I'm working on a Windows 10 MOE deployment that is using the Microsoft Security Baseline templates to provide a more secure environment. This includes the "MSFT Office 365 ProPlus 1908 - User" baseline, which has the below picture setting that manages the loading of add-ins in Outlook (current on Semi-Annual Enterprise Channel build 2002, but toying with Monthly Enterprise Channel 2008).
With this setting, users get prompted to enable add-ins for "Microsoft SharePoint Server Colleague Import Add-in" (ColleagueImport.dll), "Microsoft Teams Meeting Add-in for Microsoft Office" (Microsoft.Teams.AddinLoader.dll), "OneNote Notes about Outlook Items" (ONBttnOL.dll), "Microsoft VBA for Outlook Add-in" (OUTLVBA.dll) and "Outlook Social Connector 2016" (SOCIALCONNECTOR.dll). I could honestly do without the first one and the last one (although I've tried to use Group Policy to stop the Social Connector with no luck), but the rest will be required.
For each of the DLL's, I've extracted the Code Signing Certificate Microsoft uses to sign the DLL's and use Group Policy to import them as a "Trusted Publisher" certificate on the devices. Problem is that I've seen slight variations in these certificates (e.g. the same DLL might have been signed with a certificate with a serial number ending in 325, and then one with a serial number ending in 326). AND, the certificates are only 1 year in expiration, meaning most likely needing to manage the certificates via Group Policy on a yearly basis.
My question is this - is there any easy way to manage the Microsoft Code Signing Certificate updates easier that manually extracting the certificate and pushing via Group Policy? Would also appreciate if anyone has had luck disabling the Social Connector and SharePoint Server Colleague Import via Group Policy. I've also attached a Word document that shows each of the DLL's and SOME of the certificates used for signing (not the one's where there has been a slight variation in serial number).
Thanks
Matt
Have managed to find a GPO I can use to successfully disable the Colleague Import and Outlook Social Connector. So just needing to know about how to best managed the Trusted Publisher certificates.
