Transcript Office Add-In Monitor

MICROSOFT OFFICE
ADD-IN MONITOR
Cradle to Deployment
Matt Kramer
Director of Information Technology
[email protected]
BERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH
Member, Lex Mundi, the world's leading association of independent law firms.
WHAT’S THE BIG DEAL
Office Applications Frequently have a large number of 3rd
party plug-ins to extend functionality:
Screenshot:
Outlook
Lists
16 loaded
Add-ins!!
WHAT’S THE BIG DEAL
Screenshot of Word Add-Ins Lists 31 Add-Ins!!!
OFFICE
EXTENSIBILITY
 Microsoft Office can be extended in many ways
 Add-Ins (DotNet and COM)
 Templates
 XML
 VBA
 Various plugins share a common foundation
 Outlook Redemption.dll
 VSTO
 Office PIA
OFFICE
EXTENSIBILITY
All of this leads to tremendous flexibility…
and instability…
and…
Help Desk Tickets…
and…
Unhappy Clients…
Which leads us to…
Office Add-In Monitor
WHAT IS IT?
Office Add-In Monitor:
 Prevents disabling of 3rd Party Plugins to Office
 Works with Office 2010 and Office 2007
 Runs on W7 (x64),XP, and Citrix.
 Lightweight C# Application
 Always on in System Tray
 Currently Protects:
 Outlook
 Word
 Excel
 PowerPoint
HOW DOES IT WORK?
Office constantly writes
random values to registry
when an add-in is “active”
The Monitor “subscribes”
to registry write events
and deletes them when a
match is found.
DEMO TIME…
DEPLOYMENT - APP
Deploy via GPO:
DEPLOYMENT – REGISTRY
 Application Controlled by Registry Keys:
Checks for values in:
HKCU\Software\Policies\AddInMon
HKCU\Software\AddInMon
Supported Values:
Debug REG_DWORD 0x1
Writes Log to %TEMP%\AddInMonDebug.txt
RegEx REG_SZ
Specify Add-ins to protect,
Separated via | “pipe” symbol
DEPLOYMENT – REGISTRY
Deploy via GPO:
DEVELOPMENT
Visual Studio 2010 C#
 Major Components
Allow only one instance of application to run.
Load to System Tray
Monitor Registry Writes for Office
Delete Registry Keys by RegEx Pattern Matching
Ease of Deployment
Control Program by Group Policy Registry Keys
DEVELOPMENT
Allow only one application instance
bool isNew;
Mutex mutex = new Mutex(true, Application.ProductName, out isNew);
if (isNew)
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new Form1());
mutex.ReleaseMutex();
}
DEVELOPMENT
Monitor For Registry Events
Example: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
//Build Query for Registry Keys We Want To Monitor
WqlEventQuery query = new WqlEventQuery("SELECT * FROM RegistryTreeChangeEvent WHERE"
+ "Hive = 'HKEY_USERS' " + @"AND (
RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Word' or
RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Outlook' or
RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\PowerPoint' or
RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Excel')");
//Active the watcher for the specified registry keys
watcher = new ManagementEventWatcher(query);
//Call HandleEvent whenever a new registry value is received
watcher.EventArrived += new EventArrivedEventHandler(HandleEvent);
DEVELOPMENT
Hide Form on Application Startup
//Hide the form on initial startup
protected override void SetVisibleCore(bool value)
{
base.SetVisibleCore(allowshowdisplay ? value : allowshowdisplay);
if (firstLoad == false)
{
LoadProgram();
firstLoad = true;
}
}
DEVELOPMENT
Load Application from Tray Icon
//If the form is minimized then hide it and rely on the tray icon
private void Form1_Resize(object sender, EventArgs e)
{
if (WindowState == FormWindowState.Minimized)
{
this.Hide();
this.ShowInTaskbar = false;
}
}
//Open the form if the tray icon is double clicked
private void notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e)
{
LoadFromTray();
}
QUESTIONS?

Go forth and protect your add-ins…
https://addinmon.codeplex.com/

Check www.iltanet.org for a copy of this
PowerPoint and audio recording
Matt Kramer
Director of Information Technology
[email protected]
BERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH
Member, Lex Mundi, the world's leading association of independent law firms.