VediramDeck · add-in management for Microsoft 365Your Office runs add-ins you never chose. Deck lets you decide what loads.
Deck finds every add-in across nine Office apps, lets you group the ones you need into profiles of your own, and names the add-in behind a crash. IT manages the whole surface through Group Policy.
For people who live in Office and the IT teams who answer for it. Windows 11; classic desktop Office, 2013 onward. MSI, portable ZIP, and ADMX templates, signed through the Vediram release pipeline.
The add-ins nobody can see
Add-ins arrive with every tool the business buys: a CRM pane for Outlook, a reporting pack for Excel, a document stamp for Word. Each one loads at every start of its host app. Nobody removes them, because nobody can see them: the COM Add-ins dialog sits four menus deep in each app’s options, XLLs live in a different dialog, web add-ins in a third, and the truth behind all of them is a set of registry keys per user, per app.
So Excel opens slowly and nobody knows which passenger to blame. Outlook crashes and Windows blames Outlook. Office’s own protection makes it stranger: after a bad start, Office hard-disables an add-in on its own, silently, and the user discovers the missing toolbar mid-deadline. Re-enabling it by hand often fails, because the hard-disable entry is still armed underneath.
IT sees the same surface from the other side: no inventory of what is installed across the fleet, no record of what crashed, and no way to enforce which add-ins load short of scripting registry writes and hoping.
Every add-in, one inventory
Deck scans the machine and lists everything Office would load, in one place.
COM and VSTO add-ins, Excel XLL workbooks and add-ins, Excel Automation add-ins, and Office web add-ins.
Excel, Outlook, Word, PowerPoint, OneNote, Visio, Project, Access, and Publisher, in both the user’s and the machine’s registry scope.
Publisher and version resolved from the add-in’s own manifest or file information, plus the Office version, update channel, and bitness it runs against.
Each add-in links to a detail view with its load behavior, boot-time history, and crash record. Discovery runs at startup and on demand, and a transient read failure degrades that one entry instead of the scan.
Profiles: decide what loads
A profile is a named set of add-ins. Build one for month-end close, one for the road, one that is Outlook with nothing in it. Then switch.
Activation is one click in Deck or two in the system tray menu. A default profile applies itself at logon.
Activation writes the registry, then asks running Office apps to pick the change up through Office’s own automation interfaces. You choose per activation: apply now, or registry only for next launch.
When a profile enables an add-in that Office had hard-disabled, Deck clears the resiliency entry too. Without that step, the enable is a lie: the registry says load and Office refuses.
Deck preserves the machine’s original configuration as a protected profile, so any experiment is one switch from undone.
When Office crashes, get a name
Deck watches for Office crash dumps and attributes each crash through three tiers: Windows Error Reporting artifacts, Event Log, and Office’s own crash bookkeeping first; then the minidump itself; then a managed-memory analysis of the dump when the faulting code is .NET. The result is a crash report that names the add-in and module at fault, with the loaded-module list and event entries attached.
Crashes plot on a timeline per app. Boot-time metrics chart each add-in’s cost at every Office start, so the slow one is a line on a graph rather than a rumor. A diagnostics page reads the machine the way support would: orphaned registrations, missing files, duplicate entries, add-ins Office has disabled behind the user’s back, and web add-ins with a broken cache, each with the distinct fix it needs.
Managed by IT, without a new console
Everything Deck does on one machine, IT can set for all of them through Group Policy. Deck ships ADMX and ADML templates covering 17 policies from one generated source of truth.
Profiles
Managed profiles authored as one JSON file on a share; Full, AdminOnly, or Disabled management modes.
Scope
Which Office apps Deck manages on the endpoint.
Excel XLLs
Force-on, force-off, and load-order lists; Deck reconciles the registry autonomously, re-applying whenever Excel exits or the keys drift.
Web add-ins
An IT-supplied trusted-catalog share for side-loading, with the same Full, AdminOnly, or Disabled modes.
Features
Crash analysis and folder locations, switchable per policy.
Settings locked by policy show as managed in the UI, with the lock visible to the user instead of a control that silently fails.
Deployment
One MSI. Per-user by default, per-machine with a flag, silent with /qn, deployed with SCCM, Intune, a login script, or by hand. A portable ZIP runs without installing; an ADMX zip drops into your central store. Every release is built, verified, and signed through a pipeline where the signing key never touches a build runner, and artifacts publish with checksums to downloads.vediram.com.
On the machine, Deck is two processes: the app you see, and a background daemon that owns the registry work, the crash watcher, and the tray. Close the window and the daemon keeps your profile enforced.
Scope
Deck is released and installable today. It runs on Windows 11 and manages classic desktop Office from Office 2013 onward. New Outlook for Windows runs only centrally deployed web add-ins with no local surface to manage; Deck detects it and says so rather than pretending. Web add-in side-loading covers Excel, Word, and PowerPoint from a catalog share on Windows. XLL force lists identify add-ins by filename. Vediram is based in Lausanne, Switzerland. Deck runs standalone: no enrollment, no telemetry, no connection to Vediram. Everything it discovers stays on the machine.
Deck and the suite
The add-in was the original third-party code inside the apps where work lives, and it got there years before anyone called such a thing an agent. Vediram applies one discipline across that whole surface: know what runs, decide what runs, and keep the evidence.
Levee governs the AI agents that bring no controls of their own. Spillway enforces the controls vendor AI apps already ship with. Deck does the same work for the Office extension surface your fleet has been accumulating for a decade.
Put a hand on the switch Office never gave you.
Install Deck on one machine and it shows you what a decade of installs left in your Office. Roll it out with the MSI and the ADMX templates, and the whole fleet’s add-in surface becomes something IT can read, set, and prove.
MSI, portable ZIP, and ADMX templates. Silent install supported.