ExcelDna.ManagedHost.dll is blocked by Windows Defender as unsigned file

[kolkhi]

Hello,

We are experiencing an issue with running the Excel add-in on a machine with certain security policies enabled. The problem is caused by Windows Defender blocking the add-in loading process, as it flags ExcelDna.ManagedHost.dll as not signed, although the XLL file is signed.

The problem is resolved by adding the file to the exceptions list. However, we can't use it as a permanent solution.
Is there a possibility to sign DLLs included in the generated XLL file?

[govert]

How are you currently signing your .xll - using the <ExcelAddInSignTool> and <ExcelAddInSignOptions> properties in the project file? Would it help you if the same certificate were used to sign the ExcelDna.ManagedHost.dll as part of the build?

[Kellybnd]

What I ended up doing to address this in my application was to add a step in my build pipeline to search for all of the ExcelDNA DLLs in the NuGet cache on disk and sign them with the same code signing certificate that I use to sign the XLL files. It will skip any that are already signed. Here's the build task (in YAML) that does this:

- task: PowerShell@2
  displayName: 'Sign ExcelDna DLLs in NuGet cache'
  inputs:
    targetType: 'inline'
    script: |
      Write-Host "Locating ExcelDna DLLs in NuGet cache..."
      Write-Host ""
      
      # Find NuGet packages folder
      $nugetPaths = @(
        "$env:USERPROFILE\.nuget\packages",
        "$env:NUGET_PACKAGES",
        "C:\Users\$env:USERNAME\.nuget\packages"
      )
      
      $nugetPath = $null
      foreach ($path in $nugetPaths) {
        if (-not [string]::IsNullOrWhiteSpace($path) -and (Test-Path $path)) {
          $nugetPath = $path
          Write-Host "Found NuGet packages at: $nugetPath"
          break
        }
      }
      
      if (-not $nugetPath) {
        throw "Could not find NuGet packages folder"
      }
      
      # Find all ExcelDna folders
      $excelDnaFolders = Get-ChildItem -Path $nugetPath -Directory -Filter "exceldna*" -ErrorAction SilentlyContinue
      
      Write-Host ""
      Write-Host "Found ExcelDna package folders:"
      $excelDnaFolders | ForEach-Object { Write-Host "  - $($_.FullName)" }
      Write-Host ""
      
      $filesToSign = @()
      
      # Find only DLLs in ExcelDna folders (NOT XLLs - those are native shims that get modified during pack)
      foreach ($folder in $excelDnaFolders) {
        $files = Get-ChildItem -Path $folder.FullName -Include "*.dll" -Recurse -ErrorAction SilentlyContinue
        
        foreach ($file in $files) {
          try {
            $sig = Get-AuthenticodeSignature -FilePath $file.FullName
            if ($sig.Status -ne "Valid") {
              $filesToSign += $file.FullName
              Write-Host "Will sign: $($file.FullName)"
            } else {
              Write-Host "Already signed: $($file.Name)"
            }
          } catch {
            $filesToSign += $file.FullName
            Write-Host "Will sign (unable to verify): $($file.FullName)"
          }
        }
      }
      
      Write-Host ""
      Write-Host "Found $($filesToSign.Count) ExcelDna DLLs to sign."
      
      if ($filesToSign.Count -gt 0) {
        Write-Host ""
        Write-Host "Signing ExcelDna DLLs..."
        AzureSignTool sign -kvu "$(SigningVaultUrl)" -kvi "$(SigningClientId)" -kvt "$(SigningTenantId)" -kvs "$(SigningClientSecret)" -kvc "$(SigningCertName)" -tr "http://timestamp.digicert.com" -v $filesToSign
        
        if ($LASTEXITCODE -ne 0) {
          throw "AzureSignTool failed with exit code $LASTEXITCODE"
        }
        Write-Host ""
        Write-Host "ExcelDna DLLs signed successfully."
      } else {
        Write-Host "No unsigned ExcelDna DLLs found."
      }

I'm using the AzureSignTool to do the signature using a certificate stored in Key Vault which supports specifying multiple files to sign in one command, but you can change that line to use SignTool and adjust the PowerShell script accordingly.

