PowerPoint Opening file error

Few days ago a user reported to me a powerpoint opening file error. He has received an email with a powerpoint file as attached piece, and when he tried to open it he got this message:

PowerPoint found a problem with content in filename.pptx.
PowerPoint can try can attempt to repair the presentation.
if you trust the source if this content, click repair.

PowerPoint_error_Msg_01

And even when he clicked on the repair button he got an other message “Sorry…PowerPoint can’t read filename.pptx

 

PowerPoint_error_Msg_02

So, I told him to send me the file and I opened it successfuly on my computer.

First deduction, the problem is not related to the powerpoint file but in the PC’s configuration.

First of all, I did some search on google and I found some workarounds that suggest to disable the “Enable protected view for files originating from Internet” option in the “Trust Center > Protected View” Menu.

Office_TrustCenter_Menu

By doing so, it works but it’s not safe to let this option disabled. So I decided to deal diffrently with this problem.

To figure out what is the problem, I’ve used Process Monitor and recorded a trace when opening the file on the user’s PC.

First thing to do in Procmon, create a filter on the process name = POWERPOINT.EXE. Thus we restrict our investigation scope to the process we are interested in.

ProcMon_Filter_on_PPT

 

Next, we need to apply a filter on the result by going to the menu “Tools > Count values Occurences”

We need to look in the events by applying a filter on those that we consider interesting. I mean events like “Access denied, Name Invalid, Path not found and sharing violation”.

ProcMon_Occurences_Result_01

After a few investigations, I’ve found something interesting when applying the “Path not found” filter. PowerPoint is looking for “MSPPT.OLB” file in “C:\Program Files\Microsoft Office\Root\Office16\”

ProcMon_PathNotFound_Filter

Knowing that all our computers are using MS Office 2010 or 2013. Why PowerPoint 2013 is trying to open a file that seems to belong to an Office 2016 installation that should not to be here.
By asking the user this question, he admitted that he has installed Office 2016 to test and removed it after.

Now we need to find where PowerPoint take the Office16 path reference instead of Office15.

by doing a search using a key word “Office16” we find this:

Office16_ref

Office16_ref_01

The Office16 path is registered in the registery base.

When opening the regedit utility and seeking for the indicated key, we can notice that above the “2.c” directory exists two others “2.a” and “2.b” each one tip repectively on the following path: “C:\Program Files (x86)\Microsoft Office\Office14\MSPPT.OLB” for Office 2010 and “C:\Program Files\Microsoft Office\Office15\MSPPT.OLB” for Office 2013.

So my guess is; when PowerPoint looks for the MSPPT.OLB’s path it moves to the last folder under “HKEY_CLASSES_ROOT\TypeLib\{91493440-5A91-11CF-8700-00AA0060263B}”. And as Office 2016 have been deleted by the uninstaller, the folder “C:\Program Files\Microsoft Office\Office16” do not exist any more.

By deleting the “HKEY_CLASSES_ROOT\TypeLib\{91493440-5A91-11CF-8700-00AA0060263B}\2.c” key, PowerPoint opened the file without problem.

 

Process Monitor is a powerfull tool that can help system administrators to solve some tricky issues.

Thank you for reading.