Microsoft Office 2007 Deployment with Group Policy

I was talking with the boss last week about upgrading our departments computers to Office 2003. We talked about it and decided on Office 2007.

Today, we have a few staff away so I am needed to answer phones. I thought since I was chained to my desk, I might as well start planning the deployment for Office 2007. I popped the Office DVD into the laptop and at the command prompt in the root of D:> , typed Setup /a . That doesn’t work in 2007, a screen comes up telling you the valid arguments though. setup /admin apparently works, so I typed that. This brings up a setup utility which creates the MSP file. I went in and filled in my settings, and I also found in there the options to change which format the files are saved in. So I set that up properly and saved the file.

That is great and all, now what about a distribution point? A little search and I found out you just copy the DVD to a network distrobution point.

I also discovered some other useful things:

  • a compatiblity pack for Office 2000, XP and 2003 which allow you to open Office 2007 documents.
  • a save to PDF option for Office 2007.
  • adm templates for 2007 Office System. The article was titled “Using Group Policy to set default file save options”

I think this is going to be easier than I thought.

First, I copied the DVD to my software share. Then I extracted the Save to PDF file and put it into it’s own directory.  I then reopened OCT and added the Save to PDF executable as a program to install after Office 2007 is installed. I saved the changes and dropped the MSP file into the updates folder within the Office 2007 share folder. If you want different options for different groups of people but want to use the same distrobution point, don’t put the msp file into updates. A technet article describes the process you need to follow here. I then went into Group Policy and setup GP to deploy Office 2007. I also set the Group Policy options for the file saving format.  Here is a good word document on deploying Office 2007 as well.

I rebooted the machine and Office 2007 installed and my save as options are all what I want them to be. Couldn’t be simpler.


use to access the Office resource kit. I also changed the link above. People were getting a page not found message.

Update 2

I remember seeing somewhere that MSP files only work with the select and Enterprise Agreement media. It doesn’t work on the retail copies.


About Todd

I am a Microsoft MVP, MCSE and MCT who lives in Kingston, Ontario.

38 Thoughts on “Microsoft Office 2007 Deployment with Group Policy

  1. Todd,

    I don’t suppose you have that technet article from microsoft on O2K7 deployment via GPO saved somewhere? Microsoft pulled it.

  2. Dan, try this link

    If it works, let me know and I’ll change the post.


  3. Does this still work? Everything I’ve read suggests that deployment with group policy uses only the config.xml file, and ignores the .msp configuration file, as well as everything in updates. I was hoping to install Office 2007 and the “Save to PDF” addon using group policy, as I’ve done in previous versions of Office.

    The page at Microsoft seems to be gone, too.

  4. Todd,

    No idea how you did your deployment ? No info, from Microsoft, none from somebody else. I’ve no idea how to deploy Office 2007, without script…

    Thank You Microsoft for this new release with no comment, how to deploy if you don’t use SMS…


  5. Michel, my install went fine with Group Policy. I did what I said up above. I am using 2003 R2 with my active directory. Could that be the difference? My machine was the computer I deployed to and it went fine.

    Support has been poor for GP deployment and that needs to be addressed. Not everyone wants to run out and buy SMS or learn BDD to roll this out.

  6. Hi Todd

    I think what everyone is getting at is if you configure an assigned or published package in your deploy GPO, which MSI did you use? I’ve tried several and they all complain about XML or other script availability. Also micorsoft state that you can’t install using the MSI(s) alone, but in the next breath they are talking about assigned and published installation via GPO! Indeed the MS procedure for deploying o2k7 via SMS starts by talking about AD deployment. Does the MSI require manipulation before it can be deployed via GPO, and did you save off the MS procedure before they pulled it from the web site?


  7. Just found this on MS website

    Also when I first tried the xxWW.msi file my test box was win2k. O2k7 only supported on XP and above. Thanks for the kick-start with this page Todd.

  8. I successfully installed Office 2007 using a GPO. It took me a lot of trial and error, and I’m happy to share my knowledge to save others time. Here’s how I did it. However, I couldn’t get the Save As PDF .msi to chain on to the end, so I simply created a separate GPO to install it.

