locked
Office 365 ProPlus App-V 5.0 Package installs Lync, Outlook, Infopath and Onenote even though they are not selected for publishing RRS feed

  • Question

  • I have created an App-V 5.0 Package for Office 365 ProPlus using the documentation provided here:
    http://technet.microsoft.com/en-us/library/jj219422.aspx

    I am able to load the App-V Package into my SCCM 2012 SP1 environment and deploy the package to a test machine

    Within SCCM, I have configured the deployment type to only select a couple of applications.  Notice that Lync, Outlook, Infopath and Onenote are not selected.
    http://i.imgur.com/1eMxUlY.jpg

    For my deployment type, I only selected Word, Excel and Powerpoint.  Looking at my test machine, those 3 applications now show up in my start screen.
    http://i.imgur.com/amZmxAT.jpg

    I don't see any of the other Office applications be default on my start screen, so I would think all looks good.  If I type another Office application, lets say access at the start screen I get, "No apps match your search."
    http://i.imgur.com/fxbWEvb.jpg

    But if I type Lync, Outlook, Infopath or Onenote, it shows me that those applications are available, and I can launch them as an App-V application just as I could Excel, Word or Powerpoint, the applications that I wanted to have available.

    This is not what I was expecting when I went through the trouble to create an App-V package.  It looks like almost all of the apps become available on my client machine, all App-V is doing is making the application button in the start screen a little harder to find.

    What is interesting is that for the applications I did want published, I can search for them by just entering a few letters of the application name, and they show up with the 2013 version label, see below for an example search for Word.
    http://i.imgur.com/0LeS05z.jpg

    For the applications that I did not publish but still show up on my client, I have to type in the full name of the application for the launch button to come up.  For example, I can't type lyn and expect to see Lync, but if i type lync I will get an option to launch the application.  The same goes for Outlook, Infopath and Onenote, and when you do type in the full namke of the app, it doesn't show the version number like Word does as Word 2013, it just shows Lync, or Outlook, or Infopath, or Onenote.

    http://i.imgur.com/QV1afuc.jpg

    vs

    http://i.imgur.com/PxgSmUc.jpg

    Can anyone from Microsoft confirm that this is expected behavior.  If this is to be expected this is pretty disappointing, because a main point of the App-V package is it is the only way to limit which applications are deployed via Office 365 ProPlus but from what I can tell, it really isn't limiting anything beyond the start screen for most cases.

    Monday, January 13, 2014 3:31 PM

Answers

  • So it looks like the config xml files are the best option

    http://blogs.technet.com/b/office_resource_kit/archive/2013/12/02/announcing-app-v-5-0-sp2-support-for-office-2013-volume-licensing-editions.aspx

    You can now use the Deployment Configuration file to configure the Office installation. One question I often get is, “How do I disable msaccess.exe or infopath.exe from an Office install if I am not using the MSI package?” This can be done by modifying the Deployment Configuration file in App-V with entries like the following:

    <Application Id="[(AppVPackageRoot}]\office15\MSACCESS.EXE" Enabled="false">
      <VisualElements>
        <Name>Access 2013</Name>
        <Icon />
        <Description />
      </VisualElements>
    </Application>

    That will prevent App-V from publishing msaccess.exe on the system and/or you can remove any undesired application shortcuts from publishing on the targeted computer using the shortcuts properties by deleting or commenting them out. Once you’ve configured your Deployment and User Configuration files, you’ll have everything you need to import the packages into your App-V environment to start testing.

    Tuesday, January 14, 2014 9:34 PM
  • Hello

    You can review the config-manifests and see if they offer any additional configuration you might require. SCCMs interface is rather limited in comparision.


    Nicke Källén | The Knack| Twitter: @Znackattack

    Monday, January 13, 2014 9:12 PM
  • It may be worth checking the DeploymentConfiguration.xml file and remove the apppaths of the applications you are not deploying.
    Tuesday, January 14, 2014 8:02 AM

All replies

  • Hello,

    Most likely they are found through search via the filename of the executable, which is still part of the package.

    An administrator always has full access to the machine, but you could try to toggle the access control to limit the browsability.

    Name of setting;

    PackageStoreAccessControl

    Toggle it to 1 to limit users from browsing around


    Nicke Källén | The Knack| Twitter: @Znackattack

    Monday, January 13, 2014 5:05 PM
  • Gotcha, so again, given the following screenshot

    http://i.imgur.com/1eMxUlY.jpg

    I have only published a couple of the applications.  You are saying that all of the applications will still be "available" in the file system because the entire app-v package is downloaded?

