Hi, I’m Ted Way, a Program Manager on the Licensing team. Ever enter a 25-character key when you installed Office? That’s us. I’m looking forward to sharing how we’re helping administrators worry less about key management and seamlessly integrate Windows and Office activation in the enterprise.
Starting in Office 2010, all volume editions of Office client software will require activation. What’s great for administrators is that Office has adopted the Windows Software Protection Platform (SPP), which means that most of what you have learned (or will learn) about Volume Activation for Windows applies to Office as well. For example, the same Key Management Service (KMS) host can be configured to activate Office 2010 clients as well as Windows 7 and Windows Server 2008 R2. Also, there is no reduction in functionality in volume editions of Office 2010. Even if Office is not activated, your users will still be able to open, save, edit, and print Office files, though users will see notifications reminding them to activate.
This post will kick off a short series of articles on volume activation that will cover topics such as an introduction to volume activation, setting up a KMS host, and using Multiple Activation Key (MAK).
There are two models available for activating volume editions of Office 2010 client. The default method is KMS, which is a local activation service. A KMS host needs to be set up, and that’s the only computer that activates with Microsoft. The other is Multiple Activation Key (MAK), which is similar to the retail activation method: a key needs to be entered, and the computer will need to connect to Microsoft to activate.
KMS is set up on a designated host system that will activate all client installations of Office 2010, eliminating the need for individual computers to connect to Microsoft for product activation. It is a lightweight service that does not require dedicated resources and can easily be co-hosted on a system that provides other services. Here at Microsoft we have one KMS host up and running internally that has activated over 8000 installations of Office 2010 Technical Preview builds. It’s also activating Windows 7 and Windows Vista machines.
Computers running volume editions of Windows 7 or Windows Server 2008 R2 operating systems can be configured as Office KMS hosts. Those running Windows Server 2003 can also be used as long as the KMS service is installed. Once you enter the KMS host key and activate, the host will register its Service record on DNS so KMS clients can find it. The KMS host can be further configured with the slmgr.vbs script that ships with Windows.
By default, a KMS client key is already pre-installed on volume editions of client software. That’s why end users don't need to enter a product key when installing Office Professional Plus, for example. A great aspect of KMS is that once you have a KMS host set up, KMS clients will automatically look for the host on DNS and activate themselves against it. Only one KMS host is needed to activate Windows and all Office client products. Just enter one KMS host key and activate, and the KMS host can activate not just Word, Excel, and PowerPoint, but also Visio, Project, and InfoPath.
KMS activation is not perpetual, so computers are activated (i.e. in the licensed state) for 180 days. Within that time, the KMS client will need to contact the KMS host and re-activate. When it does, it gets another 180 days starting from the day of re-activation. KMS clients by default attempt re-activation every seven days without a notification shown to the user, so this reactivation will happen automatically behind the scenes without any distractions. No “activation count” is “used up” when KMS clients activate and re-activate.
It might be easier to understand Multiple Activation Key, or MAK, by thinking of how Office 2007 retail editions are activated. You went to a store and got a CD for Office 2007. When you installed Office 2007, you were prompted to enter a product key found on the CD’s sleeve. Activation was then done with Microsoft’s activation servers, but you couldn’t activate more than a few times using the same key.
For MAK, the same principle applies, except each key has a different activation count depending on your organization’s needs. For example, a consulting firm with 50 employees constantly on the go may get a MAK key with an activation count of more than 50 (the extra activations are a buffer). That means the same 25-character key is entered for all 50 employee computers, and each of their computers activate online with Microsoft. A smaller firm may only have five computers, and they will get a key with an activation count that’s different than the other company’s key, but it will have enough for their needs.
MAK results in perpetual activation. Once activated, computers do not need to re-activate unless significant hardware changes occur, such as changing a hard drive.
In practice, organizations with 25 or fewer computers will likely find it easiest to use MAK. Larger organizations will see the value in setting up a KMS host to facilitate activation for hundreds if not thousands of computers.
