Microsoft Office Applications not opening while Windhawk is running

[mtremains-SelectSires]

Im not able to open Microsoft Office Applications (word, excel, powerpoint, etc) while Windhawk is running

I use Windhawk for the 'Taskbar Thumbnail Reorder'. I used to use '7+ Taskbar Tweaker' on previous windows versions.

Windhawk version: 1.0.7

Windows:

• Edition: Windows 11 Enterprise
• Version: 23H2
• OS build: 22631.3593
• Experience: Windows Feature Experience Pack 1000.22700.1003.0

[m417z]

Are you seeing any error message when trying to run Office?

Meanwhile you can exclude them in Windhawk's advanced options.

Update (Jun 22)

For now, the best workaround is to exclude the Office folder as following:

https://github.com/ramensoftware/windhawk/assets/4129781/433713a0-3280-4c04-b47f-285f255bc580

Use the correct folder depending on where your Office resides:

C:\Program Files\Microsoft Office\root\Office16\*

C:\Program Files (x86)\Microsoft Office\root\Office16\*

If unsure, you can just add both lines, it won't hurt.

It's recommended to avoid using %ProgramFiles%, as it resolves to different paths for different processes.

It was also suggested in the comments to exclude all but selected processes (e.g. exclude *, then include explorer.exe). This approach is generally not recommended. For an explanation of why Windhawk injects code into all processes, see my answer here: https://github.com/ramensoftware/windhawk/discussions/21. Excluding all processes is only recommended in unusual circumstances, such as a corporate computer with an antivirus which prevents Windhawk from working unless it's limited to a specific process.

[mtremains-SelectSires]

No errors if the application is already running and i start Windhawk.

If Windhawk is running and i try to start app, cursor spins then nothing happens.

Havent had a chance to debug yet

[jimmyknowles]

Edition Windows 11 Pro Version 23H2 Installed on ‎2/‎4/‎2023 OS build 22631.3737 Experience Windows Feature Experience Pack 1000.22700.1009.0

I'm seeing the same thing. I tried running winword.exe and outlook.exe from the command line and don't see any errors there. I also tried running them w/ the /safe flag and same results. I haven't had a chance to check any other relevant logs.

It doesn't appear to be a specific mod that is causing the behavior. Even if I have Windhawk running w/ all mods disabled, it still doesn't allow the Office apps to open.

I was able to add them to the process exclusion list and it works fine when they're added there.

Not sure if there's anything of value in the '3-Windhawk Log.log', but it's at pastebin - https://pastebin.com/Vhwyu223

Thanks!

[mtremains-SelectSires]

@jimmyknowles can you share the the processes you added to the exclusion list? thanks!

[jimmyknowles]

@jimmyknowles can you share the the processes you added to the exclusion list? thanks!

Sorry, I should have included that. I added winword.exe and outlook.exe to the exclusion list. In the log I provided, the process that I tried to run that wasn't in the list was excel.exe. And it did the same thing, it just silently failed.

Let me know if you'd like me to try anything else.

[mtremains-SelectSires]

excellent. programs are working with these exclusions

[bluesteeldriver-ancon]

In case it's helpful for troublshooting: Suddenly I'm having the same problem. With Windhawk running, Office programs will not start normally. But they will start if I right-click the program shortcut and select "Run as administrator."

Strangely, this problem started today, sometime during the middle of the day. As far as I'm aware, no Windows or Office updates were installed between this morning (when programs opened normally) and now.

P.S. adding the Office exe's to Windhawk's exclusion list did fix the problem.

[Carolpea55]

I have the exact problem. Any idea when it will be fixed? Exceptions I put in excel.exe winword.exe outlook.exe Powerpnt.exe mspub.exe onenote.exe msaccess.exe teams.exe

[chinook77]

I have the same problem, no need to add one by one, this path on exclusions solved for me, at least for now:

C:\Program Files\Microsoft Office\root\Office16\*

Source : https://www.reddit.com/r/Office365/comments/1de5nma/comment/l8kmcbm/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

Event Viewer log:

Faulting application name: ONENOTE.EXE, version: 16.0.17628.20144, time stamp: 0x6663987f Faulting module name: AppVIsvSubsystems64.dll, version: 16.0.17804.43981, time stamp: 0x665fe11c Exception code: 0xc0000005 Fault offset: 0x00000000000b12ad Faulting process id: 0x0x76AC Faulting application start time: 0x0x1DABF22533F5D86 Faulting application path: C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE Faulting module path: C:\Program Files\Microsoft Office\root\Office16\AppVIsvSubsystems64.dll Report Id: 357ee123-bf13-42e3-8122-5f087756ab40 Faulting package full name: Faulting package-relative application ID:

[The-MAZZTer]

I am seeing this issue as well.

I attempted to repair my Office install before I figured out it was Windhawk (didn't work).

I have the same error in my Event Viewer as chinook77 for Excel and Word.

I am running Office Professional Plus 2021 (the one-time purchase version, not the perpetually updating subscription version).

Faulting application name: EXCEL.EXE, version: 16.0.17628.20144, time stamp: 0x66639ab5 Faulting module name: AppVIsvSubsystems32.dll, version: 16.0.17804.43981, time stamp: 0x665fe10e Exception code: 0xc0000005 Fault offset: 0x0006c87d Faulting process id: 0x0x27A4 Faulting application start time: 0x0x1DABF4B870EE594 Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE Faulting module path: C:\Program Files (x86)\Microsoft Office\root\Office16\AppVIsvSubsystems32.dll Report Id: 20c44db8-3f2c-4a8c-bd5c-a274453dd32f Faulting package full name: Faulting package-relative application ID:

Faulting application name: OLicenseHeartbeat.exe, version: 16.0.17628.20144, time stamp: 0x666397b4 Faulting module name: AppVIsvSubsystems32.dll, version: 16.0.17804.43981, time stamp: 0x665fe10e Exception code: 0xc0000005 Fault offset: 0x0006c87d Faulting process id: 0x0x57B0 Faulting application start time: 0x0x1DABF4AD3F94355 Faulting application path: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe Faulting module path: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE16\AppVIsvSubsystems32.dll Report Id: 82b50f54-5a4b-42e1-b078-5534c69ce59e Faulting package full name: Faulting package-relative application ID:

Faulting application name: WINWORD.EXE, version: 16.0.17628.20144, time stamp: 0x6663934e Faulting module name: AppVIsvSubsystems32.dll, version: 16.0.17804.43981, time stamp: 0x665fe10e Exception code: 0xc0000005 Fault offset: 0x0006c87d Faulting process id: 0x0x4B08 Faulting application start time: 0x0x1DABF4937E4BA15 Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE Faulting module path: C:\Program Files (x86)\Microsoft Office\root\Office16\AppVIsvSubsystems32.dll Report Id: 01bbfae1-8a67-4e8e-b76c-9922424d0e90 Faulting package full name: Faulting package-relative application ID:

Did not try all office apps.

The issue occurs even if all mods are disabled.

If I run elevated as bluesteeldriver-ancon suggests that appears to work around it, though that is a bad idea for general use so I won't be doing that. Windhawk should be injecting into elevated processes so it's unclear to me why that works.

I am running Windhawk 1.4.1 on Windows 11 Version 22H2 Build 22621.3737

[Geexp]

I have also been having the exact same issues. Was just about to do complete uninstall/reinstall of Office.

I read here bleepingcomputer.com) about Winhawk and lo and behold, I closed Winhawk and Office started working again as before.

Would be great to know when Winhawk is fixed so it works properly without having to exclude paths / apps.

[MainWire]

Same issue here, the folder exception doesn't work for me, I have to start them as admin. Using Windows 11 Home 22631.3593, i'm using the taskbar size mod

[Geexp]

@MainWire make sure that the path you are posting is correct and that there is a \ before the eg: `C:\Program Files\Microsoft Office\root\Office16\`

[RandScullard]

Having the same issue here. This fixed it for me:

@MainWire make sure that the path you are posting is correct and that there is a \ before the eg: `C:\Program Files\Microsoft Office\root\Office16\`

[ygoe]

This caught me by surprise yesterday in the morning. Office 2016 still worked one or two days earlier, but from Sunday on, all of its applications failed to start on three(!) of my computers. One with Windows 10, the other two with latest Windows 11. With nothing but the same entries in the event log. To me, it looked like a global-scale issue and appeared like a burnt-in expiry data for that software. No updates were installed, at least on one of the devices. No Windhawk modules or the application itself were updated within many days. No other conficuration changes were done. The Windows 10 computer wasn't even used in a week. Only after reports from friends that their Office was still working, I started to eliminate other conflicts in my environment. Stopping Windhawk made Office work again, just stopping the mods didn't help.

At least I can continue my work with the process exclusion list now. I don't need Windhawk to do anything with these processes, so that's fine. But nevertheless I would like to know what caused this extremely annoying issue. I was basically blocked in my work for two days before finding this workaround.

Edit: Actually, I took this issue as an occasion to (hopefully) prevent future issues like this. I went through my installed mods and only included the mentioned include processes to the global include list (was only explorer.exe and devenv.exe), and * to the exclude list. All mods still work. Maybe this should be the default behaviour?

[SaiMorphX]

I came to say this just started for me this morning. I just noticed this was an issue already, I'm not alone!! I'm going to try the exclusion fix from the first few comments.

I also didn't notice the update for Taskbar height and icon size until today, updating it didn't help. turning off ALL mods didn't help. having windhawk running with no mods caused this to happen.

I'm kind of wondering when it's I use it loosely, "attacking" programs the mods aren't intended to target. So far no issues with Steam or my games, but I hope this doesn't cause a Steam anticheat violation. my account is almost 20 years old and I don't need all my games gone. So why is this affecting apps other than the ones it should be? sorry, love windhawk it's the only way I'm going to get my taskbar and clock as close to the way I want it as posable. taskbar so far I've been trying to get it to act like how I had the task bar in Ubuntu Budgie, the only thing I haven't figured out yet is centering active apps.

video of what it was doing.

[ygoe]

@SaiMorphX If you're worried about Windhawk getting into processes you don't want it to, I'd suggest you set it up like I described in my last comment. It will only go into selected processes and nothing else, just to be sure.

[SaiMorphX]

Edit: Actually, I took this issue as an occasion to (hopefully) prevent future issues like this. I went through my installed mods and only included the mentioned include processes to the global include list (was only explorer.exe and devenv.exe), and * to the exclude list. All mods still work. Maybe this should be the default behaviour?

If you're worried about Windhawk getting into processes you don't want it to, I'd suggest you set it up like I described in my last comment. It will only go into selected processes and nothing else, just to be sure.

Thank you, this does make me feel a lot better knowing it's only targeting the processes the mods should be targeting. Thank you!! settings ss

[Anixx]

Just check what mod causes this.

[SaiMorphX]

Just check what mod causes this.

as a few of us have mentioned. you DON'T need any mods installed, only Windhawk running! mods have noting to do with this.

Forcing a wildcard to Windhawk's exception list, then only allowing the processes the mods needs fixes this for now. For example.

[tomashons90]

Thank you @SaiMorphX , your fix is clear, simple and functional.

[garlic-os]

Like @ygoe suggested, would it be worth patching in that %ProgramFiles%\Microsoft Office\root\Office16\* fix for now until we find something cleaner? If this is always preventing Office programs from running, that could potentially be a lot of affected users.

[MainWire]

Make sure of that :

Having the same issue here. This fixed it for me:

@MainWire make sure that the path you are posting is correct and that there is a \ before the eg: `C:\Program Files\Microsoft Office\root\Office16\`

and that you put the path in the exclusions and not inclusions window:

[Fazyfaz]

@MainWire Thanks! I accidentally put it in the inclusion list at first (from seeing some people's example above), but it didn't work. Then I realized it was in the wrong box. This is the correct box you're supposed to put it in, for future readers:

[m417z]

Hi guys, sorry for the late reply. I updated my first comment with the recommended way of excluding Office.

Also, I tried reproducing the problem, but unfortunately had no success. I installed Office 2016 version 16.0.17628.20144 on Windows 11, but the AppVIsvSubsystems64.dll file I got is of version 10.0.22000.2116, unlike 16.0.17804.43981 which can be seen in crash reports in this thread. If you know how to install the problematic version, please let me know.

Also, for those who can reproduce the issue, can you capture a crash dump? You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

Please post the dump here or, if you prefer, email it to me.

I went through my installed mods and only included the mentioned include processes to the global include list (was only explorer.exe and devenv.exe), and * to the exclude list. All mods still work. Maybe this should be the default behaviour?

The reason Windhawk injects code into all processes is to be able to hijack creation of new processes, which allows Windhawk to load mods before the target process has the chance to run. Without this ability, mods are loaded with some delay, which can cause problems with some mods which require to be initialized at an early stage.

If you don't use mods which require such early initialization, you can use this method. It might be surprising if one day you'll install another mod and it won't work as expected, that's why it's not the default behavior and I don't generally recommend it. The intervention for monitoring process creation is minimal and has little impact. The situation with Office is not a common one, and is still being investigated,

[garlic-os]

Speaking for just myself, I'm actually on the latest version of Office/Microsoft 365 I got off office.com a couple days ago (https://portal.office.com/account/?ref=Harmony#installs), not Office 2016. Couldn't tell you why they decided to name the folder "Office16" 🤷 @m417z I went ahead and emailed you a crash dump.

[SunsetTechuila]

can you capture a crash dump?

It doesn't crash. The process does not terminate, remains active, but consumes only 2 megabytes

I installed Office 2016 version

As it was said above you have to install Office 365. You can get the installer here (doesn't require account/license or anything, also it's not piracy)

[groovyclam]

You have to get Office 365 which is free ( all Office 365 does is open Office files in a browser based version of Excel/Word/Powerpoint/etc. ) BUT you also have to choose the option to install (some) of the apps to your PC and it will install Word, Excel, Powerpoint, Publisher and few others to your PC. It is THESE exes that fall victim to the bug. I think this local install option requires you have a subscription to Office 365.

If you don't put the locally installed exes in the Windhawk exclude list you can still launch the Word.exe/Excel.exe/etc. successfully with a right-click "Launch as Administrator". But this won't work if you left or right click an existing word or exel file of data.

[ygoe]

After installing Office 2016, you may have an old version of it. There are regular updates. I'm currently at "Version 2405 (Build 17628.20144)". You can install updates immediately by clicking "File", "Account", "Update options". Repeat until it says you have the latest version. Maybe older versions are not affected. I could try that if desired, it just takes some time.

[tariel36]

I have the same issue using Office 2021 Pro Plus running on Windows 10 PRO. Same Access Violation error as posted above.

[zheung]

for my crash enviroment: Office 365 2406 (17726.20078) Windows 11 23H2 (22631.3737) Windhawk 1.4.1

My Windows login account is Administrator. Maybe that has something to do with it.

This is a split-volume compression file in 7z format. Please remember to change the extension if you use CrashDumps.7z.001.zip CrashDumps.7z.002.zip

[ryknuth]

Hello. I am a Microsoft employee and own the Appv binaries that are part of Office. This bug looks eerily similar to a bug I recently fixed. I am on my phone right now but I will check the crash dumps when I get a chance.

If someone is able to look at the dumps in the meantime, it's easy to verify the problem. First check the version of appvisvsubsytems32.dll (or 64.dll). It should begin with 16. Then, check to see if two threads with Appv in the stack are hung inside locale related calls.

[m417z]

Hi @ryknuth. I looked at the dumps (thanks @garlic-os and @zheung), and I understand the problem, which is totally Windhawk's fault. Sorry for that. Fortunately, I have a fix in mind and it shouldn't be very difficult, but unfortunately, I still haven't found the time to work on it.

In short, the problem is that NtCreateKey ends up being called by Windhawk from a thread which has uninitialized TLS (thread local storage), but AppVIsvSubsystems{32,64}.dll hooks that function, and some of the hook code makes use of thread local variables (just before calling ucrtbase!towlower_l).

So if you'd like to implement a workaround in Office for the time being, you can avoid using thread local storage in this hook. Since it didn't crash before, I hope that a quick workaround can be implemented, which will help users for now while I come up with a proper fix in Windhawk, and also for users who won't update to the new version with the fix right away.

If you need more information, feel free to reach me out.

[ryknuth]

Interesting. tolower_l is part of the solution I used to fix the problem. Can you post the stacks you saw where the uninitiated TLS was? Can you point me to your code?

[m417z]

I don't have symbols, but here's @zheung's dump, for example:

0:004> k
  *** Stack trace for last set context - .thread/.cxr resets it
 # Child-SP          RetAddr               Call Site
00 000000a8`c60febb0 00007fff`d168f8e1     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xa74dd
01 000000a8`c60febe0 00007fff`d168149e     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xb5b11
02 000000a8`c60fec20 00007fff`d16846a2     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xa76ce
03 000000a8`c60fedc0 00007fff`d1686db1     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xaa8d2
04 000000a8`c60fefc0 00007fff`d1686738     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xacfe1
05 000000a8`c60ff1b0 00007fff`d168d752     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xac968
06 000000a8`c60ff250 00007ff8`238af79e     AppVIsvSubsystems64!VirtualizeCurrentProcess+0xb3982
07 000000a8`c60ff2a0 00007ff8`23935b05     KERNELBASE!Wow64NtCreateKey+0xae
08 000000a8`c60ff380 00007ff8`238b0d8f     KERNELBASE!BaseRegCreateKeyInternal+0x2dd
09 000000a8`c60ff690 00007ff8`238af085     KERNELBASE!LocalBaseRegCreateKey+0x47
0a 000000a8`c60ff6f0 00007ff8`238aecfb     KERNELBASE!RegCreateKeyExInternalW+0x145
0b 000000a8`c60ff7d0 00007ff8`068d6e2a     KERNELBASE!RegCreateKeyExW+0x4b
0c 000000a8`c60ff830 00007ff8`068d2b03     windhawk!GlobalHookSessionEnd+0x559a
(more Windhawk code...)