    I’m installing Office 2007 Standard with an Open License.

    1. Create a network share, for example \\myserver\office_2007

    2. Copy the Office 2007 CD in its entirety to the share

    3. The Standard.WW folder contains the .msi file you’ll use for a GPO installation. (I’m pretty sure this is true for any Office 2007 product—that is, use the .WW folder’s .msi for a GPO installation.) On the share go into the Standard.WW folder and edit the config.xml file for your specific needs.

    (Important Note: Re-format the following lines into the correct format in the config.xml file. Unformately Todd’s SysAdmin Page won’t save my formatting, so this is all I can show)

    Here is how mine looks:

    Configuration Product=”Standard”

    Display Level=”basic” CompletionNotice=”no” SuppressModal=”no” AcceptEula=”yes”


    COMPANYNAME Value=”My Company”

    DistributionPoint Location=”\\myserver\Office_2007″
    Setting Id=”Reboot” Value=”IfNeeded”


    If you need instructions on what the various options mean in this config.xml file, go here , which is in the Office 2007 Resource Kit instructions.

    4. Build your GPO on your domain controller as follows. Create a new GPO and name it something like Office 2007 Deployment. Right-click, Edit this GPO and go Computer Configuration, Software Settings, Software installation. Right-click Software Installation and choose New Package. Browse to the StandardWW.msi on the share you created above. I chose Assigned, OK. You should now see the ‘Microsoft Office Standard 2007’ package listed in the right pane of your Software Installation item. Right-click on the ‘Microsoft Office Standard 2007’, Properties. Click the Deployment tab and then check ‘Uninstall this application when it falls out of the scope of management.’ (This automatically uninstalls the package if the computer is removed from the container (s) this GPO is applied to). OK.

    5. I then enabled my GPO to run against my Organization Unit. So on my domain controller, I have an Organization Unit called Client PCs. In my Group Policy MMC, I right-clicked on my Client PCs OU, chose ‘Link an Existing GPO’ and chose the ‘Office 2007 Deployment’ which I created back in step 4. Finally I left-clicked on my Office 2007 Deployment GPO, and I see in the Links pane on the right that it is linked to my Client PCs OU. In the bottom right pane (Security Filtering), I clicked on Authenticated Users and Remove. I then clicked Add, click the Object Types button and check Computers, OK, then added the specific computers I want this GPO to be applied to.

    6. I noticed that client PCs only check in every few hours with the domain controller, which means it will take a while for Office 2007 to get installed. I wanted to force Office 2007 to get installed right away to a few PCs, so I went to them individually, opened a command prompt and typed ‘gpupdate /force’. They then come back with a message that in order for some policies to be applied, you must reboot. Say Yes, and after the reboot you’ll see Office start to install. It takes about 5 minutes, so don’t be in a hurry.

    7. I then created a Save as PDF GPO in exactly the same way, except that you don’t have to configure a config.xml file. The .msi will install without any user intervention.

    8. The final thing I noticed was the first time a user runs Office 2007, there are two screens of popups about using Help online if connected to the internet, automatically install updates, etc. If you want to eliminate those screens, then you’ll need build a GPO for Office 2007 using the adm templates files that Todd has provided a link to.

    Best of luck to you.

  9. I know this is kind of old… but I’m having some serious trouble deploying office 2k3. The RSoP shows that the GPO is getting applied, but the Software Installation policy is missing. This seems really strange. I had the given Security Filtering access to a group of users and Authenticated Users.
    It’s obvious to me now that an ACE that qualifies the target Computer(s) needs access. The issue is that Authenticated Users is an ACE that qualifies the target Computer(s)… it includes all (authenticated) Domain PCs and Authenticated Users.

    Have you had this same issue; the GPO is applied, but the Software Installation policy is missing?

    It’s driving me insane.



