Office Add-ins

[roandr]

We have a GPO that blocks all unmanaged add-ins (Office 2013), for all users.

I need to give a few users access to an Excel add-in and I would like to do this with UEM if possible.

I've attached a PDF that explains how the add-in works.

How do I go about making this add-in accessible for a few users with the help of UEM?

Regards

Ronny

[ijdemes]

There are multiple ways of doing it. But I would use a predefined setting for that and use a condition (i.e. Group Membership) for applying the predefined setting. You can either apply it as:

* Default Settings --> Applied if no user profile archive exists

* Partially Enforced Settings --> Applied always, after import of user profile archive

* Default Settings with Partial Enforcement --> Combination of above two settings

* Fully Enforced Settings --> Applied always

You have to look which type suits best for your situation.

Here's an example we are using at a customer:

Does this answer your question?

[roandr]

Thank you for your quick response Ivan!

I see now that my question was badly formulated. I'll try to explain it better.

The users in question are using Office 2013 x86. The plugin was installed manually, by running an installer downloaded from their site, so the registry entries for the OSRFunctions (described in the attached PDF) are there.

When it comes to the keys/values for the HKCU part of the hive I don't know if I'm importing them to the correct key or if my problem have something to do with the GPO that blocks all unmanaged add-ins. Since all users are not supposed to get this add-in I can't just disable the GPO either?

If I could use UEM to inject keys and values into the users HKCU\Software\Policies tree I think the solution would be simpler. I don't know how to do that and I'm not sure I should either (since that tree is used for GPO settings).

Basically the GPO injects the users hive [HKCU\Software\Policies\Microsoft\office\15.0\excel\resiliency] with the value restricttolist=1 and as far as I know this blocks Excel from running any add-in unless it's managed as described in: http://https://support.microsoft.com/en-us/help/2733070/no-add-ins-loaded-due-to-group-policy-settin...

I've tried injecting the users hive with, the HKCU values from the attached PDF in original post, both at [HKCU\Software\Wow6432Node\Office\Excel\Addins] and [HKCU\Software\Office\Excel\Addins]. I'm doing this with User Environment > Registry Settings.

I've checked and these values are injected as expected but Excel still doesn't want to load the add-in:

"The add-in you have selected is disabled by your system administrator"

[ijdemes]

I believe that the key from your registry file:

[HKEY_CURRENT_USER\Software\Wow6432Node\Microsoft\Office\15.0\Excel\Resiliency\AddinList]

should be

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\Excel\Resiliency\AddinList]

If I read the documentation correctly

The rest of the configuration in the registry file seems correct.

[Pim_van_de_Vis]

UEM cannot edit the regsitry keys and values under HKCU/Software/Policies, since that location is protected and can only be edited by GPO or system management.

However since you use a USER GPO to limit the Office template, why not move that GPO to UEM and let UEM apply that GPO using the 'ADMX based settings'?

Use a condition on that ADMX based setting to only apply to the users that need the limitation and all other users can still use the office plugin.

[ijdemes · Accepted solution]

I agree with Pim. I wasn't really clear about the HKCU\Software\Policies registry key.

You can add the excel15.admx to UEM's ADMX-based settings using "Manage Templates". After that create a new ADMX-based Settings and click "Select Categories".

Choose "Miscellaneous" (see picture).

Click "Edit policies".

Enable "List of managed add-ins" and click "Show" to add "OneStop.ReportDesigner" with a value of 1

Using the "Conditions" tab you can choose which users/groups receive this policy setting.

This should result in the GPO for disabling the add-ins being applied to all users and for those users that need the managed add-in for OneStop.ReportDesigner an exception is made by the ADMX-based settings.

You can also consider moving the other user based GPO settings to UEM (ADMX-based settings) like Pim already suggested.

[roandr]

Oh, that looks promising. I was not aware of this feature. I have to play around with this a lot more it seems.

I've setup ADMX-based settings as described by ijdemes above. I've checked and these settings are indeed being written to the USERs hive as expected:

and the ribbon part of the Add-in have been written to the users hive as well:

But the add-in is still listed as deactivated in Excel:

... and I'm not able to start it either. Same as before:

What am I missing?

EDIT: I noticed I had been using the wrong ProgID. Should be OneStop.ReportDesigner and not OneStop.Reporting. Changed this but still no go. The screenshots above still shows the wrong ProgID though.

EDIT2: I'm such an idiot. I spelled OneStop.ReportDesigner wrong. Changed it again and now the add-in is loading.

