUS server. You can configure an automatic or manual synchronization. The primary WSUS server can be used to update other WSUS servers on the network.

For information about WSUS, see Windows Server Update Services 3.0 SP2 Step By Step Guide.

System Center 2012 Configuration Manager

System Center 2012 Configuration Manager is a software distribution tool that is designed for medium and large-sized organizations that manage many clients in a complex and quickly changing business environment. In addition to using System Center 2012 Configuration Manager to first deploy Office, you can use it to distribute product updates to a mixture of Microsoft Windows clients.

When you use System Center 2012 Configuration Manager to maintain Office, you can set a precise control over the deployment process. For example, you can use System Center 2012 Configuration Manager to query client computers for software requirements before you install Office, and you can target the installation to computers that meet your criteria.

For more information about System Center 2012 Configuration Manager, see Microsoft System Center 2012 Configuration Manager and Software Updates in Configuration Manager.

Microsoft Self-Extractor files

Microsoft Self-Extractor is used to combine software installation updates, and hotfixes into self-extracting executable files called Microsoft Self-Extractor packages. Administrators can install these packages by double-clicking the .exe file or by running the .exe file at a command prompt. This deployment option is useful if you do not have System Center 2012 Configuration Manager or WSUS.

You can use a switch to specify package deployment and logging options when you run the .exe file to install a package at the command prompt. You can also run the .exe file by using the Search box on the Start menu, or by clicking Start, and then clicking Run.

Note:

We recommend that you do not extract and run the .msp files from product patch .exe files. Incorrect application of the .msp files generates an error if the patch does not apply to the product that is installed on the computer. Also, the product might not be completely updated until all required .msp files are applied. The package contains detection logic to determine exactly which patches are applicable and to install only the patches that are needed.

If the update is being applied during the initial installation of Office, you must extract the .msp files to the Updates folder for installation together with the Office product. Only .msp files are processed.

For information about how to use the Updates folder for updates that are deployed with initial installations, see Deploying software updates with an initial Office 2013 installation.

The following sections provide information about how to use Microsoft Self extractor files:

  • Microsoft Self-Extractor command-line switches

  • Deploying all Microsoft Self-Extractor packages in a folder

  • Sample batch file

  • Sample script

Microsoft Self-Extractor command-line switches

To determine which switches are available for a package, use one of the following Help switches:

/?

/h

/help

The command-line switches that are supported by Microsoft Self-Extractor are listed in the following table.

Command-line switches

Switch | Description
/extract:[path] | Extracts the content of the package to the path folder. If a path is not specified, a Browse dialog box appears.
/log:[path of log file] | Enables verbose logging for the update installation. You must also include the file name in addition to the path information. The command does not create a folder. Therefore, you must use an existing folder name. In addition to the specified file name, a separate log file is created for each .MSI file that you run.
/lang:lcid | Sets the user interface to the specified locale when multiple locales are available in the package.
/quiet | Runs the package in silent mode.
/passive | Runs the update without requiring user interaction.
/norestart | Prevents prompts to the user when a restart of the computer is needed.
/forcerestart | Forces a restart of the computer when the update is complete.
/? /h /help | Displays a help message.

For more information about the command-line switches, see Microsoft Knowledge Base article 912203: Description of the command-line switches that are supported by a software installation package, an update package, or a hotfix package that was created by using Microsoft Self-Extractor.

Deploying all Microsoft Self-Extractor packages in a folder

This section includes examples of a batch file and a Visual Basic script that can be used to deploy all the Microsoft Self-Extractor packages that are contained in a folder. The batch file and script code is written so that, if a single installation fails, succeeding installations can continue. Note that both the batch file and the script are intended as examples. You might have to configure them for your specific scenarios.

Sample batch file

The following batch file first deletes an existing log file and then it installs all the Microsoft Self-Extractor files that are contained in the directory in which you have put the batch file.

@echo off

del %temp%\oupdates.txt /q

for /f "delims=-; tokens=1,2,3,4,5" %%i in ('dir /b *kb*.exe') do echo %%j-%%i-%%k-%%l-%%m >> %temp%\oupdates.txt

for /f "delims=-; tokens=1,2,3,4,5" %%i in ('type %temp%\oupdates.txt') do %%j-%%i-%%k-%%l-%%m /log:%temp%\officeupdates.log /passive /norestart

Sample script

The following Visual Basic script provides functionality that is similar to the previous batch file. This script installs all Microsoft Self-Extractor files that are contained in the folder in which you place the script. The code specifies that the Microsoft Self-Extractor packages be installed silently, and enables logging so that the log files are generated in the user's %temp% temporary folder, for example, C:\Users\<username>\AppData\Local\Temp\<officeupdate>.log. These switches are not intended for executable (.exe) files other than Microsoft Self-Extractor files. Therefore, we recommend that you do not include other kinds of .exe files in the folder that contains the Self-Extractor files.

Dim wShell 'As WshShell

Dim fso 'As FileSystemObject

Dim f 'As File

Dim sLogName 'As String

Dim sPatchFolder 'As String

Dim sPatchCmd 'As String

Const kTempFolder = 2

On Error Resume Next

sPatchFolder = Replace(Wscript.ScriptFullName, Wscript.ScriptName, "")

Set fso = CreateObject("Scripting.FileSystemObject")

Set wShell = CreateObject("WScript.Shell")

For Each f In fso.GetFolder(sPatchFolder).Files

If UCase(Right(f.Name, 4)) = ".EXE" Then

sLogName = fso.GetSpecialFolder(kTempFolder) & "\" & Left(f.Name, Len(f.Name) - 3) & "log"

sPatchCmd = f.Path & " /quiet /norestart /log:" & sLogName

wShell.Run sPatchCmd, 0, True

End If

Next

If you are deploying software updates after an initial installation of Office 2013 by using Microsoft Self-Extractor files, you can use a text editor, such as Notepad, to change the Visual Basic script and batch file samples in this section to suit your specific requirements. Save the files after you complete customizations. You can then run the script or batch file to chain the installation of the new Microsoft Self-Extractor packages. In this case, the basic process is as described in the following procedure, which uses Update for Microsoft Outlook 2013 (KB2737132) 32-Bit Edition as an example. The information applies to other Office updates also.

Note:

You can complete tasks in all Office 2013 suites by using a mouse, keyboard shortcuts, or touch. For information about how to use keyboard shortcuts and touch with Office products and services, see Keyboard shortcuts and Office Touch Guide.

To deploy all the Microsoft Self-Extractor packages that are contained in a folder

  1. Download the software update file. For example, download the Update for Microsoft Outlook 2013 (KB2737132) 32-Bit Edition.

  2. Save the download .exe file (which is outlook2013-kb2737132-fullfile-x86-glb.exe in this example) to your hard disk drive in the same folder that contains the script or batch file that you are using to deploy the Microsoft Self-Extractor packages. For example, save the file to C:\Office2013Updates.

  3. Run the customized batch file or script (based on the samples in Deploying all Microsoft Self-Extractor packages in a folder) to install all the Microsoft Self-Extractor files that are contained in the C:\Office2013Updates folder.

For information about how to use the Updates folder to incorporate the installation of updates with an initial installation of the Office 2013 products, see Deploying software updates with an initial Office 2013 installation.

Updates folder

If you are deploying an initial installation of Office 2013 and you also have to deploy Office 2013 software updates, such as service packs or hotfixes, Setup can apply them as part of the initial installation process. If you are installing Office 2013 after Office 2013 product updates have been released, we recommend that you store those updates in the Updates folder. You can store the updates for any Office-related products that are located in the installation point in the Updates folder. Only one Setup customization .msp file per product in the Updates folder is supported. A Setup customization .msp file is created by using the Office Customization Tool (OCT).

During the initial installation, Setup checks the Updates folder for.msp files that are relevant to the Office 2013 product that is being installed and applies only one Setup customization .msp file during the installation. Windows sort order is used to determine the order in which to install the first .msp file. The remaining product update files in the Updates folder are installed at the end of the installation. If you are installing a customization .msp file together with Office updates, you should change the file name of the customization .msp file to make sure that it is installed first. For example, change Custom.MSP to 1_Custom.MSP.

Setup identifies the customization .msp file that typically is located in in the Updates folder during initial deployment. Setup detects customization .msp files at the beginning of the setup process and passes the .msp files directly to Microsoft Windows Installer as it installs the Windows Installer (MSI) files for the product. This makes sure that the correct option states and other settings that are specified by the administrator are established before the product updates are applied. As a result, users receive the latest updates together with Office.

Important:

The Updates folder can only be used to deploy software updates during an initial installation of Office 2013. If there is a combination of one Setup customization .msp file and product update files, only the Setup customization .msp file is applied during the deployment phase, and the product update files are applied after the installation is complete. As noted previously, the Setup customization .msp file must be deployed first to make sure that changes such as product key (such as KMS or MAK keys) and quiet mode settings are applied.

You cannot use the Updates folder to deploy product updates after the initial installation of Office.

The following sections provide information about how to use the Updates folder:

  • Deploying software updates with an initial Office 2013 installation

  • Testing and verifying the Windows Installer (.msp) files

  • Modifying the Config.xml file to specify an alternative location for updates

  • SetupUpdates Syntax

  • Using the SetupUpdates element in Config.xml

Deploying software updates with an initial Office 2013 installation

Administrators can use the Updates folder to incorporate the installation of updates with an initial installation of the Office 2013 products. Only Windows Installer patch files that are contained in this folder are installed during the initial installation. Therefore, you must extract these patches from the Microsoft Self-Extractor package. You can also use this method to install customization patches.

