Ticket #1: If Excel Raced a Snail... The Snail Would prevail.

It was a dark and rainy Friday night when I received an emergency note delivered via carrier pigeon...

OK, it was actually a hot and dry Monday afternoon, and I received the following note in my company IT support ticketing system.

I knew that the sales logs in reference were simple excel spread sheets that are no bigger than a single Megabyte or so. I went through the standard triage procedure of mine which basically involves having the user reproduce the issue in my presence, close all programs and try again, and finally, the action that every IT support rep holds in their toolbox, a simple reboot. After that, I was still left with a computer that would open excel and then halt for 30 seconds to a minute before opening a 805k in size spreadsheet.

I copied the trouble document to the users local desktop and excel would open the document in just a couple of seconds. I would have some major explaining to do if my network took 30 seconds to transfer 1MB of data from my file server to the workstation. I copied a few large files over the network to quickly debunk that idea. Within a few minutes I knew that the slowness was only noticeable on excel spreadsheets approaching 1MB and up also, my workstation was not affected. My workstation is currently running windows 7 and office 2010, and the affected workstations all seemed to be running windows XP and office 2003. this told me that the issue was most likely only affecting either windows XP, or Office 2003

I did remember pushing out a round of Microsoft updates within the past couple of weeks. So I preceded to uninstall each of the recent security updates as well as the office updates in hopes of finding the culprit, but after all recent updates were removed, we were left with a unpatched PC that was still slow to open networked Excel documents. I was stumped, so I went to the one place that never lies and has all of the answers, The Internet!

After some googling I happened to run into a Microsoft Knowledge Base article which seemed to be referring to the same issue I was running into. It can be found here http://support.microsoft.com/kb/2570623. This article explains that the culprit was likely an office 2003 add-in called Office File Verification. Microsoft provided a fix it solution that was supposed alleviate the symptoms. However, for some reason after running the patch I was left with a computer that would ask for the installation files for the Office File Verification Add-in before opening any excel file. Though I had an unexplained side affect, I did notice that once I made it around the prompt, the Excel files were actually opening very quickly.

This confirmed that the symptoms were related to the OFV add-in(http://support.microsoft.com/default.aspx?scid=kb;en-US;2501584) which was pushed out via Microsoft t Automatic Updates. I did not run across this in my preliminary uninstalling due to the fact that that the the add-on is listed with its own uninstaller and is listed as ?Microsoft Office File Validation Add-in?, and frankly... I just missed it. After presenting my findings to my companies IT Director, we decided that the best course of action would be to push out a script that would disable the OFV add-in for excel. This way, in the event Microsoft fixes the issue, we would just reverse the registry changes to re-enable OFV for Excel 2003.

A Few Final Statements:

• We utilized a simple VBScript log on script as the settings need to be pushed out per user login as the changes take place in the HKEY_CURRENT_USER registry key. My script included the following code snippet to make the changes, as well as some extra code to filter out which domain computers we wanted the script to run on.

  Set WshShell = Wscript.CreateObject("WScript.Shell")
  WshShell.RegWrite "HKCUSoftwarePoliciesMicrosoftOffice11.0ExcelSecurityFileValidationEnableOnLoad", 0, "REG_DWORD"

• We decided against uninstalling the add-in for a few reasons, Including the fact that the simple registry fix was easily pushed out via script, and would be easy to reverse. Also, OFV does close some security holes in the other office applications. Only excel is affected so, only excel needs to be left unpatched.

• The KB article KB2570623 states "Microsoft Office 2007 and Microsoft Office 2010 are not affected because they include a new feature for opening files over the network that copies the complete file locally first and then scans the file by using the OFV so that the file reads do not include the network traffic."