Managing Excel XLL Extensions

Force Excel .xll add-ins on or off and control their load order with the Managed Extensions policies

Excel native .xll add-ins are not loaded through the COM LoadBehavior mechanism that governs Word/Outlook/PowerPoint add-ins. Instead, Excel loads them from a numbered list of OPEN registry values. Deck manages that list on your behalf through three machine-scoped policies under Managed Extensions.

Background: how Excel loads XLLs

Excel reads its XLL add-ins from:

HKCU\SOFTWARE\Microsoft\Office\16.0\Excel\Options

as a sequence of values named OPEN, OPEN1, OPEN2, … Each holds an entry like /R "C:\Addins\MyAddin.xll". The order of these values is the load order, and gaps or duplicates can prevent add-ins from loading. Managing this by hand across a fleet is fragile - which is what these policies solve.

The Managed Extensions policies

These settings live under a dedicated subkey and are machine-scoped only:

HKLM\SOFTWARE\Policies\Vediram\Deck\ManagedExtensions

In the Group Policy editor they appear under Computer Configuration → … → Vediram → Deck → Managed Extensions.

Value	Type	Meaning
`OPENorder`	`REG_SZ`	Semicolon-delimited bare XLL filenames defining the required load order.
`ForceOn`	`REG_SZ`	Bare filenames that must always be loaded. Deck adds them to the `OPEN` sequence if missing.
`ForceOff`	`REG_SZ`	Bare filenames that must never be loaded. Deck removes them from the `OPEN` sequence.

All three use bare filenames (for example MyAddin.xll), not full paths - Deck resolves the file. Separate multiple entries with semicolons:

OPENorder = RiskEngine.xll;MarketData.xll;Pricing.xll
ForceOn   = MarketData.xll
ForceOff  = LegacyReporting.xll

How Deck reconciles the list

Deck's XLL reconciliation runs autonomously in the Core daemon: it watches the OPEN values and rebuilds them to satisfy policy. The resulting order is determined by these rules, applied in priority:

ForceOff wins. Any listed filename is removed from the OPEN sequence, even if it also appears in ForceOn or OPENorder.
ForceOn next. Listed filenames are ensured present. If a filename can't be resolved to an actual .xll on the machine, it is skipped (no broken entry is written).
OPENorder sets the sequence. Remaining forced/ordered entries are arranged in the order you specify.
Original entries follow. XLLs that were already registered but aren't named in any policy are kept, appended after the ordered ones in their original relative order.

Because ForceOff takes precedence over ForceOn, listing the same file in both results in the add-in being off.

Deck records per-XLL state (filename, registry value, enabled/disabled, and force state) internally so reconciliation is stable across restarts.

Worked example

Goal: guarantee the risk and market-data add-ins load first and always, keep a legacy add-in permanently disabled, and leave any other user-installed XLLs alone.

OPENorder = RiskEngine.xll;MarketData.xll
ForceOn   = RiskEngine.xll;MarketData.xll
ForceOff  = LegacyReporting.xll

Result on a machine that also has UserMacro.xll installed:

LegacyReporting.xll is removed.
RiskEngine.xll, then MarketData.xll are placed first (forced on and ordered).
UserMacro.xll remains, appended after the managed entries.

Notes and limits

These policies apply to Excel .xll add-ins only. COM/VSTO add-ins (including Excel COM add-ins) are managed through profiles and LoadBehavior - see Managing Profiles Centrally.
The settings are machine-only; there is no user-scope equivalent.
Filenames are matched by name, not path - two different .xll files with the same filename cannot be distinguished.

Managing Profiles Centrally Common Admin Scenarios