Microsoft 365 Apps (Office)¶

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun" -ErrorAction SilentlyContinue |
    Select-Object InstallPath, PackageGUID, VersionToReport

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -ErrorAction SilentlyContinue |
    Select-Object CDNBaseUrl, UpdateChannel, ClientCulture, Platform, VersionToReport

$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
Set-ItemProperty -Path $c2rPath -Name "UpdateUrl" `
    -Value "\\fileserver\Office365Updates$" -Type String
Set-ItemProperty -Path $c2rPath -Name "UpdateEnabled" -Value "True" -Type String

$config = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$cdnUrl = $config.CDNBaseUrl

$channels = @{
    "492350f6-3a01-4f97-b9c0-c7c6ddf67d60" = "Current Channel"
    "55336b82-a18d-4dd6-b5f6-9e5095c314a6" = "Monthly Enterprise Channel"
    "b8f9b850-328d-4355-9145-c59439a0c4cf" = "Semi-Annual Enterprise (Preview)"
    "7ffbc6bf-bc32-4f92-8982-f9dd17fd3114" = "Semi-Annual Enterprise Channel"
    "5440fd1f-7ecb-4221-8110-145efaa6372f" = "Beta Channel"
}

$guid = ($cdnUrl -split '/pr/')[-1]
$channelName = $channels[$guid]
Write-Host "Canal actuel : $channelName ($guid)"
Write-Host "Version : $($config.VersionToReport)"

$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$monthlyEnterpriseGuid = "55336b82-a18d-4dd6-b5f6-9e5095c314a6"
$newCdnUrl = "http://officecdn.microsoft.com/pr/$monthlyEnterpriseGuid"

Set-ItemProperty -Path $c2rPath -Name "CDNBaseUrl" -Value $newCdnUrl -Type String
Set-ItemProperty -Path $c2rPath -Name "UpdateChannel" -Value $newCdnUrl -Type String

$c2rExe = "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
Start-Process $c2rExe -ArgumentList "/update user displaylevel=false forceappshutdown=true" -Wait

$policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\OfficeUpdate"
if (-not (Test-Path $policyPath)) { New-Item -Path $policyPath -Force }
Set-ItemProperty -Path $policyPath -Name "UpdateBranch" `
    -Value "MonthlyEnterprise" -Type String
Set-ItemProperty -Path $policyPath -Name "EnableAutomaticUpdates" -Value 1 -Type DWord
Set-ItemProperty -Path $policyPath -Name "HideEnableDisableUpdates" -Value 1 -Type DWord

$apps = @("Word", "Excel")
foreach ($app in $apps) {
    $secPath = "HKCU:\SOFTWARE\Microsoft\Office\16.0\$app\Security"
    if (-not (Test-Path $secPath)) { New-Item -Path $secPath -Force }
    # Niveau 3 : macros signees uniquement
    Set-ItemProperty -Path $secPath -Name "VBAWarnings" -Value 3 -Type DWord
}

$apps = @("Word", "Excel", "PowerPoint", "Access")
foreach ($app in $apps) {
    $secPath = "HKCU:\SOFTWARE\Microsoft\Office\16.0\$app\Security"
    if (-not (Test-Path $secPath)) { New-Item -Path $secPath -Force }
    Set-ItemProperty -Path $secPath -Name "BlockContentExecutionFromInternet" `
        -Value 1 -Type DWord
}

$trustPath = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location10"
if (-not (Test-Path $trustPath)) { New-Item -Path $trustPath -Force }
Set-ItemProperty -Path $trustPath -Name "Path" `
    -Value "\\fileserver\macros-approuvees$" -Type String
Set-ItemProperty -Path $trustPath -Name "AllowSubfolders" -Value 1 -Type DWord
Set-ItemProperty -Path $trustPath -Name "Description" `
    -Value "Macros approved by IT department" -Type String

$apps = @("Word", "Excel", "PowerPoint", "Access")
foreach ($app in $apps) {
    $secPath = "HKCU:\SOFTWARE\Microsoft\Office\16.0\$app\Security\Trusted Locations"
    if (-not (Test-Path $secPath)) { New-Item -Path $secPath -Force }
    Set-ItemProperty -Path $secPath -Name "AllowNetworkLocations" -Value 0 -Type DWord
}