In addition, larger organizations will probably use a mixture of KMS and MAK. KMS would be the default for computers that are connected to the corporate network at least a few times every 180 days. MAK activation would be suitable for laptops or other computers that are not connected to the company network.
Although the technology is the same, there are some important items to note between Windows and Office:
1. KMS hosts configured to activate Office should be installed on Windows Server 2003, volume editions of Windows 7, and Windows Server 2008 R2
2. If you want your KMS host to activate multiple products (e.g. Office 2010 and Windows 7), you will have to install the Windows KMS host key in addition to the Office KMS host key and activate both of them.
3. Office KMS clients are activated when five or more computers with Office attempt activation with the KMS host. For Windows client operating systems (Windows Vista and Windows 7), activation occurs after 25 or more computers with Windows client request activation.
I’ll be posting more articles that get into the nitty-gritty of these activation methods. The goal is to show you how easy and fast it is to set up a KMS host or MAK activate and get your users up and running Office in no time!
Business Contact Manager is a powerful contact and customer information management feature of Outlook.
The new version of Business Contact Manager (BCM) for Outlook 2010 is far more powerful and flexible than BCM for Outlook 2007. Manage your business contacts, track opportunities through the sales cycle, send personalized marketing campaigns, and organize your business projects.
With this introductory post, the BCM team has started to write about the top features in their upcoming release for Office 2010:
There are many new and exciting features in BCM. Visit BCM Team Blog regularly to learn how BCM for Office 2010 can help grow your business.
When you try Office 2010 you can download BCM from the Microsoft Connect site. Please try it out and send us your feedback!
For those of you who are dogfooding the Technical Preview build, thanks for all of the great feedback you’ve sent us so far on the new Backstage view! We’ve been getting a lot of requests for a sneak peak at the design changes that we’ve been making to the Backstage view since the Technical Preview builds have been released. I’ll talk through some of these changes in this post. Please note that these screenshots are still subject to change - they are from an interim build on the way to our Beta later this fall. We continue to tweak the designs based on what we learn in our usability labs and appreciate continued feedback from those of you that are dogfooding the Technical Preview.
File ButtonFrom the early days of this release, we have been working on making the common commands like Print, Save, and Open more discoverable than in Office 2007. When we created the Office Menu in Office 2007, we optimized for Fitt’s Law – making it super easy to put your mouse in the upper left corner and get to these commands. For those folks who discovered the Office Button right away, this was a great little feature that made Office easier to use. Unfortunately, because this design was unconventional and different from the rest of the Ribbon UI we added, it was hard for some customers to find the Office Button the first time. Many who saw the Office Button believed it to be a branding decoration, rather than a functional button.
In the Technical Preview build, we took steps towards addressing this feedback. First off, we put the Office Button within the same row as the other Ribbon tabs. The location of the Office Button contributed most to people confusing it with a decorative logo. Another thing that we changed was the shape – instead of a fancy round button, we turned it into a button that looked much more like a tab. Lastly, we added an arrow to the button to try to encourage people to click on it.
With these changes, we started seeing some significant improvements in the usability tests in terms of people finding this button quickly the first time. But we still thought the initial discoverability needed to be better - we want to be sure people have no trouble finding the functionality under this button. Over and over in the usability lab, customers told us the word “File” was something they were looking for in the UI – all the years of using the File menu to use commands like “Save As” and “Print” is a hard habit to break. So we’ve listened to our customers and in our Beta release you’ll see we’ve added the “File” label to the tab. This has been a tremendous success in the usability labs and we’ve seen an incredible surge in initial discoverability of the Backstage view.
No More Back ButtonOne of the things we’ve been working on has been improving the navigation to and from the Backstage. Because the Backstage view covers up the document, we created the Back button mechanism to allow you to navigate back to your document. Unfortunately, this design had some issues that we’ve been working through – it led to some confusion around what the “X” (close) button in the top right corner should do, set incorrect expectations around what “Back” actually implies (does it work like in the browser?), and was not an easy target to hit.
