Share via

Excel not opening properly after Intune rollout

Kyle Moody 111 Reputation points
2020-12-08T13:00:33.903+00:00

Hi,

I have been experiencing an issue recently where I open Excel and I can see the process start in Task Manager (with about 30-40% CPU usage) however the application doesn't open. I have been able to get around it by performing a Quick Repair which fixes it briefly however the issue reoccurs.

We recently rolled out Intune and it seems this may be the cause.

Is anyone able to shed any light on this? I have had issues with Outlook crashing and that was caused by Exploit Guard however I wanted to make it known before I go looking elsewhere.

Thanks.

Excel Management
Excel Management
Excel: A family of Microsoft spreadsheet software with tools for analyzing, charting, and communicating data.Management: The act or process of organizing, handling, directing or controlling something.
1,661 questions
0 comments
Accepted answer
  1. Kyle Moody 111 Reputation points
    2020-12-09T08:42:22.927+00:00

    Thanks for the responses,

    I believe it may be Exploit Guard again causing the issue. It only happens on Excel however that is where policies from Exploit Guard are assigned. In the XML change:

    EnableExportAddressFilter = "false"
    EnableExportAddressFilterPlus="false"

    I haven't heard back from the user yet so hopefully that fixes the issue. I will keep you posted if there is any development.

    Update: This was not the case, user is facing the same issues this morning but after a reboot.

    FROM A REDDIT POST

    "Hi All. We have found out the issue here. It is the Security Baseline, specifically the XML configuration in Exploit Guard. Edit the XML to remove EnableRopSimExec="true" from EXCEL.EXE.

    If you have impacted users, if you have admin rights on the Intune machine you can do this via the GUI:

    Start > Windows Security > App & browser control left-hand option > Exploit protection settings > Program settings > search for Excel.exe > Edit > and TURN OFF "Simulate execution (SimExec)"

    1 person found this answer helpful.

7 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tarquin M 1 Reputation point
    2020-12-09T00:08:26.883+00:00

    Not a fan of me tooing but we are having the exact same issue across multiple intune tenants - the only commonality being Intune itself.

    0 comments
  2. Tarquin M 1 Reputation point
    2020-12-09T01:27:46.733+00:00

    We removed Intune from one of our, now many, affected devices - this has resolved the issue until we can identify the exact cause. We havent adjusted policies in weeks within Intune which signals a concern that something on Microsoft's end has gone wrong. It would, as always, be great to hear from them on this matter but I won't hold my breath.

    0 comments
  3. Erin Ding-MSFT 4,456 Reputation points
    2020-12-09T06:49:56.657+00:00

    anonymous userMoody-3398

    Does this issue occur on other Office applications like Word?

    Please try to open Excel in safe mode eliminate interference from add-ins and startup items.
    Press Win+R, type excel /safe, Enter.

    If you can open Excel successfully in safe mode:

    • Move the files in C:\Users\<User Name>\AppData\Roaming\Microsoft\Excel\XLSTART to other location temporarily, then check if the issue still exists.
    • If it doesn't work, go to File>Options>Add-Ins. Towards the bottom of the window, where it says Manage, click the Go button. In the dialog box, uncheck the add-ins to disable them.

    > We recently rolled out Intune and it seems this may be the cause.

    << Do you mean that you enrolled your device in Intune to manage?
    If yes, please add the Enterprise Context column to the Details tab of the Task Manager.

    You could also try to un-enroll your device from Intune to check the issue.

    Besides, to better help you, it is recommended to add a tag related to Intune like “mem-intune-enrollment”.

    If an Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments
  4. Martin H 6 Reputation points
    2020-12-10T04:00:34.553+00:00

    The fix provided above worked for us, however some users are experiencing issues when using formula's =SUM(A1:A7) and excel crashes.

    unsure if its related, however EventID shows

    Log Name: Application
    Source: Application Error
    Date: 12/10/2020 10:19:54 AM
    Event ID: 1000
    Task Category: (100)
    Level: Error
    Keywords: Classic
    User: N/A
    Computer: xxx
    Description:
    Faulting application name: EXCEL.EXE, version: 16.0.13127.20910, time stamp: 0x5fcbbcd1
    Faulting module name: PayloadRestrictions.dll, version: 10.0.19041.1, time stamp: 0xe257489f
    Exception code: 0xc0000409
    Fault offset: 0x0006e6d6
    Faulting process id: 0x232c
    Faulting application start time: 0x01d6ce81bba7b4d8
    Faulting application path: C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE
    Faulting module path: C:\WINDOWS\SYSTEM32\PayloadRestrictions.dll
    Report Id: 2656bb9d-2038-4f3b-8a33-dec13b73cb3a