$privacyPath = "HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Privacy"
if (-not (Test-Path $privacyPath)) { New-Item -Path $privacyPath -Force }

# Desactiver les experiences connectees optionnelles
Set-ItemProperty -Path $privacyPath -Name "ControllerConnectedServicesEnabled" `
    -Value 0 -Type DWord
# Desactiver l'analyse du contenu utilisateur
Set-ItemProperty -Path $privacyPath -Name "UserContentDisabled" -Value 1 -Type DWord

Set-ItemProperty -Path $privacyPath -Name "SendTelemetry" -Value 1 -Type DWord

$privacyPath = "HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Privacy"
# Desactiver toutes les experiences connectees
Set-ItemProperty -Path $privacyPath -Name "DisconnectedState" -Value 1 -Type DWord
# Desactiver le telechargement de contenu en ligne
Set-ItemProperty -Path $privacyPath -Name "DownloadContentDisabled" -Value 1 -Type DWord

$osmPath = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\OSM"
if (-not (Test-Path $osmPath)) { New-Item -Path $osmPath -Force }
Set-ItemProperty -Path $osmPath -Name "EnableUpload" -Value 0 -Type DWord
Set-ItemProperty -Path $osmPath -Name "Tag1" -Value "VDI-Pool-A" -Type String

# Verifier les produits installes
$config = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
Write-Host "Produits : $($config.ProductReleaseIds)"

# Verifier le mode de licence
$sca = $config.SharedComputerLicensing
Write-Host "Shared Computer Activation : $(if ($sca -eq '1') {'Active'} else {'Desactive'})"

# Etat de la licence via l'outil OSPP
$osppPath = "C:\Program Files\Microsoft Office\Office16\OSPP.VBS"
if (Test-Path $osppPath) {
    cscript $osppPath /dstatus
}

$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
Set-ItemProperty -Path $c2rPath -Name "SharedComputerLicensing" -Value "1" -Type String

$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
Set-ItemProperty -Path $c2rPath -Name "SCLCacheOverride" -Value 1 -Type DWord
Set-ItemProperty -Path $c2rPath -Name "SCLCacheOverrideDirectory" `
    -Value "\\fileserver\office-licenses$\%USERNAME%" -Type String

# Verification complete de l'etat de licence
Write-Host "=== Configuration ===" -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" |
    Select-Object ProductReleaseIds, SharedComputerLicensing, SCLCacheOverride |
    Format-List

Write-Host "=== Licensing ===" -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Licensing" -ErrorAction SilentlyContinue |
    Format-List

Write-Host "=== Identite utilisateur ===" -ForegroundColor Cyan
Get-ItemProperty "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Identity" -ErrorAction SilentlyContinue |
    Select-Object FederationProvider, SignedIn, ADAccountName |
    Format-List

$paths = @(
    "HKLM:\SOFTWARE\Microsoft\Office\Excel\Addins",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Office\Excel\Addins",
    "HKCU:\SOFTWARE\Microsoft\Office\Excel\Addins"
)

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem $path | ForEach-Object {
            $props = Get-ItemProperty $_.PSPath
            [PSCustomObject]@{
                Name         = $_.PSChildName
                FriendlyName = $props.FriendlyName
                LoadBehavior = $props.LoadBehavior
                Source       = if ($path -like "HKLM*") { "Machine" } else { "User" }
            }
        }
    }
}

$addinPath = "HKLM:\SOFTWARE\Microsoft\Office\Excel\Addins\ProblematicAddin.Connect"
if (Test-Path $addinPath) {
    # Passer LoadBehavior a 0 (decharge)
    Set-ItemProperty -Path $addinPath -Name "LoadBehavior" -Value 0 -Type DWord
}

$resPath = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DisabledItems"
if (Test-Path $resPath) {
    Get-ItemProperty $resPath | Select-Object * -ExcludeProperty PS*
}

$doNotDisable = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Excel\Resiliency\DoNotDisableAddinList"
if (-not (Test-Path $doNotDisable)) { New-Item -Path $doNotDisable -Force }

