PowerPoint appModule: make the call to getActiveObject directly to PowerPoint via rpc rather than out-of-process. PowerPoint protected mode seems to contain its own copy of the running object table and therefore does not expose powerPoint.application crosss-process. this again allows access to protected mode, but this time only with UIAccess (installed NVDA).