About Virtualization, VDI, SBC, Application Compatibility and anything else I feel like
Windows 2003 Enterprise (32 bit), Citrix XenApp 5, RES Workspace Manager 2011, McAfee VirusScan Enterprise 8.7.0i.
When a opening an Excel workbook from Sharepoint the whole session freezes.
I asked the user to open an Excel workbook from Sharepoint and I noticed the following popup:
So my first thought was that the user somehow clicked this message to the background and IE was waiting for a response.
This message appears because the option “Confirm open after download” is active in the file type options:
I knew this setting was stored in the registry but couldn’t remember where, so I used Process Monitor to quickly determine it’s location. I set a filter on “Process is explorer.exe” and “Operation is RegSetValue”:
First line is a direct hit, the registry key is “HKCR\Excel.Sheet.8\EditFlags”:
HKEY_CLASSES_ROOT is actually a merged view of HKEY_LOCAL_MACHINE\Software\Classes and HKEY_CURRENT_USER\Software\Classes so you can set this value either per user or for all users.
In my case I set this value in RES Workspace Manager as an Application Specific Configuration:
After this change the warning wasn’t shown anymore but the workbook still didn’t open.
After a little wait Explorer didn’t respond any more, which in the user’s experience makes the whole session freeze. The RES Dialog was indicating it was still launching Excel:
So I opened Process Monitor to see what was going on and I noticed a recurring sequence of several NotifyChangeDirectory operations from Explorer. I filtered on this operation:
As you can see in the screenshot there is a massive number of entries, each taking up about a second. And after waiting several minutes Excel was launched.
I then tried to open Excel directly and this showed the same behavior.
So I doubleclicked one of the entries and inspected the Stack. As you can see the last 6 operations are related to virus scanning because fltMgr.sys is the File Filter Filter Manager (virus scanners usually use a filter driver):
And mfehidk.sys is a driver from McAfee:
To see whether the Virus Scanner was at fault, I deselected “When reading from disk” (for performance reasons it’s I would recommended to turn this off anyway) from the Scan Items in the On-Access Scan Properties:
After that change Excel launched almost immediately!
I am not really satisfied with this workaround so I will ask the customer to report this to McAfee. I will update this article if I get any feedback.
.NET .NET FrameWork Active Directory Altiris Apple Automation Manager Citrix Dell Delphi Excel Exchange Exchange2003 Exchange2010 Hack HP iOS Java LinkedIn Linux Lync MSI Office Office 2010 Passat Password PowerPoint PowerShell RES RNS510 SasLibEx SCOM Security Terminal Server ThinApp TSAdminEx VBS VCDS Visual Basic Visual Studio VMWare Volkswagen VW Windows PE Wordpress XenApp