CB Defense: Excel Workbook returns "Page Cannot be Displayed" in IE11

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)

Issue/Introduction

• Configure Excel to automatically open Print to PDF Software Plugin (Print2PDF.xlam) when it starts
• Select hyperlink to Excel Workbook to open in Internet Explorer (IE) 11 
• Spreadsheet will fail to open with "Page Cannot be Displayed"
• Deny and Terminate events are not observed in the Cb Defense PSC Web Console

Environment

• Cb Defense PSC Console: All Versions
• Cb Defense Sensor: All Versions
• Microsoft Windows: All Supported Versions

Cause

When the CB Defense Sensor is enabled, Excel fails to open because access to Print2PDF.xlam is denied. This case can be observed in Windows Process Monitor.

EXCEL.EXE	32332	30860	IRP_MJ_CREATE	C:\Program Files (x86)\Microsoft Office\Office14\XLSTART~$Print2PDF.xlam	ACCESS DENIED C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

 

Resolution

Delete the Print2PDF.xlam from the XLSTART folder. The path to this folder may change depending on the version of Windows. See Automatically open a specific workbook or template when you start Excel

Additional Information

• Print to PDF Software Plugin (Print2PDF.xlam) is a Excel Macro-Enabled Add-In file that allows users to convert office documents to a PDF