If you use the Office Customization Tool to create a Setup customization .msp file, we recommend that you rename the customization file so that it is installed first. Setup.exe processes only one .msp file during installation. All other patches that are contained in the folder are chained at the end of the installation. You can rename the customization patch by adding a "1" at the beginning of the file name to make sure that it is processed first.

The following procedure uses the Update for Microsoft Outlook 2013 (KB2737132) 32-Bit Edition as an example. It shows how to install the update package (outlook2013-kb2737132-fullfile-x86-glb.exe in this example) and highlights the steps that are required to populate the Updates folder with the update patches. The information applies to other Office updates also.

Note:

The following procedure pertains only to initial installations of Office 2013. For information about how to deploy software updates after an initial installation of the Office 2013 by using Microsoft Self-Extractor files, see Deploying all Microsoft Self-Extractor packages in a folder.

To install software updates by using the Updates folder

  1. Download the Office 2013 ISO image and burn the image to a DVD, and then copy the content to a network location. For information, see Deploy Office 2013 from a network installation point.

  2. Use the Office Customization Tool to make any necessary modifications to the installation. Save the Setup customization .msp file to the Updates folder. As noted previously, ensure that the file name begins with "1." For information about customizations, see Office Customization Tool (OCT) reference for Office 2013.

  3. To change the Config.xml file, use the Config.xml file that is located in the root of the product folder for the product that you are installing. Use a text editor such as Notepad to change the file. For example, you can specify installation options (such as the path of the network installation point, the product to install, and custom setup options) and specify the languages to install. For information, see Config.xml file reference for Office 2013.

    When you complete the Config.xml customizations, save the Config.xml file. You can use the /config Setup command-line option to specify the location of the Config.xml file, as shown in the following example:

    \\server\share\setup.exe /config \\server\share\ProPlus.WW\config.xml

    where \\server\share is the network location that contains the Office 2013 source files.

  4. Download the Update for Microsoft Outlook 2013 (KB2737132) 32-Bit Edition.

  5. To extract the .msp patches from the Microsoft Self-Extractor file (outlook2013-kb2737132-fullfile-x86-glb.exe in this example), run the .exe file and use the /Extract:[extract folder path] switch. For example, type the following at the command prompt:

    outlook2013-kb2737132-fullfile-x86-glb.exe /extract:"c:\ExtractFiles"

    This command begins to extract the .msp files. Prior to beginning the extraction process, Microsoft Software License Terms are displayed. After you accept the license terms, the files are extracted to the location that you specify (C:\ExtractFiles in this example). You do not have to use the quotation marks with the path. However, it does make it easier to read the command line. By using quotation marks, you can also avoid problems with paths that contain spaces.

  6. Copy the Windows Installer patch (.msp) files to the Updates folder.

  7. Repeat the process for any other Office 2013 update packages that you want to install. The Windows Installer patch file names are unique. Therefore, there should be no risk of a file being accidentally overwritten, which could cause a problem with the installation. If you are deploying the product is with additional language packs, the language pack service packs will be added to the Updates folder.

    After you complete the previous steps, you can deploy the product.

Note:

In some scenarios, customers may be unable to install updates by using the Microsoft Self-Extractor file. A generic error message that resembles the following may display: "The installation of this package failed." In such cases, customers can use the following method to install the updates.

To install a specific software update by using the .msp file

  1. To extract the .msp patches from the Microsoft Self-Extractor file (Office2013-kbxxxxxxx-fullfile-x86-glb.exe in this example), run the .exe file and use the /extract:[extract folder path] switch. For example, type the following at the command prompt:

    Office2013-kbxxxxxxx-fullfile-x86-glb.exe /extract:"c:\UpdatesToInstall"

  2. Navigate to the UpdatesToInstall directory. Type the following at the command prompt:

    cd c:\updatestoinstall

  3. For each .msp file that is extracted in the C:\UpdatesToInstall folder, run the msiexec /update [update.msp] command. For example, type the following at the command prompt:

    msiexec.exe /update clview.msp /l*v "clview.log"

    After the .msp files are extracted, you can also double-click the .msp file to install the updates. However, double-clicking the .msp does not provide additional logging.

    Note that you can also install multiple .msp files at the same time by separating the file names with a semicolon (;). For example, type the following at the command prompt:

    msiexec.exe /update clview.msp;access.msp /l*v "updates.log"

Testing and verifying the Windows Installer (.msp) files

If you want to test updates and verify the list of .msp files before you copy them to the Updates folder on the Office 2013 network installation point, you can first install updates on a test computer, use a Visual Basic script to extract the .msp files to a target folder, and then copy the .msp files from the target folder to the Updates folder. This method is described in the following procedure.

To extract the .msp files from a test computer and copy them to the Updates folder

  1. On the test computer, install all Office 2013 applications that will be installed on users' computers.

  2. Run Microsoft Update to apply all the necessary Office 2013 updates on the test computer.

  3. Verify that your applications are running as expected.

  4. Save the following Visual Basic script as "CollectUpdates.vbs." Then run it to extract the update files that are installed on the test computer to a target folder. The script uses %Temp%\Updates as the target folder, where %Temp% is the Windows temporary folder.

    Dim oMsi,oFso,oWShell

    Dim Patches,SumInfo

    Dim patch,record,msp

    Dim qView

    Dim sTargetFolder,sMessage

    Const OFFICEID = "000-0000000FF1CE}"

    Const PRODUCTCODE_EMPTY = ""

    Const MACHINESID = ""

    Const MSIINSTALLCONTEXT_MACHINE = 4

    Const MSIPATCHSTATE_APPLIED = 1

    Const MSIOPENDATABASEMODE_PATCHFILE = 32

    Const PID_SUBJECT = 3 'Displayname

    Const PID_TEMPLATES = 7 'PatchTargets

    Set oMsi = CreateObject("WindowsInstaller.Installer")

    Set oFso = CreateObject("Scripting.FileSystemObject")

    Set oWShell = CreateObject("Wscript.Shell")

    'Create the target folder

    sTargetFolder = oWShell.ExpandEnvironmentStrings("%TEMP%")&"\Updates"

    If Not oFso.FolderExists(sTargetFolder) Then oFso.CreateFolder sTargetFolder

    sMessage = "Patches are being copied to the %Temp%\Updates folder." & vbCrLf & "A Windows Explorer window will open after the script has run."

    oWShell.Popup sMessage,20,"Office Patch Collector"

    'Get all applied patches

    Set Patches = oMsi.PatchesEx(PRODUCTCODE_EMPTY,MACHINESID,MSIINSTALLCONTEXT_MACHINE,MSIPATCHSTATE_APPLIED)

    On Error Resume Next

    'Enum the patches

    For Each patch in Patches

       If Not Err = 0 Then Err.Clear

        'Connect to the patch file

        Set msp = oMsi.OpenDatabase(patch.PatchProperty("LocalPackage"),MSIOPENDATABASEMODE_PATCHFILE)

        Set SumInfo = msp.SummaryInformation

        If Err = 0 Then

            If InStr(SumInfo.Property(PID_TEMPLATES),OFFICEID)>0 Then

                'Get the original patch name

                Set qView = msp.OpenView("SELECT `Property`,`Value` FROM MsiPatchMetadata WHERE `Property`='StdPackageName'")

                qView.Execute : Set record = qView.Fetch()

                'Copy and rename the patch to the original file name

                oFso.CopyFile patch.PatchProperty("LocalPackage"),sTargetFolder&"\"&record.StringData(2),TRUE

            End If

        End If 'Err = 0

    Next 'patch

    oWShell.Run "explorer /e,"&chr(34)&sTargetFolder&chr(34)

  5. Verify that all the required .msp files are in the target folder (%Temp%\Updates).

  6. Copy all .msp files from %Temp%\Updates on the test computer to the Updates folder on the Office 2013 network installation point.

Modifying the Config.xml file to specify an alternative location for updates

Administrators can direct Setup to look for updates in a folder other than the Updates folder by using the SetupUpdates element in the Config.xml file.

SetupUpdates Syntax

SetupUpdates in Config.xml uses the following syntax:

<SetupUpdates [CheckForSUpdates="Yes" | "No"] [SUpdateLocation="path-list"]/>

The SetupUpdates attributes are listed in the following table.

SetupUpdates attributes

Attribute Description

CheckForSUpdates

Setup uses the path list in SUpdateLocation to find Setup customization files. The default value is Yes.

If the value is set to No, Setup does not search for Setup customization files by using the path list in SUpdateLocation.

SupdateLocation="path-list"

Specifies a list of fully qualified paths to folders, separated by semicolons.

Setup looks in all the specified folders for Setup customization files that were created for the product that is being installed, and applies them in alphabetical order, by file name. If a Setup customization file is specified on the Setup command line, that file is applied first, followed by any files that were found in the folder that was specified by the SetupUpdates element.

Customization files are product-specific. Setup applies only those files that are relevant to the product being installed. However, if you store more than one customization file for the same product in the Updates folder, Setup applies all files to the user's configuration in alphabetical order.

Using the SetupUpdates element in Config.xml

Administrators can use the SetupUpdates element in the Config.xml to specify an alternative location for updates.