An important change has been to keep the Ribbon tabs visible and usable while you’re in the Backstage view. This makes the Backstage work much more like any other Ribbon tab – a metaphor people are already familiar with. In addition to clicking on the document thumbnail or pressing ESC, you can simply click on any one of the other Ribbon tabs to get back to your document and use those commands, just as you would switch between other Ribbon tabs.
Technical Preview:
Beta:
Updated VisualsWe’ve also worked to implement our nearly final set of visuals for the Backstage view. Our designers have worked to develop a set of visuals that help make the Backstage easier to browse and make the transition between your document and the Backstage feel smoother:
Organization of Navigation CommandsWe have also added a little bit more efficiency to the “Quick Commands” in the left side of the Backstage view. Commands like “Save”, “Save As”, “Open”, and “Close” are no longer located beneath the “Info” tab and are actually closer to the File button than they have been in previous versions. Options and Exit are also no longer associated with the last tab, which has been renamed to “Help” to better reflect the commands located on this tab (you can think of the Help tab as the replacement for the commands that used to be located on the Office 2003 Help menu.)
Most Recently Used DocumentsFor some of our customers, having very efficient access to their most recently used documents is super important. There are several ways to do this. First, you can add the “Open Recent File” command to the Quick Access Toolbar (QAT). Just drop down the Quick Customize menu at the right of the QAT.
Clicking on the “Open Recent File Button” from the QAT will open the Backstage view directly to the Recent tab.
You could also choose to add a number of recently used documents directly to the navigation pane – the left hand side of the Backstage view. At the bottom of the Recent tab is a new feature that will allow you to choose the number of recent documents to show in the pane.
If you turn on this feature by clicking on the checkbox…
The number of documents you choose will be shown along with the other “Quick Commands” at the top of the Backstage navigation pane.
Turning this feature on also means that you’ll be able to use the keyboard sequence Alt+F+1 (or 2 or 3, etc) to open the most (or 2nd most, etc) recent document. And for those of you who use the pinning feature of the Recent Documents list (which keeps your favorite documents at the top of the list), you will be able to use the Alt+F+1 (or 2, or 3, etc) keyboard sequence to get to your favorite document, regardless of when it was last opened!
You can now use the keyboard to open your pinned and most recently viewed documents:
Thanks for all of the great feedback that you’ve been giving us so far and we hope that these changes help you become even more productive with the new Backstage view. Let us know what you think of these changes and we look forward to continue hearing your feedback on all of the work that we’ve put into Office 2010. We are listening closely and looking forward to the release of the beta version later this fall.
Marina, Program Manager on the Office User Experience team
Hello, my name is Vikas and I work in the Office Trustworthy Computing security team. Today I will be telling you more about a feature I have been working on called Protected View. Protected View is one of the new security defense-in-depth features added in Office 2010. If you have not seen Brad’s post yet on this and the other new security improvements, it’s definitely worth taking a few minutes to look it over.
With any piece of complex software, over time new file parsing exploits against it may be found. The older Office binary file formats had been susceptible to these types of attacks. Over the past years hackers have discovered ways to manipulate Office binary files so that when they are opened and parsed, they cause their own code embedded within the file to run. To address these binary file parsing attacks in Office 2007, several new XML based file formats were introduced. These XML file formats are much easier to parse and provide a significant security benefit over the older binary formats. We do understand that there are still several billion binary files being used today and migrating to the new XML formats will take some time but if possible, the sooner you can migrate over, the sooner you can start leveraging the security benefits these new formats provide.
To address these attacks in the past, the Office team had released the MOICE (Microsoft Office Isolated Converter Environment). MOICE would take a potentially risky binary file type and convert it within a sandboxed process to the new XML format and then back to the binary format and open it. The hope of doing this conversion was to remove any exploit code that was hidden away within the file. Some downsides to MOICE were files that required a long time to convert would seem to take a long time to open and users would get frustrated. In addition, the conversion process did not always maintain 100% of the documents layout so there certainly was room to improve when it came to the overall user experience of the feature.
