Reenabling Office Home and Student 2019 VBA macros

[alspoe]

Hi there! I'd like to run some downloaded office macros and get "the macros in the project are disabled". I can't seem to figure out how to re-enable setting trusted locations. I've tried modifying internet explorer group policy settings, fiddling with policies in regedit (e.g., HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\word\security), and even using the Unblock-File cmdlet, but I can't seem figure this one out. Any thoughts appreciated!

[simeononsecurity]

It's crucial to weigh the benefits against the potential security risks they pose. Macros, particularly from downloaded Office documents, are a common vector for malware and phishing attacks. The convenience they offer can often be overshadowed by these security concerns. It's advisable to explore alternatives to macros that can provide similar functionality without the associated risks. However, if your operational requirements still necessitate the use of macros, here's how you can adjust the settings via Local Group Policy Editor (LGPO) with an emphasis on security:

Instructions to Enable Macros via LGPO

1. Open Local Group Policy Editor:

   • Press Windows + R, type gpedit.msc, and press Enter.

2. Import Policy Definitions:

   • Before adjusting any settings, ensure you have the latest policy definitions. Download the ADMX Policy definitions from this repository.
   • Copy these definitions to the C:\Windows\PolicyDefinitions folder on the system where you're trying to modify GPOs. This step ensures that you have access to the most current and relevant security settings and configurations.

3. Navigate to Microsoft Office Macros Settings:

   • Go to User Configuration > Administrative Templates > Microsoft Office 2016 (or your version) > Security Settings.
   • If you're specifically looking to manage Word macros, navigate further into the settings for Word.

4. Adjust Macro Settings:

   • Find the policy Block macros from running in Office files from the Internet and ensure it's enabled. This setting allows macros but blocks them in files from the Internet, which is a compromise between functionality and security.
   • To fully enable macros, including those in downloaded files (which is not recommended), look for a setting like Macro Settings under the same path and adjust it to enable all macros. Note: This significantly increases security risks.

5. Consider Trusted Locations:

   • While you're in the Group Policy Editor, you can also look for policies related to Trusted Locations if you absolutely need to use them. However, adding Trusted Locations also increases risk as it creates exceptions to security measures.

6. Apply and Update Group Policy:

   • Once you've made your changes, apply them and close the Local Group Policy Editor.
   • To ensure the policies take effect, open a Command Prompt as administrator and run gpupdate /force.
   • Reboot your computer.

Emphasizing Security Concerns and Alternatives

The instructions above are provided with a strong recommendation to carefully assess the security risks associated with enabling macros, especially from downloaded Office documents. Macros can be exploited by malicious actors to compromise your system. It's crucial to explore safer alternatives and implement robust security practices:

• Seek Safer Alternatives: Many tasks that require macros can be achieved with built-in features, secure add-ins, or external tools that offer enhanced security measures.

• Maintain Vigilant Security Practices: Ensure your antivirus software is current, conduct regular security training, and promote safe practices among all users.

• Regular Security Policy Reviews: Treat macro enablement as a carefully controlled exception. Regularly review such exceptions to confirm they are essential and that the documents remain secure.

[alspoe]

Thanks for the speedy and extensive response! They're fairly basic editing macros for word, which I'd run locally, but I understand this increases the risk.

I tried to follow the steps above, though only downloading the office16 and word16 admx files (PolicyDefinitions) and word16 and office16 adml and admx files (PolicyDefinitions\en-US), but in GPE it shows Office 2016 and Word 2016. I'm only running Office 2019 (Home and Student), which in Word's file attributes is listed however as product version 16. Might it not be configurable with a Home and Student version or am I using the wrong adml/admx files?

In any case, under "User Configuration > Administrative Templates > Microsoft Office 2016 > Security Settings" or any of the subfolders, there is no policy "Block macros from running in Office files from the Internet" or anything like "Macro Settings", although I see that "Allow mix of policy and user locations", which would let users define a trusted location, is disabled.

[simeononsecurity]

The 2016 ADMX/ADML files apply to all office versions 2016 and newer.
But for multiple reasons, you should copy the entire policy definitions folder from the linked repo and not just parts just FYI.
The Office templates can be annoying. There are policies in the 2010 and 2013 admx/adml that apply to 2016 and newer but aren't in the 2016 templates. Additionally, there are Office 365 versions of office which have settings that aren't in any of the admx. This is why we include the templates for 2010, 2013, 2016, and 2016 (Office 365).

The path to the exact policy for this reason can be confusing. We update our ADMX/ADML templates often, but don't per say keep documentation on where in the structure those options are if they change.

You should run a gpresult /H report.html and open that html to see all the options applied via gpo to your system. Searching for anything with macros. Then disable or reverse any of the configured applicable options.

[simeononsecurity]

But after inspecting again the path that seems most relevant to you is Microsoft Word 2016/Word Options/Security/Trust Center at least from quickly checking. The macro settings is one of the ones that is required per STIG like 2 dozen different ways. So checking gpresult is probably your best bet.

[alspoe]

Great, thanks again for the exhaustive answer - much appreciated!