A few days ago, a user reported to me a powerpoint opening file error. He has received an email with a powerpoint file as attached piece, and when he tried to open it he got this message:

PowerPoint found a problem with content in filename.pptx.
PowerPoint can try can attempt to repair the presentation.
if you trust the source if this content, click repair.


And even when he clicked on the repair button he got an other message “Sorry…PowerPoint can’t read filename.pptx



So, I told him to send me the file and I opened it successfuly on my computer.

First deduction, the problem is not related to the powerpoint file but to the PC’s configuration.

First of all, I did some search on google and I found some workarounds that suggest to disable the “Enable protected view for files originating from Internet” option in the “Trust Center > Protected View” Menu.


By doing so, it works but it’s not safe to let this option disabled. So I decided to deal diffrently with this problem.

To figure out what is the problem, I’ve applied Mark Russinovich motto; “When in doubt, run Process Monitor “. So I recorded a trace when opening the file on the user’s PC.

First thing to do in Procmon, create a filter on the process name = POWERPOINT.EXE. Thus we restrict our investigation scope to the process we are interested in.


Next, we need to apply a filter on the result by going to the menu “Tools > Count values Occurences”

We need to look in the events by applying a filter on those that we consider interesting. I mean events like “Access denied, Name Invalid, Path not found and sharing violation”.


After a few investigations, I’ve found something interesting when applying the “Path not found” filter. PowerPoint is looking for “MSPPT.OLB” file in “C:\Program Files\Microsoft Office\Root\Office16\”


Knowing that all our computers are using MS Office 2010 or 2013. Why PowerPoint 2013 is trying to open a file that seems to belong to an Office 2016 installation that should not to be here.
By asking the user this question, he admitted that he has installed Office 2016 to test and removed it after.

Now we need to find where PowerPoint take the Office16 path reference instead of Office15.

by doing a search using a key word “Office16” I found this:



The Office16 path is registered in the registery base.

When opening the regedit utility and seeking for the indicated key, you can notice that above the “2.c” key, exists two others “2.a” and “2.b”. Each one point respectively on the following path: “C:\Program Files (x86)\Microsoft Office\Office14\MSPPT.OLB” for Office 2010 and “C:\Program Files\Microsoft Office\Office15\MSPPT.OLB” for Office 2013.


So my guess was; when PowerPoint looks for the MSPPT.OLB’s path it moves to the last folder under “HKEY_CLASSES_ROOT\TypeLib\{91493440-5A91-11CF-8700-00AA0060263B}”. And as Office 2016 have been removed (not properly), the folder “C:\Program Files\Microsoft Office\Office16” do not exist any more.

By deleting the “HKEY_CLASSES_ROOT\TypeLib\{91493440-5A91-11CF-8700-00AA0060263B}\2.c” key, PowerPoint opened the file without problem.

Process Monitor is a powerfull tool that can help system administrators to solve some tricky issues.

Thank you for reading.


Get The Windows Performance Troubleshooting Course for FREE !

Signup now and receive an email once I publish new content.

I will never give away, trade or sell your email address. You can unsubscribe at any time.