1: Create the policy
Firstly you need to create a default policy from which you can build, to do this follow the below steps:

1. Create your group policy as per normal
2. When the policy editor is open (gpedit.msc) navigate to Computer Configuration -> Windows Settings ->Security Settings
3. Right click “Software Restriction Policies” and click “Create New Policies”

At this point, you have a standard policy with nothing out of the ordinary.

2: Set policy enforcement
Now that you have the policy, you need to set what the policy will apply to.

1. Click “Software Restriction Policies” if not already selected
2. double-click “Enforcement”
3. Choose “All Software files” and “All users except local administrators”

3: Remove links from protection
By removing link files, you’re allowing start menu entries, desktop shortcuts etc to execute. Make sure you prevent users from creating shortcuts then though.

1. Double click “Designated File Types”
2. Remove “LNK Shortcut” from the list and click OK

4: Enable policy
Now, we need to enable the policy (or rather, change it from unrestricted to restricted)

1. Expand “Security Levels”
2. Right click “Disallowed” and choose “Set as default”
3. Click “Yes” to set the defact action to restrict

If you then need to add exclusions to allow execution of programs etc, you can do that via the “Additional Rules” section.

%HOMEPATH%\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}

You then need to create an MST using Orcas and MsiTran or download mine. All you need to change if you create your own transform is change the IEXPLORER Property from 0 to 1.

Then put the MSI and MST in your distribution share and simply assign the MSI and apply the transform as you would normally and you’re done.

For reasoning unknown to me, Microsoft released them as an exe as opposed to an MSI so it’s a little work to get them to deploy via group policy (and ZAP is evil).

Extract FileFormatConerters.exe to somewhere useful like so:

FileFormatConverters.exe /extract:\\nwtraders.msft\SoftwareDeployment\FileFormatConverters

Once that’s done setup the software installation as per usual and then use the following WMI filter to restrict the install to systems with Office 2003 (since we don’t want to install it if they have office 2007)

SELECT * FROM Win32_Product WHERE (Caption LIKE .Microsoft Office%2003%.)

SELECT * FROM Win32_OperatingSystem WHERE Caption LIKE '%Windows Vista%'OR Caption LIKE '%Windows XP%'

By applying the above WMI filter to the group policy you will restrict the policy to Windows XP and Windows Vista only.