Topics in this chapter   Understanding System Policies     How to Set System Policies     Office System Policies     Working with Difficult Policies

How to Set System Policies

System policies provide administrators the ability to control client Desktops. Policies are special registry settings applied to users’ computers when users log on to the network. The Microsoft Office XP Resource Kit includes system policy templates that describe the system policy settings available for Microsoft Office XP. The policy settings available in these policy templates enable administrators to do the following:

• Modify the user interface.
  
  
• Grant permissions to run or not run features of an application or utility.
  
  
• Restrict a user from customizing parts of the different Office applications.

Note   The System Policy Editor is the primary tool mentioned in this topic. However, the Group Policy snap-in is the suggested tool of choice for the Microsoft Windows 2000 operating system. Consult the Help available with the Group Policy snap-in for information on how to set policies, to propagate them with Active Directory™, and to create custom ADM templates.

Working with system policy templates

A system policy setting represents a controllable option or feature on a user’s computer. Each system policy setting listed within an ADM template corresponds to one or more registry keys, value names, or value data. Policy templates are organized by the application they can control. Each registry key, value name, or value data is noted in standard ASCII text within the ADM template and lists the minimum or maximum values each entry can have, if applicable, and the registry key changed on the user’s computer.

When you create a system policy file (*.pol) or a Group Policy Object (GPO), you use one or more policy templates loaded into either the System Policy Editor from the Policy Templates… menu option (Options menu) or the Group Policy snap-in (select either Computer Configuration or User Configuration, right-click Administrative Templates, then click Add/Remove Templates…). The Microsoft Office XP Resource Kit includes the policy template files listed in the table below. These files list the policy settings you can control for each application.

Note   With the System Policy Editor you cannot add templates if your policy file is open, so be sure to add in all the templates you plan to use for the policy file you are working with prior to setting policies.

Policies in a template are organized into a hierarchy so they are easier to find. For applications with user-interface elements, the templates are organized to correspond to the user interface. For example, items usually found in the Options dialog box (Tools menu) are listed under Tools | Options in the template.

In some cases, however, the templates do not exactly match the user interface. Some Office settings appear in the Options dialog box (Tools menu) for each component. Corresponding policies are listed in the Office10.adm template. For example, the Provide feedback with sound option (under Miscellaneous) is common to Word, Excel, PowerPoint, and Access, so it is stored in the Office10.adm template rather than in the templates of the individual applications. Similarly, each component has a Web Options button on the General tab in the Options dialog box (Tools menu), so you can control the use of Office applications and their ability to access the Web. You can set a policy for these options by using the Office10.adm template. Look for the Tools|Options|General|Web Options… category in the Office10.adm rather than in each template for the individual applications.

Note   The System Policy Editor can also work with other Windows template files (Common.adm, Windows.adm, Winnt.adm, System.adm, etc.) and the Windows Installer template Instlr11.adm. These templates do not contain Office-related policies. Windows policy templates are useful for managing a workgroup, user, or a single computer. In the case of Windows Installer, the template provides both system and user policies. For more information, see the Windows NT Server Resource Kit or the Windows NT Workstation Resource Kit.

Before you enable a policy, you must load the policy template containing the policy you want to use.

The system policy templates contain individual system policy settings organized by category. For detailed information about the contents of each template, use a text editor and examine the contents of each ADM file to determine which registry settings are being changed.

Note   ADM templates created for use with the Group Policy snap-in cannot be read by the System Policy Editor. The syntax for the Group Policy snap-in ADM templates is a superset of the syntax used by the System Policy Editor and uses statements not recognized by the System Policy Editor.

Policy setting states

When you use the System Policy Editor, you will see that a policy can have one of three settings in the Properties dialog box:

• Selected (checked)

  When selected, a policy is enforced. For many policies, another check box in the work area of the Properties dialog for the policy indicates whether the setting is enforced as on or off. When a user logs on, the Windows registry changes to conform to the policy.

  For example, in Excel you can set a policy to determine whether the Formula bar is visible in normal view. You enforce the policy by selecting the Show Formula bar in Normal View check box. Then you use the Check to enforce setting on; uncheck to enforce setting off check box to determine which way the setting is enforced (selecting the check box enforces the policy).

• Cleared (unchecked)

  When cleared, the policy is turned off. If it was enforced previously, the previously specified settings are removed from the Windows registry. When you clear a policy, the option returns either to the application default state or to whatever setting the user had specified before you set the policy.