To use the SetupUpdates element in Config.xml

  1. Open the Config.xml file in a text editor tool, such as Notepad.

  2. Enter the options that you want to use for the SetupUpdates element, as shown in the following syntax example:

    <SetupUpdates CheckForSUpdates="Yes" SUpdateLocation="\\server1\share;\\server2\share" />

    In this case, path-list lists the fully qualified paths to folders, separated by semicolons ("\\server1\share;\\server2\share").

  3. Save the Config.xml file in the same folder that contained this file before you edited it.

For more information about the SetupUpdates element of the Config.xml file, see SetupUpdates element in Config.xml file reference for Office 2013.

Choosing an update strategy

Use the criteria in the following table to help determine the recommended software update solution for your organization.

Criteria for determining appropriate software update solutions

Customer type Need Recommended solutions

Large enterprise

Advanced software update management

System Center 2012 Configuration Manager

Updates folder (only for initial installations)

Note:

If the customization is different for different groups of users, we recommend that you select a different location for the .msp files.

Distribution of Microsoft Updates only

Windows Server Update Services

Medium enterprise

Advanced software update management

System Center 2012 Configuration Manager

Updates folder (only for initial installations)

Note:

If the customization is different for different groups of users, we recommend that you select a different location for the .msp files.

Distribution of Microsoft Updates only

Windows Server Update Services

Small business

Distribution of Microsoft Updates in environments that have at least one Windows-based computer and one IT administrator

Windows Server Update Services

All other scenarios

Microsoft Update

Microsoft Self-Extractor files

Updates folder (only for initial installations)

Note:

The Updates folder is only applicable for .msp files.

Consumer

All scenarios

Microsoft Update

See also

Overview of Setup architecture for Office 2013
Config.xml file reference for Office 2013
Office Customization Tool (OCT) reference for Office 2013


Office Anywhere in Office 2013

Published: October 16, 2012

Summary: Contains articles that will help you work with Office 2013 anywhere and from any device.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The following table includes links to articles that provide information about how to work with Office 2013 regardless of where you are or what device that you are using.

Office Anywhere articles on TechNet

Article | Description
Configure user sign-in for Office 2013 | Provides information about how users sign in to Office 2013 and how they can set sign-in IDs
Overview of user and roaming settings for Office 2013 | Provides information about the user settings and roaming settings that are new to Office 2013 and relevant to the IT Professional.
Overview of Office on Demand in Office 2013 | Introduces the Office on Demand technology and how it is used with Office 2013.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


Configure user sign-in for Office 2013

Published: October 16, 2012

Summary: Describes how users sign in to Office 2013 and how they can set sign-in IDs.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 users can sign in by using either of two types of credentials: Microsoft account, or Organization or School. The second type of credential is the user ID that is assigned by the organization or school for the purpose of accessing Office 365. The user supplies these credentials within the user interface (UI) or, in certain cases, the credentials can be picked up from the operating system.

In this article:

  • The sign-in UI

  • Sign-in settings

  • Single sign-on, Active Directory, and federated sign-in

The sign-in UI

Sign-in is a two-step process that involves discovery and authentication. In the discovery step, the user enters the email address that is associated with his or her account. The Sign in user interface is shown in the following screen shot.

Figure: User interface for signing into Office

A screenshot of a sign-in window that lets you decide whether to use a Microsoft account or Organization ID to sign-in.

The next step is authentication.

  • When users enter an email address that is associated with a Microsoft account, they are taken to a Microsoft account version of the sign-in UI. The Can't access your account? link goes to a page that contains password reset instructions.

    Figure: User interface for signing into Office with a Microsoft account ID

    A screenshot of a sign-in window that lets you sign in to Office 2013 with a Microsoft account ID.

  • When users enter an email account that is associated with their organization or school, they are taken to the organization version of the sign-in UI.

    Figure: User interface for signing into Office with an Organization ID

    A screenshot of the Office sign-in page that lets user sign in with Personal ID.

Sign-in settings

You can enable one of four sign-in states by using the Block sign-in to Office Registry setting. This setting controls whether users can provide credentials to Office 2013, and whether they can use their Microsoft account or the user ID that is assigned by your organizations, or both.

The Registry key for this setting is:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\SignIn\SignInOptions

To enable a sign-in option, set SignInOptions to a particular numeric value as shown in the following table. The table also describes how each selection affects users.

SignInOptions settings

If you set SignInOptions to this… | This is what it means | This is the effect on users
0 | Both IDs allowed | Users can sign in and access Office content by using either ID.
1 | Microsoft account only | Users can sign in only by using their Microsoft account.
2 | Organization only | Users can sign in only by using the user ID that is assigned by your organization.
3 | None allowed | Users cannot sign in by using either ID.

If you disable, or do not configure, the Block sign-in to Office setting, the default setting is Both IDs allowed, which means that users can sign in by using either ID.

Single sign-on, Active Directory, and federated sign-in

When a user signs in to Office 2013, Office automatically tries to use the Active Directory Domain Services (AD DS) account with which the user logged into the operating system. If that Active Directory account is federated with Office 365, the customer automatically receives all the benefits of signing into Office 365 without having to perform any additional steps. For more information about federating your domain with Office 365, see Prepare for single sign-on.


Overview of user and roaming settings for Office 2013

Published: October 16, 2012

Summary: Describes the user settings and roaming settings that are new to Office 2013 and that are relevant to the IT Professional.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Find out what's new in user settings and roaming settings in Office 2013. This article describes the features that you have to know about so that you can set up users easily and quickly.

Important:

This article is part of the Content roadmap for Office 365 ProPlus for IT Professionals. It applies to Office 365 ProPlus.

Are you looking for help with installing Office with Office 365? You may be looking for Get started with Office 365 and Install Office with Office 365, which will help you learn how to set up and use Office 365 on your computer, phone, and tablet.

In this article:

  • User settings for Office 2013

  • Roaming settings for Office 2013

User settings for Office 2013

In addition to the user settings that are available in Office 2010, Office 2013 contains user settings for the following tasks:

  • Determining where to sign in to Office 2013

  • Enabling Office 2013 to connect to services

  • Adding or removing services from an Office 2013 profile

These settings can be added from the My Office tab in the Office Backstage view, which is available from the Manage link in the Me Control, or in context of the feature that the settings apply to. Basically, users can do this wherever they can open or save files and they can do it from the Insert Media dialog box.Also, users can set the default Save settings in the Backstage view through File -> Options ->Save.

Determine where users sign in to Office 2013

To access personal services, the first step is to sign in to the Office application. Users can sign in from several locations:

  • From the Me Control (at the upper corner of the application)

  • From My Office in the Backstage view

  • From Save As in the Backstage view

Users can choose to sign in by using either a Microsoft account or the user ID that is assigned by your organization (the organization ID) for accessing Office 365, as long as one or both IDs are enabled by the administrator. For more information, see Configure user sign-in for Office 2013.

Enable Office 2013 to connect to services

To enable this setting, users select a check box under Privacy Options in the Trust Center user interface (UI) (File > Options > Trust Center > Trust Center Settings).

Add or remove services from an Office 2013 profile

By default, certain services are available in Office 2013 when a user signs in. For example, users who are signed in to their Microsoft accounts receive access to SkyDrive accounts. Other services are optional and can be added to or removed from an Office 2013 profile. For example, users can choose to add a Facebook account to their Office 2013 profiles so they can upload photos to and download photos from their Facebook albums.

Set default save settings

Users can set the default Save settings in the Backstage view by choosing File > Options > Save.

  • Always show "Sign in to SkyDrive" location during Save Selecting or clearing the check box for this option shows or hides the "Sign in to SkyDrive" option if a user is not logged in with a Microsoft account.

  • Prefer cloud locations when saving This setting determines whether the default Save location is in the cloud (for example, SkyDrive or SharePoint) or on a local computer.

    Note:

    By default, documents are always saved to the location in which they are currently stored. Therefore, documents that were saved before a settings change are not affected by the change.

Roaming settings for Office 2013

This section contains the following information about Office 2013 roaming settings:

  • Roaming settings and what information is roamed

  • Active Directory Roaming

  • Cloud identities and where data is stored (secure cloud storage)

  • Group Policy to disable roaming settings.

What are roaming settings?

As shown in the following table, roaming settings for Office 2013 have the following characteristics:

Roaming settings characteristics

Characteristics | Comments
They are a small group of settings that presents a large, high-valued effect on a broad set of users. | These are settings that make the most sense to roam.
They are tolerant of the nature of remotely-synced data. | Settings that are located in the cloud may change during a session. As soon as the new settings become available, they are updated within the application, even while the application is running.
They connect to user-specific data that affects the Office experience. | These settings are connected to the user and are highly relevant to the Office 2013 experience.
They are in logical groups of settings, as perceived by the user. | A user can expect that similar settings, or those that are grouped, will be treated in the same manner, regardless of how the underlying storage is implemented.
They remain the same across logins, just as users expect. | When signing into Office 2013, the user will experience Office the same way, whether they're on a desktop, a laptop, or a mobile device.

