MICROSOFT OFFICE ADD-IN MONITORCradle to Deployment

Matt KramerDirector of Information Technologymkramer@bernsteinshur.comBERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH Member, Lex Mundi, the world's leading association of independent law firms.

WHAT’S THE BIG DEALOffice Applications Frequently have a large number of 3rd party plug-ins to extend functionality:

Screenshot:Outlook Lists16 loadedAdd-ins!!

WHAT’S THE BIG DEALScreenshot of Word Add-Ins Lists 31 Add-Ins!!!

OFFICE EXTENSIBILITY Microsoft Office can be extended in many ways

Add-Ins (DotNet and COM) Templates XML VBA

Various plugins share a common foundation Outlook Redemption.dll VSTO Office PIA

OFFICE EXTENSIBILITYAll of this leads to tremendous flexibility…

and instability…and…

Help Desk Tickets…and…

Unhappy Clients…Which leads us to…

Office Add-In Monitor

WHAT IS IT?Office Add-In Monitor:

Prevents disabling of 3rd Party Plugins to Office Works with Office 2010 and Office 2007 Runs on W7 (x64),XP, and Citrix. Lightweight C# Application Always on in System Tray Currently Protects:

Outlook Word Excel PowerPoint

HOW DOES IT WORK?Office constantly writes random values to registry when an add-in is “active”

The Monitor “subscribes”to registry write events and deletes them when a match is found.

DEMO TIME…

DEPLOYMENT - APPDeploy via GPO:

DEPLOYMENT – REGISTRY Application Controlled by Registry Keys:

Checks for values in:HKCU\Software\Policies\AddInMon HKCU\Software\AddInMon

Supported Values:Debug REG_DWORD 0x1

Writes Log to %TEMP%\AddInMonDebug.txtRegEx REG_SZ

Specify Add-ins to protect, Separated via | “pipe” symbol

DEPLOYMENT – REGISTRYDeploy via GPO:

DEVELOPMENTVisual Studio 2010 C# Major Components

Allow only one instance of application to run.Load to System TrayMonitor Registry Writes for OfficeDelete Registry Keys by RegEx Pattern MatchingEase of DeploymentControl Program by Group Policy Registry Keys

DEVELOPMENTAllow only one application instance

bool isNew;

Mutex mutex = new Mutex(true, Application.ProductName, out isNew);

if (isNew){ Application.EnableVisualStyles(); Application.SetCompatibleTextRenderingDefault(false); Application.Run(new Form1()); mutex.ReleaseMutex();}

DEVELOPMENTMonitor For Registry Events Example: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

//Build Query for Registry Keys We Want To MonitorWqlEventQuery query = new WqlEventQuery("SELECT * FROM RegistryTreeChangeEvent WHERE" + "Hive = 'HKEY_USERS' " + @"AND (RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Word' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Outlook' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\PowerPoint' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Excel')");

//Active the watcher for the specified registry keyswatcher = new ManagementEventWatcher(query);

//Call HandleEvent whenever a new registry value is receivedwatcher.EventArrived += new EventArrivedEventHandler(HandleEvent);

DEVELOPMENTHide Form on Application Startup

//Hide the form on initial startup protected override void SetVisibleCore(bool value) { base.SetVisibleCore(allowshowdisplay ? value : allowshowdisplay); if (firstLoad == false) { LoadProgram(); firstLoad = true; } }

DEVELOPMENTLoad Application from Tray Icon

//If the form is minimized then hide it and rely on the tray icon private void Form1_Resize(object sender, EventArgs e) { if (WindowState == FormWindowState.Minimized) { this.Hide(); this.ShowInTaskbar = false; }

}

//Open the form if the tray icon is double clicked private void notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e) { LoadFromTray(); }

QUESTIONS? Go forth and protect your add-ins…

https://addinmon.codeplex.com/

Check www.iltanet.org for a copy of this PowerPoint and audio recording

Matt KramerDirector of Information Technologymkramer@bernsteinshur.comBERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH Member, Lex Mundi, the world's leading association of independent law firms.