  For example, if an Excel user has set the Formula bar to appear in normal view, and you apply a policy to turn off the Formula bar, that user no longer sees the Formula bar in normal view. If you then clear the policy, it reverts to the previous settings, so the user sees the Formula bar in normal view once again.

Note   It is advised to clear a policy setting if it has ever been enforced previously, to make sure it is turned off. Settings from a policy remain in effect until the setting is cleared.

• Unavailable (grayed)

  System policies can be changed to an unavailable state. A grayed check box indicates the setting is not configured or is being ignored by the policy setting enforcement code in the logon process. Note that registry settings are neither set nor removed by the logon process. When you first create a system policy, all of the settings are set to the unavailable (grayed) state. If you have configured a policy and distributed the policy file and need to turn it off, use the clear setting to disable the policy.

Note   The unavailable state does not disable a previously enforced policy setting. Only the clear setting of a policy forces a change to the registry entry associated with this policy.

By using the Group Policy snap-in available with Windows 2000, you can give a policy one of three settings in the Properties dialog:

• Not Configured

  This is the same as the Unavailable option in the System Policy Editor.

• Enabled

  This is the same as the Selected option in the System Policy Editor.

• Disabled

  This is the same as the Cleared option in the System Policy Editor.

All of the system policies for an application are listed in the corresponding policy template (ADM file).

Setting system policies for selected users or groups

You can set system policies to apply to a single user, a group of users, or for all users. You can also set policies for a single computer or for all computers. You make these choices in the System Policy Editor when you create policy profiles from the Edit menu. The Edit menu provides the ability to create a policy profile for a user, computer, or group.

Policies set by the Group Policy snap-in are stored in Registry.pol files. Policies for machine-related settings go in the GPT\Machine folder, while policies for user-related settings go in the GPT\User folder. For more information on how these files are propagated through Active Directory, see the Group Policy snap-in Help.

The policies you create and enforce from the Office10.adm policy template are set in the \Software\Policies\Microsoft\ node of each user’s Windows registry.

Setting system policies for all users or all computers

You can configure a policy for all of the users in your domain by double-clicking the Default User icon in the System Policy Editor. You can also set a policy for all client computers in your domain by double-clicking the Default Computer icon. When you double-click one of these icons, the Properties dialog box opens, and you can set the policies for the user or computer you selected. You can set a policy for all users, for all computers, or for both. If you do not want to set a system policy for users or computers, you can select users or computers and press the delete key or select Remove (Edit menu).

Note   The full name of the Properties dialog box changes depending on the name of the icon you double-click in the main window of the System Policy Editor. The dialog box is generically referred to as the “Properties dialog box” in this topic.

Setting system policies for one user or one computer

You can set a policy for a specific user account by adding the user to the policy file. For example, if your network includes a Guest account, and you want to limit a guest user’s access to options, you can create a system policy for the Guest account (considered a User and added in through the Add User option as Guest). Similarly, if all your guest users only use one computer, you can create a policy for that computer. See the Group Policy snap-in Help for information on how to set policies for a single user or computer.

Note   The user name or computer name you specify in the System Policy Editor must be recognized by the domain controller, otherwise the policy is never enforced. You cannot create new user names or computer names from within the System Policy Editor.

To add a user to a policy file

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Select Edit.
   
   
4. Select Add User…
   
   
5. Enter the UserID of the user you want to create a policy for into the text box in the Add User dialog and click OK.

Since a user’s settings are maintained in the HKCU, the resulting policy profile has the same options as the Default User policy profile.

To add a computer to a policy file

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Select Edit.
   
   
4. Select Add Computer…
   
   
5. Enter the machine name of the computer you want to create a policy for into the text box in the Add Computer dialog and click OK.

A computer’s settings are maintained in the HKLM registry node. The resulting policy profile has the same options as the Default Computer policy profile.

Setting system policies for a group

You can set policies for groups of users in your domain. For example, all of the users in your Accounting department may require the same options in Excel. If you create a Microsoft Windows NT user group for the Accounting department, you can control the options for all users in the Accounting group by setting a policy for them. See the Group Policy snap-in Help for information on how to set policies for a group.

Note   The group name you specify in the System Policy Editor must be recognized by the domain controller. You cannot create new groups from within the System Policy Editor.

