Skip to main content

Troubleshooting Office Plugins

Use this guide to diagnose Cyberhaven Office plugin issues across Outlook (Classic), the New Outlook add-in, and Word, Excel, and PowerPoint. Start with the common workflow, then follow the product-specific guidance.

Troubleshooting workflow​

  1. Confirm prerequisites: Ensure the endpoint meets the Plugin Prerequisites and that the Cyberhaven Sensor is healthy on the Endpoint Sensors page.
  2. Baseline the issue: Reproduce the behavior with the Cyberhaven plugin disabled. If the problem persists, the root cause may be unrelated to the plugin.
  3. Collect diagnostics: Generate a diagnosis bundle from the Cyberhaven console (Endpoint Sensors > Actions > Generate Diagnostics) and provide it to Cyberhaven Support when opening a case.
  4. Check registry protections: Verify that the managed add-in registry keys listed in the installation guide are present. Missing keys can allow Outlook or users to disable the plugin.
  5. Review endpoint protections: Confirm that antivirus or EDR tools exclude the Cyberhaven Sensor processes and installation directory so they are not blocking plugin activity.

Outlook (Classic) plugin​

Verify plugin status​

  • Confirm CyberhavenOutlookMonitor is listed under Active Application Add-ins in Outlook (File > Options > Add-ins).
  • If the add-in appears under Disabled Application Add-ins, select COM Add-ins in the Manage box, click Go, and re-enable the add-in.
  • Restart Outlook after every change to ensure the plugin loads correctly.

Resolve "Outlook Plugin Stopped" alerts​

  • Enable Cached Exchange Mode in Outlook and restart the application.
  • If Cached Exchange Mode must remain disabled, contact Cyberhaven Support to enable the backend configuration that supports non-cached environments.

Gather TRACE logs (temporary)​

  1. Close Outlook.
  2. Open Notepad as an administrator.
  3. Edit C:\Program Files\Cyberhaven\settings-core.json.
  4. Change "Logging": { "Level": "INFO", "PushIntervalSeconds": 60 } to "Logging": { "Level": "TRACE", "PushIntervalSeconds": 60 }.
  5. Save the file and restart Outlook.
  6. Reproduce the issue, collect the resulting logs, then revert the logging level to INFO to prevent performance degradation.

Temporarily disable for testing​

WARNING: Use only for debugging on affected hosts. Manual registry changes must be reversed to restore normal operation.

  1. Open regedit as an administrator.
  2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\CyberhavenOutlookMonitor.
  3. Rename the Manifest value (for example, to !Manifest).
  4. Restart Outlook to unload the plugin.
  5. Restore the original value name and restart Outlook to re-enable the plugin.

Suppress performance warning banners​

If Outlook displays "Outlook disabled the add-in 'Cyberhaven Outlook Add-In'. It caused Outlook to start slowly," set the following registry values to 0 and redeploy via GPO or another device management tool:

[HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Resiliency\NotificationReminderAddinData]
"CyberhavenOutlookMonitor\\dtype"="0"
[HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Resiliency\NotificationReminderAddinData]
"CyberhavenOutlookMonitor\\dtype"="0"
[HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Resiliency\NotificationReminderAddinData]
"CyberhavenOutlookMonitor\\dtype"="0"

New Microsoft Outlook add-in​

  • Confirm the device is running the New Microsoft Outlook (September 2023 release or later). The add-in is not compatible with Outlook (Classic).
  • Ensure the user is signed in with a Microsoft account. The add-in cannot be deployed to non-Microsoft identities.
  • Verify deployment from the Microsoft 365 admin center completed successfully and that the add-in appears under Manage add-ins in Outlook.
  • Review the Endpoint Sensors page for any "Restart Outlook" actions and instruct users to relaunch the application.
  • Remember documented limitations when validating behavior:
    • "Received File" and "Saved Email Attachment" events are not captured (use the legacy plugin for those signals).
    • Files attached using Suggested files, or added to OneDrive and shared as links, are not tracked.
    • External email accounts (for example, Gmail via IMAP) are not monitored.
    • Actions performed in rapid succession may be missed due to Microsoft add-in processing constraints.
  • If users see misleading connectivity warnings while Outlook is online, confirm network access to Cyberhaven and Microsoft services. The messages typically clear once connectivity stabilizes.

Word, Excel, and PowerPoint plugins​

  • Verify that CyberhavenWordMonitor, CyberhavenExcelMonitor, and CyberhavenPowerPointMonitor are listed under Active Application Add-ins in each application.
  • Reapply the registry policies documented in the installation guide if the plugins move to Disabled Application Add-ins.
  • Check that file activity is reported in the Cyberhaven console. If events are missing, confirm the Office application was restarted after installation and that endpoint protections are not blocking the plugin DLLs.

Contacting Support​

If the above steps do not resolve the issue, gather the diagnosis bundle, relevant log files, and details about the affected Office version, and open a case with Cyberhaven Support for further assistance.