# Utiliser le ProgID du complement comme nom de valeur
Set-ItemProperty -Path $doNotDisable -Name "CriticalAddin.Connect" -Value 1 -Type DWord

$apps = @("Word", "Excel")
foreach ($app in $apps) {
    $addinListPath = "HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\$app\Resiliency\AddinList"
    if (-not (Test-Path $addinListPath)) { New-Item -Path $addinListPath -Force }

    # Valeur = 1 : toujours actif, 0 : toujours desactive, 2 : configurable par l'utilisateur
    Set-ItemProperty -Path $addinListPath -Name "TeamsMeetingAddin.Connect" -Value 1 -Type DWord
    Set-ItemProperty -Path $addinListPath -Name "UCAddin.UCConnect" -Value 1 -Type DWord
}

$onedrivePath = "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive"
if (-not (Test-Path $onedrivePath)) { New-Item -Path $onedrivePath -Force }

# Remplacer par votre Tenant ID Azure AD
$tenantId = "12345678-1234-1234-1234-123456789012"

Set-ItemProperty -Path $onedrivePath -Name "KFMSilentOptIn" -Value $tenantId -Type String
Set-ItemProperty -Path $onedrivePath -Name "KFMSilentOptInWithNotification" -Value 1 -Type DWord
Set-ItemProperty -Path $onedrivePath -Name "KFMBlockOptOut" -Value 1 -Type DWord

$onedrivePath = "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive"
Set-ItemProperty -Path $onedrivePath -Name "KFMSilentOptInDesktop" -Value 0 -Type DWord
Set-ItemProperty -Path $onedrivePath -Name "KFMSilentOptInDocuments" -Value 1 -Type DWord
Set-ItemProperty -Path $onedrivePath -Name "KFMSilentOptInPictures" -Value 0 -Type DWord

$onedrivePath = "HKLM:\SOFTWARE\Policies\Microsoft\OneDrive"
# Configuration automatique du compte avec les identifiants Windows
Set-ItemProperty -Path $onedrivePath -Name "SilentAccountConfig" -Value 1 -Type DWord
# Activer les fichiers a la demande (economie d'espace disque)
Set-ItemProperty -Path $onedrivePath -Name "FilesOnDemandEnabled" -Value 1 -Type DWord

# Script d'inventaire a executer via SCCM ou Intune
$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$config = Get-ItemProperty $c2rPath -ErrorAction SilentlyContinue

if ($config) {
    $cdnUrl = $config.CDNBaseUrl
    $guid = ($cdnUrl -split '/pr/')[-1]

    $channels = @{
        "492350f6-3a01-4f97-b9c0-c7c6ddf67d60" = "Current"
        "55336b82-a18d-4dd6-b5f6-9e5095c314a6" = "MonthlyEnterprise"
        "b8f9b850-328d-4355-9145-c59439a0c4cf" = "SemiAnnualPreview"
        "7ffbc6bf-bc32-4f92-8982-f9dd17fd3114" = "SemiAnnual"
    }

    [PSCustomObject]@{
        ComputerName = $env:COMPUTERNAME
        Channel      = $channels[$guid]
        Version      = $config.VersionToReport
        Platform     = $config.Platform
        Products     = $config.ProductReleaseIds
    }
}

# Script de migration de canal - deployer via GPO ou SCCM
$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$monthlyEnterpriseGuid = "55336b82-a18d-4dd6-b5f6-9e5095c314a6"
$newCdnUrl = "http://officecdn.microsoft.com/pr/$monthlyEnterpriseGuid"

# Etape 1 : changer le canal dans le registre
Set-ItemProperty -Path $c2rPath -Name "CDNBaseUrl" -Value $newCdnUrl -Type String
Set-ItemProperty -Path $c2rPath -Name "UpdateChannel" -Value $newCdnUrl -Type String

# Etape 2 : supprimer le verrouillage de version s'il existe
$currentTarget = (Get-ItemProperty $c2rPath -Name "UpdateTargetVersion" -ErrorAction SilentlyContinue).UpdateTargetVersion
if ($currentTarget) {
    Remove-ItemProperty -Path $c2rPath -Name "UpdateTargetVersion" -ErrorAction SilentlyContinue
}