Some users are members of more than one group. To avoid potential conflicts between policies enabled for these groups, you can prioritize the different groups so policies are applied in a particular order. When a user who is a member of several groups logs on, the policy settings from the highest priority group are read in last so these settings take precedence over the settings from lower-priority groups.

To create a group policy

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Select Edit.
   
   
4. Select Add Group…
   
   
5. Enter the Group name of the group you want to create a policy for into the text box in the Add Group dialog and click OK.

Since a group is a collection of users, a group receives the same policy profile settings as used by users, HKCU. The resulting policy profile has the same options as the Default User policy profile.

Sometimes a user is a member of more than one group. To avoid potential conflicts between group policies, you can set relative priorities so group policies are applied in a specific order. To set priorities for a group, click Group Priority (Options menu) in the System Policy Editor.

Using system policies to disable user-interface items

Several system policies enable you to stop users from changing items in the user interface. By using these policies, you can disable menu commands, toolbar buttons, and shortcut keys so users cannot use or gain access to those features or options.

Disabling menu and toolbar items

System policies can disable menu commands and their corresponding toolbar buttons. When you disable a menu command and toolbar button through a policy, users cannot use that command or button.

A menu command disabled through a policy still appears on the menu, but it is grayed out and unavailable. Similarly, a toolbar button disabled through a policy appears on the toolbar as grayed out, but it is unavailable to users. It also displays the name of the toolbar button followed by “Disabled by your system administrator”.

Several menu commands and toolbar buttons are listed in the Predefined category of each applications template. These include several commands administrators frequently disable, such as the Hyperlink… command (Insert menu) and the Macro command (Tools menu). If you want to disable any other command in an Office XP application (even predefined commands), use the Custom category or use either the Custom Installation Wizard or Custom Maintenance Wizard to modify settings on the Specify User Configuration Settings page of each wizard. To disable a menu command and toolbar button in the Custom category, enter the control ID for the item in the System Policy Editor. You can look up the control ID for any command or button using Visual Basic® for Applications (VBA). For more information about finding control IDs for menu commands, see Working with Difficult Policies.

Disabling shortcut keys

Many Office commands have corresponding shortcut keys. When you disable the menu command and toolbar button through a policy, users can still press the shortcut key to run the command. To make the option completely unavailable, you must also disable the shortcut key.

For example, suppose you disable the Hyperlink… option (Insert menu) in Excel and a user knows the shortcut key for the command is CTRL+K. The user can still use the shortcut key to insert a hyperlink. To prevent users from inserting hyperlinks, disable the CTRL+K key combination, too.

To disable a shortcut key in the Predefined category of a policy template, select the shortcut key from the resulting list in the Settings for Disable shortcut keys work area. You can also disable any shortcut key by using the Custom category. To disable a shortcut key in the Custom category, look up the virtual key code for the registry entry corresponding to the shortcut key (see Help in the Custom Installation Wizard and search the index for virtual key code) and then enter the virtual key code (example: VK_T or VK_DOWN). If it is used with a modifier key (like Alt, Ctrl, Shift) enter the two as CTRL+VK_T. In situations where more than one modifier is used, combine them as CTRL+SHIFT+VK_T.

For more information about disabling shortcut keys and virtual key codes, see Working with Difficult Policies.

Note   Even when you disable both a menu command and its corresponding shortcut key, the command is still available through Visual Basic for Applications (VBA). This is by design, so you can create macros to use the command.

You can also disable the following: a predefined or custom menu, a toolbar item, and either a predefined or custom shortcut key.

Using environment variables in system policies

Windows 98, Windows NT 4.0, Microsoft Windows Millennium Edition (Windows Me), and Windows 2000 all include the capability to use environment variables in the Windows registry to replace file names, paths, or other changeable values. Environment variables in the Windows registry use the REG_EXPAND_SZ data type.

For example, the Default file location policy for Excel 2002 allows the setting of a default path where users can store Excel files. If you want to store the Excel files of users under their user names on the network, you can use a network drive and the following environment variable:

X:\%USERNAME%\

When you distribute the policy, the environment variable is written to each user’s registry. Office XP recognizes %USERNAME% as an environment variable and expands it to whatever the %USERNAME% variable is set to on the user’s computer. For example, Office XP expands this example to X:\UserA\ for User A, X:\UserB\ for User B, and so on.

You can also use any other appropriately defined environment variable to set Default file location to a particular path or folder. Because Office XP recognizes the REG_EXPAND_SZ data type, you can use environment variables that exist by default in the operating system or variables you set on your own.

Note   Windows 98 does not create environment variables automatically. You must create and define variables manually so they resolve correctly for each user. For example, to create the %USERNAME% environment variable for Windows 98 clients, use a Windows NT logon script. To view the current environment variables you already have, open a command prompt (DOS window) and enter “SET”.

You can use environment variables in place of directory paths or specific user information. For more information, see the Windows NT Server 4.0 Resource Kit.

System policies and the Windows registry

If you used the System Policy Editor to create a system policy file and then placed that file in the network logon directory on the primary domain controller server, when a user logs on to the network, the system policy file is downloaded to the user’s computer. Before the user can begin to use his computer again, the Windows registry is updated to use the values specified in the system policy file.

If a change occurs to your organization that requires changing policy settings again, you can update each user’s computer by placing an updated system policy file in the logon directory on the primary domain controller. The Windows registry for each client computer is updated when the user logs on.

Where the Windows registry stores policies

In previous versions of Office, system policies were stored in the Windows registry in application-specific subkeys under HKEY_CURRENT_USER\Software\Microsoft\Office. System policies for Office 2000 and XP are consolidated in the HKEY_CURRENT_USER\Software\Policies subkey.

The Policies subkey mirrors most of the HKEY_CURRENT_USER\Software\Microsoft\Office\10.0 subkey. Placing all of the system policies together in the same subkey prevents Windows registry errors and also makes it possible for administrators to lock the Policies subkey for Windows NT–based operating systems.

The following example shows the hierarchy of the Policies subkey in the Windows registry.

HKEY_CURRENT_USER

Software

      Policies

         Microsoft

            Office

               10.0

                  Access

                  Common

                  Excel

                  FrontPage

                  Outlook

                  PowerPoint

                  Word

Locating a registry entry associated with a system policy

Each system policy in a policy template corresponds to one or more entries in the Windows registry. If you want to know which entries in the Windows registry correspond to a particular policy, you can open the policy template in a text editor, and then look for the policy.

The policy template files are divided into categories, and each category lists the Windows registry subkey with the entries for that category. Each policy entry in the template lists the Windows registry value name the policy affects and the specific Windows registry value data it sets when the policy is turned on or off.

For example, in the Word10.adm template, the following policy entry lists the Windows registry entries set when you disable the Insert Hyperlink shortcut key:

POLICY !!DisableShortcutKeys
KEYNAME Software\Policies\Microsoft\Office\10.0\Word _
\DisabledShortcutKeysCheckBoxes
   PART !!InsertHyperlinkKey CHECKBOX
   VALUENAME InsertHyperlink
   VALUEON 75,8
   VALUEOFF 0
   END PART   

The double exclamation points (!!) in the template file indicate the text following it is a string variable and the variable is set at the bottom of the file. For example, if you see a line such as !!InsertHyperlinkKey in the template file, there is a section at the bottom of the file under [strings] where it is set:

[Strings]
InsertHyperlinkKey = “Ctrl+K (Insert | Hyperlink...)”

The following table lists the entries in the policy template files you can see when you open the files with a text editor.

POLICY

KEYNAME

PART

VALUENAME

VALUEON

VALUEOFF

;

Saving and distributing the policy file

After you set the policy values you want, you are ready to save and distribute the policy file. For Windows 98 clients, save the policy file as Config.pol. For Windows NT 4.0 or Windows 2000 clients, save the policy file as Ntconfig.pol. Then exit the System Policy Editor.

Next, you need to store the policy file on the network, where it can be downloaded to users’ computers when they log on.

For networks running Windows NT Server, copy Config.pol or Ntconfig.pol to the Netlogon folder of the primary domain controller, as defined for your client computers. When your users next log on, the system policies are automatically downloaded to their computers and their registry settings are updated with the policy settings.

For Windows 2000 systems with Active Directory, no special posturing of the policy files (Registry.pol) is required on the primary domain controller. Active Directory manages the task for you. See the Group Policy snap-in Help for details on how to use the Group Policy snap-in.

Locking down user options in Office using system policies

The new administrative features in Microsoft Office XP include the ability to turn off options or features to which you do not want users to have access. Office XP provides the ability to lock down a specific configuration and control exactly how users interact with applications.

