Office Update trying to start inside Default Sandbox

[caduser]

I started outlook today (NOT IN SANDBOX) as I do each morning and I saw there was an office update available. I selected and a moment later I got a warning about trying to start a program in another sandbox when one is running.

I have a sandbox called test and I am running a program. SO I thought strange wonder what triggered an attempt on a second sandbox. I closed the error and carried on. I kept getting the pop up so I selected my default and Terminate all programs. It indicated I did not have any running.

Every time I tried to start the office update (running outside sandbox I never run office in sandboxes) the message popped up. So I closed al office apps, I closed all my sandbox, killed the service and process. Restarted sandboxie (nothing running in any sandbox). Started outlook, and then tried to start my test again. I could not as it indicated something was now running in one of the other. Sure enough my Default Sandbox was trying to run the office update...how has this happened? How do I stop it? I don't want office updating in the sandbox I want it running outside.



--------MERGED POST ------------------
SBIE1303 Only one sandbox can be active at a time
SBIE1211 Could not initiate sandboxing for process 14184


Happening again I killed Sandbox..ran full windows update (I usually have updates paused). Restarted Started my test sandbox program and 10 mins later this, something keeps trying to start in a sandbox and I guess the Default.

I had also changed the default sandbox settings to Restrictiosn Start/Run Only notepad.exe can run hoping that it would prevent anything else even trying.

The Default has zero programs installed so only has some reghive in the folder.

Is there a way to find what program keeps trying (I am assuming it is from my office app as the windows update did not appear to find office updates yet office is) and also how can I stop it.

[Barb@Invincea]

Hello ,

Please provide all the required info so that we can assist you: (be sure to include the exact office version that you are running, and whether it is click-to-run (365) or a different version):
viewtopic.php?f=11&t=19746

Also, please post the output of your Sandboxie configuration
Configure---> Edit configuration
Copy-paste the contents
Highlight the contents and click on the "</>" button to format it in the forums.

Regards,
Barb.-

[caduser]

Office 2016 Installed locally but was from my Office 365 subscription.
OS = Windows 10 (all programs installed not apps)
Sandboxie 5.22 64bit

Code: Select all

[GlobalSettings]

Template=WindowsRasMan
Template=DigitalPersona
Template=WindowsLive
Template=AdobeAcrobatReader
Template=WacomTablet
Template=OfficeLicensing
Template=AdobeDistiller
Template=OfficeClickToRun
FileRootPath=D:\Sandbox\%USER%\%SANDBOX%
TemplateReject=ScreenReader

[DefaultBox]

ConfigLevel=7
AutoRecover=y
BlockNetworkFiles=y
Template=qWave
Template=WindowsFontCache
Template=BlockPorts
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Enabled=y,caduser
NotifyStartRunAccessDenied=y
ProcessGroup=<StartRunAccess>,notepad.exe
ClosedIpcPath=!<StartRunAccess>,*

[UserSettings_40C004F0]

SbieCtrl_UserName=caduser
SbieCtrl_NextUpdateCheck=1518791387
SbieCtrl_UpdateCheckNotify=n
SbieCtrl_ShowWelcome=n
SbieCtrl_AutoApplySettings=n
SbieCtrl_WindowCoords=303,226,1237,703
SbieCtrl_ActiveView=40021
SbieCtrl_EnableLogonStart=y
SbieCtrl_EnableAutoStart=y
SbieCtrl_AddDesktopIcon=y
SbieCtrl_AddQuickLaunchIcon=y
SbieCtrl_AddContextMenu=y
SbieCtrl_AddSendToMenu=y
SbieCtrl_ProcessViewColumnWidths=250,70,300
SbieCtrl_BoxExpandedView=Test_apps,test_ts

[Test_apps]

Enabled=y
ConfigLevel=7
AutoRecover=y
BlockNetworkFiles=y
Template=qWave
Template=WindowsFontCache
Template=BlockPorts
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl

[test_ts]

Enabled=y
ConfigLevel=7
AutoRecover=y
BlockNetworkFiles=y
Template=qWave
Template=WindowsFontCache
Template=BlockPorts
Template=LingerPrograms
Template=Chrome_Phishing_DirectAccess
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl

I run various test apps several home grown (test installers). I happen to be running only an install of teamspeak to ensure that particular version was running OK I have actually been running it for 6 weeks no changes only had the issue when office notified me of updates. I can't be 100% sure it is those updates but they would only restart once my other sandbox was stopped so for some reason it would appear that the office update tried to initiate in a sandbox.

Sandboixe was installled several days after I installed MS Office 2016.
Other possible unique things was I had this issue because I run Inventor (not sanboxed) which I resolved by unchecking JAWS:

viewtopic.php?f=11&t=23510&p=131828#p131828



--------MERGED POST -----------------
I have selected for now Disable forced Programs and so far not had the pop up..will monitor. I guess worst case I disable sandbox service...try to force the Office update and then restart.

[Barb@Invincea]

Hello caduser,

I have selected for now Disable forced Programs and so far not had the pop up

Did you make those changes before posting your Sandboxie configuration? (I was looking for something similar, to see what was being forced, but didn't find anything ).

What else was forced? (if anything).

Regards,
Barb.-

[caduser]

I did it before posting but it seems temporary. Also looks like office just stopped checking. I don't have any forced programs I was just grasping at straws.

the problem is still there though I just used the Office > Account > Check for updates and straight away I get the sandbox warning. And it is constant every 30 seconds another popup

Even if I terminated my other sandbox so it could run in default I do not want office installing updates in the sandbox, why is it spawning a sandbox process.

To be honest I had no clue what Click-to-Run was I used to use Office from a DVD and only recently moved to 365, I do see that as a running service so I killed it and that stopped the messages again for now.

[Barb@Invincea]

Hello caduser,

Updates should not run in the Sandbox (in fact, they will most likely fail if forced to run there). I cannot repro this behavior on Win 10 FCU x64 + Sbie 5.23.5 + Office 2016 C2R.

Do you have the current Sandboxie configuration (the one that is triggering the updates to run Sandboxed)? If yes, please post it.
What is the exact version of Office that you are running?

Please try the latest beta as it contains some updates regarding office (slightly different version, but I wonder if it affects 2016):
viewtopic.php?f=64&t=25114

If all fails, please go ahead and run a procmon so that we can review the logs:
Download procmon.exe from https://docs.microsoft.com/en-us/sysint ... ds/procmon
Start procmon and reproduce the issue, then save the log and provide us the link (you will have to upload it to a file hosting website as they tend to be big files).

Regards,
Barb.-

[caduser]

Do you mean the current sandbox config that is running or the config of the one it seems to want to run in?

Seems to be outlook 1x a day at moment (when it first happened it was popping up a lot). Outlook2016 MSO 16.09001.2080 32bit

As soon as I select File > Office Account > Update Options > Update Now

Then I cannot get any work done because it is constant popup messages could not initiate sandboxing for process (some number) and it keeps running and running for a bout 5 or 6 tries and eventually stops or until I kill outlook and start over. I have this on my laptop and never had an issue there same version same OS same Office. Any way to capture the process name it is trying to start the ID of course doe snot exist as it cannot start it.

[Barb@Invincea]

Hello caduser ,

The config that is causing the problem. It should be the one in which Office is trying to run the updates.

Also, please try the other things I suggested whenever you get a chance.

Regards,
Barb.-

[caduser]

How do I get the config of just that sandbox?

MERGED POST
Fixed it well work around maybe...I just unchecked the setting in Software Compatibility > Microsoft Office Click-to-Run it is checked by default but not needed by me. I did this and then selected update this time the updater actually started (Red Office update checking > Updates found and applying)