  10. Make sure you grant domain computers access to the folder where the microsoft office share is located.

  11. Hi, I have had this method deployed in our environment and it works fine except in the following scenario. As with most people, our Office 2007 installation is intended to replace Office 2003. Normally when deploying new versions of applications via GPO, you can instruct the new MSI to UNINSTALL the previous version before installting the new version. However this DOES NOT work correctly with Office 2007. During the uninstallation phase of Office 2003, an error is generated (Application error OSE00000.exe) which casues the uninstallation of )2K3 to end prematurely. This results in a mixture of 2003 AND 2007 apps being installed and is generally very messy. Has anyone else experienced this problem and found a way around it?

  12. Brandon Primeaux on Wednesday, June 20th, 2007 at 1:06 pm said:

    im getting that same problem on my network (ose00000.exe). however, none of 2007 gets installed, it simply reinstalls 2003 after the error pops up.

    if i can’t get this figured out by friday im just going to pull back 2003 first and then deploy 2007 on the machines to see if that will eliminate the error.

  13. I don’t see any options you can add to the xml file to force an uninstall of the old version. I know in the MSP you can tell it to remove the old version. Unfortunately, the only way I can see it working is the way you say Brandon, force the old one to uninstall with GPO then apply the new one. I start my installs tomorrow, so I’ll let everyone know how I make out.

  14. The error that I described above has been confirmed by MS NZ as a bug. They have said that it will be resolved in O2K7 SP1 but as yet there is no ETA on when exactly that will be. So far after extensive testing the only way to install O2K7 via GPO in an environment where O2K3 is already installed is to manually remove O2K3 prior to assigning the PC to the GPO that will install O2K7. Also MSP’s will not help you get around the problem either – i.e. a half/half installation of O2K3 and O2K7 on the same machine cannot be fixed by applying an MSP manually on that machine (even if the MSP has the option set that instructs O2K3 to be removed prior to the commencement of the O2K7 install). As always I am keen to hear if someone comes up with a way to get around this problem! Cheers.

  15. One more point I forgot to mention. As Todd mentioned that there was no way to tell the config.xml file to uninstall O2K3. Well actually there is – but it doesn’t work!

    You can use the following string in the config.xml to tell O2K7 setup to execute a command prior to installing the O2K7 program files.

    In this case I tried to tell is to use a standard MSIEXEC command to UNINSTALL O2K3 BEFORE installing O2K7.

    Command Path=”msiexec.exe” Args=”/x \\YOURSERVER\Applications\Microsoft\Office2003\PRO11.msi” QuietArg=”/q” ChainPosition=”before” Execute=”install”

    As I said it doesn’t work. Just thought I would post that in case someone else was thinking of trying the same thing….Cheers.

  16. Todd,

    I have a question. I’m using a combination of the config.xml and the .msp file. The config.xml is set to not install Outlook, and the .msp handles most other functions. It seems to be reading the .msp file because it’s picking up my trusted locations which are only defined there. The problem is it’s not installing the save as PDF/XPS tool. It works fine if I run it using the command setup /adminfile office.msp

    Any ideas?

  17. hey todd,

    can you please tell me how I can uninstall Ms office xp via commandline before it’s installing ms office 2007 please.

    Kind regards
    Van Impe Jörg

  18. Jorg, Nizar wrote above this is the command for 2003, you’ll need to adjust for XP.

    “msiexec.exe” Args=”/x \\YOURSERVER\Applications\Microsoft\Office2003\PRO11.msi” QuietArg=”/q” ChainPosition=”before” Execute=”install”

    He was also quick to point out that it doesn’t work. There is a bug in the software that prevents the auto uninstall with GPO. If you pushed out Office XP with GPO you might be able to uninstall it that way. Otherwise, the way I am installing these is creating a fully automated XML file, but kicking off the installs manually and that is working for me.

  19. Jon, can push out the PDF tool in GPO? I have found the MSP to be hit and miss, so I have been doing my stuff in the XML and using the Group Policy templates (or manual configuration where needed) to handle what I would have done with the MSP.

  20. Hey Guys,
    I have a question. Has anyone been able to do a natural upgrade from 2003 to 2007 without being forced to uninstall the previous version yet?
    Please advise.