In Office 2010 when a file appears to be from a potentially risky location, such as the Internet, it is now opened in Protected View. Protected View will appear like any other read-only view. Under the covers however, when a file is opened in Protected View, it is being opened in the new Office 2010 sandbox. The Office 2010 sandbox is the “next version” of the MOICE sandbox described earlier. Unlike with MOICE, no file conversation is happening. In fact what is occurring is the file is being opened within a sandboxed instance of the application (Word, Excel, PowerPoint) and if there was malicious code present in the file the goal is that code would not be able to find a way to tamper with your documents; change your profile or other user settings. I will describe this in more detail a bit later in this post.
Since Protected View is a read only view, we understand it is not something that should be used for every file you interact with. Our goal when designing this feature was to only use it in high risk scenarios:
· Files opened from the Internet. When a file is downloaded from the Internet the Windows Attachment Execution Service places a marker in the file’s alternate data stream to indicate it came from the Internet zone. When a Word, Excel or PowerPoint file is opened and has this marker it will open in Protected View until the user decides to trust and edit it. That is done by pressing the “Enable Editing” button shown below:
In some cases when a file is opened from a network share that you believe is part of your Intranet zone it will open in Protected View and indicate on the trust bar that it originated from an Internet location. This could occur because of how your proxy is setup or because you have not indicated in your Internet Options – Local intranet setting to “automatically detect intranet network” as shown below:
· Attachments opened from Outlook 2010. When an attachment is opened from Outlook 2010 it will open in Protected View. Administrators will be able to configure if they want all attachments to open in Protected View or just those sent from senders outside their Exchange environment.
· Files opened from unsafe locations. An example of an unsafe location is files that are opened from your Temporary Internet Files folder. As an administrator you can extend this list to include directories you feel are also unsafe.
· Files that are blocked by File Block Policy. In Office 2007 we introduced a feature called File Block. This allowed administrators to define file types that should not be opened. When a type was blocked it simply could not be opened. From your feedback we heard that this was overly limiting from a usability aspect since your users still wanted to “read” those files. In Office 2010 these blocked files can now be opened in Protected View and as an administrator you can set policy to indicate if the user should be allowed to leave Protected View (by editing the file) or force them to stay in it. We hope this design will make all the issues and pains you felt go away!
· Office File Validation failures. Office File Validation is a new feature that scans an Office file when it is being opened and validates it against a well-known schema. When there are inconsistences between the file and the schema, the file will fail validation and will open in Protected View. Similar to File Block, policy will be available to determine if the user should be allowed to edit the file or not when a failure occurs.
· File Open Dialog. You can open files in Protected View explicitly by using the Open button:
The biggest gain is it lets us remove “are you sure” security prompts while giving you greater protection than you had in the past. For example, if you are an Outlook user like me you may have noticed that each time you open an attachment you are asked a question:
For me it is extremely hard to answer this question without seeing the contents of the file first. In Office 2010 we have removed this dialog and instead we now just open the file directly in Protected View! This allows you to look over the contents and make an informed decision if you really trust the file or not. If you do not, or if you only wanted to read it, you can get your job done and then close it. The reason we are comfortable opening the file directly is because of the many defense in depth checks we now have in place.
In addition to the open prompt, we also removed the Outlook Preview pane prompt shown below:
Now when you read Word, Excel, PowerPoint and Visio files in the Outlook preview pane you will no longer be prompted asking if you really trust the file first when Protected View is enabled.
Protected View had changed how Word, Excel and PowerPoint are architected. When a file is opened in Protected View there are two instances of the application that are running. To illustrate I will use Word. We have one instance of winword.exe that runs in the context of the account you are logged in as (we call this the “host” process) and we have another instance of winword.exe running in a very isolated process (we call this the “client” process). We also call the isolated process the Office sandbox and you will see these two terms intermixed.
The best way to describe it is with a picture. The client process is the part of the UI that is highlighted black and everything else is part of the host process as shown below:
When the user clicks on any part in the Host processes UI, because of UIPI, we have a high assurance the action came from the user and do not need to prompt with additional ‘are you sure you did this?’ dialogs. The host process owns the top level application frame window as shown above which includes the window caption, the ribbon, the trust bar, status bar, etc. The host process manages the Protected View and non-Protected View windows and acts as a “broker” for the client process. There is only one instance of the client/sandbox running at a given time and all files opened in Protected View share the same sandbox instance within an application. When all Protected View windows are closed the client process is terminated. When the client needs to perform a privileged task (such as accessing the file system, registry or other system resources) it makes a request to the host process and the host then will broker and perform the action if it deems appropriate.