Office 2013 includes the following roaming settings:

  • Most Recently Used List (MRU) Documents and Places

  • MRU Templates

  • Office Personalization

  • Custom Dictionary

  • List of Connected Services

  • Word Resume Reading Position

  • OneNote - custom name a notebook view

  • PowerPoint Last Viewed Slide

  • Visio Settings: Scroll to Zoom, Center Selection on Zoom; Developer Mode

Active Directory Roaming

When an organization has an on-premises Active Directory domain that is federated with Office 365, roaming of the on-premises user settings within the cloud can be enabled. But, some organizations might not have signed up and federated yet with Office 365 or have just decided not to federate. For these organizations, as a way to highlight the benefits of roaming, Active Directory Roaming will automatically enable roaming of their on-premises user settings as soon as the user first signs in to an Active Directory domain computer through a Microsoft account. There are implications to this behavior:

  • Corporate data such as Most Recently Used (MRU) entries (but not the file contents) and the custom dictionary (words that are added while the user is signed in—not the existing contents of custom dictionaries) will be stored in the cloud. The corporate data is associated with a user's Microsoft account and can be accessed on other computers that the user signs into by using the same Microsoft account.

Note:

If you are concerned about corporate data roaming in the cloud through a Microsoft account, you can disable signing in through the Microsoft account. This means that users won't be able to sign in to Office at all with a Microsoft account. Because there is no Microsoft account present, settings won't have a Microsoft account through which to roam.

You can disable the Microsoft account through the following Group Policy setting:
User Configuration\Administrative Templates\Office 2013\Miscellaneous\Block signing into Office

For more information, see Configure user sign-in for Office 2013.

Cloud services

Cloud Services through Office 2013 offers the following:

  • Microsoft Online Services cloud IDs (cloud identities): Users receive cloud credentials, which are separate from other desktop or corporate credentials, for signing into Office 365 services. The cloud ID password policy is stored in the cloud with the Office 365 service.

    If the user's credentials are not federated, logging into Office 365 and authentication occur through a web browser. Users are directed to the Office 365 sign-in service page, where they type their Microsoft Online Services ID and password. The sign-in service authenticates their credentials and generates a service token that the web browser posts to the requested service and logs in the users.

    Note:

    You can integrate cloud IDs into your on-premises infrastructure by subscribing to Office 365 and federating your on-premises identities with Office 365 Organization IDs. This enables users to keep their Active Directory logins and also have an associated cloud ID that allows roaming settings.

Storing cloud identities

Cloud identities connect to secure cloud storage through the Settings Web Service, which is hosted on the Windows Azure platform. The Settings Web Service is the web interface that enables updating of roaming settings data for Office 2013 rich-client applications. This way, the roaming settings can remain consistent for the user from device to device. By using the Settings Web Service you do not have to provision your own server, configure any firewalls, or manage any settings. User data is always encrypted as it travels across the Internet. Therefore, it is never vulnerable to exposure to third parties. The data is securely stored online in a manner that enables only appropriately authenticated users access to their own data.

Important:

To reduce the risk of data being compromised, sensitive data (such as passwords) is never stored in the cloud.

Controlling roaming settings through Group Policy

You can enable or disable roaming settings by using the "Disable Roaming Office User Settings" Group Policy setting. It determines whether data can be stored in the cloud. You can find this Group Policy setting at this location:
User Configuration\Administrative Templates\Office 2013\Services\Disable Roaming Office User Settings

In addition, you can enable or disable roaming settings through the Registry as follows:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Common\Roaming\RoamingSettingsDisabled

Important:

If you disable roaming settings, data that existed in the cloud before you disabled roaming settings will remain in the cloud. To make sure that corporate data is kept out of the cloud, you must make sure that the Group Policy or Registry setting to disable roaming settings is in effect on every computer at the time that a user logs into it with a Microsoft account or Organization ID. Be aware that if you disabled roaming settings, you must change the Group Policy or Registry setting manually if you ever want roaming settings re-enabled. This includes any future sign-up for Office 365.

The following table displays the Registry settings for RoamingSettingsDisabled.

Registry settings for RoamingSettingsDisabled

If you set RoamingSettingsDisabled to… | This is the effect
0 (enable roaming settings) | Roaming settings are synchronized with the Microsoft Office Roaming Settings Web Service and users can access data from various devices. Data that already exists in the cloud is not affected by this policy.
1 (disable roaming settings) | Roaming settings are stored only locally and not synchronized to the Microsoft Office Roaming Settings Web Service.
Note:

If you do not configure this setting, the value becomes 0 and roaming settings are enabled.

See also

Configure user sign-in for Office 2013

Content roadmap for Office 365 ProPlus


Overview of Office on Demand in Office 2013

Published: October 16, 2012

Summary: Introduces the Office on Demand technology and how it is used with Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office on Demand uses Click-to-Run streaming technology to deliver Office 2013 on demand to a Windows 7 or Windows 8 computer that connects to the Office 365 service. A user can access Office on Demand through SkyDrive Pro in Office 365 and also at Office Customer Preview FAQ in the "Using the Preview" section. An Office 2013 application, such as Word, Excel, or PowerPoint, is streamed to the computer and can be used before the application is completely downloaded. A user can start to use an Office on Demand application within 30 seconds of the initial streaming of the application.

Downloading Office on Demand is an excellent way to train users on the new Office user interface and features without requiring that you fully deploy Office 2013. You do not have to grant administrative credentials to users, because users do not have to be local administrators on their computers to be able to use Office on Demand.

Important:

This article is part of the Content roadmap for Office 365 ProPlus for IT Professionals. It applies to Office 365 ProPlus.

Are you looking for help with installing Office with Office 365? You may be looking for Get started with Office 365 and Install Office with Office 365, which will help you learn how to set up and use Office 365 on your computer, phone, and tablet.

In this article:

  • How does Office on Demand work?

  • Using Office on Demand

How does Office on Demand work?

Office on Demand is available for Word, Excel, PowerPoint, Access, Publisher,Project, and Visio.
Office on Demand is not available for Lync, OneNote, or Outlook.

Because Office on Demand does not require administrative credentials on the computer, it can be used on any Internet-connected Windows 7 or Windows 8 computer. This includes computers that are used temporarily. Office 365 ProPlus subscription users are not limited by the number of computers on which they can access Office on Demand. All application processes run from the user's profile. By default, files are opened from and saved to a SkyDrive Pro location that is associated with the user account.

Note:

Office on Demand applications are delivered through application virtualization, and therefore it is not possible to customize Office on Demand applications with add-ins, dependent applications, or other customizations unless they already exist in Office installations. The Office on Demand application does not register itself in the system or automatically associate with Windows file types. After the user closes the Office on Demand application session, other users can't access the Office 2013 applications or the previous user's remotely stored files.

When Office on Demand is delivered, it always contains the latest builds of Office 365 ProPlus programs. They are always delivered through Office 365 public cloud services. Therefore, unlike Click-to-Run on-premises delivery, Office on Demand cannot be delivered to an on-premises infrastructure.

The Office on Demand application data is stored in the %userprofile% root folder. After Office on Demand runs for the first time and Office is fully cached in the %userprofile% root folder, successive starts of Office on Demand applications are almost instantaneous because the applications are executing from the local cache. When the Office builds are updated on the Office content delivery network (CDN), starting Office on Demand streams the Office applications again with the updated build.

Using Office on Demand

Users access Office on Demand applications through an active SkyDrive Pro account in Office 365. When a user opens, updates, and closes a document, it is saved back to the online location from which the document was opened. Office on Demand disables the long-term local cache to make sure that when the application is closed and the user is signed out, the user's files are stored back to the online location from which they were opened.

Figure: SkyDrive Pro documents folder

An Office Web Apps page that shows the SkydrivePro documents folder

Before Office on Demand can run for the first time, you must install the Microsoft Office (Roaming) add-on as follows.

  1. In Internet Explorer, choose the Tools menu, and choose Manage Add-ons. The Manage Add-ons tool is displayed.

  2. Under Add-on Types, choose Toolbars and Extensions. In the pane that is under Microsoft Corporation, locate the Microsoft Office (Roaming) add-on.

  3. Verify that the Microsoft Office (Roaming) add-on is enabled. If it is not, select the add-on and choose the Enable button in the bottom corner of the tool.

Figure: Manage Add-ons dialog box

An Internet Explorer window that lets you manage add-ons

The act of choosing a document starts the Office Web App that is associated with the file. In many cases, the Office Web App provides both view and edit functionality for the file. If you want to use functionality that is not available in the Office Web App, you can choose to edit the document in an already existing Office installation or by starting the full Office application in the Office Web App viewer.

For example, to start the full Word application from the Office Web App viewer:

  1. Choose the EDIT DOCUMENT menu in the Office Web App viewer.

  2. Choose Edit in Word.

Similarly, you can start the full versions of other Office applications such as PowerPoint and Excel.

Figure: Using the Word Web App viewer to choose how to edit a Word document

Edit either through the web app or the full app

See also

Content roadmap for Office 365 ProPlus
Office Customer Preview FAQ


User Readiness for Office 2013

Published: July 16, 2012

Summary: Contains articles that will help you prepare users in your organization to work with Office 2013.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The following table includes links to articles that will help you train users so they can feel confident and ready to begin working with Office 2013.

Office 2013 user readiness articles on TechNet

Article | Description
User Readiness for Office 2013 | Provides links to resources to help users in an organization learn about Office 2013 applications and Office 365.

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

To provide feedback about the documentation for Office 2013Office 365 ProPlus, choose the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Email us to suggest content Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


End user training resources for Office 2013 and Office 365

Published: December 11, 2012

Summary: Helps users in your organization find free training resources so they can learn about Office 365 and Office 2013 applications.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Pros

This article contains links to end-user training resources. To download a Quick Start Guide, you must have the free Adobe Reader installed. To view a "Make the switch to" video course, you can use the free PowerPoint Viewer.

