How to disable Office 365 Business Premium Macros and prevent users to change settings with GPO

Question

_{Monday, March 2, 2020 12:51 PM}

Hi Everyone,

I am trying to configure office to Only run macros from trusted locations following this guide
https://www.cyber.gov.au/publications/microsoft-office-macro-security

I installed the administrative templates which seems to support only volume license and Office 365 ProPlus.
However, after configuring the GPOs I can see that the GPO has worked for Office 365 Business premium (at least seems to be working) as it changed the registry entries for Office security, it disables the Macros but allow the end user to enable it from the notification bar and also if the user goes to options they are allowed to change the office Macro settings.

I have searched all day for a proper solution and I could not find it yet.

Anyone have successfully blocked office Macros on O365 Business premium, I would like to see the below notification when users try to enable the macros.

If I should not use the administrative templates, can someone direct me to the correct registry keys that I can use to get the same results.

I have tried this ones:

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\word\security
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\office\16.0\excel\security

In each key listed above, created this value:
DWORD: blockcontentexecutionfrominternet
Value = 1

and this one

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Excel\security
HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Word\security

In each key listed above, created this value:
DWORD: VBAWarnings
Value = 4

No luck same results as using GPO.

Best Regards,

Tom

Everton Menezes

All replies (3)

_{Tuesday, March 3, 2020 6:14 AM}

Hi Tom,

>> However, after configuring the GPOs I can see that the GPO has worked for Office 365 Business premium (at least seems to be working) 

<< From article "Office applications service description", we can find that Group Policy support for Office 365 Business Premium is No. But I have searched some users who are using Office 365 Business Premium said the administrative templates work properly with Office.

To disable macros except from trusted locations, and prevent users to change settings, I would like to suggest you try the following steps via GPO to have a check.

1. Please locate to the path below, enable "VBA macro Notification Settings" and choose the option of "Disable all except digitally signed macros".

Access: Administrative Templates (Users) > Microsoft Access 2016 > Application Settings > Security > Trust Center > "VBA Macro Notification Settings"

Excel: Administrative Templates (Users) > Microsoft Excel 2016 > Excel Options > Security > Trust Center > "VBA Macro Notification Settings"

Outlook: Administrative Templates (Users) > Microsoft Outlook 2016 > Security > Trust Center > "Security setting for macros"

PowerPoint: Administrative Templates (Users) > Microsoft PowerPoint 2016 > PowerPoint Options > Security > Trust Center > "VBA Macro Notification Settings"

Word: Administrative Templates (Users) > Microsoft Word 2016 > Word Options > Security > Trust Center > "VBA Macro Notification Settings"

2. When you need to allow macros from trusted locations, such as the shared network, please go the following path to add the path from shared network into Trusted Locations if needed.

Administrative Templates (Users)\Microsoft Office 2016\Security Settings\Trust Center

You could add one or more path as you need into "Trusted Location #1", "Trusted Location #2" and others.

Then you could go to the following path to enable "Allow Trusted Locations on the network."

Access: Administrative Templates (Users) > Microsoft Access 2016 > Application Settings > Security > Trust Center > Trusted Locations > Allow Trusted Locations on the network.Excel: Administrative Templates (Users) > Microsoft Excel 2016 > Excel Options > Security > Trust Center > Trusted Locations > Allow Trusted Locations on the network.PowerPoint: Administrative Templates (Users) > Microsoft PowerPoint 2016 > PowerPoint Options > Security > Trust Center > Trusted Locations > Allow Trusted Locations on the network.Word: Administrative Templates (Users) > Microsoft Word 2016 > Word Options > Security > Trust Center > Trusted Locations > Allow Trusted Locations on the network.

If you have any updates, please feel free to let me know.

Best Regards,

Emily

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Office 2019.

_{Tuesday, March 3, 2020 12:26 PM}

Hi Emily,

Thank you for your reply and recommendation.

I have created a new Group Policy and configured the following as suggested.

For testing purposes I only did configure Word and Excel to disable the macros and havent configured exeptions for trusted locations.

Excel: Administrative Templates (Users) > Microsoft Excel 2016 > Excel Options > Security > Trust Center > "VBA Macro Notification Settings"Word: Administrative Templates (Users) > Microsoft Word 2016 > Word Options > Security > Trust Center > "VBA Macro Notification Settings"

I checked the clients registry and I can see the GPO making the changes



When testing from Excel or Word it disabled the macros with notification, but users are able to enable it on the notification bar and users are also able to go to the application options and change the Macro settings.

Any other suggestions ?

Thanks you for your help.

Everton Menezes

_{Wednesday, March 11, 2020 12:00 PM}

Hi Everton,

Sorry for the delay.

I am afraid you could not meet your requirements.

In my opinion, these steps about Group Policy do not work is caused by Office 365 Business with not support of Group Policy. 

I find a related thread in UserVoice forum, Office 365 Business Group Policy, maybe you could have a look. 

Besides, I created the registry key of "VBAWarnings" for Word for Office 365 Business, but it does not work either, the options under Macro Settings are not greyed out.

If you need further assistance, feel free to post back.

Best Regards,

Emily

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact [email protected].

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Office 2019.