As alluded to earlier, the client process is another Windows process that is running in the context of the user account however the token being used is a restricted token. By using a restricted token we were able to remove several rights and privileges this process has. To further lock down the client process we are also running it as a low integrity process. Together the restricted token and low integrity (UIPI) provide the foundations for our Office 2010 sandbox.
As discussed, Protected View is one of the many security defenses in Office 2010. For a malware to actually be able to run in Protected View it will first need to find a way around DEP, ASLR, GS and our new 2010 Office File validation checks. After all that, the malware would need to find a way to break out of the sandbox.
Hopefully now when you think you received a ‘scary’ Word, Excel or PowerPoint file you will be able to open it in Protected View and read it without having to worry that something bad could happen to your computer.
I appreciate you reading this far and stay tuned for more security posts coming soon!
Thanks.Vikas MalhotraSecurity Program ManagerOffice Trustworthy Computing
Hi, my name is Marina and I am a Program Manager on the Office User Experience team. In previous blog posts, you’ve read about the new Backstage view and how it has helped to improve the Printing experience. Now I’d like to tell you about the Info tab - the default tab you see when you enter the Backstage view.
Whenever you are working on a document, there is a ton of information available about its current state. Unfortunately, it is not very easy to actually view all of this information. And when it is displayed, it is spread out across many different parts of the application - in dialogs, the title bar, the status bar, the properties dialog, or even in Windows explorer. Some information is always visible (the word count that is shown on the status bar); while other information isn’t shown unless you know to look for it (is there any personal information hidden in the properties of the file?) And some information isn’t even accessible from within the Office application (what is the full path to my file?)
Information about your document can be found in many different places in the product:
In Office 2010, we are providing a way for you to see all the information that is available about your document in one convenient place. And not only that, but we are making this information readily available, so you don't have to dig around for it yourself. You no longer have to remember to run several features before sending your file to a potential employer. And if your document is in a state that you didn't know about, you will be able to notice this on your way to saving it to a public share.
The Info tab of the Backstage view is the place that assembles all this information:
While there are many features exposed in the Info tab which can help make working with documents easier, I'll highlight a few of my favorites. Simple Features Made Useful
Sometimes, knowing some of the most basic document properties can help you make a decision. With the Info tab, it's now easy to see (at one glance) when your document was last modified and who did it. You can also find out the file size of your document without having to leave the application and search through the Windows explorer:
One other task that has always been difficult to do from within Office applications has been to get the full path of where a document you're working on lives. We now show you this path in the Info tab, and you can easily copy and paste this path wherever you need it:
If you ever wanted to protect a document from accidentally being edited, but didn't want to prevent someone from editing it if they really wanted to, you can use the Mark as Final feature. Just select the radio button to indicate that you think this document is final in the Info tab:
Your document will now be made read-only, and anyone can see that it has been marked as final. They can also easily understand how to change this state if they wanted to go ahead and change something in the file.
When we were designing the Backstage, one thing that we realized is that it is much more interesting to read about the current state of your document, rather than reading the description of the feature that will provide you that state.
Instead of telling you that you can "Increase the security of the document by adding encryption" and making you guess whether you want to use this feature (or if it has already been applied), we can just say "Anyone can open, copy, and change any part of this document". Seeing the current state of the document makes it much easier for you to decide if you want to use one of the available features to change this state.
The Office Menu in Office 2007 shows you a list of features you can use to "Prepare the document for distribution":
In the Office 2010 Backstage view, instead of just giving you a list of features you can use, we tell you the current state of your document, without requiring you to first run the features yourself:
And of course, if the state of the document is anything but the default, we update the information to give you the most up-to-date status of your document, and highlight it to indicate that something special is going on:
Another example where showing you the status of the document is much more effective is the Document Inspector feature. It can scan through your document and find personal information (such as the author's name) or content that is hidden (such as hidden sheets or comments) - content that you may not want other people to see.
