1. MICROSOFT OFFICE ADD-IN MONITOR Cradle to Deployment Matt Kramer Director of Information Technology mkramer@bernsteinshur.com BERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH Member, Lex Mundi, the world's leading association of independent law firms.

2. WHAT’S THE BIG DEAL Office Applications Frequently have a large number of 3 rd party plug-ins to extend functionality: Screenshot: Outlook Lists 16 loaded Add-ins!!

3. WHAT’S THE BIG DEAL Screenshot of Word Add-Ins Lists 31 Add-Ins!!!

4. OFFICE EXTENSIBILITY  Microsoft Office can be extended in many ways  Add-Ins (DotNet and COM)  Templates  XML  VBA  Various plugins share a common foundation  Outlook Redemption.dll  VSTO  Office PIA

5. OFFICE EXTENSIBILITY All of this leads to tremendous flexibility… and instability… and… Help Desk Tickets… and… Unhappy Clients… Which leads us to… Office Add-In Monitor

6. WHAT IS IT?  Office Add-In Monitor:  Prevents disabling of 3 rd Party Plugins to Office  Works with Office 2010 and Office 2007  Runs on W7 (x64),XP, and Citrix.  Lightweight C# Application  Always on in System Tray  Currently Protects:  Outlook  Word  Excel  PowerPoint

7. HOW DOES IT WORK? Office constantly writes random values to registry when an add-in is “active” The Monitor “subscribes” to registry write events and deletes them when a match is found.

8. DEMO TIME…

9. DEPLOYMENT - APP Deploy via GPO:

10. DEPLOYMENT – REGISTRY  Application Controlled by Registry Keys:  Checks for values in:  HKCU\Software\Policies\AddInMon  HKCU\Software\AddInMon  Supported Values:  Debug REG_DWORD 0x1  Writes Log to %TEMP%\AddInMonDebug.txt  RegEx REG_SZ  Specify Add-ins to protect,  Separated via | “pipe” symbol

11. DEPLOYMENT – REGISTRY Deploy via GPO:

12. DEVELOPMENT Visual Studio 2010 C#  Major Components  Allow only one instance of application to run.  Load to System Tray  Monitor Registry Writes for Office  Delete Registry Keys by RegEx Pattern Matching  Ease of Deployment  Control Program by Group Policy Registry Keys

13. DEVELOPMENT Allow only one application instance bool isNew; Mutex mutex = new Mutex(true, Application.ProductName, out isNew); if (isNew) { Application.EnableVisualStyles(); Application.SetCompatibleTextRenderingDefault(false); Application.Run(new Form1()); mutex.ReleaseMutex(); }

14. DEVELOPMENT Monitor For Registry Events Example: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word //Build Query for Registry Keys We Want To Monitor WqlEventQuery query = new WqlEventQuery("SELECT * FROM RegistryTreeChangeEvent WHERE" + "Hive = 'HKEY_USERS' " + @"AND ( RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Word' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Outlook' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\PowerPoint' or RootPath = '" + userName + @"\\Software\\Microsoft\\Office\\" + ver + @"\\Excel')"); //Active the watcher for the specified registry keys watcher = new ManagementEventWatcher(query); //Call HandleEvent whenever a new registry value is received watcher.EventArrived += new EventArrivedEventHandler(HandleEvent);

15. DEVELOPMENT Hide Form on Application Startup //Hide the form on initial startup protected override void SetVisibleCore(bool value) { base.SetVisibleCore(allowshowdisplay ? value : allowshowdisplay); if (firstLoad == false) { LoadProgram(); firstLoad = true; }

16. DEVELOPMENT Load Application from Tray Icon //If the form is minimized then hide it and rely on the tray icon private void Form1_Resize(object sender, EventArgs e) { if (WindowState == FormWindowState.Minimized) { this.Hide(); this.ShowInTaskbar = false; } //Open the form if the tray icon is double clicked private void notifyIcon1_MouseDoubleClick(object sender, MouseEventArgs e) { LoadFromTray(); }

17. QUESTIONS?  Go forth and protect your add-ins… https://addinmon.codeplex.com/  Check www.iltanet.org for a copy of this PowerPoint and audio recordingwww.iltanet.org Matt Kramer Director of Information Technology mkramer@bernsteinshur.com BERNSTEIN SHUR | Portland, ME | Augusta, ME | Manchester, NH Member, Lex Mundi, the world's leading association of independent law firms.