Most Reward for the Least Effort
Will was on the right track. I've found that the best bang for your buck is to move (or delete) the /Applications/Microsoft Office 2008/Office/Shared Applications/Proofing Tools
folder. After you do that, Word's "Tools" menu will no longer contain "Spelling and Grammar" and "Thesaurus", and the "Spelling and Grammar" item in the Preference Pane becomes greyed out.
Users are still able to access the Dictionary, and I was able to tell it to access the Thesaurus through Word once, but could not repeat it in further testing.
[It may be worth pointing out that I couldn't see how to do this from Workgroup Manager, and used Casper to execute my commands at login and logout.]
Being Doubly Safe
Managing Word Preferences through Workgroup Manager
Working from these instructions, I ran Word once, then copied the ~/Library/Preferences
folder. I then ran Word again, and set a number of preferences the way I wanted them (such as turning off grammar checking, turning on autorocovery, and turning off checking for automatic updates).
I then diffed the directories (and, after running plutil -convert xml1 com.microsoft.*
in both directories to change the plists from binary to xml format, diffing them again) to see where the changes were listed in the plist files. Then in Workgroup Manager, I selected the group I wanted to manage, clicked on "Preferences" on the toolbar, and then the "Details" tab on the right. There I was able to hit the plus button and, one at a time, import the plists that had been modified and delete all the keys that I didn't care about (only retaining the ones that differed and looked useful).
With those settings applied (whether managed "Often" or "Always") users can change them, but the defaults are set.
Blocking the Online Dictionary
I ran iftop and saw that the unit was connecting to businesscentralserver2007.com using HTTP. I had been asked to disable internet access anyway, and using the parental control feature in Workgroup Manager, I disabled access to all sites. [Except apple.com, as you can't disable that.]
Application Whitelisting
Lastly, I whitelisted Office to make it run (and implicitly blacklisted every other application, such as the web browsers). The folders I chose to make accessible were:
- /Applications/Microsoft Office 2008/
- /Library/Application Support/Microsoft/