How to troubleshoot orphaned and corrupted Office registry keys



Overview: COM and .NET errors

In some circumstances, devices that have completed an Office architecture migration (e.g., moving from 32-bit to 64-bit) will have lingering registry keys that interfere with COM and .NET functionality. Generally, these issues occur when the COM or .NET client is running as a 32-bit process.


The following PowerShell script is an example where you may encounter these errors. The following code is being executed using PowerShell (x86):



$xl = New-Object -ComObject Excel.Application
$xl.Visible = $True



The observed errors may include:


Understanding how to detect the problem

Detection and eventual remediation requires scanning the registry for leftover or corrupted registry keys and deleting or correcting the identified keys. At this time, we have identified the following patterns:


1. Orphaned references to 32-bit providers of Office type libraries.

There may be keys that follow the pattern [HKEY_CLASSES_ROOT\WOW6432Node\TypeLib\<GUID>\1.9\0\Win32] and contain a default value that points to a non-existent Office executable in the Program Files (x86) path, such as C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE. These keys should have adjacent Win64 keys that point to a correct 64-bit Program Files location. The remediation is to delete the Win32 key.


2. Corrupted (empty) values for Office 32-bit interface definitions.

There may be keys that follow the pattern [HKEY_CLASSES_ROOT\WOW6432Node\Interface\<GUID>\ProxyStubClsid32] and have an empty default value. These keys should have corresponding keys outside of the WOW6432Node, following the pattern [HKEY_CLASSES_ROOT\Interface\<GUID>\ProxyStubClsid32], and with properly defined default values. The remediation is to delete the parent Interface key with a path having the pattern of [HKEY_CLASSES_ROOT\WOW6432Node\Interface\<GUID>].


Available resources for remediation


Orphaned references to 32-bit providers of Office type libraries.

We have developed two resources to help detect and remediate this first pattern. 

  • Standalone PowerShell script - This script can be executed on affected devices to detect and remediate the orphaned references.
  • Configuration Baseline - The baseline is for use with Microsoft Endpoint Configuration Manager. Once imported, the baseline can be deployed in "Monitor" mode first to help detect impacted devices, and then enabled for automatic remediation.

Both of these resources are available on GitHub, along  with additional instructions for deployment:


GitHub: Office TypeLib Remediation


Corrupted (empty) values for Office 32-bit interface definitions.

Remediation for the second pattern will be coming soon. Be sure to subscribe to the post for future updates.


Future Updates

At the time of writing this post we are continuing to monitor for reports of additional symptoms, and exploring opportunities for better integration. This article and the corresponding resources are provided as a first step in addressing these symptoms. We will continue to update this post and the provided resources as we identify new variables.

0 Replies