User-Agent

++++++++ If the Word document is in "protected view" then when a user clicks on a link they first get a warning about the dangers of the internet, and then Word tries to retrieve the document. In this case, the user agent string DOES NOT identify that it's coming from Word or Office - at least not in any way I can tell.

Protected View User Agent String:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0)

Unprotected View User Agent String:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0; ms-office)

You can see the "ms-office" part only arrives if the user has turned off protected view.

Since I can't force users to turn off protected view in a document (esp one they downloaded from the internet), I can't work out how to reliably tell if the "browser" is an older version of Internet Explorer or Microsoft Word.

Any ideas?

Very interesting question I would like to rate this thread up.

In all my ASM installations I always see violations because of the User-Agent string "ms-office". I don't see any relation to opening documents in protected or unprotected mode. I see those requests as valid requests to websites, loading CSS and other stuff. It's very rare that these requests are related to files, which may be opened by MS Office. Typically customers are not able to tell if those requests are necessary or not and in most cases the customers decide to allow those requests in the policy.

Does anyone know which clients do send those requests, using the "ms-office" User-Agent string, and most importantly WHY do they send those requests?

Would be great to have a genereal discussion here.

Greets, svs

I think it is default behavior of some updated version of browsers. we couldn't identify the clients having this USer-Agent.

Which (real and trusted) browser would send "ms-office" in its User-Agent string? I'm not aware of any browser that would send a string like this - not even IE or Edge Not even UA-Sniffers recognize "ms-office"...

I've found the same thread on TechNet, which you have already referenced (https://social.technet.microsoft.com/Forums/Azure/en-US/348c37d1-5e17-4578-bb89-d12a5390816b/list-of-useragent-used-by-microsoft-office-products?forum=Office2016ITPro), but I still doubt that there is a relation between protected or unprotected documents. The last time I've seen this was on a wordpress blog page.

How to check the user-agent from requestor PC? If I want to try from some different PCs then I have to open the page source bar or any other criteria that I know about my PC user-agent.

What is difference b/w the below two:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0)

====

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36