# Etape 3 : declencher la mise a jour
$c2rExe = "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
if (Test-Path $c2rExe) {
    Start-Process $c2rExe -ArgumentList "/update user displaylevel=false forceappshutdown=false" -Wait
}

# Script de verification a executer sur les postes pilotes
$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$config = Get-ItemProperty $c2rPath

$guid = ($config.CDNBaseUrl -split '/pr/')[-1]
$expectedGuid = "55336b82-a18d-4dd6-b5f6-9e5095c314a6"

$result = [PSCustomObject]@{
    Computer   = $env:COMPUTERNAME
    Channel    = if ($guid -eq $expectedGuid) { "MonthlyEnterprise" } else { "ECHEC - Canal incorrect" }
    Version    = $config.VersionToReport
    UpdateUrl  = $config.CDNBaseUrl
}

$result | Format-List

# Parametres GPO a configurer
$policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\OfficeUpdate"
if (-not (Test-Path $policyPath)) { New-Item -Path $policyPath -Force }

# Forcer le canal Monthly Enterprise
Set-ItemProperty -Path $policyPath -Name "UpdateBranch" `
    -Value "MonthlyEnterprise" -Type String
# Activer les mises a jour automatiques
Set-ItemProperty -Path $policyPath -Name "EnableAutomaticUpdates" -Value 1 -Type DWord
# Masquer les notifications de mise a jour pour ne pas perturber les utilisateurs
Set-ItemProperty -Path $policyPath -Name "HideUpdateNotifications" -Value 1 -Type DWord
# Empecher la desactivation des mises a jour
Set-ItemProperty -Path $policyPath -Name "HideEnableDisableUpdates" -Value 1 -Type DWord
# Date limite d'installation : 7 jours apres la disponibilite
Set-ItemProperty -Path $policyPath -Name "UpdateDeadline" -Value "07:00" -Type String

# Script de rapport a executer depuis un serveur de gestion
# Prerequis : PowerShell Remoting actif sur les postes

$computers = Get-ADComputer -Filter 'OperatingSystem -like "*Windows 10*" -or OperatingSystem -like "*Windows 11*"' |
    Select-Object -ExpandProperty Name

$results = Invoke-Command -ComputerName $computers -ScriptBlock {
    $c2r = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" -ErrorAction SilentlyContinue
    if ($c2r) {
        $guid = ($c2r.CDNBaseUrl -split '/pr/')[-1]
        [PSCustomObject]@{
            Computer = $env:COMPUTERNAME
            Channel  = switch ($guid) {
                "55336b82-a18d-4dd6-b5f6-9e5095c314a6" { "MonthlyEnterprise" }
                "7ffbc6bf-bc32-4f92-8982-f9dd17fd3114" { "SemiAnnual" }
                default { "Unknown ($guid)" }
            }
            Version  = $c2r.VersionToReport
        }
    }
} -ErrorAction SilentlyContinue

# Resume
$summary = $results | Group-Object Channel | Select-Object Name, Count
Write-Host "`n=== Avancement de la migration ===" -ForegroundColor Cyan
$summary | Format-Table -AutoSize

$total = ($summary | Measure-Object -Property Count -Sum).Sum
$migrated = ($summary | Where-Object { $_.Name -eq "MonthlyEnterprise" }).Count
$percentage = [math]::Round(($migrated / $total) * 100, 1)
Write-Host "Progression : $migrated / $total ($percentage%)" -ForegroundColor Green

$c2rPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
$semiAnnualGuid = "7ffbc6bf-bc32-4f92-8982-f9dd17fd3114"
$rollbackUrl = "http://officecdn.microsoft.com/pr/$semiAnnualGuid"

Set-ItemProperty -Path $c2rPath -Name "CDNBaseUrl" -Value $rollbackUrl -Type String
Set-ItemProperty -Path $c2rPath -Name "UpdateChannel" -Value $rollbackUrl -Type String

# Forcer la mise a jour vers la derniere version Semi-Annual
$c2rExe = "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
Start-Process $c2rExe -ArgumentList "/update user displaylevel=false forceappshutdown=true" -Wait