Windows DevCenter    
 Published on Windows DevCenter (
 See this if you're having trouble printing code examples

Deploying Microsoft Office Using Group Policy

by Mitch Tulloch, author of Windows Server Hacks

Group Policy has a useful feature called Software Installation that lets you easily deploy Windows Installer Packages (.msi files) to users and computers on your network. One application that Windows administrators often try to deploy using Group Policy is Microsoft Office, but before you jump overboard and try this on a thousand-seat network, you need to be aware of some considerations.

Methods for Deploying Office Using Group Policy

One simple way of deploying Office to your client machines is to copy the entire contents of the Office CD to a shared folder on your file server. For example, you might copy the CD files to the folder C:\Office on server TEST220 and then share this folder as Office. Now if you wanted to deploy Office to all the client computers in the Sales organizational unit (OU), you could create a new GPO called Install Office and link the GPO to the Sales OU. Then to deploy Office to computers in the Sales department, you would do the following:

The result of this procedure will be to create a software installation policy to deploy Office to all computers in the Sales OU, and when Sales users next reboot their machines, Office will be installed.

The downside of this approach is that if you later need to apply a hot fix or Service Pack to Office, you have to create a new software installation policy for each hot fix or Service Pack you need to apply. This can complicate things, as you need to keep track of lots of different packages and make sure they have been properly applied to all concerned machines.

Another approach is to perform an administrative installation of Office onto the shared folder on your file server. To perform such an install, you run Setup.exe for Office using the /a switch. The advantage here is that later when you need to deploy a hot fix or Service Pack for Office, you can apply it directly to the administrative installation. Then, to patch your clients, you simply do the following:

Related Reading

Windows Server Hacks
100 Industrial-Strength Tips & Tools
By Mitch Tulloch

Deploying Office over Slow Links

While this second method makes it easier to maintain Office, you can run into problems if you try using this approach to deploy Office over a slow WAN link, say from company headquarters to a remote branch office. The problem here is that as soon as Group Policy detects that the network link is slow, it automatically skips processing any software installation policies you have configured for computers or users at that remote site. And even if you disable slow link detection using Group Policy, there's a good chance that your installation of Office might fail anyway because of the long time it takes to install such a large program over a slow WAN link.

The workaround in this situation is to first copy your Office setup files to the computers at the remote site, and then use Group Policy to remotely trigger the Office installation package. To copy the Office CD files to your remote computers, you could use a Resource Kit tool like Robocopy, or you could run a script with xcopy commands, or you could just ship out a CD with the necessary files and an autorun script to copy them, or you can use any other method suitable to your organization. Then once you've copied the Office installation files to the local hard drive on your remote machines, you can use Group Policy to create a software installation policy as follows:

Note how the second step here differs from the second step in the earlier procedure. If you're installing Office from a network share, you need to specify the UNC path to the .msi file in your software installation policy; if you're installing Office from local files, however, you need to specify the absolute path on the target computer instead; for example, C:\OfficeFiles\pro11.msi for installing Office 2003 Professional. Note that you'll need to save the Office install files to the same location on your deployment machine as on your target machines so that you can specify an absolute path when you create your software installation policy.

Unfortunately, this method complicates the process of maintaining Office, as you will need to copy your hot fixes and Service Packs to your remote computers and run msiexec.exe on these machines to update their local installation files. But at least you've managed to get Office rolled out to your branch office without needing someone to fly out there to do the job.

Well, maybe. After going to all the trouble of copying the Office install files to your remote machines, you might still find that when you create a software installation policy mapped to these local files, it still won't process over a slow link. Fortunately, there's a way around this; just enable the following policy setting in the GPO you use to deploy Office to your remote site:

Computer Configuration\Administrative Templates\System\Group Policy\Software 
  Installation Policy Processing\Allow processing across a slow network connection.

Once you've configured this policy, any computers at the remote location will always process software installation policies, even if the Group Policy engine detects a slow link.

Final tip: For more tips and tricks using Group Policy, check out my blog.

Mitch Tulloch is the author of Windows 2000 Administration in a Nutshell, Windows Server 2003 in a Nutshell, and Windows Server Hacks.

Return to the Windows DevCenter.

Copyright © 2009 O'Reilly Media, Inc.