#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : An add-in keeps disabling itself, or will not stay enabled
    Fix   : Stop Office disabling a known-good add-in across the estate
    Source: https://jbtecwiz.com/support/win-office-addin-disabled

    Run as     : Group Policy or the registry, as administrator
    Expect     : 40 minutes
    Risk       : medium
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    A business-critical add-in is being disabled on many machines and you
    have satisfied yourself it is healthy.

    HOW TO UNDO IT
    Delete the DoNotDisableAddinList value to hand control back to Office.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

# - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT -
# The commands below contain values only you can supply. Search the
# script for each one, replace it, then delete this block.
$script:MustEdit = @(
    'Vendor.AddinName'   # a placeholder add-in ProgID
)
if ($script:MustEdit.Count) {
    Write-Host ""
    Write-Host '  This script needs editing before it can run.' -ForegroundColor Yellow
    Write-Host '  Replace each of these with a real value:' -ForegroundColor Yellow
    $script:MustEdit | ForEach-Object { Write-Host ("    " + $_) -ForegroundColor Yellow }
    Write-Host ""
    Write-Host '  Then delete the $script:MustEdit block near the top.'
    Write-Host ""
    exit 2
}

# This fix is documented as needing an elevated session.
$id = [Security.Principal.WindowsIdentity]::GetCurrent()
if (-not (New-Object Security.Principal.WindowsPrincipal $id).IsInRole(
        [Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host ''
    Write-Host '  This fix needs an elevated PowerShell.' -ForegroundColor Yellow
    Write-Host '  Close this window, right-click PowerShell, Run as administrator,'
    Write-Host '  and run the script again.'
    Write-Host ''
    exit 3
}

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 5"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  An add-in keeps disabling itself, or will not stay enabled' -ForegroundColor White
Write-Host '  Stop Office disabling a known-good add-in across the estate' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: medium   Reversible   40 minutes'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Confirm it really is healthy first. This fix tells Office to stop protecting the user from it, so a genuinely crashing add-in will now take the application down every time instead of being disabled.' -Why 'The resiliency mechanism exists for a reason. Overriding it for something that actually crashes converts a manageable annoyance into repeated data loss for the user.' -Manual

Invoke-Step -Number 2 -Do 'Get the add-in''s ProgID exactly as registered.' -Command {
    Get-ChildItem 'HKCU:\Software\Microsoft\Office\Excel\Addins' | Select-Object PSChildName
}

Invoke-Step -Number 3 -Do 'Add it to the do-not-disable list for the application.' -Why 'A value of 1 keeps the add-in enabled even if it crashes or loads slowly. 0 and 2 are narrower -- 1 is the setting people actually want here.' -Command {
    $k='HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Resiliency\DoNotDisableAddinList'
    New-Item $k -Force | Out-Null
    Set-ItemProperty $k -Name 'Vendor.AddinName' -Type DWord -Value 1
}

Invoke-Step -Number 4 -Do 'Deploy it through the Office administrative templates for a fleet rather than per machine, so it survives rebuilds.' -Manual

Invoke-Step -Number 5 -Do 'Also raise the load-time threshold if the add-in is being disabled for being slow rather than for crashing -- that is a separate policy under the same Resiliency branch.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'The add-in stays enabled across restarts on a machine that was previously disabling it.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-addin-disabled' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Delete the DoNotDisableAddinList value to hand control back to Office.' 'DarkGray'
Write-Rule