In this article:

  • Training resources for Office

  • Office Touch Guide

The following table contains lists of training resources for Office 365 and for all the Office 2013 applications.

Training resources for Office

Office 2013 logo

Office 365

If your organization signed up for Office 365 and you need to start reading email, sharing documents, and more, see the following resources to get started with Office 365:

  • Get started with Office 365

  • Get started with the new Office

  • Install Office with Office 365

  • Use my Office desktop applications with Office 365

  • Set up and use Office 365 on your phone or tablet

  • Start using Office and Office Web Apps

  • Start using SharePoint sites, SkyDrive Pro, and Newsfeed to share documents and ideas

  • Start using Outlook Web App for email and calendars

  • Start using Lync for IM and online meetings

  • Change your account settings in Office 365 like your password or language

Video (play button) icon

Office 365 videos

The following Office 365 videos are available:

  • Video: Welcome to Office 365

  • Video: Share Documents in Office 365

  • Video: Use email and more in Office 365

  • Video: Communicate with Lync in Office 365

  • Video: Use Office and Office Web Apps in Office 365

Also available is the following downloadable Office 365 training course, which includes the preceding Office 365 videos to help you learn about Office 365, how to use mail, share documents, and more:

  • Get to know Office 365

Office 2013 logo

Office 2013 suite

See the Office 2013 clean, new look. The features that you know and use are still there—together with some new features that are big time savers. To get started with Office 2013, see the following resources:

  • Self paced Office training

  • Office 2013 Quick Start Guides

  • Training on Office.com

  • What's new in Office 2013

Access 2013

Access 2013

Access 2013 apps are built for the web for easier sharing and collaboration. Access Web App is a new type of database that you build in Access, then use and share with others as a SharePoint app in a web browser. To learn about Access 2013 see the following resources:

  • Access 2013 Quick Start Guide

  • What's new in Access 2013

  • Access training

  • Make the switch to Access 2013

  • Basic tasks for an Access app

  • Basic tasks for an Access 2013 desktop database

Excel 2013

Excel 2013

Excel 2013 has a brand-new look and it's also designed to help you get professional-looking results quickly. To learn about new features in Excel 2013, see the following resources:

  • Excel 2013 Quick Start Guide

  • What's new in Excel 2013

  • Excel training

  • Make the switch to Excel 2013

Lync 2013

Lync 2013

To learn about getting started with IM, presence, and contacts, and how to set up, join, or share during a Lync 2013 meeting or set up your audio and video, see the following resources:

  • Quick Reference guides about Lync

  • What's new in Lync 2013

  • Lync training

  • Make the switch to Lync 2013

Office 2013 logo

Office Web Apps

Microsoft Office Web Apps are a part of most Office 365 plans. Depending on the Office 365 plan that you purchase, you can use view and edit documents on the web. To learn about Office Web Apps, see the following resources:

  • Office Web Apps

  • Use Office Web Apps to work together in Office 365

  • Office Web Apps: Anywhere-access to Office documents in Office 365

  • Basic tasks in Excel Web App

  • Basic tasks in OneNote Web App

  • Basic tasks in PowerPoint Web App

  • Basic tasks in Word Web App

OneNote 2013

OneNote 2013

OneNote 2013 has a fresh, clean look. It is fully integrated with the cloud to enable you to free your files from your computer's hard disk drives so that your notes and information are saved and searchable wherever you go, on almost any mobile device, tablet, or browser. To learn about OneNote 2013 see the following resources:

  • OneNote 2013 Quick Start Guide

  • What's new in Microsoft OneNote 2013

  • OneNote training

  • Make the switch to OneNote 2013

Outlook 2013

Outlook 2013

Outlook 2013 has a brand-new look that is cleaner, and helps you focus on what's important by providing a clear view of email, calendars, and contacts. To learn about Outlook 2013 see the following resources:

  • Outlook 2013 Quick Start Guide

  • What's new in Outlook 2013

  • Outlook training

  • Make the switch to Outlook 2013

PowerPoint 2013

PowerPoint 2013

PowerPoint 2013 has a brand-new look and is optimized for use on tablets and phones so that you can swipe and tap your way through presentations. To learn about PowerPoint 2013 see the following resources:

  • PowerPoint 2013 Quick Start Guide

  • What's new in PowerPoint 2013

  • PowerPoint training

  • Make the switch to PowerPoint 2013

Project 2013

Project 2013

Project 2013 is a brand-new look and features that include a new set of customizable reports, built-in Lync features, and a task path feature that enables you to highlight how tasks interlink in complex projects. To learn about Project 2013 see the following resources:

  • Project 2013 Quick Start Guide

  • What's new in Project 2013

  • Project training

  • Make the switch to Project 2013

Publisher 2013

Publisher 2013

Publisher 2013 provides new ways to work with your pictures. You can use the new picture and text effects to move or swap pictures, and add visual effects to your publications. To learn about Publisher 2013 see the following resources:

  • Publisher 2013 Quick Start Guide

  • What's new in Publisher 2013

  • Publisher training

  • Make the switch to Publisher 2013

Visio 2013

Visio 2013

Visio 2013 has updated diagram templates, new styles, themes, and other useful tools to help you cut the time, you spend drawing. You'll also find more ways to collaborate on Visio diagrams, and new commenting features. To learn about Visio 2013 see the following resources:

  • Visio 2013 Quick Start Guide

  • What's new in Visio

  • Visio training

  • Make the switch to Visio 2013

Word 2013

Word 2013

Word 2013 allows you to add an online video, open and edit a PDF file, and easily align pictures and diagrams. The new Read Mode works really well on tablets. Word includes improved collaboration features, and has direct connections to your online spaces and streamlined review features such as Simple Markup and comments. To learn about Word 2013 see the following resources:

  • Word 2013 Quick Start Guide

  • What's new in Word 2013

  • Word training

  • Make the switch to Word 2013

Office Touch Guide

Users who are new to Office with Windows 8 on a touch screen can learn about touch and gestures in the Office Touch Guide.

See also

SharePoint online training


Office 2013 Glossary

Published: July 16, 2012

Summary: Contains terms and definitions for terminology that is used in Office 2013 and SharePoint 2013 products or content.

Applies to: Office 2013 | Office 365 ProPlus

Glossary for Office 2013

Office 2013 logo The following table contains definitions for terms that are either new or changed in Office 2013.

Term | Definition
Access app | An app for SharePoint that is built by using Access and has its data stored in SQL Server or SQL Azure.
Account | A tab in the Backstage view where users can manage their identities and services, view licensing details, and link to account management features.
Action Items | A feature that identifies a possible question or requested action in an email message and enables the user to take action on it from within the message.
alignment guide | A line that is used to help line up figures with common locations on the page, such as the top of paragraphs or page margins.
Analytics Service | The service that performs analytics processing for search in SharePoint.
App Catalog | A SharePoint document library that administrators can use to distribute apps for Office and SharePoint to their end users.
app custom action | A type of custom action that is added to a host site by an app for SharePoint and that links to more functionality that is contained by the app.
app for Office | A cloud-enabled app that integrates rich, scenario-focused content and services into an Office application.
app for SharePoint | A cloud-enabled app that integrates rich, scenario-focused content and services into a SharePoint environment.
App Monitor | A dashboard where admins can track the overall health of the apps in a site collection or tenancy.
app step | A workflow step whose actions can read from and write to all items in a site.
Attachment Reminder | A feature that alerts the user before an email message is sent if it detects that an attachment may have been omitted from the message.
audio style | A combination of audio playback options that are identified by a style name. This allows you to configure playback with a single click.
Audit and Control Management Server | A Microsoft Office product that provides non-intrusive auditing of changes made to Excel spreadsheets and Access databases, and supports alerts, notifications and automatic workflows based on user activities such as macro or formula changes.
Auto-Extend | A feature that facilitates the use of Presenter View by automatically applying the Extend setting for Windows projection and identifying the correct display for Slide Show versus Presenter view.
Bing Maps | The Bing service that allows search and view of maps and satellite images.
Border Painter | A tool that is used to apply formatting to borders in a table.
Border Sampler | A tool used to collect the formatting of an existing table border so that it can be applied to another border.
Border Styles gallery | A gallery of predefined and recently used formatting styles that the user can apply to borders.
Business Intelligence Center | A SharePoint site template that provides an entry point for users to access the business intelligence ecosystem.
calculated measure | A measure whose value is calculated at run time by using an expression.
calculated member | A member of a dimension whose value is calculated at run time by using an expression. Calculated member values can be derived from the values of other members.
calendar item peek | A contextual summary of appointment or meeting information, which is displayed in a callout without opening the item.
Calendar peek | A contextual summary of the user's daily schedule, which is displayed in a callout without switching to the Calendar module.
callout | A contextual UI element that displays additional content and controls in a container that resembles a callout balloon.
canary | A predetermined value that must be present in a client-server request for the request to be considered valid.
canary value | A predetermined value that must be present in a client-server request for the request to be considered valid.
catalog | A list or library that is shared between site collections.
change hint | A vertical bar in the margin of a document that shows where changes have been tracked and displays those changes when clicked.
chart element | One of the distinct pieces that make up a chart, such as a title, axis, legend, trendline, or error bar.
chart style | A predefined style that users can apply to their chart and that is optimized for the chart type.
client object model | A set of APIs for SharePoint products. These APIs are based on the server object model, and can be called from clients such as desktop PCs and mobile devices.
client-side rendering | Technology that enables rendering operations to be handled by the client.
Cloud App Model | An application-hosting architecture that relies on cloud-based services. Application logic and data are typically hosted on a distributed set of services on the Internet, connected through web APIs, and authenticated with server-to-server authentication technologies such as OAuth.
COALESCE | A function that returns the first non-null expression from a list of arguments.
comment hint | A visual indicator that denotes the presence of a comment and opens the comment when clicked.
Comments pane | A pane beside the document that displays all comments made in the document.
Community | A site template that is designed to create an online community where people come together to share ideas or get answers to their questions.
contact linking | The process of linking contacts that represent the same person. This enables you to view information from multiple contacts in a single contact card.
content app | An app for Office that is embedded in the body of a client application window, inline with content.
content app for Office | An app for Office that is embedded in the body of a client application window, inline with content.
Content by Query | A Web Part that queries data from multiple sources within a site collection and presents that data in a custom view.
Content Search | A Web Part that performs a search using a customizable query and presents the results in a custom view.
continuous crawl | A crawl that operates on a continuous basis to scan and index new and modified content from a source.
cross-site publishing | A content publishing model in which multiple sites select and republish content that is authored and managed in a single source location.
crypto escrow key | A secondary encryption key that provides the ability for an authorized IT Helpdesk administrator to open an encrypted document when the password is lost.
CSOM | A set of APIs for SharePoint products. These APIs are based on the server object model, and can be called from clients such as desktop PCs and mobile devices.
CSR | Technology that enables rendering operations to be handled by the client.
custom action | A dropdown menu item or ribbon component that is added to a site page.
custom extraction dictionary | A user defined dictionary that lists single words or phrases that the system matches to words in the content in either a case-sensitive way or a case-insensitive way, depending on the type of dictionary that is used.
cycle chart | A chart that surfaces cyclical patterns in data by comparing the performance for certain time periods, such as days of the week or months, over time.
Data Grid | An instance of Excel that has minimal UI and that enables a user to insert or edit chart data within the context of a non-Excel Office document.
data layout | The arrangement and structure of data in a chart.
Database Compare | A Microsoft Office product that detects and categorizes changes between two databases to facilitate review and approval processes.
deep link | A link that takes you to a precise location, such as a slide within a presentation, a section of a document, or a specific page within a site, instead of to the main page of the web site.
Define | A menu option that becomes available when a user right-clicks a word. It opens the chosen definitions provider and displays information for the word selected.
definitions callout | A callout that is invoked through contextual UI to display reference data, such as definitions and synonyms, for the word selected.
Design Manager | A feature that guides the user through the process of using an HTML editor to design and customize a SharePoint site.
Detected Events | A feature that identifies a possible meeting request or event in an email message and enables the user to take action on it from within the message.
Developer Site | A site template that is designed to help developers to test the apps they are building and get feedback about their apps from others.
dictionary | A collection of keys or key and value pairs that is used for content or query processing in search.
DIGRAM FOR HEAVENLY EARTH | The Unicode character U+1D301, which represents a Tai Xuan Jing symbol.
Discovery and Risk Assessment | A Microsoft Office product that identifies business-critical Excel spreadsheets and Access databases by discovering files across network shares and SharePoint libraries, and that provides flexible risk assessment and categorization based on relevance, materiality and business impact.
document parsing | The process of detecting the file type of an item during content processing, and converting the item to text.
dynamic canary | A canary whose value changes depending on the request context.
dynamic landing page | An individual page in a topic series, or any page that is primarily search-driven.
eDiscovery | The process by which organizations find, retain, and preserve electronic documents related to a legal action.
Edit mode | A mode that provides full functionality for creating or editing a file.
Efficient File Storage | A storage method in which a file is split into pieces that are stored and updated separately, and streamed together when a user requests the file.
entity extraction | The process of extracting information from unstructured text in an item and storing that information as additional managed properties for the item.
entity extractor | A content processing feature that extracts information from unstructured text in an item and stores that information as additional managed properties for the item. The additional managed properties can be used to refine results.
event listener | A function or object that invokes an event handler when a specific condition occurs in an application.
exact word extraction dictionary | A custom extraction dictionary that lists words or phrases that are matched to exact words in the content in a case-sensitive way. For example, the system matches "anchor" to "anchor," but not to "Anchor" or "Anchorage."
exact word part extraction dictionary | A custom extraction dictionary that lists words or phrases that are matched anywhere in the content in a case-sensitive way. For example, the system matches "anchor" and "anchorage," but not "Anchor."
Excel interactive view | An online view of data that provides an enhanced visual experience through tables, slicers, charts, and other Excel objects.
Excel Online Viewer | An Excel Web App technology that enables users to view in full fidelity an Excel document that is stored online.
Exchange ActiveSync | A protocol that makes it possible for users to sync their e-mail, calendar, contact, and task data from Exchange Server to supporting devices.
Exchange Fast Access | A feature that enables Exchange users to see new email messages and up-to-date calendar items as soon as they open Outlook, without waiting for it to finish synchronizing.
external access | Authenticated access that can be granted to external partners and clients to enable sharing of selected SharePoint Online content.
external task | A line item in a timesheet that does not correspond to a project task in Project Server.
eyedropper | A tool that enables a user to sample the color of any pixel on a screen and apply that color to an object.
faceted navigation | The process of refining a search for information by filtering on individual properties or facets of the items being searched.
Favorites | A user-specified list of people who can be accessed quickly across Office communication and collaboration products.
Flash Fill | A feature that extends AutoComplete functionality to show a live preview of suggested values for an entire range of cells based on what the user is typing.
flow | A content processing or query processing pipeline that contains operators that determine how the content or the query is processed.
Folder Pane | A pane in the Outlook window that contains folders for each view, such as Mail or Calendar.
follow | To track content, people or other entities by adding them to a list of things that you care about and for which you would like to surface updates about changes and activities.
Format Object task pane | A task pane that provides functionality for formatting objects.
full-screen mode | A display mode that shows as much content as possible by hiding elements such as navigation and toolbars.
Grammar pane | A pane that provides functionality to correct grammar errors in your document.
guest link | A unique link that provides external users anonymous access to selected documents stored in SharePoint Online, with no sign in required.
index partition | A logical portion of the search index.
index replica | A copy of a search index within an index partition.
In-Place Hold | A feature that allows for preservation of content documents, pages, and messages in Exchange and SharePoint so that when they are modified or deleted, the original version can still be accessed for electronic discovery and other legal purposes.
interactive view gallery | A gallery of objects that provides different ways of visualizing data.
Internet-facing URL | A URL that is directly accessible over the Internet and that does not require special credentials or network access to connect to it.
JavaScript API for Office | A JavaScript API that provides simple and consistent programmatic access to Office documents and applications across Office client environments through common as well as application-specific data types, objects, functions and events.
key filter | A metadata column or field in a Key Filters control.
Key Filters | A metadata navigation control that enables users to limit the items displayed in a list or library to those that match selected values.
ligature | In typography, a single character created from two joined letters that replaces the two separate letters.
live layout | A layout that is updated in real time as an object on the page is moved, resized, or rotated, enabling the user to preview the end result before the action is completed.
Lock Tracking | An option that turns on change tracking and lets you set a password to prevent unauthorized users from turning it off.
Log Level Manager | A Project Server logging infrastructure that improves efficiency by enabling admins to customize logging levels for project entities.
loop | To execute a group of statements repeatedly.
loop | A series of instructions that is repeated a fixed number of times or until a terminating condition is reached.
MAHJONG TILE ONE OF CHARACTERS | The Unicode character U+1F007, which represents a Mahjong tile.
mail app | An app for Office that appears only in Outlook or Outlook Web App.
mail app for Outlook | An app for Office that appears only in Outlook or Outlook Web App.
managed navigation | A feature that enables SharePoint customers to build their site navigation around a metadata term set, and that enables friendly URLs for pages in the navigation structure.
master-level guide | A guide that is created and edited in Slide Master view, and that applies to slides that use the master layout in which it was created.
Merge Shapes | A tool that enables users to create custom shapes by combining multiple shapes into a single shape, using one of five geometric Boolean operations: Union, Combine, Fragment, Intersect, and Subtract.
microblogging | A form of blogging that emphasizes brief posts.
Microsoft Office Proofing Tools | Collections of proofing tools for different languages that that are available to users of Office applications.
move handle | A handle that is displayed on some objects such as toolbars, tables, or on individual rows or columns, that allows the user to drag them to another location.
My Account | A web experience on Office.com that enables users to manage their Office licenses and subscriptions.
My Office | A tab available to users who are signed in on Office.com where they can launch Office on Demand and access their most recently used online documents and folders.
My Tasks | A feature that provides a search-based aggregation of tasks assigned to a My Site user across SharePoint, Project Server and Exchange to help the user organize and complete these tasks.
named set | A grouping of dimension members or items from a data source that are named and treated as a single unit and can be referenced or reused multiple times.
Navigation Bar | A control bar in Outlook that enables the user to navigate quickly to different areas or views within the application.
newsfeed | A feed that provides information, notifications and updates based on people, documents, and tags you are following.
notification | A message or other indicator that informs users of events that are unrelated to their current activity, such as the number of new messages received while their computer is locked.
object layout | The positioning of an object, such as a chart, shape, image or text box, on a page, along with related options such as text-wrapping styles.
object zoom | A view that shows a close-up of an object within a document.
OData Connector | A feature that enables connectivity from SharePoint to external systems that use the OData protocol.
Office Automation Services | Collectively, the SharePoint service applications that write to ULS logs using shared code for automated document processing.
Office compatibility definition file | A file that stores information about compatibility issues and workarounds and makes it available to the Office Telemetry Log and Office Telemetry Dashboard.
Office Deployment Tool | A tool in Office 365 that enables IT professionals to manage how Office is installed for their users. Users receive the correct language and configurations individually tailored to them automatically, without the need to install anything themselves.
Office on Demand | A feature that enables subscription customers to launch Office rich client applications online from a computer on which those applications are not already installed.
Office Presentation Service | A free online service that enables Office users to share presentations with people who view them on the web.
Office Side-by-Side | A Click-to-Run feature that enables two versions of Office to exist on the same computer to provide a seamless transition for users in supported scenarios.
Office Store | An Internet site that provides a collection of products and services developed by Microsoft partners for Microsoft Office users.
Office Telemetry Agent | A feature of the Office Telemetry Dashboard that supports collection and upload of inventory and usage data for Office related solutions on client computers across an organization.
Office Telemetry Dashboard | A tool that enables IT pros to monitor usage, error, and compatibility issue information from Office related solutions on client machines across an organization.
Office Telemetry Log | A feature that displays an Office event log in Excel format and helps the user to find and resolve known compatibility issues for Office files and solutions.
Office telemetry logging | The process that populates data to the Office Telemetry Log.
Office Telemetry Processor | A Windows service application that reads data files uploaded by the Office Telemetry Agent and inserts the data into SQL Server.
Office-enabled app for SharePoint | An app that has both an Office and a SharePoint component.
OneNote Online Viewer | A OneNote Web App technology that enables users to view in full fidelity a OneNote document that is stored online.
Online Video | A feature that lets you insert a video from a web-based source into your document and play it back without leaving the document.
Online Viewers | A technology that enables users to view Office documents in full fidelity with Office Web Apps, no matter where those documents are stored online.
Online Viewers, powered by Office Web Apps | A technology that enables users to view Office documents in full fidelity with Office Web Apps, no matter where those documents are stored online.
operator | An object that processes and enhances items in a content processing flow and processes and enhances queries in a query processing flow.
PARENTHESIZED LATIN CAPITAL LETTER A | A Unicode character with hex value U+1F110
PDF reflow | A process that converts a PDF file to flowing text and document elements that are native to the application being used.
People | A view that aggregates rich information about your contacts and makes it easy to initiate communication with them.
People peek | A contextual summary of the user's favorite contacts and People search functionality, which is displayed in a callout without switching to the People view.
picture content | An image that is bounded by a picture frame.
picture frame | A container that surrounds the picture content.
Power View | A feature that enables rich visualizations for interactive data exploration, presentation and reporting in SharePoint and Excel.
PowerPoint Online Viewer | A PowerPoint Web App technology that enables users to view in full fidelity a PowerPoint document that is stored online.
Present Online | A feature that enables users to present a document to remote viewers in a web browser or in Lync.
presentation-level guide | A guide that applies to all slides in a presentation.
preservation hold library | A SharePoint document library in which content is stored after being deleted or modified so that it can be accessed for electronic discovery or other legal purposes.
Product Catalog | A site template that is designed to manage product catalogs for publishing purposes.
Project Online | An online service for teams, departments and organizations that need a flexible portfolio and project management (PPM) solution.
Project Server permission model | A security model in which permissions are assigned directly in Project Server using global and category permissions.
Project Site | A site template that is designed to provide lightweight project management functionality, including Tasks, Calendar, Timeline, and Project Summary.
Project Site Sync | A mechanism that synchronizes permissions from Project Server to project sites throughout a site collection.
Project Web App Site Sync | A mechanism that synchronizes permissions from Project Server to the Project Web App site.
public-facing URL | A URL that is directly accessible over the Internet and that does not require special credentials or network access to connect to it.
query rule | A rule that an administrator can configure and apply to query processing to help optimize results and create an enhanced user experience.
queryable managed property | A managed property that can be queried against. The query must contain the managed property field name, either in the query itself or programmatically.
Quick Analysis | A feature that enables single-click access to top data analysis features such as formulas, conditional formatting, sparklines, charts and PivotTable reports.
Quick Edit | A feature that enables users to edit SharePoint list content directly without opening an edit window.
Quick Explore | A feature that enables single-click access to trend and contribution patterns within a PivotTable or PivotChart report.
Quick Notes | A section in the default OneNote notebook where certain notes are stored by default.
Quick Preview | A feature that displays a preview of item content when a user hovers over a search result in SharePoint. The preview is optimized for the content type.
radial menu | A touch-friendly, contextual control that presents commands in a circular arrangement.
ranking model | An XML document that describes how to rank items in search results.
Read mode | A mode that is optimized for reading or viewing content and does not support edit functionality.
reading indicator | A visual effect in the navigation pane that shows users where they are in a document.
reading position indicator | A visual effect in the navigation pane that shows users where they are in a document.
recalculation animation | An animation effect that plays when the value of a cell is recalculated. The old value slides out of the bottom as the new value slides in from the top.
recommendations | A set of features that identify and surface content, people, apps or other items that a user may be interested in.
Recommended Charts | A feature that presents the user with recommended charts that can be used to display the data provided.
Recommended PivotTables | A feature that presents the user with recommended PivotTables that can be used as a starting point to analyze the data provided.
refinable managed property | A managed property that can be used as the basis for a refiner for search results.
reflow | The process by which content lays itself out dynamically based on the available window or device size.
reflow | To adjust content layout dynamically based on the available window or device size.
Related Items | A feature that enables users to link an item in a SharePoint task list to other items in the site that are related to it.
repeating section content control | A content control that enables a user the repeat its contents as many times as the user wants to repeat it.
Request Management | A SharePoint feature that helps make smart routing decisions, based on routing rules that relate the nature of requests to the dynamic topology of its farm.
request throttling | A method of preventing a denial of service attack by limiting the number of requests that can be made to a system.
resize handle | A handle that enables resizing of a row, column, window or other object.
resource budget | The amount of system resources that are allowed to be used by a block of code. Usage that exceeds this amount results in an error.
result source | A source that returns a set of search results for a given search query. The source can be a search service in the local server farm or another server farm, or another search engine that is compliant with the OpenSearch protocol.
Resume Reading | A feature that shows users their position in a document the last time they were reading, and lets them return there in a single action.
retrievable managed property | A managed property that can be displayed in search results.
rich text XML mapping | A type of XML mapping that links WordprocessingML content directly to the backing data in the custom XML part.
Role Sync | A feature that synchronizes SAP roles and SharePoint user profiles, which enables administrators to secure SharePoint objects such as sites, lists and items using SAP roles.
ruler guide marker | A marker in the ruler that aligns with the current guide position and enables users to add, edit, or delete a guide from within the ruler.
screen clipping | An image that shows all or part of a computer screen or other display.
Search on Web | A feature that enables the user to start a web search from text that is selected within a document.
search schema | A data structure that describes crawled properties, managed properties, and the mapping between them.
searchable managed property | A managed property whose value can be returned by a query.
Search-Driven Navigation | A set of controls that helps users navigate directly to where they want to go in SharePoint, without having to navigate the hierarchy or edit the URL.
seeding | A process that ensures that index replicas on the same index partition remain syncronized during regular operation and during recovery.
set | A grouping of dimension members or items from a data source that are named and treated as a single unit and can be referenced or reused multiple times.
shape-level validation | The act of checking a visual workflow to ensure that the shapes and connections are valid.
SharePoint integrated permission model | A security model in which Project Server permissions are derived from SharePoint.
SharePoint Store | An integrated online storefront where site owners can purchase apps for SharePoint.
SharePoint Translation Services | A collection of extensible features that allows customers to use machine translation or external translation vendors to translate their website content.
Simple Markup view | A view for tracked changes that clearly identifies where changes and comments are in a document, and gives you easy access to them, without detracting from the readability.
simplified sharing | A streamlined process for sharing Office documents with others.
site mailbox | An Exchange mailbox that is associated with a SharePoint site, enabling users to access documents and email related to group projects through either Outlook or SharePoint.
Snippet Gallery | A gallery of HTML code snippets for common components that can be customized and added to SharePoint designs.
sortable managed property | A managed property whose result set can be sorted based on the property before the result set is returned.
Spelling pane | A pane that provides functionality to correct spelling errors in your document.
Spreadsheet Compare | A Microsoft Office product that detects and categorizes changes between two spreadsheets to facilitate review and approval processes.
Spreadsheet Inquire | A Microsoft Office product that provides interactive diagnostics to identify errors, deviations from spreadsheet best practices and insights into data flow in and out of the spreadsheet.
stage view | A high-level view in Visual Designer that shows the stages of a SharePoint workflow, rather than individual actions or conditions.
Start | A screen that gives users quick access to recent documents and recommended templates when an Office application starts.
Start screen | A screen that gives users quick access to recent documents and recommended templates when an Office application starts.
stream-based conversion | A mode of Word Automation Services in which the input and output of the conversion are streams, rather than files on the site.
stylistic set | A stylistic variation on a font that provides an alternative to its default appearance.
sub-pixel positioning | A font rendering technique that takes advantage of partial pixels to make text appear sharper on the screen.
Swap Displays | A feature in Presenter View that enables the user to switch which monitor is showing Presenter View and which monitor is showing Slide Show.
swipe | To quickly slide a finger for a short distance.
swipe | A gesture represented by a quick slide of a finger over a short distance.
synchronous conversion | A mode of Word Automation Services in which requests are processed synchronously, rather than in batches.
task pane app | An app for Office that resides within a task pane in a client application.
task pane app for Office | An app for Office that resides within a task pane in a client application.
task path | A series of tasks that includes the predecessors and successors to the task that is selected.
Tasks peek | A contextual summary of the user's task list, which is displayed in a callout without switching to the Tasks module.
Team Work Center | A Web Part that combines a search list of projects in a site collection along with a timeline that shows how those projects relate to one another.
tenant administrator | A user account that has been assigned as an administrator for the tenant.
tenant-level external data log | An error log that contains errors and exceptions that occur when SharePoint tries to connect to external systems through Business Connectivity Services. It can be retrieved by tenant administrators.
TETRAGRAM FOR DEFECTIVENESS OR DISTORTION | The Unicode character U+1D30F, which represents a Tai Xuan Jing symbol.
Text-Based Designer | A text-based workflow editor that enables users to create and edit workflows by using declarative statements.
theme family | A set of variants on a single theme.
theme variant | One of the variations of a theme that make up a theme family.
Thesaurus pane | A pane that provides synonym lookup and display functionality.
Timeline | A graphic control that allows users to select time periods for data filtering, using a familiar linear time representation.
top-level property grid | A property grid that only displays the properties that appear in the sentence-level view of an action.
touch selection handle | A handle that enables touch selection scenarios that are not possible or are difficult to accomplish with standard touch gestures alone.
trend chart | A chart that shows the change in data over time.
update group | A collection of managed properties that are updated together in the search index.
usage event | A user action that is counted and analyzed by the recommendations algorithm in the Analytics Service.
Vertipaq | A high performance analytics engine that uses compressed in-memory column-oriented storage to manage large volumes of data and deliver fast response to user queries.
visibility mode | A mode in which SharePoint Server is the primary source for all the project details. Project Server scheduling, time and status, and advanced functionality are disabled.
Visual Designer | A Visio-based design surface that enables users to create and edit workflows visually by manipulating shapes that represent actions and conditions.
Weather Bar | A feature in the Outlook calendar that can be enabled to display the weather forecast for a selected location.
word extraction dictionary | A custom extraction dictionary that lists words or phrases that are matched to exact words in the content in a case-insensitive way. For example, the entry "anchor" will match "anchor" and "Anchor," but not "anchorage."
Word Online Viewer | A Word Web App technology that enables users to view in full fidelity a Word document that is stored online.
word part extraction dictionary | A custom extraction dictionary that lists words or phrases that are matched anywhere in the content in a case-insensitive way. For example, the entry "anchor" will match "anchor," "Anchor," and "anchorage."
Work Management Service | A SharePoint shared service that aggregates tasks that systems such as SharePoint, Project Server, and Exchange assign to users.
Work Management Task Sync | A component of the Work Management Service that synchronizes tasks with systems outside of SharePoint, such as an Exchange mailbox, to enable task management in Outlook.
workflow stage | A defined point in a workflow that is entered when specified conditions are met.


Downloadable content for the Office 2013 Resource Kit

Updated: April 2, 2013

Summary: Find downloadable content that will help you plan, deploy, and manage Office 2013 in your organization.

Applies to: Office 2013 | Office 365 ProPlus

Audience: IT Professionals

Office 2013 logo The content in Office Resource Kit is augmented by content that is available for download. Some resources are also available for purchase from Amazon.com.

The following table lists and describes the available downloadable resources.

Content | Description
Downloadable eBook: Deployment guide for Office 2013 | Download or print content about how to deploy Office 2013. Available in several file formats.
White Paper: Office 2013--Access Services Setup for an On-Premises Installation | This white paper provides instructions for configuring SQL Server 2012 for Access Services in SharePoint Server 2013, and for an on-premises installation of Access Services on a server that runs SharePoint Server 2013.
Microsoft Office Web Apps Server Management Pack Guide for System Center Operations Manager | This white paper provides step-by-step instructions for setting up the environment, importing management packs, and configuring the system for monitoring by using System Center Operations Manager. It also lists and describes the Monitors and Rules for Office Web Apps Server and provides links to them and other System Center Management Pack resources.
Telemetry in Office 2013: A new way to Assess Office Compatibility | This poster explains and illustrates what Office Telemetry is, what's monitored in Office 2013, and how telemetry data is collected. It also lists and describes all components of Office Telemetry.
Spreadsheet Management Controls with the New Office | This white paper provides information about a new Microsoft offering: a comprehensive tool set of discovery, auditing, and management capabilities. You'll learn about spreadsheet control management that uses Excel client tools. They include Spreadsheet Inquire, Spreadsheet Compare, Database Compare and the enterprise server products, Audit and Control Management Server and the Discovery and Risk Assessment Server.
Identity and Authentication in the cloud: Office 2013 and Office 365 | This poster illustrates and explains the new world of identity and authentication in Office 2013 and Office 365. Two scenarios illustrate how identities are provisioned and how those identities are authenticated completely in the Microsoft cloud or in a hybrid (on-premises and Microsoft cloud) topology.

Change History

Date | Description
April 02, 2013 | Added new poster: "Identity and Authentication in the cloud: Office 2013 and Office 365."
July 16, 2012 | Initial publication


social icons 2013

Published: July 16, 2012

Test Link that uses a parameterized legacyLink element:Downloadable content for SharePoint Server 2010

Test Link that uses a parameterized Link element: Downloadable content for SharePoint Server 2010

Test Link that uses a legacyLink element without the trailing version parameter: Downloadable content for SharePoint Server 2010

Email us to suggest content Subscribe to Office 2013 news and highlights Read the Office IT Pro Blog Read Office IT pro forums Visit Office on Facebook Follow Office Resource Kit on Twitter

Email us to suggest content Subscribe to SharePoint 2013 news and highlights Read the To the SharePoint blog Read SharePoint 2010 forums Visit SharePoint on Facebook Follow @MSOffice_ITPro on Twitter

Broken link


Office 2013

Published: July 31, 2012

Summary: Find information about Office 2013 solutions.

Applies to: Office 365 ProPlus | Office 2013 | Office Web Apps

  • Office 2013 Resource Kit

  • Office Web Apps

The following table contains links to newly published content, getting started content, and content feedback information.

Other Office resources for IT pros

What's new icon (box)

Newly published content

See the following article for a list of new or recently updated Office Resource Kit articles.

  • Newly published content for the Office 2013 Resource Kit

Getting started

Getting started

TechNet documentation includes the following articles about the new features in Office and Office 365 ProPlus.

  • Overview of Office 365 ProPlus Preview

Chat icon

Provide feedback

Provide feedback about the documentation for Office 2013 or Office 365 ProPlus, depending on the TechNet view:

Click the Feedback link at the bottom of the page. This delivers your feedback directly to the documentation team.

email To suggest content or request more documentation (or report an error), please contact us at feedork@microsoft.com.

Find training and other resources about Office

Download

Office ProPlus 365

Office 365

Office 2013

Office code samples

Office scripts and sample files

Office developer downloads

Office downloads

Office 365 downloads

How To

Build apps for Office

Deploy Office 2013

Manage Office 2013

Train Office 2010 end users

Office SDKs

Office developer training

Office developer videos

Office 365 developer videos

Office IT pro training

Office IT pro videos

Office 365 IT pro videos

Open specifications

Office protocols

Open Specifications Interactive Pivot

Sites

Office developers

Office IT pros

Office 365 developers

Office 365 IT pros

Office 2013 Resource Kit

SharePoint developers

SharePoint IT pros

Visual Studio developers

Office.com

Microsoft.com: Office 365

Help

Office updates

Apps for Office and SharePoint blog

Forums: Office for Developers

Forums: Office 365

TechNet Wiki

StackOverflow: Office

Office MVPs

Office IT pro support

Office developer support


Plan the deployment of Office 2013

Published: October 11, 2012

Setup architecture and planning for Office 2013 desktop configurations, security, applications, migration, upgrades, virtualization, and Remote Desktop Services are discussed in the following articles.

Article | Description
Overview of Setup architecture for Office 2013 | Provides an overview of the Setup architecture for Office 2013, setup sequence of events, language-neutral design and deployment of multiple languages, customization methods, required local installation source, and updates process.
Plan a migration and upgrade strategy for Office 2010 | Provides information about how to plan the installation of the Office 2010 suites, and how to migrate the user data, such as user and computers settings and documents created from the previously installed versions of Office.
Plan desktop configurations | Provides information and guidelines about items to consider before you deploy Office 2013.
Volume activation of Office 2013 | Provides an overview of Microsoft Volume Licensing and Office Activation Technologies for Office 2013 and how describes how to plan for volume activation.
Internet Protocol version 6 support for Office 2013 | Provides information about the support for Internet Protocol version 6 (IPv6) addressing in Office 2013 applications.