  21. I’m following this with much interest since I haven’t done anything else but reading about chances to get Office-2007 released to my environment. In a way I’m lucky enough to be able to install the general office 2007 install sweet as … BUT and this is a big BUT:

    I will distribute the OfficeProPlus to all PC’s in the company (about 1.000 times)and now there are some SPECIAL people who are so special (about 50 of them) that they want additionally things like Visio, Project and Sharepoint Designer. Now I’m stuck because I think I’ve tried everything; I don’t get these single products installed out of the Office suite via an additional GPO/MSI. Sure I could do it via SETUP /… but then it would completely conerdict with my attempt to having it installed as advertised with all its advantages of future maintenance.

    Whoever has a solution here will get a big virtual chocolate fish from me (this is a very special NZ expression).

    Looking forward to your comments!

  22. Hey guys,

    I created an MST files to upgrade outlook97 to 2003 this works fine using GPO to deploy Outlook 2003.
    The problem is when i add new features for outlook 2003 meaning i have to edit the MST files and copy all the installation back to the shared folder on the network which is no big deal.. but my problem is once you applied the modified mst files it actually uninstall outlook 2003…which is really bizzare???? i was wondering if you guys actually experence the same issue????

  23. So in conclusion when sp1 is released for office 2007 will deploying office 2007 via GPO force uninstallation of old office versions? My Office 2003 was installed through a msiexec /i command line.

  24. Bob – I haven’t come across that problem, but I haven’t tried what you did either. I have been working in Office 2007.

    Pete – I haven’t seen anything official from Microsoft confirming that SP1 will force an uninstallation. Until I see something in writing from Microsoft on their site, I am going to assume nothing.

  25. thanks, do you know a release date for sp1?

  26. A further thought, can we not just create out initial MSP files, open the Office MSI in Orca, apply our MSP and then create a MST Transform file (that presumably will actually work in Group Policy deployment)?

  27. I am using GPO to deploy Office 2007. I have edited the config.xml file and the program installs. However, when the first user logs in, they only see Outlook in the Programs>Microsoft Office menu. If they launch Outlook, a configuring Office window appears and several minutes later, the rest of the compnents (Word, etc) appear in the menu. Is there anyway for the installation to complete the first time?

  28. Just a quick note to say that I did this exactly as Todd says and its working with no problenms at all.

  29. For those who are getting the OSE00000.exe error “The instruction at “0x7c9118d0” referenced memory at “0x00000000”. The memory could not be “written”: I’ve discovered a fix for this.

    Only folks who are uninstalling Office 2003 via GPO get this error. Here’s why: Office 2003 leaves an (Office Source Engine) file behind that needs to be replaced. This file is located in C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.

    On every client to be upgraded, replace this OSE.EXE with the one from your Office 2007 *.WW folder. After that, clients upgrade via GPO without a hitch!

  30. I have read the postings above and have found many to be useful. I am using OCT and GP to install Office 2007. I also included the Save to PDF to the OCT config. It works but I have to say yes to the EULA before it will complete the install of the Save to PDF. Is there a way to automate this with in the OCT config?

  31. I guess these questions are in regard to Tim’s post with the step by steps. I have worked with deploying MSI’s with group Policy for many years at the hospital I work at. I am familiar with most of the steps in this thread. I hope you might give me more clarity on your step 3. Since that is the only step that is in question for me.

    1. The xml configuration you mentioned is that the only things in your XML file?

    2. Did you use an MST or save a MSP as a MST or anything to that effect? It is my impression you just changed the config.xml. That didn’t work for me so I am wondering if there is more.

    3. Is your server share image any sort of administrative export/install. from the instructions is says just copy the CD to the share. Again that’s what I did with no success being able to install it.

    4. Can you just click on the MSI from your share with our the GPO install, the reason I ask is more for testing. I would think you could just click on it to get the install to work if the config.xml was correct. Oh and I have tried both enterprise and standard with no luck using the folder with the …WW at the end as I should be.

    5. You said you had luck after trying several times. What stuff were you changing as you tested, the config.xml or other layers.


