Can MS Office Protected View be Disabled via GPO?

Question

I'd like to disable the Protected View MS Office files open in when opening files from email and other non-local places.

We have a mixture of Office 20007, 2010, and 2013 in place so if these are controlled via different GPOs, I would need each of them.

Thanks in advance.

If memory serves me right, if a setting exists in all three versions of Office then you can control it with the GPO templates for the latest version of Office that you have deployed. I know that Protected View exists in Office 2010 and I'm assuming it exists in Office 2013, but I don't know if it exists in Office 2007. — joeqwerty, Mar 06 '13 at 19:09
@joeqwerty Some settings are for all versions of Office, most are not. Some settings also apply to all applications within a year, most are not. Office 2007 didn't have Protected view, only 2010 and 2013; also only Word, Excel, and Powerpoint. — Chris S, Mar 06 '13 at 22:15

score 9 · Accepted Answer · answered Mar 06 '13 at 22:12

9

The Protected View settings are specific to each application in Office (Word, Excel and Powerpoint only), and to each year (2010 and 2013 only).

Grab the ADMX templates, install them to the PolicyDefinitions folder for the domain, or add them individually to a GPO in Group Policy Management.

The settings are in: User Configuration, Policies, Administrative templates, Microsoft $PRODUCT $YEAR, $PRODUCT Options, Security, Trust Center, Protected View, "Do not open files in unsafe locations in Protected View", Enable.

answered Mar 06 '13 at 22:12

Chris S

77,337
11
120
212

thanks for the great response. As soon as I get a chance to verify this as the solution I will award the bounty. – Windows Ninja Mar 07 '13 at 00:06
Can you point me to a reference explaining how to import the ADMX template? I cannot figure this out. – pgunston Jun 17 '15 at 01:42

score 1 · Answer 2 · edited Jul 29 '16 at 18:37

Regarding updating the Central Store for Policies, this is the process I use.

Active Directory Central Store for policies

The domain Central Store is a file location on domain controllers that is checked by the Group Policy tools. The Group Policy tools use any .admx files that are in the Central Store. The files that are in the Central Store are replicated to all domain controllers in the domain.

The Central Store must be updated with new .admx and .adml files when a new operating system comes up if you want to use the new policies.

Generally %systemroot% = C:\Windows

• On the domain controllers, the central store is located at

%systemroot%\SYSVOL_DFSR\domain\Policies\PolicyDefinitions

(was %systemroot%\sysvol\domain\policies\PolicyDefinitions in Windows Server 2008),

where %systemroot% is generally C:\Windows

• Sometimes the latest collection of .admx and .adml files can be downloaded from Microsoft. If you can find an up-to-date download link, use that. It does sometimes take them awhile to post the new policies.

• If not, you will find the needed .admx and .adml policies on the latest Windows and Windows Server computers themselves. %systemroot%\PolicyDefinitions stores the .admx and .adml files for installed components on the local computer. But to find all .admx and .adml files, go instead to %systemroot%\winsxs

• On the latest version of Windows and on the latest version of Windows Server, search for .admx files in %systemroot%\winsxs. Copy these to a new folder at \\Server\Share\CentralStore_Adds. For example, \\Server\Share \Windows 8.1 Update 1 Server 2012 R2

• Create a subfolder of this new folder named en-US. Search %systemroot%\winsxs for all .adml files and copy these to the newly-created en-US folder

• Remember, the two steps above need to be done on the latest versions of both Windows Server and Windows.

• Combine these two folders, keeping the latest version of the .admx and .adml files. I used robocopy to do this.

robocopy \\server\share\folder1 \\server\share\folder2 /XO /S

• After consulting with group policy admins on both the workstation and server side, this combined folder is now ready to be copied to the Central Store on a domain controller at %systemroot%\sysvol\domain\policies\PolicyDefinitions. In Server 2012 R2, these will be at

%systemroot%\SYSVOL_DFSR\sysvol\hcggse.frse.co.hennepin.mn.us\Policies\PolicyDefinitions

• Once replication has occurred, you will be able to use these new policies in your Group Policy Management Console. The new policies will be available in all GPOs that you edit.

Can MS Office Protected View be Disabled via GPO?

2 Answers2