Microsoft Office Add-In Monitor

1. Microsoft Office Add-In Monitor Cradle to Deployment

2. What’s the big Deal • Office Applications Frequently have a large number of 3rd party plug-ins to extend functionality: • Screenshot: • Outlook • Lists • 16 loaded • Add-ins!!

3. What’s the big Deal • Screenshot of Word Add-Ins Lists 31 Add-Ins!!!

4. Office Extensibility • Microsoft Office can be extended in many ways • Add-Ins (DotNet and COM) • Templates • XML • VBA • Various plugins share a common foundation • Outlook Redemption.dll • VSTO • Office PIA

5. Office Extensibility All of this leads to tremendous flexibility… and instability… and… Help Desk Tickets… and… Unhappy Clients… Which leads us to… Office Add-In Monitor

6. What is IT? • Office Add-In Monitor: • Prevents disabling of 3rd Party Plugins to Office • Works with Office 2010 and Office 2007 • Runs on W7 (x64),XP, and Citrix. • Lightweight C# Application • Always on in System Tray • Currently Protects: • Outlook • Word • Excel • PowerPoint

7. How Does IT Work? • Office constantly writes • random values to registry • when an add-in is “active” • The Monitor “subscribes” • to registry write events • and deletes them when a • match is found.

8. Demo Time…

9. Deployment - App • Deploy via GPO:

10. Deployment – REGISTRY • Application Controlled by Registry Keys: • Checks for values in: • HKCU\Software\Policies\AddInMon • HKCU\Software\AddInMon • Supported Values: • Debug REG_DWORD 0x1 • Writes Log to %TEMP%\AddInMonDebug.txt • RegExREG_SZ • Specify Add-ins to protect, • Separated via | “pipe” symbol

11. Deployment – REGISTRY • Deploy via GPO:

12. Development • Visual Studio 2010 C# • Major Components • Allow only one instance of application to run. • Load to System Tray • Monitor Registry Writes for Office • Delete Registry Keys by RegEx Pattern Matching • Ease of Deployment • Control Program by Group Policy Registry Keys

13. Development • Allow only one application instance boolisNew; Mutexmutex = newMutex(true, Application.ProductName, outisNew); if(isNew) { Application.EnableVisualStyles(); Application.SetCompatibleTextRenderingDefault(false); Application.Run(newForm1()); mutex.ReleaseMutex(); }

14. Development • Monitor For Registry Events • Example: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word //Build Query for Registry Keys We Want To Monitor WqlEventQueryquery = newWqlEventQuery("SELECT * FROM RegistryTreeChangeEventWHERE" + "Hive = 'HKEY_USERS' "+ @"AND ( RootPath= '" + userName+ @"\\Software\\Microsoft\\Office\\" + ver + @"\\Word' or RootPath= '" + userName+ @"\\Software\\Microsoft\\Office\\" + ver + @"\\Outlook' or RootPath = '" + userName+ @"\\Software\\Microsoft\\Office\\" + ver + @"\\PowerPoint' or RootPath= '" + userName+ @"\\Software\\Microsoft\\Office\\" + ver + @"\\Excel')"); //Active the watcher for the specified registry keys watcher = newManagementEventWatcher(query); //Call HandleEvent whenever a new registry value is received watcher.EventArrived+= newEventArrivedEventHandler(HandleEvent);

15. Development • Hide Form on Application Startup //Hide the form on initial startup protectedoverridevoidSetVisibleCore(bool value) { base.SetVisibleCore(allowshowdisplay ? value : allowshowdisplay); if (firstLoad == false) { LoadProgram(); firstLoad = true; } }

16. Development • Load Application from Tray Icon //If the form is minimized then hide it and rely on the tray icon privatevoid Form1_Resize(object sender, EventArgs e) { if (WindowState == FormWindowState.Minimized) { this.Hide(); this.ShowInTaskbar = false; } } //Open the form if the tray icon is double clicked privatevoid notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e) { LoadFromTray(); }

17. Questions? • Go forth and protect your add-ins… • https://addinmon.codeplex.com/ • Check www.iltanet.org for a copy of this PowerPoint and audio recording • Matt KramerDirector of Information Technologymkramer@bernsteinshur.comBERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH • Member, Lex Mundi, the world's leading association of independent law firms.