  32. Korb - everything you need to make it work! on Monday, April 7th, 2008 at 11:55 am said:

    1. configure config.xml file in editor (notepad). (see below)
    2. place config.xml in the same dir as setup.exe
    3. use the vb script below to deploy (note: this is a silent install. you will not even know it is deploying – wait 5 to 10 min and check your start menu for the additions – whatever you mark “absent” will be removed if already installed)

    (note: “local” means install “absent” means don’t install or uninstall if present)

    //access db Engine replication
    //Clip Organizer
    //SOAP toolkit
    //docu update util
    //script editor
    //picture manager
    //sharepoint support
    //visio viewer
    //new,open office docu lnks

    here is a link to what the options mean in the config.xml file

    *Children refers to EVERY OPTION available with that piece of software. (easiest way to do it) You can break it down further but it require more statments detailing exactly what “accessories” are to be added.
    see the technet link for that.

    **also I’d like to note:
    We tried the setup /config /config.xml… have no clue why you do this? maybe to set the path if it is somewhere other than the office setup.exe directory? dont waste your time.
    just config the config.xml with an editor and place it in the same directory as setup.exe and run the vbscript from a logon gpo…

    VBscript used in GPO:
    ————cut below
    ‘Message to users
    MsgBox “Your wonderful IT Staff is installing the brand new MS Office 2007 on this PC right now! Some system slowness may occur while this update is applied. You may close this window and continue working.”,64,”YOUR COMPANY – MSOffice 2007 update”

    ‘Option Explicit
    On Error Resume Next

    ‘define our variables
    Dim str_base_registry, str_path, flag_debug

    ‘enable debug mode?
    flag_debug = 0

    ‘create a command shell for use below
    Set CommandShell = createobject(“”)

    ‘Setup with config.xml already set
    cmdline = “\\server\e$\OfficeGPO\Office12\Office_Professional_Plus_2007\setup.exe”
    If flag_debug = 1 Then WScript.Echo cmdline End If
    CommandShell.Run cmdline, 1, True
    !end of file

    worked for us.

  33. Korb - everything you need to make it work! (didnt post config.xml correctly - added link) on Monday, April 7th, 2008 at 12:01 pm said:

    sorry –
    the xml file did not post correctly.
    get it here:

  34. HELP FOR KORB on Monday, April 7th, 2008 at 12:16 pm said:

    (if the rapidshare link goes away). cut and paste this into notepade to configure. place it in the same directory as setup.exe and run Korbs script (above) from a GPO. It is a silent install, may take 10 mins to show up on start menu!!!

    REMEBER, the term “absent” means DON’T INSTALL or REMOVE EXISING.
    The term “local” means install. This example doesnt install much.

    See option B – 1/3 of the way down for a working config.xml:

  35. HELP FOR KORB on Monday, April 7th, 2008 at 12:58 pm said:


    —– checkfor07.bat —–

    IF NOT EXIST “%ProgramFiles%\Microsoft Office\Office12\WINWORD.EXE” START /WAIT \\server\OfficeGPO\scripts\office_07_install.vbs

    —– End Of File ——-

    ** use this batch file to call the script and it will not run the VBS on machines already installed.

    substitute the bat above for the korb’s .vbs in the GPO login script and have it call that script if needed.

  36. I can’t believe it could be so easy… just follow Todd’s advice and create the MSP file with “setup.exe /admin”.
    After this is complete it as simple as pointing to the MSP file with a simple batch file.
    “\\server\folder\office12\setup.exe /adminfile \\server\folder\office12\my.MSP”

  37. Hi,
    I have been trying to deploy office 07 proplus for over a week now and haven’t had anything but problems. It starts to install when the computer starts up, but then quickly stops. I have creaed the network share, with read permission for the group of computers that will be installing office. I have also created a new OU and put the computers and computer group (office 07 computers) in there. I created a new GPO and linked it to the OU as assigned under computer config.
    Here is my config.xml file.

    Any help would be greatly appreciated.

  38. Hi, I just got mine working for Office 07 ProPlus. I didn’t use the config.xml file, just the MSP file I created. I was having a really hard time with it because it would start and then stop instantly with no log or errors. I went into GPM and opened the GP in Software Installation, right clicked on the Office 07 deployment and All Tasks -> Redeploy and it works great. I hope that helps some of you.

Post Navigation

%d bloggers like this: