Skip to main content

Word, Excel, and PowerPoint Plugin Installation

The Cyberhaven Windows Sensor installs three add-ins—CyberhavenWordMonitor, CyberhavenExcelMonitor, and CyberhavenPowerPointMonitor—to extend data protection into Microsoft Office productivity apps. Follow this guide to confirm the plugins are active and keep them enabled across your environment.

Installation workflow​

  1. Verify prerequisites: Review the Plugin Prerequisites to confirm each endpoint meets the supported Windows, Office, and Cyberhaven Sensor requirements.
  2. Install the Cyberhaven Sensor: Use your standard Windows deployment method (interactive MSI, Microsoft Intune, Microsoft Configuration Manager, or another tool). No additional parameters are required—the Office plugins install automatically.
  3. Restart Office applications: If Word, Excel, or PowerPoint were open during installation, restart them so the add-ins load.
  4. Validate the add-ins: In each application, navigate to File > Options > Add-ins and ensure the corresponding Cyberhaven add-in appears under Active Application Add-ins. Re-enable it via COM Add-ins if it lands in the disabled list.

Silent installation example​

msiexec /i CyberhavenSensorSetup.msi /qn

After silently deploying the sensor, notify users to relaunch Office apps (or automate that step) so data collection begins immediately.

Keep the plugins enabled​

  • Manage the add-ins via Group Policy or another endpoint-management platform to prevent non-admin users from turning them off.
  • At startup the Cyberhaven Sensor enforces the following registry policies, adding values only when none exist:
[HKEY_USERS\*\Software\Policies\Microsoft\Office\16.0\Word\Resiliency\AddinList]
"CyberhavenWordMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\16.0\Word\Resiliency\AddinList]
"CyberhavenWordMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\15.0\Word\Resiliency\AddinList]
"CyberhavenWordMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\15.0\Word\Resiliency\AddinList]
"CyberhavenWordMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\14.0\Word\Resiliency\AddinList]
"CyberhavenWordMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\14.0\Word\Resiliency\AddinList]
"CyberhavenWordMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\16.0\Excel\Resiliency\AddinList]
"CyberhavenExcelMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\16.0\Excel\Resiliency\AddinList]
"CyberhavenExcelMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\15.0\Excel\Resiliency\AddinList]
"CyberhavenExcelMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\15.0\Excel\Resiliency\AddinList]
"CyberhavenExcelMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\14.0\Excel\Resiliency\AddinList]
"CyberhavenExcelMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\14.0\Excel\Resiliency\AddinList]
"CyberhavenExcelMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\16.0\PowerPoint\Resiliency\AddinList]
"CyberhavenPowerPointMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\16.0\PowerPoint\Resiliency\AddinList]
"CyberhavenPowerPointMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\15.0\PowerPoint\Resiliency\AddinList]
"CyberhavenPowerPointMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\15.0\PowerPoint\Resiliency\AddinList]
"CyberhavenPowerPointMonitor"="1"
[HKEY_USERS\*\Software\Policies\Microsoft\Office\14.0\PowerPoint\Resiliency\AddinList]
"CyberhavenPowerPointMonitor"="1"
[HKEY_USERS\*\Software\Wow6432Node\Policies\Microsoft\Office\14.0\PowerPoint\Resiliency\AddinList]
"CyberhavenPowerPointMonitor"="1"

Administrators can adjust these keys as needed; the sensor does not overwrite existing values so custom GPO configurations are preserved.

Troubleshooting​

For troubleshooting workflow, log collection, and remediation guidance across all Office plugins, see Troubleshooting Office Plugins.