views:

162

answers:

2

Hi,

when i am using below code with windows application it always fires WOrkBookOpen event.

public partial class Form1 : Form
{
    public Form1()
    {
        InitializeComponent();
    }
    Microsoft.Office.Interop.Excel.Application app;
    private void button1_Click(object sender, EventArgs e)
    {
        app = new Microsoft.Office.Interop.Excel.Application();
        app.WorkbookOpen += new Microsoft.Office.Interop.Excel.AppEvents_WorkbookOpenEventHandler(app_WorkbookOpen);
        app.WorkbookActivate += new Microsoft.Office.Interop.Excel.AppEvents_WorkbookActivateEventHandler(app_WorkbookActivate);
    }

    void app_WorkbookActivate(Microsoft.Office.Interop.Excel.Workbook Wb)
    {
        MessageBox.Show(Wb.FullName);
    }

    void app_WorkbookOpen(Microsoft.Office.Interop.Excel.Workbook Wb)
    {
        MessageBox.Show(Wb.FullName);
    }

    private void button2_Click(object sender, EventArgs e)
    {
        app.Quit();
        Marshal.FinalReleaseComObject(app);
    }
}

But when I want to fire same event using windows service its not firing. Below is the code used for service. I am creating Excel interop object in OnStart() of service and attaching same event. But after installation of service this event doesnt fire. whereas in same windows application it fires up. Here for testing purpose i am creating FIle on my disk to check if event is firing or not.

public partial class Service1 : ServiceBase
{

    Microsoft.Office.Interop.Excel.Application excel;
    public Service1()
    {
        InitializeComponent();
    }

    protected override void OnStart(string[] args)
    {
        try
        {
            File.Create("C:\\SampleService\\Start - " + DateTime.Now.Ticks.ToString());

            excel = new Microsoft.Office.Interop.Excel.Application();
            excel.WorkbookOpen += new Microsoft.Office.Interop.Excel.AppEvents_WorkbookOpenEventHandler(excel_WorkbookOpen);
            excel.WorkbookActivate += new Microsoft.Office.Interop.Excel.AppEvents_WorkbookActivateEventHandler(excel_WorkbookActivate);
            File.Create("C:\\SampleService\\Start - " + DateTime.Now.Ticks.ToString());

        }
        catch (Exception e)
        {
            using (StreamWriter stream = new StreamWriter(@"C:\SampleService\Err.txt", true))
            {
                stream.Write(e.Message);
            }
        }
    }

    void excel_WorkbookActivate(Microsoft.Office.Interop.Excel.Workbook Wb)
    {
        File.Create("C:\\SampleService\\EXCEL - " + DateTime.Now.Ticks.ToString());
    }

    public void excel_WorkbookOpen(Microsoft.Office.Interop.Excel.Workbook Wb)
    {
        File.Create("C:\\SampleService\\EXCEL - " + DateTime.Now.Ticks.ToString());
    }

    protected override void OnStop()
    {
        if (excel != null)
        {
            excel.Quit();
            Marshal.FinalReleaseComObject(excel);
        }
    }
}

I have also using serviceInstaller and i am installling service on machine. I am giving proper rights to service to create object of Excel.Application com component.

Is anyone came across such issue? Or do you find I am missing anything?

Thanks Paresh

A: 

What account is your service running under? If it is SYSTEM make sure the option Allow service to interact with desktop is checked. Alternatively, try running your service under a normal user account.

0xA3
Yes its system account I am running with and same option is checked.Also I tried with other user having admin rights. But no success.
Paresh.Bijvani
Anyway, I don't see why you need these events because you are fully controlling the application by your service, i.e. you open, activate, etc the documents yourself using `Application.Documents.Open` etc.
0xA3
I need to track all office document opened on the machine. I want to create log for this file. That why I am using this event to track this.
Paresh.Bijvani
shahkalpesh
Hi Kalpesh..Creating instanace of Excel.APplication giving me event for any excel opened on machine. SO it will work for me.But I couldnt understand what is Excel Addin? Can you tell me in detail, if that is the better approache for doing this.
Paresh.Bijvani
A: 

First, it appears that you are trying to log excel files opening using a service and excel.application object. This is not a very good solution, and you will find it gives inconsistent results at best.

The Excel.Application object will be created within your application under the service account. This service may or may not be able to interact with the desktop, depending on your service settings. The user, however, will always be able to open the excel application within their user account.

Second, if you are running the excel object service from the system account, you are opening yourself up for a huge security problem. Office documents are a huge source for all kinds of malware, and you will be giving anything opened under it a level of access to your system not even the administrator has. You should not be opening documents under a privileged account without considering the security ramifications.

Third, many of the events in excel are specific to the gui, and if their is not a visible window, they may not fire. I learned this the hard way many years ago under 2000, and since then I have really limited my dependence on them.

If I may make some recommendations,

  • If your intent is to monitor who opens a file, consider using the file system security / logging built into windows. It can be set to audit a file and write to the security event log when the file is accessed. This information can easily be retrieved over the network with WMI.
  • Do not run anything under a privileged account unless you are certain of what it will do. Your excel files may be fine right now, but one user bringing in a macro virus could be disastrous.
  • If you must write your own "logging", consider using a global hook to monitor (monitor only, not change or modify) file opens by excel. A quickie hook application that only logs when an excel file is opened will not effect system performance, and will be much safer and more stable than what you are suggesting. If you are unfamiliar with hooks, desaware used to make some great components for hooking and subclassing and you should check them out. Unless you are very familiar with that the program is doing, though, only monitor the messages, don't attempt to "handle" them for excel.
  • An Excel addin is just a file that adds custom functions or functionality to excel, it is most commonly VBA in an xll or xla file. If you need security, do not depend on an addin to monitor file access because they can easily be disabled.

The most effective way to monitor who opens a file will be using file auditing that is built into NTFS.

Cub
Thanks for giving detail explanation. But I think file auditing of NTFS will not work for me as I want to audit file from shared folder.
Paresh.Bijvani
You might consider setting the logging on the server hosting the file then. It is going to be the only 100% effective method to monitor file access/changes.If you have full access to the target machines, you could register a trusted certificate on the machines and write a macro to respond to the file opening. You will then have to set a password for the macros.By signing it with a trusted certificate, it will not prompt the user to disable macros when the file is opened. Be aware, however, you can still open the file with macro's disabled (just by holding the shift key).
Cub