Not sure if that's what you were asking about. Just to make clear, the TLS is uninitialized because the thread was created with NtCreateThreadEx and the THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH (0x00000002) flag.

[ryknuth]

I have a fix and is being tested internally. I have never used Windhawk. What would be the easiest way to repro this issue? Install and open Windhawk then open an Office application?

Edit: I did just this and it easily repro'd the issue. Should be good on testing :)

[groovyclam]

@ryknuth Yes install Windhawk on Windows 11. Run it - it can either be an open desktop window or minimised to the tray - it happens either way. You don't have to install any mods into Windhawk.

Now try to launch an Office 365 app that has been installed to the PC e.g. Word or Excel by clicking its icon - the mouse pointer will twirl for a second as if something is happening but the office app won't start. If you right click and choose to "Run as Administrator" then the Office app WILL start.

Clicking on a file of office data e.g. a .docx or .xlsx won't open the file of data either.

[ryknuth]

The fix has been submitted and will hit the May and June forks eventually. I have no control over how fast they come out. My guess is in a few weeks.

[groovyclam]

@ryknuth - thank you

[jswinde]

Thank you all for posting, identifying, troubleshooting and resolving the problem so quickly! Many issues that are reported by users in GitHub and in other communities go unsolved for YEARS! After investigating this issue for 5 straight days, I am supper happy that I "stumbled" upon this thread. MS Office lives again! 🏆

[1111Al]

The problem are Windows updates, now Windows don't like any external modding/customization programs. it will be worse and worse in the future with each update. I blocked WU shit for some time, and so I have no more problems with WindHawk and other external tools.

[tariel36]

The problem are Windows updates, now Windows don't like any external modding/customization programs. it will be worse and worse in the future with each update. I blocked WU shit for some time, and so I have no more problems with WindHawk and other external tools.

Yeah, first thing I do after installing fresh copy of Windows and all the required drivers, is disabling WU in all the ways I know and installing my own service that spams "disable WU services in all the ways I know" every second. Since then, issues with Windows have been reduced to near 0 :-)

[1111Al]

Yeah, first thing I do after installing fresh copy of Windows and all the required drivers, is disabling WU in all the ways I know and installing my own service that spams "disable WU services in all the ways I know" every second. Since then, issues with Windows have been reduced to near 0 :-)

I have now become some kind of theoretician and technician of the clean installation of Windows :) to install a kind of light customized copy of Windows. I dont' just disable WU which is the core of the problems, after installing Windows 11 Pro, I removed Cortana,, Edge e WinDefender too, along with all telemetry processes of course. :) Just 105 processes on my system startup :) no more scratch my head, no more problems, no stress, and no more swearing without WU! :) We must realize that 90% of Windows problems originate in WU, the remaining 10% is user's fault.

[psemphie]

Yeah, first thing I do after installing fresh copy of Windows and all the required drivers, is disabling WU in all the ways I know and installing my own service that spams "disable WU services in all the ways I know" every second. Since then, issues with Windows have been reduced to near 0 :-)

I have now become some kind of theoretician and technician of the clean installation of Windows :) to install a kind of light customized copy of Windows. I dont' just disable WU which is the core of the problems, after installing Windows 11 Pro, I removed Cortana,, Edge e WinDefender too, along with all telemetry processes of course. :) Just 105 processes on my system startup :) no more scratch my head, no more problems, no stress, and no more swearing without WU! :) We must realize that 90% of Windows problems originate in WU, the remaining 10% is user's fault.

Yeah, I do exactly the same and totally agree that WU/WD are source of issues in 90% of the cases. All the bloatware, WD, telemetry, web-searching and much more I don't remember now is gone after initial install. My PC is stable for years after that kind of treatment. It's shocking.

[jswinde]

Which specific windows update(s) is causing the problem?