An Attune project that automates the unattended installation of Microsoft Office on Windows targets using Microsoft's Office Deployment Tool (ODT). The project bundles the ODT installer, an editable configuration.xml, and a sequenced blueprint of seven PowerShell steps that download the Office source, install it, verify success, and clean up.
This README explains what the project does, how Attune executes each step, and how to import and run it against your own Windows fleet.
Microsoft's recommended way to deploy Office (Microsoft 365 Apps, Office LTSC 2021/2024) on Windows is the Office Deployment Tool — a small command-line utility (setup.exe) that reads a configuration.xml, downloads the requested Office binaries from Microsoft's CDN, and installs them silently. Done manually it's a multi-stage, error-prone process. Done across a fleet, it's painful.
This project wraps the entire flow in an Attune blueprint that runs end-to-end without operator interaction:
- Pushes the ODT installer to the target
- Extracts
setup.exefrom it - Pushes a customised
configuration.xml - Runs
setup.exe /downloadto fetch the Office source onto the target - Runs
setup.exe /configureto install Office - Verifies the install via the Windows registry
- Deletes the staging directory to reclaim disk space (~3 GB)
The result is a repeatable, auditable, hands-off Office deployment — exactly the kind of task Attune is designed for.
Attune is an agentless orchestration platform. It connects to Windows targets over WinRM (and Linux targets over SSH) using credentials you supply, and runs a sequence of declarative steps against them. There is no agent to deploy on the target — Attune logs in over the wire, runs commands, captures output, and disconnects.
A few concepts worth knowing before reading the rest of this document:
- Project — a self-contained bundle of files, parameters, and steps that gets imported into Attune. This repository is a project, exported in Attune's on-disk format.
- Parameter — a typed input slot that the operator fills in when planning a run. This project has two: the Windows target and the Windows credential.
- Step — a single unit of work, e.g. "push this file" or "run this PowerShell script". Each step has its own timeout, success criteria, and failure behaviour.
- Blueprint — a step group that orchestrates a set of child steps into a sequenced workflow. This project has one blueprint:
Office Deployment Tool Installation. - Plan — an instance of a blueprint with concrete parameter values, ready to run.
When Attune runs the blueprint, each step executes in declared order. If a step fails, the run halts (every step in this project is configured with actionOnStepFail: stop). Output from each step is captured in the Attune UI in real time with timestamps, exit codes, and stdout/stderr.
.
├── project/
│ ├── metadata.json Project identity (UUID, name, revision)
│ └── README.md One-line project description shown in Attune UI
├── parameters/
│ ├── windowscredential/ Type: Windows OS credential
│ └── windowsnode/ Type: Windows Server target
├── files/
│ ├── officedeploymenttool/ Microsoft's ODT self-extracting installer (~3.5 MB)
│ └── configurationxml/ Editable configuration.xml (versioned, templated)
└── steps/
├── officedeploymenttoolinstallation/ The blueprint (step group)
├── deploytheodtinstaller/ Step 1: push ODT installer
├── extractsetupexe/ Step 2: extract setup.exe
├── deployconfigurationxml/ Step 3: push configuration.xml
├── downloadoffice/ Step 4: download Office source
├── installoffice/ Step 5: install Office
├── verifyofficeinstallation/ Step 6: verify install via registry
└── officeinstallcleanup/ Step 7: remove staging directory
Each step folder contains a metadata.json describing the step type and configuration. PowerShell steps also include a script.txt with the actual code that gets executed on the target.
When you plan a run from this blueprint, Attune prompts for two values:
| Parameter | Type | Purpose |
|---|---|---|
Windows Node |
WindowsServer |
The Windows target machine where Office will be installed |
Windows Credential |
WinOsCred |
An administrator credential used to authenticate over WinRM |
The same node and credential are reused across every step in the blueprint. The account needs local administrator rights on the target — Office install writes to HKLM and C:\Program Files.
The official Microsoft Office Deployment Tool installer (officedeploymenttool_19929-20090.exe), shipped as part of the project so you don't have to download it at runtime. This is a self-extracting EXE that yields setup.exe and sample configuration XMLs when run with /extract.
To update the ODT to a newer Microsoft release:
- Download the latest ODT from Microsoft Download Center
- Replace
files/officedeploymenttool/content with the new EXE - Update
fileNameandmd5inmetadata.json - Update the
Start-Processfilename reference insteps/extractsetupexe/script.txt
The Office Deployment Tool's configuration.xml. This controls everything about the install — product, channel, architecture, language, which apps to include or exclude, and licensing properties.
The shipped configuration installs Office LTSC 2024 Volume, 64-bit, en-US, with everything excluded except Word and Excel:
<Configuration>
<Add SourcePath="C:\OfficeInstall" OfficeClientEdition="64" Channel="PerpetualVL2024">
<Product ID="ProPlus2024Volume" PIDKEY="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX">
<Language ID="en-us"/>
<ExcludeApp ID="Access"/>
<ExcludeApp ID="Bing"/>
<ExcludeApp ID="Groove"/>
<ExcludeApp ID="Lync"/>
<ExcludeApp ID="OneDrive"/>
<ExcludeApp ID="OneNote"/>
<ExcludeApp ID="Outlook"/>
<ExcludeApp ID="PowerPoint"/>
<ExcludeApp ID="Publisher"/>
<ExcludeApp ID="Teams"/>
</Product>
</Add>
<Display Level="None" AcceptEULA="TRUE"/>
<Property Name="AUTOACTIVATE" Value="0"/>
<Property Name="FORCEAPPSHUTDOWN" Value="TRUE"/>
<Property Name="SharedComputerLicensing" Value="0"/>
<RemoveMSI/>
</Configuration>You must edit this before running — the PIDKEY placeholder is not a valid product key. Replace it with a valid Office LTSC 2024 Volume key, or switch to Microsoft 365 Apps (see Customisation below).
The parent blueprint Office Deployment Tool Installation orchestrates seven sequential steps. Each step is documented below with its purpose, type, timeout, and behaviour.
- Type:
StepPushDesignFileTuple(file push) - Source:
files/officedeploymenttool/officedeploymenttool_19929-20090.exe - Destination:
\\<target>\C$\OfficeInstall\officedeploymenttool_19929-20090.exe
Attune copies the ODT installer EXE from the project archive to the target's C:\OfficeInstall\ directory over an administrative SMB share, authenticated by the supplied Windows credential. The directory is created if it doesn't exist.
- Type: PowerShell over WinRM
- Timeout: 60 seconds
Runs the ODT installer's /extract switch to unpack setup.exe and a sample configuration.xml from the self-extracting archive:
Start-Process -FilePath 'C:\OfficeInstall\officedeploymenttool_19929-20090.exe' `
-ArgumentList '/extract:C:\OfficeInstall', '/quiet' -WaitAfter this step, C:\OfficeInstall\setup.exe exists on the target.
- Type:
StepPushDesignFileCompiledTuple(templated file push) - Source:
files/configurationxml/contents/configuration.xml - Destination:
\\<target>\C$\OfficeInstall\configuration.xml
Pushes the project's configuration.xml to the target. This is a compiled file push, meaning Attune can substitute Mako template variables before delivering (no substitutions are configured in this project but the capability is there for future extension).
After this step, both setup.exe and configuration.xml are present on the target — ready for ODT to do its work.
- Type: PowerShell over WinRM
- Timeout: 600 seconds (10 minutes)
This is the longest step and the most operationally interesting. It runs setup.exe /download configuration.xml to fetch ~2.8 GB of Office source binaries from Microsoft's CDN to C:\OfficeInstall\Office\Data\.
The script implements filesystem-based completion detection rather than waiting for setup.exe to exit. This is necessary because:
setup.exeis a launcher. The actual download work is done by theClickToRunSvcWindows service.- After the download completes,
setup.execan sit idle for many minutes (or hang indefinitely) before exiting cleanly. Start-Process -Waittherefore can't be trusted as a completion signal.
The script's algorithm:
- Start
setup.exe /downloadand keep a handle to the process - Poll the size of
C:\OfficeInstall\Office\Data\every 15 seconds - While the size is growing, log progress and reset the stability counter
- Once the size exceeds 2 GB (the minimum size of a real Office download) and stays unchanged for 6 consecutive polls (90 seconds of stability), declare the download complete
- Forcibly terminate the
setup.exeprocess and proceed to the next step
The 2 GB floor exists to reject false positives early in the download — there's a legitimate setup-phase pause around the 40-50 MB mark while the click-to-run service prepares for the main transfer, and an earlier version of this script terminated prematurely during that pause.
Log output looks like:
[2026-05-29 14:23:15] Downloading - 0.04 GB
[2026-05-29 14:23:30] Size 0.04 GB below 2 GB minimum - still waiting
[2026-05-29 14:24:00] Downloading - 0.52 GB
[2026-05-29 14:28:45] Downloading - 2.81 GB
[2026-05-29 14:29:00] Size stable at 2.81 GB (1/6)
...
[2026-05-29 14:30:30] Size stable at 2.81 GB (6/6)
[2026-05-29 14:30:30] Download complete - terminating setup.exe
- Type: PowerShell over WinRM
- Timeout: 600 seconds
Runs setup.exe /configure configuration.xml to install Office from the local source files staged in step 4. Unlike /download, the /configure invocation exits cleanly when the install finishes, so this step can use the standard Start-Process -Wait pattern.
The script is a PowerShell class (OfficeInstaller) with two methods:
validate()— verifiessetup.exe,configuration.xml, andOffice\Data\all exist before attempting install. Fails fast with a clear error if any are missing.install()— invokessetup.exe /configure, waits for completion, and checks the exit code.
A non-zero exit code from setup.exe fails the step and halts the blueprint.
- Type: PowerShell over WinRM
- Timeout: 60 seconds
Confirms the install registered correctly by reading the Click-to-Run configuration registry key:
HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\ConfigurationIf the key exists and VersionToReport is populated, the install is considered successful and the version is logged. Otherwise the step fails.
This step exists because setup.exe /configure can sometimes report success at the process level while leaving Office in an incomplete state. The registry check is the definitive signal that Office is actually installed and registered with Windows.
- Type: PowerShell over WinRM
- Timeout: 60 seconds
Removes C:\OfficeInstall\ recursively, reclaiming the ~3 GB of staging space used by the source binaries. The Office install itself lives under C:\Program Files\Microsoft Office\ and is unaffected.
If the directory is already absent (e.g. a previous run cleaned up), the step succeeds without doing anything.
To run this project you need:
- An Attune instance reachable from your workstation
- A Windows target running Windows 10/11 or Windows Server 2016+ with:
- WinRM enabled and reachable from the Attune server
- At least 8 GB free disk on
C:(3 GB for source, ~3 GB for the install, plus headroom) - Internet access to
officecdn.microsoft.com(required for the Download step) - No existing Click-to-Run Office install (or be prepared for it to be upgraded/replaced)
- A Windows administrator credential on the target, registered in Attune
- A valid Office LTSC 2024 Volume PIDKEY (or modify
configuration.xmlto use a different licensing model — see Customisation)
In the Attune UI, import this repository. The project will appear in the Designer with all parameters, files, and steps populated.
Open files/configurationxml/contents/configuration.xml and replace the PIDKEY placeholder with your actual Office LTSC 2024 Volume key, or change product/channel for a different edition (see Customisation).
In the Plan view, create a new plan from the Office Deployment Tool Installation blueprint. Attune prompts for:
- Windows Node — pick the target machine
- Windows Credential — pick the credential to authenticate with
Start the plan. Watch progress in real time as each of the seven steps executes. Total runtime is typically 15-25 minutes end to end, dominated by the download and install phases. The download time varies with network speed to Microsoft's CDN.
When the plan completes, log in to the target and confirm Word and Excel are installed and launch correctly. The "Verify Office Installation" step has already done this programmatically.
Replace the <Add> block in configuration.xml:
<Add SourcePath="C:\OfficeInstall" OfficeClientEdition="64" Channel="Current">
<Product ID="O365ProPlusRetail">
<Language ID="en-us"/>
<!-- ExcludeApp tags as needed -->
</Product>
</Add>Drop the PIDKEY attribute (Microsoft 365 Apps activates by user sign-in) and remove the <RemoveMSI/> line.
Use <ExcludeApp> to suppress apps you don't want. The shipped config installs only Word and Excel; remove <ExcludeApp ID="Outlook"/> (for example) to also install Outlook.
Note:
<ExcludeApp>controls what installs, not what downloads. Microsoft ships a monolithic ~2.8 GB source bundle regardless of which apps you exclude. There's no way to make the download smaller via configuration.
Replace <Language ID="en-us"/> with the IETF tag of your preferred language (e.g. de-de, fr-fr, ja-jp). Add multiple <Language> tags for multi-language installs (each adds ~370 MB to the download).
Microsoft releases new ODT builds periodically. To update:
- Download the latest ODT EXE from Microsoft Download Center
- Replace the binary in
files/officedeploymenttool/ - Update
fileName,md5, andsizeinfiles/officedeploymenttool/metadata.json - Update the filename reference in
steps/extractsetupexe/script.txt
The two longest steps (Download Office and Install Office) are configured with 600-second (10-minute) timeouts. On constrained networks the download can take longer than this — if you see the download step timeout while progress logs show active downloading, increase the timeout value in steps/downloadoffice/metadata.json.
The target needs ~6 GB free during the run: ~3 GB for the staged source and ~3 GB for the installed product. After the cleanup step the source is removed, leaving only the install footprint.
The blueprint is idempotent in the sense that re-running it against a target that already has Office will trigger ODT to repair / update / reconfigure the install according to the current configuration.xml. It will not produce side effects on a healthy install.
Step 4 requires the target to reach officecdn.microsoft.com over HTTPS. For air-gapped environments, modify the blueprint to ship the pre-downloaded Office\Data\ tree as an additional project file and remove the download step — the install step will then read from the local source without needing internet.
The Download Office step completes too quickly (under 2 minutes) with a tiny final size
The completion detection threshold has been tripped prematurely. Increase stableChecksRequired in steps/downloadoffice/script.txt from 6 to 10 or higher to require a longer stable window.
The Download Office step hits the 600s timeout
Either the download is genuinely slow (slow WAN, throttled proxy) or stalled. Check the log output — if size is still growing at the end, increase the step timeout. If size is flat well below 2 GB, investigate network or proxy issues from the target to officecdn.microsoft.com.
Verify Office Installation fails with "configuration key not found"
The install step exited 0 but Office isn't actually registered. This usually means the install was interrupted or configuration.xml referenced a product/channel combination that isn't valid. Check the install step's log for ODT errors, and review the Microsoft Click-to-Run logs at C:\Windows\Temp\ on the target.
Step 4 succeeds but Step 5 fails with "Office source not found"
The Download step's completion detection terminated setup.exe while the ClickToRunSvc was still finishing — but the install step ran before the service caught up. Re-run; or set a higher stableChecksRequired value to force a longer wait.
This project is published as-is for reference and reuse. The Office Deployment Tool, configuration.xml schema, and Microsoft Office itself are Microsoft products subject to Microsoft's own licensing terms.