Restricting access to Office programs breaks Outlook preview feature for Excel

We run Office on a terminal server and have historically restricted access to the Office programs using security groups. Only users in our "Office" security group can access the programs from the start menu and the executables. This helps us enforce our licensing for Office. Specifically we do the following:

1. Restrict the start menu "Microsoft Office" folder to "Office" users.

2. Restrict the Excel.exe, Winword.exe, etc. programs to the "Office" users.

We did the same with Office 2010 and everything worked EXCEPT Excel. When legitimate users (including Domain Admins) ran Outlook they would get an out of memory error when trying to preview Excel documents. Keep in mind they had access to the Excel files, just the permissions were not the inherited ones and did not include the "Users" group. Also, when the file was saved from Outlook to the disk, it still could not be opened by Excel. It would report an out of memory error and then that the file was corrupt. Unblocking the message on the hard drive allowed it to be opened.

Now when the permissions were set back to be the inherited ones from the Office 14 folder, everything worked fine for the same users using the same messages and files.

How could this possibly be? It makes no sense from a security model perspective since everything should be running under the user account permissions. Plus, running Excel and opening other documents or creating new ones work fine. Just preview or saving from Outlook to the disk creates the issue.

Any Microsoft folks have insight?

Rob

Continue reading...