MICROSOFT OFFICE ADD-IN MONITOR Cradle to Deployment Matt Kramer Director of Information Technology...

MICROSOFT OFFICE ADD-IN MONITOR

Cradle to Deployment

Matt KramerDirector of Information Technologymkramer@bernsteinshur.comBERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH Member, Lex Mundi, the world's leading association of independent law firms.

WHAT’S THE BIG DEAL

Office Applications Frequently have a large number of 3rd party plug-ins to extend functionality:

Screenshot:

Outlook

Lists

16 loaded

Add-ins!!

WHAT’S THE BIG DEALScreenshot of Word Add-Ins Lists 31 Add-Ins!!!

OFFICE EXTENSIBILITY

Microsoft Office can be extended in many ways

Add-Ins (DotNet and COM) Templates XML VBA

Various plugins share a common foundation

Outlook Redemption.dll VSTO Office PIA

OFFICE EXTENSIBILITY

All of this leads to tremendous flexibility…

and instability…and…

Help Desk Tickets…and…

Unhappy Clients…

Which leads us to…

Office Add-In Monitor

WHAT IS IT?Office Add-In Monitor:

Prevents disabling of 3rd Party Plugins to Office Works with Office 2010 and Office 2007 Runs on W7 (x64),XP, and Citrix. Lightweight C# Application Always on in System Tray Currently Protects:

Outlook Word Excel PowerPoint

HOW DOES IT WORK?Office constantly writes

random values to registry

when an add-in is “active”

The Monitor “subscribes”

to registry write events

and deletes them when a

match is found.

DEMO TIME…

DEPLOYMENT - APP

Deploy via GPO:

DEPLOYMENT – REGISTRY

Application Controlled by Registry Keys:

Checks for values in:HKCU\Software\Policies\AddInMon HKCU\Software\AddInMon

Supported Values:Debug REG_DWORD 0x1

Writes Log to %TEMP%\AddInMonDebug.txtRegEx REG_SZ

Specify Add-ins to protect, Separated via | “pipe” symbol

DEPLOYMENT – REGISTRY

Deploy via GPO:

DEVELOPMENT

Visual Studio 2010 C# Major Components

Allow only one instance of application to run.Load to System TrayMonitor Registry Writes for OfficeDelete Registry Keys by RegEx Pattern MatchingEase of DeploymentControl Program by Group Policy Registry Keys

DEVELOPMENT

Allow only one application instance

bool isNew;

Mutex mutex = new Mutex(true, Application.ProductName, out isNew);

if (isNew){ Application.EnableVisualStyles(); Application.SetCompatibleTextRenderingDefault(false); Application.Run(new Form1()); mutex.ReleaseMutex();}

DEVELOPMENT

Monitor For Registry Events Example: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

//Build Query for Registry Keys We Want To MonitorWqlEventQuery query = new WqlEventQuery("SELECT * FROM RegistryTreeChangeEvent WHERE" + "Hive = 'HKEY_USERS' " + @"AND (RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Word' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Outlook' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\PowerPoint' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Excel')");

//Active the watcher for the specified registry keyswatcher = new ManagementEventWatcher(query);

//Call HandleEvent whenever a new registry value is receivedwatcher.EventArrived += new EventArrivedEventHandler(HandleEvent);

DEVELOPMENT

Hide Form on Application Startup

//Hide the form on initial startup protected override void SetVisibleCore(bool value) { base.SetVisibleCore(allowshowdisplay ? value : allowshowdisplay); if (firstLoad == false) { LoadProgram(); firstLoad = true; } }

DEVELOPMENT

Load Application from Tray Icon

//If the form is minimized then hide it and rely on the tray icon private void Form1_Resize(object sender, EventArgs e) { if (WindowState == FormWindowState.Minimized) { this.Hide(); this.ShowInTaskbar = false; }

}

//Open the form if the tray icon is double clicked private void notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e) { LoadFromTray(); }

QUESTIONS?

Go forth and protect your add-ins…

https://addinmon.codeplex.com/

Check www.iltanet.org for a copy of this PowerPoint and audio recording

Matt KramerDirector of Information Technologymkramer@bernsteinshur.com

BERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH Member, Lex Mundi, the world's leading association of independent law firms.