Locking down Office is accomplished primarily for registry settings on systems running Windows 98. Operating systems like Windows NT and Windows 2000 require setting permissions of registry branches, drives, or folders to lock down the configuration of the computer. Some settings related to locking down a system are controlled through the System Policy Editor and of these settings, they can all be set by using the Custom Installation Wizard or Custom Maintenance Wizard with either the Set User Configuration Settings page or the Add/Remove Registry Entries page. If a test computer is used, it is possible to capture a configuration of Office on the test computer and then distribute that configuration to all users using the Profile Wizard.

For more information on locking down a Windows NT or Windows 2000 operating system, see Running Office in a Secure Environment.

When to lock down an Office installation

There are several reasons for wanting to lock down a particular configuration of Office XP. The following scenarios illustrate a few of the more important reasons for locking down a configuration.

Keep important information accessible

If your organization has a high employee turnover rate, you might not want some employees to add password-protection to their files. When someone is replaced, your new employee will probably need access to all the previous user’s files. Disabling password-protection on user files helps guarantee important customer information is always accessible.

Even organizations that do not have a high employee turnover face situations where many users need access to files on one workstation, and all of those users may need to store files in a specific folder or in a source file library management system like Microsoft Visual Source Safe. Setting a default directory where files are stored simplifies the user experience and adds a level of configuration control to the system.

Reduce support costs

If you are training employees who are computer novices, you can raise everyone’s confidence level by locking down a uniform configuration of Office and disabling all user customization until users become more skilled. Enforcing default Office settings can help reduce training and support costs.

Create a consistent user environment

If you have shifts of employees sharing computers, you can make the transitions between shift changes easier by enforcing a consistent user interface on every computer. A consistent user experience is easier for all users when they can rely on settings and features being the same every time they use a computer.

Limit potential distractions of the Internet

Office XP includes built-in hyperlinks to sites on the World Wide Web where users can obtain more information about features of Office. However, if users do not normally use the Internet for their work duties, distracting them with the Web may not be beneficial to productivity. You can disable access to these URLs to reduce user distraction.

How to lock down options with system policies

System policies are organized by application when displayed within the System Policy Editor. Each application requires the loading of a related system policy template. Within the templates are categories for Office applications, such as Tools | Options or Disable items in user interface. Within these categories are individual policies. You enable a policy by selecting it in the System Policy Editor and setting it to checked (selected) and then enforcing the policy or adding extra parameters/values to the policy in the work area at the bottom of the properties dialog.

The following types of policies are useful for locking down options.

Disable command bar items

You can disable any menu command in an application, along with its corresponding toolbar button. To disable a standard command bar item, use the Disable command bar buttons and menu items policy in the Predefined category for a specific Office application. To disable any other command bar button, use the Custom category and enter the control ID for the user interface element.

When you disable an item on a menu or toolbar, that item still appears on the menu or toolbar; but the item is grayed, which means the corresponding command is unavailable. When a user points to a disabled toolbar button, the ScreenTip indicates the button has been disabled.

Prevent command bar customization

To enforce a consistent user interface across all of the computers in your organization, you can stop users from customizing menu bars or toolbars. To disable command bar customization, set the Disable command bar buttons and menu items policy to checked in the Predefined category and select the Tools | Customize check box.

Disable shortcut keys

Many users memorize the keyboard shortcuts for various menu commands and toolbar buttons. If you want to completely lock down an option, you must disable the shortcut key as well as the corresponding menu bar and toolbar items.

You can disable any shortcut key by using the Disable shortcut keys policy under the Predefined or Custom category. When a user presses a disabled shortcut key combination, the application does not respond.

Note   Even when you disable both a menu command and its corresponding shortcut key, the command is still available through Visual Basic for Applications. This is by design, so macros can be created to use the command.

Disable dialog box items

You can prevent users from changing options in dialog boxes by locking them down with a policy. For example, several of the options in the Options dialog box (Tools menu) for each application can be changed using a policy in the policy template. This allows you to easily disable an option you don’t want users to change.

Disable Password Protection

Several of the applications in Office XP give users the ability to protect file content by setting a password. You can disable this feature by turning off the command-bar buttons and menu-bar items used to set passwords in Access, Excel, and Word by configuring a policy setting.

