Microsoft Word (Office 365) still calls 'GetClipboardData' API for fetching clipboard data even after disabling the 'Active Clipboard' feature - Win11

Problem statement:

Issue with Office 365 windows/ Win11: Despite disabling the Microsoft Office's 'Active Clipboard' via registry, Word application continues to access Clipboard data originating from the default Notepad.

Brief problem description:

Pre-Understanding :

When a user tries to copy a data from an application and paste in another, the later application calls the API 'GetClipboardData' to fetch the data from clipboard to make it available in it. The 'Active Clipboard' feature in Office applications automatically retrieves clipboard data and displays it within their respective windows when the app is opened, even in the absence of a 'paste' action by the user. For this the application internally calls the API 'GetClipboardData'.

If we don't want this unintentional fetching of Clipboard data, we can disable this feature of Office applications via registry. Disabling 'Active clipboard' via registry worked just fine till Win 10. That is, after disabling this feature, the office application won't try to fetch clipboard data automatically unless user tries to perform manual paste action. In other words, if the feature is disabled, the application won't call 'GetClipboardData' API by itself.

Main problem :

In Win 11, this behavior is broken. Even after disabling the 'Active clipboard', word application tries to call 'GetClipboardData' unnecessarily internally when the application is opened. This problem we see in conjunction with usage of default notepad.

How to reproduce:

(Reproduction needs an external tool that can trace the Win32 api calls made by the word application. I used API monitor.)

1. In windows 11,

2. Make sure office's active clipboard is turned off by setting the value to appropriate registry keys (what value and which registry keys are explained below).

3. Open a word document (any) and keep it minimized.

4. Start tracing the api calls done by the word application.

5. Open a text file that has some random text using win 11 default notepad.exe

6. Copy some text from notepad editor.

7. Now, open the minimized word document by clicking on the word app icon from toolbar.

8. Word document gets displayed on the screen.

9. This moment, we can see that WinWord.exe calls the GetClipboardData API (even though Office's active clipboard is turned off).

   
   
   

How to disable Office's Active clipboard via registry:

We follow the steps mentioned in https://support.microsoft.com/en-us/topic/macro-takes-longer-than-expected-to-execute-many-individual-copy-and-paste-operations-in-excel-2010-and-later-403dc927-b7e7-7096-0cc8-bd8a2b1e685c

We are disabling it by setting the value 0x80000000 for both the below registry keys:

Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\General\\AcbControl

 &

Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\General\\AcbControl

We confirm that Active clipboard is disabled by checking in the Word application UI. (Screenshot attached).

Impact:

This issue has a significant impact on the functionality of our DLP security product, resulting in the generation of false positive alerts within our customers' systems.

Our DLP product hooks into 'GetClipboardData' API to track data retrieved from the clipboard by Office applications following a user-initiated 'Paste' action (Ctrl+V). Upon detection of sensitive data, our product processes it and generates notification alerts in the customer's system in the event of a security violation. To prevent the generation of alerts for unintentional clipboard data fetching, we typically disable the 'Active Clipboard' feature of Office applications on customer systems.

However, despite this preventive measure being effective up to Windows 10, we have encountered escalations from customers using Windows 11 reporting false positive alerts from our product even after disabling the 'Active Clipboard' feature.

Versions: