Deploy Office 2019 via GPO

With the advent of Office 2019, Microsoft has moved away from GPO deployment via MSI. There is no MSI of Office, Visio, Project, etc available to download anymore. Microsoft is moving toward using SCCM or the Office Deployment tool. I was tasked with coming up with a method for deploying Office via GPO in a fully automated manner.

There may be more than one way to accomplish GPO deployment of Office, and I do not claim to have the best method. It took me quite a bit of research and troubleshooting to get this method to work. I hope it helps someone looking to accomplish the same thing I was.

First off, head over to Microsoft and download the Office Deployment Tool (ODT) HERE. Run the executable and extract the files to a directory.

Next, use the Microsoft tool for generating an XML file HERE. Set your preferences, in my case, it was a volume license MAK copy of Visio 2019. Export the XML file and place it in the directory where you extracted the ODT.

The XML file I used to deploy Visio 2019 using a volume license looked like this:

<Configuration ID="xxxxxxxxxxxxxxxxxxxxxxx">
<Add OfficeClientEdition="64" Channel="PerpetualVL2019" SourcePath="\\server\ODT\" AllowCdnFallback="TRUE" ForceUpgrade="TRUE">
<Language ID="en-us" />
<ExcludeApp ID="Groove" />
<ExcludeApp ID="OneDrive" />
<Property Name="SharedComputerLicensing" Value="0" />
<Property Name="PinIconsToTaskbar" Value="TRUE" />
<Property Name="SCLCacheOverride" Value="0" />
<Property Name="AUTOACTIVATE" Value="TRUE" />
<Updates Enabled="TRUE" />
<RemoveMSI />
<Setup Name="Company" Value="Company" />
<Display Level="None" AcceptEULA="TRUE" />
<Logging Level="Standard" Path="" />

Notice the Display Level option. If set to FULL the installer will be visible. NONE means the install is silent.

Using an elevated command prompt under the ODT folder issue the following:

setup /download configuration.xml

Replace configuration.xml with the name of the XML exported earlier. The process will download the Office 2019 packages to a directory called “data” within the ODT folder.

Once complete, move the directory to a network share location. Set the share permissions appropriately, and make sure to edit the NTFS settings to allow domain users and domain computers read access.

Create a text file in the share directory and name it something that makes sense, in my case it was installvisio.txt. We are going to build a batch script from this file. The batch I created looks like this:

@echo off

 echo Visio 2019 Installer DO NOT CLOSE THIS WINDOW

 echo Checking for Visio Installation

 cd %SystemDrive%\users 
 dir /s completedoffice.txt 
 if not errorlevel 1 goto end

 echo Running Visio installer

 \server\ODT\Setup.exe /configure \server\ODT\configuration2.xml 

 echo Office Install Complete > %SystemDrive%\users\completedoffice.txt


The echos were used mainly during my testing phases while creating the .bat script. The script checks a directory for a text file that the script creates after the install is completed. If the file does not exist it calls the ODT and references the XML file. Rename the text file to a .bat file.

Next we want to create GPO that will do two things:

  1. Move the .bat from the share to the local machine
  2. Create a scheduled task that runs the .bat

In the GPO under User Settings –> Preferences –> Windows Settings –> Files, create a new files policy that looks like this:

In the GPO under User Settings –> Preferences –> Control Panel Settings –> Scheduled Tasks, create a new scheduled task.

The general tab should look like this:

Make sure when setting the security options, you BROWSE for the SYSTEM account as follows:

Under the triggers tab, configure a new trigger that begins at logon under any user. It should look like this:

On the actions tab, configure a new action as follows:

No other settings need to be configured on the GPO. Under the Delegation tab of the GPO, we opted to target a specific group of people for the Visio install. To accomplish this, we removed Authenticated Users. In AD we created a new security group called wgrp-visio-install. We added this group to the delegation tab and set the permission to read. Under advanced, make sure to check “apply policy”. Domain Computers needs to be added to the delegation tab as well.

Make sure to add the users or groups that need the office product the script will install to the newly created group.

If you opted for a silent install in the XML the user never even knows anything happened. As with everything, make sure to test this deployment method before applying to a production environment.

Happy trails!

One Reply to “Deploy Office 2019 via GPO”

  1. First and foremost, thank you for yout detailed explanations on how to tackle this topic. It is a great resource for anyone trying to deploy Office 2019 to computers.

    I am still struggling with it. As far as I know using this method of deployment we are not able to produce a GUI/installation progress visible to the user that is logged on during the installation.

    This would only be achived by creating another task running under the currently logged on user displaying a installation note that will be closed once the “completedoffice.txt” file has been created. (not tested yet – just an idea)

    The batchfile used to install Office had to be expanded to uninstall and then to install Kerio Offline Connector on the computer since this Addin installs itself differently for Office 2010 (what we have been using) and Office 2013/2016/2019 thus some DLLs are not in the right folders and sending essages in Outloo would not work.

Leave a Reply