To disable password protection for Access, Excel, and Word

1. In the System Policy Editor, double-click the Default User icon.
   
   
2. In the Properties box, expand the application node (click the plus (+) sign) you want to change.
   
   
3. Expand the Disable items in user interface node.
   
   
4. Expand the Predefined node.
   
   
5. Set the Disable command bar buttons and menu items policy to checked.
   
   
6. For Access 2002, set the Tools | Security | Set Database Password check box to checked.

For Excel 2002, set the Tools | Protection, Tools | Protection | Protect Sheet, Tools | Protection | Protect Workbook and Tools | Protection | Protect and Share Workbook check boxes to checked.

For Word 2002, set the Tools | Protect Document check box to checked.

In Word 2002, PowerPoint 2002, and Excel 2002, users can still set passwords for a file by using the Save As command (File menu). Setting a policy to lock down the command-bar buttons and menu-bar items for password protection does not prevent users from taking advantage of this alternative.

For example, in Word, users can set a password for a document by clicking Save As on the File menu, and then in the Save As dialog box, clicking the Tools menu and then clicking Security Options…. The Security tab is displayed and includes two password options allowing users to set a password for the file: Password to open and Password to modify. Excel makes similar options available through the Save As command (File menu).

Disable built-in connections to the Web

Office XP includes several built-in references to URLs on the World Wide Web. For example, if a user queries the Office Assistant and it cannot find an answer, the user can click None of the above, look for more help on the Web. This starts a search across the Web to a Microsoft server with more information.

If you do not want users to use these built-in links to the Web, you can disable them with system policies. For example, you can prevent users from gaining access to the Web by not installing the feature that provides the access, or you can block the Web address using a firewall server.

Toolbox   The built-in Web connections in Office XP are listed in a spreadsheet called Webent.xls. The spreadsheet also identifies the connections you can disable and how to disable them. Webent.xls is installed by default when you run the Office Resource Kit Setup program. For more information, see Supplemental Documentation in the Toolbox.

For example, you can disable the Office on the Web hyperlinks within HTML Help by setting a policy in each of the templates for applications you want to limit. The following procedure shows how to disable this option for Excel.

To disable the Office on the Web connections in Excel

1. In the System Policy Editor, double-click the Default User (HKCU) icon.
   
   
2. In the Default User Properties dialog box, expand the Microsoft Excel 2002 node (click the plus (+) sign to the left).
   
   
3. Expand the Disable items in user interface node.
   
   
4. Expand the Predefined node.
   
   
5. Set the Disable command bar buttons and menu items check box to checked.
   
   
6. Under Settings for Disable command bar buttons and menu items, set the Help | Office on the Web check box to checked.

You can redirect the Answer Wizard Web connections to a place on your own Internet or intranet site. For more information about customizing Web connections in the Answer Wizard, see Making Custom Help Content Accessible.

Other policy settings related to disabling Web access are:

• Feedback URL (Microsoft Office XP | Assistant | Help on the Web)
  
  
• Office on the Web URL (Microsoft Office XP | "Help | Office on the Web")
  
  
• Web Query dialog home page (Microsoft Office XP | Shared paths)
  
  
• Prevent users from uploading settings to the Internet (Microsoft Office XP | Save My Settings Wizard)
  
  
• Error reporting location (Microsoft Office XP | Corporate Error Reporting)
  
  
• Display Clips Online access from Clip Organizer (Clip Organizer 2002)

For more information on locking down the configuration of an operating system, see Running Office in a Secure Environment.

Enabling read and write access to Office documents on the web

With the requirement of many businesses to maintain documents on a Web site, a new policy was added to the Office10.adm template to allow users the ability to open a document directly from the Web site while in a browser. Through the use of the System Policy Editor you can easily create a policy file to enable this feature of Office.

To enable read and write access to Office documents on the Web

1. Start the System Policy Editor.
   
   
2. Make sure the Office10.adm template is loaded.
   
   
3. Create a new policy file or open an existing one.
   
   
4. In the Default User Properties dialog box, expand the Microsoft Office XP node (click the plus (+) sign to the left).
   
   
5. Expand the Tools|Options|General|Web Options node.
   
   
6. Expand the Files node.
   
   
7. Set the Open Office Documents as read/write while browsing policy check box to checked.
   
   
8. Under Settings for Open Office documents as read/write while browsing, set the Check to enforce setting on; uncheck to enforce setting off check box to checked.