[roandr]

Excel is now loading the Add-in but I'm getting the following from Microsoft Office Customization Installer:

How do I solve this with UEM?

Note: Should I make a new thread for this?

[Pim_van_de_Vis]

This has to do with TRUST settings.

Probably one of these TechNet articles can help you configure the right GPO setting. This can be done with the UEM ADMX based settings.

Configure security by using OCT or Group Policy for Office 2013

Plan and configure Trusted Locations settings for Office 2013

[roandr]

Thank you for your help Pim_van_de_Vis. Put me on the right track.

Had a hard time figuring out how to do this with "ADMX-based settings" only so ended up with a combination of "ADMX-based settings" and "Registry settings".

For the sake of posterity:

The ADMX-based settings:

A lot of the settings are imported with USER ENVIRONMENT > Registry Settings

With the help of Regshot I found a few more keys than what was listed in the install doc. Feels like a dirty reg hack since I did not get the time to test these values properly... some of these might be redundant or not needed.

[HKCU\Software\Wow6432Node\Microsoft\Office\Excel\Addins\OneStop.ReportDesigner]

"Manifest"="C:\\Program Files\\OneStop Reporting\\Report Designer\\ReportDesigner\\OneStop.ReportDesigner.vsto|vstolocal"

"LoadBehavior"=dword:00000003

"FriendlyName"="OSR Report Designer 5 32-bit"

"Description"="Reporting - Budgeting - Analysis"

[HKCU\SOFTWARE\OneStop Reporting\{3A6CC65F-1AA9-46C5-BA3E-68B58583B352}]

"BITNESSOVERRIDE"="x86"

[HKCU\SOFTWARE\Classes\osr-launch]

@="URL:OSR Launcher"

"URL Protocol"=""

[HKCU\SOFTWARE\Classes\osr-launch\DefaultIcon]

@="\"C:\\Program Files\\OneStop Reporting\\Report Designer\\DesktopLauncher\\DesktopLauncher.exe\",0"

[HKCU\SOFTWARE\Classes\osr-launch\shell]

[HKCU\SOFTWARE\Classes\osr-launch\shell\open]

[HKCU\SOFTWARE\Classes\osr-launch\shell\open\command]

@="\"C:\\Program Files\\OneStop Reporting\\Report Designer\\DesktopLauncher\\DesktopLauncher.exe\" \"%1\""

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}]

@="OneStop Reporting Functions"

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}\Implemented Categories]

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}]

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}\InprocServer32]

"Assembly"="OneStop.OSRFunctions, Version=3.3.0.0, Culture=neutral, PublicKeyToken=null"

"CodeBase"="file:///C:\\Program Files\\OneStop Reporting\\Report Designer\\ReportDesigner\\OneStop.OSRFunctions.dll"

"RuntimeVersion"="v4.0.30319"

"Class"="OneStop.ReportPlayer.OSRFunctions"

@="C:\\Windows\\SysWOW64\\mscoree.dll"

"ThreadingModel"="Both"

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}\InprocServer32\3.3.0.0]

"RuntimeVersion"="v4.0.30319"

"Assembly"="OneStop.OSRFunctions, Version=3.3.0.0, Culture=neutral, PublicKeyToken=null"

"Class"="OneStop.ReportPlayer.OSRFunctions"

"CodeBase"="file:///C:\\Program Files\\OneStop Reporting\\Report Designer\\ReportDesigner\\OneStop.OSRFunctions.dll"

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}\ProgId]

@="OneStop.ReportPlayer.OSRFunctions"

[HKCU\SOFTWARE\Wow6432Node\Classes\CLSID\{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}\Programmable]

[HKCU\SOFTWARE\Classes\OneStop.ReportPlayer.OSRFunctions]

@="OneStop.ReportPlayer.OSRFunctions"

[HKCU\SOFTWARE\Classes\OneStop.ReportPlayer.OSRFunctions\CLSID]

@="{74B6B2D2-F28A-4F03-BB6A-6B5DA5306460}"

[HKCU\Software\Microsoft\VSTO\Security\Inclusion\621c083a-79d7-433e-8540-d67b1520aed4]

"Url"="file:///C:/Program Files/OneStop Reporting/Report Designer/ReportDesigner/OneStop.ReportDesigner.vsto"

"PublicKey"="<RSAKeyValue><Modulus>snipped</Modulus><Exponent>AQAB</Exponent></RSAKeyValue>"

[HKCU\Software\Microsoft\VSTO\SolutionMetadata\{8776EBEB-6199-4D87-B489-85412DF2997B}]

"PreferredClr"="v4.0.30319"