Unfortunately in the past, you had to actively remember to run this feature in order to find out if this content exists in your document. In Office 2010, we provide this information without waiting for you to run the feature yourself:
By glancing at this section in the Info tab of the Backstage view, you can quickly tell that your document contains some comments and hidden worksheets that you've forgotten about and may want to remove.
In addition to the information that every document contains (such as document properties, permission information, presence of hidden information, etc), if your document is ever in a special state, we make sure to tell you. This contextual information is not interesting to know about at all times - otherwise you'd be bombarded with all the possible states that your document could be in. So it only appears when your document is in this special state and there is an action that you may want to take as a result.
For example, your workbook may have some disabled macros in it, which are necessary for your file to work correctly, but are blocked to protect your computer from being attacked. The Info tab will show you this contextual information and allow you to enable the macros:
Another example of contextual information that will be shown is if you are working with a file that was created in a previous version of Office. In this case, your document may be in Compatibility mode - and some of the rich new features have been disabled. This state is reflected in the Info tab, and you can convert your file to the latest version if you want to use those features:
And if your document lives on a SharePoint site and you use features like Co-authoring, Workflows, Check Out, or Policy, the Info tab will always show you what is going on with your document. For example, if you have a workflow task assigned to you, you will be shown this information in the Info tab:
Thanks for reading. We hope that working with documents is a bit easier now that you have this information at your fingertips! Let us know what you think!
-Marina
With posts about the Sections slide organization feature and the ability to open Unlimited Windows, the PowerPoint team has started to unveil many of the great new features included in PowerPoint 2010. As mentioned in their Introduction, many of your presentations will look better simply because you're presenting with the new version of the software. Most recently, they've been announcing the first-class video support features that are now built directly into the product.
Visit the PowerPoint Team Blog to learn about the new advancements that are included in PowerPoint 2010 and the story behind the development of these features.
The PowerPoint team has made several posts to their team blog about new media features coming in Office 2010. Here is an excerpt from Allen Huang on the PowerPoint team:
One of our pillars for PowerPoint 2010 has been crafting a multimedia experience that allows users to effectively harness the storytelling power of audio and video content. With improvements in bandwidth, computing power, and media devices, we’re seeing media – particularly video – used in all walks of life to enrich communication. We’ve gotten a lot of feedback on PowerPoint’s video capabilities over the years, and we’re very excited about the features we’re rolling out in 2010 to make this experience not only dependable, but pleasurable too.
You can find more details (and a video overview) in Allen’s post here. In addition, there’s a post on trimming your media right from within PowerPoint, and another on brand new multimedia features which allow you to easily share and present media-rich presentations on other computers.
Enjoy.
The current reality of collaboration pushes language, cultural and local requirements to new levels. In this new environment, for Office 2010, we are increasing our investments on World-Readiness and Global Experience to enable our customers to be successful. GXP contributes to this strategy by providing a platform that enables the Office organization to deliver an optimal Global User Experience across the Office System. Our team executes this mission in three ways:
So how is this accomplished in an organization the size of Office? Well, you need a great team that is well plugged in to the Office organization and that can see Office as one system. You need people that live their jobs as the global customer's advocates and really want to make a difference for all customers throughout the world. This is exactly what the GXP team is about; a team of developers, testers and program managers that came from all over the world to create a product that any information worker or consumer can use regardless of their language, culture or location. We have people from Canada, China, France, Germany, India, Jordan, Libya, Mexico, Morocco, Pakistan, Palestine, Romania, Russia, Spain, Thailand, Ukraine, etc. And of course, since we are all about diversity we also have some people from the United States (8-).
On behalf of the GXP team, I want to thank you for your interest in Office and its Global support. We look forward to your comments and to sharing more about the release in the coming weeks.
To learn more about our Global features in Office 2010, please visit http://blogs.technet.com/office_global_experience
Javier Larrinaga, Group Program Manager, GXP.