Group Containers

Here's the script I use to disable auto-updates. I set it as a system preference and remove user preferences. Granted, a user could choose to set the preference later and it will use that, but none of our users ever go to the update menu...

#!/bin/sh



# Delete user level preference for all existing users.

localUsers=$( dscl . list /Users UniqueID | awk '$2 >= 501 {print $1}' )

echo "$localUsers" | while read userName; do

    defaults delete /Users/$userName/Library/Preferences/com.microsoft.autoupdate2.plist HowToCheck

done



# Set system level preferences, disabling First Run dialog for all applications.

sudo defaults write /Library/Preferences/com.microsoft.Word kSubUIAppCompletedFirstRunSetup1507 -bool true

sudo defaults write /Library/Preferences/com.microsoft.Excel kSubUIAppCompletedFirstRunSetup1507 -bool true

sudo defaults write /Library/Preferences/com.microsoft.Powerpoint kSubUIAppCompletedFirstRunSetup1507 -bool true

sudo defaults write /Library/Preferences/com.microsoft.Outlook kSubUIAppCompletedFirstRunSetup1507 -bool true

sudo defaults write /Library/Preferences/com.microsoft.onenote.mac kSubUIAppCompletedFirstRunSetup1507 -bool true



# Set system level preferences, setting autoupdates to manual.

sudo defaults write /Library/Preferences/com.microsoft.autoupdate2.plist HowToCheck "Manual"

Office 2016 apps (Excel, OneNote, Outlook, PowerPoint and Word) are all sandboxed now. That means their preferences will live in ~/Library/Containers for each application. You'll find manageable plists (plists you can control with Configuration Profiles) in:

~/Library/Containers/com.microsoft.Excel/Data/Library/Preferences/com.microsoft.Excel.plist
~/Library/Containers/com.microsoft.OneNote/Data/Library/Preferences/com.microsoft.OneNote.plist
~/Library/Containers/com.microsoft.Outlook/Data/Library/Preferences/com.microsoft.Outlook.plist
~/Library/Containers/com.microsoft.PowerPoint/Data/Library/Preferences/com.microsoft.PowerPoint.plist
~/Library/Containers/com.microsoft.Word/Data/Library/Preferences/com.microsoft.Word.plist

With that said, most preferences for these applications have moved to a SQLite database found here:

~/Library/Group Containers/UBF8T346G9.Office/MicrosoftRegistrationDB.reg

The MicrosoftRegistrationDB.reg plist is unmanageable and Microsoft has purposely not documented it because they're reserving the right to change it in the future. Mac admins have made them aware we need to manage plists and Microsoft is researching the issue to find a solution.

Therefore, if the rulers preference is not in the com.microsoft.Word.plist file above (and I don't see it), you won't be able to manage that preference using a configuration profile. Most preferences you find under the application's Preference menu are stored in the SQLite database.

@talkingmoose Thank you, that's good to know. I'm unfamiliar with the sandbox concept with plist files. Are those preferences for applications installed via the App store? I know Microsoft is looking at moving the Office installer to the App store at some point.

This clarified it a bit for me: http://www.peachpit.com/articles/article.aspx?p=2303966
I'm still new to OSX management, still lots to learn :P

Everything I understand about sandboxing on OS X is from Erik Schwiebert with Microsoft. Because they eventually want to distribute Office for Mac in the Mac App Store, they've had to rework their apps for sandboxing.

Just yesterday, Erik presented OS X Sandboxing Overview for MacAdmins for the University of Utah Mac Managers meeting. You may find the recording interesting.

We've been getting this error message with Word 15.22 - 15.25.

The solve is to set the AutoRecovery location in Word Preferences. Which works well and gets rid of the error.

I'd like to be able to set this programmatically. Does anyone know how/where to set these preferences? I've looked at the preferences in ~/Library/Containers/com.microsoft.Word/Data/Library/Preferences/com.microsoft.Word.plist but I'm not finding it anywhere. Thanks.

Hi @talkingmoose Do you know of the value to pull to determine if a user is logged into a personal OneDrive account?

Thanks

@ocla&&09, I did a quick test and found what I think is the best indicator of an active OneDrive Personal user. This Extension Attribute is minimally tested, but appears to return the correct results for me.

#!/bin/bash



# get list of user home folders of users with UIDs over 500

userList=$( dscl . list /Users UniqueID | awk '$2 > 500 { print $1 }' )



# get current epoch time

rightNow=$( /bin/date "+%s")



# recurse through user list

for aUser in $userList

do

    # read the LastRefresh line from the ClientPolicy.ini file

    echo "Getting ClientPolicy.ini for user $aUser"

    lastRefresh=$( sudo -Hu "$aUser" bash -c '/bin/cat "$HOME/Library/Application Support/OneDrive/settings/Personal/ClientPolicy.ini" 2> /dev/null | grep LastRefresh' )



    # list user as active if the last refresh was less than 24 hours (86400 seconds) ago

    if [ $((rightNow-lastRefresh)) -lt 86400 ]; then

        activeUsers="$aUser $activeUsers"

        echo "Active user: $aUser"

    fi  

done



echo "<result>$activeUsers</result>"



exit 0

Thanks! I will check this out.