Embedded Word Templates - Clients on external networks to reject immediately

[kalyanram.piratla]

Hi Guys

Wondering if anyone has any ideas on;

There are external clients / users attempting to open word documents that use word templates stored on the corporate network drive.  When the user is offsite and not connected to Global Protect or VPN and the user attempts to open the document, Word will attempt to open the template on the network drive and continue to do so for several minutes before giving up and eventually opening the file.

For example when I open a word document that contains an embedded template, it will try and download the template from \\abc.com\applications\common\office templates\ABC templates which will cause a DNS lookup of abc.com which returns a public address on my network and therefore hits the PA.

Is there any way / guidance on how we can get the firewall to reject the requests to connect to the template and therefore cause word to open the file immediately? I have tried putting in rules to reject / drop / reset when an external client tries to connect via SMB to the IPs that \\abc.com resolves to but this does not appear to work.

Any thoughts on this will be greatly appreciated.

Thanks in advance.

KP

[BPry]

This would be more of an issue with Word than your PA. 

Go to HKEY_CURRENT_USER\Software\Microsoft\Office\*\Word\Options (* is whatever version you are using)

create a new DWORD value called "UseTimeoutForAttachedTemplateLoad"

Give it a value of "1"  (The value is milliseconds, so set it accordingly. If you have users that actually do open the VPN I would give it something like 3000 to actually give it 3 seconds to respond) 

Exit Regedit and probably restart just to be sure and give it a go.

You probably can't do this on clients machines, but without a timeout set it really doesn't matter if your PA sends a reset packet to the other end, as Word wont be "listening" for one for lack of a better term. 

[kalyanram.piratla]

Thanks for your input - I did look at this option, but trying to understand how this can be achieved at a larger scale as there will be plenty of users external to the network who can have access to loads of templates stored on the shared drive.

[BPry]

The only way you could do this on external clients would be to remove any reference to the shared drive. All the solutions that we could possibly provide you would require that you modify something on the users computer; if you can't do that then you would need to remove the template that is linked to the external location all together.