[kolkhi]

How are you currently signing your .xll - using the <ExcelAddInSignTool> and <ExcelAddInSignOptions> properties in the project file? Would it help you if the same certificate were used to sign the ExcelDna.ManagedHost.dll as part of the build?

Hi Govert. Sorry for late reply. We sign XLL files from the nuget package manually and then create a new package consumed from the internal nuget server. I believe <ExcelAddInSignTool> and <ExcelAddInSignOptions> will sign XLL file automatically during the build, but will this affect the ExcelDna.ManagedHost.dll?

[kolkhi]

What I ended up doing to address this in my application was to add a step in my build pipeline to search for all of the ExcelDNA DLLs in the NuGet cache on disk and sign them with the same code signing certificate that I use to sign the XLL files. It will skip any that are already signed. Here's the build task (in YAML) that does this:

- task: PowerShell@2
  displayName: 'Sign ExcelDna DLLs in NuGet cache'
  inputs:
    targetType: 'inline'
    script: |
      Write-Host "Locating ExcelDna DLLs in NuGet cache..."
      Write-Host ""
      
      # Find NuGet packages folder
      $nugetPaths = @(
        "$env:USERPROFILE\.nuget\packages",
        "$env:NUGET_PACKAGES",
        "C:\Users\$env:USERNAME\.nuget\packages"
      )
      
      $nugetPath = $null
      foreach ($path in $nugetPaths) {
        if (-not [string]::IsNullOrWhiteSpace($path) -and (Test-Path $path)) {
          $nugetPath = $path
          Write-Host "Found NuGet packages at: $nugetPath"
          break
        }
      }
      
      if (-not $nugetPath) {
        throw "Could not find NuGet packages folder"
      }
      
      # Find all ExcelDna folders
      $excelDnaFolders = Get-ChildItem -Path $nugetPath -Directory -Filter "exceldna*" -ErrorAction SilentlyContinue
      
      Write-Host ""
      Write-Host "Found ExcelDna package folders:"
      $excelDnaFolders | ForEach-Object { Write-Host "  - $($_.FullName)" }
      Write-Host ""
      
      $filesToSign = @()
      
      # Find only DLLs in ExcelDna folders (NOT XLLs - those are native shims that get modified during pack)
      foreach ($folder in $excelDnaFolders) {
        $files = Get-ChildItem -Path $folder.FullName -Include "*.dll" -Recurse -ErrorAction SilentlyContinue
        
        foreach ($file in $files) {
          try {
            $sig = Get-AuthenticodeSignature -FilePath $file.FullName
            if ($sig.Status -ne "Valid") {
              $filesToSign += $file.FullName
              Write-Host "Will sign: $($file.FullName)"
            } else {
              Write-Host "Already signed: $($file.Name)"
            }
          } catch {
            $filesToSign += $file.FullName
            Write-Host "Will sign (unable to verify): $($file.FullName)"
          }
        }
      }
      
      Write-Host ""
      Write-Host "Found $($filesToSign.Count) ExcelDna DLLs to sign."
      
      if ($filesToSign.Count -gt 0) {
        Write-Host ""
        Write-Host "Signing ExcelDna DLLs..."
        AzureSignTool sign -kvu "$(SigningVaultUrl)" -kvi "$(SigningClientId)" -kvt "$(SigningTenantId)" -kvs "$(SigningClientSecret)" -kvc "$(SigningCertName)" -tr "http://timestamp.digicert.com" -v $filesToSign
        
        if ($LASTEXITCODE -ne 0) {
          throw "AzureSignTool failed with exit code $LASTEXITCODE"
        }
        Write-Host ""
        Write-Host "ExcelDna DLLs signed successfully."
      } else {
        Write-Host "No unsigned ExcelDna DLLs found."
      }

I'm using the AzureSignTool to do the signature using a certificate stored in Key Vault which supports specifying multiple files to sign in one command, but you can change that line to use SignTool and adjust the PowerShell script accordingly.

Thanks for the suggestion. Unfortunately, this solution won't work for the ExcelDna.ManagedHost.dll, as it does not exist in the NuGet package as a standalone file.