    As far as PackageStoreAccessControl I will need to upgrade my App-V client since that is new with App-V 5.0 SP2

    I'll let you know how that goes but I am still a little skeptical, because I am not able to search for Access or Publisher for example, so my thinking is that Microsoft is forcing some applications to be published whether you want them to or not.  To me, that would mean that the app-v package has some flexibility, but just not down to the level I would like it to be.

    Monday, January 13, 2014 8:52 PM
  • So looking deeper into the file system, Access and Publisher are there and I can launch them.  So the App-V package will contain all of the Office apps that are packaged into it once it gets to the client, regardless of the publishing options that you set.  It just seems that the publishing mechanism only seems to hide some of the applications from an end user because of their file names.

    Nicke you are correct, it seems that it is finding Lync, Outlook, Infopath or Onenote based on their file name because their product name and file name are the same, where access runs through MSACCESS.EXE which explains why I don't see anything when I search for access on its own, but if I type msaccess it does comes up.

    This again is disappointing, because it seemed App-V was the only way to control which applications got installed through an Office 365 Pro Plus deployment, but it seems that it still includes the whole program and doesn't control anything beyond the links that get created in the start screen.

    Monday, January 13, 2014 9:09 PM
  • Hello

    You can review the config-manifests and see if they offer any additional configuration you might require. SCCMs interface is rather limited in comparision.


    Nicke Källén | The Knack| Twitter: @Znackattack

    Monday, January 13, 2014 9:12 PM
  • Thanks Nicke.  From what I had read, SCCM could provide all of the same capabilities as a stand alone App-V environment.  I do have a deploymentconfig.xml and a userconfig.xml that the packaging process created which are both huge, about 4MB a piece.  I will see what I can find in those but I am not optimistic, especially since I didn't actually do the sequencing manually myself, it was a process that I followed defined by Microsoft that simply takes the Office 365 Pro Plus install files and converts them into an App-V package.  See here for details: http://technet.microsoft.com/en-us/library/jj219422.aspx

    Monday, January 13, 2014 10:34 PM
  • It may be worth checking the DeploymentConfiguration.xml file and remove the apppaths of the applications you are not deploying.
    Tuesday, January 14, 2014 8:02 AM
  • Hello,

    Yes, SCCM provides all the capabilities as a standalone AppV Environment.

    Those files are parsed when you import the package and then applied when you deploy the package through SCCM


    Nicke Källén | The Knack| Twitter: @Znackattack

    Tuesday, January 14, 2014 8:06 AM
  • Alternatively look at controlling access to the applications with AppLocker. That way you can ensure that only authorised users are allowed to launch the applications even though the applications are in the package and on the file system.


    Please remember to click "Mark as Answer" or "Vote as Helpful" on the post that answers your question (or click "Unmark as Answer" if a marked post does not actually answer your question). This can be beneficial to other community members reading the thread.


    This forum post is my own opinion and does not necessarily reflect the opinion or view of my employer, Microsoft, its employees, or other MVPs.

    Twitter: @stealthpuppy | Blog: stealthpuppy.com | The Definitive Guide to Delivering Microsoft Office with App-V

    Tuesday, January 14, 2014 10:34 AM
    Moderator
  • Thanks Aaron.  I was aware of the AppLocker option, I just find it to not be a very graceful solution in this case and was trying to avoid going down that road.  It seems at this point the config xml files are probably the best place for me to continue with, I just haven't some across any documentation on those files from Microsoft so I will have to look into them myself and see what I can find.
    Tuesday, January 14, 2014 3:00 PM
  • So it looks like the config xml files are the best option

    http://blogs.technet.com/b/office_resource_kit/archive/2013/12/02/announcing-app-v-5-0-sp2-support-for-office-2013-volume-licensing-editions.aspx

    You can now use the Deployment Configuration file to configure the Office installation. One question I often get is, “How do I disable msaccess.exe or infopath.exe from an Office install if I am not using the MSI package?” This can be done by modifying the Deployment Configuration file in App-V with entries like the following:

    <Application Id="[(AppVPackageRoot}]\office15\MSACCESS.EXE" Enabled="false">
      <VisualElements>
        <Name>Access 2013</Name>
        <Icon />
        <Description />
      </VisualElements>
    </Application>

    That will prevent App-V from publishing msaccess.exe on the system and/or you can remove any undesired application shortcuts from publishing on the targeted computer using the shortcuts properties by deleting or commenting them out. Once you’ve configured your Deployment and User Configuration files, you’ll have everything you need to import the packages into your App-V environment to start testing.

    Tuesday, January 14, 2014 9:34 PM