Blocking Office 2010 Macros

One of the most effective ways to protect your company and its computers is to implement the blocking of macros in Microsoft Office documents (this includes: Word, PowerPoint, Excel, Publisher, Outlook, Access, and Visio). Blocking macros is a relatively straight-forward and simple process as it can be done via Group Policy, and that is what I will be covering in this post.

The first thing you must do is download and install the ADMX files for the version of Office that you have in your environment (i.e. Office 2010), these files may be downloaded from Microsoft and can be found easily with some simple Google searches. To make your life a bit easier, make sure to review this Microsoft technet article: https://technet.microsoft.com/en-us/library/cc709647(v=ws.10).aspx

Once you’ve downloaded and installed the ADMX files, you will open the Group Policy Management console by running gpmc.msc in the Run prompt. Once it opens, create a new Group Policy, name it something appropriate (i.e. Macro Blocking). Once you have created it, go ahead and edit it. The settings that you’ll be looking for are located at User Configuration\Policies\Administrative Templates\Classix Administrative Templates. You’ll see a list of Office programs, which you will go through one-by-one and configure the macro settings.

Group policy - Office 2010 Settings

Here is a list of the keys and their locations:

Microsoft Access 2010
Application Settings/Security/Trust Center/VBA Macro Notification Settings – Enabled – Disable all macros without notification

Microsoft Excel 2010
Excel Options/Security/Trust Center/VBA Macro Notification Settings – Enabled – Disable all macros without notification

Microsoft Outlook 2010
Security/Trust Center/Security setting for macros – Enabled – Never warn, disable all

Microsoft PowerPoint 2010
PowerPoint Options/Security/Trust Center/VBA Macro Notification Settings – Disable all macros without notification

Microsoft Publisher 2010
Security/Trust Center/VBA Macro Notification Settings – Enabled – Disable all macros without notification

Microsoft Visio 2010
Visio Options/Security/Trust Center/VBA Macro Notification Settings – Enabled – Disable all macros without notification

Microsoft Word 2010
Word Options/Security/Trust Center/VBA Macro Notification Settings – Enabled – Disable all macros without notification

If you have multiple versions of Office in your environment, you’ll have to download the appropriate ADMX files for that version. For Office 2016 the setup is a little different, and I’ll cover it in another post.

Thanks for reading, and hopefully this information has helped you out.

 

Note: These settings were done for Microsoft Office 2010, on a Windows 2008 R2 domain controller

Written By jamesmontour

James Montour is a Systems Administrator and information security enthusiast living in the US. His skills include Active Directory Administration, Database Administration, Network Administration, Automation/Scripting, Windows Server Management, and IT Compliance.