Microsoft Office Macro Hardening | ASD's Blueprint for Secure Cloud (2024)

Microsoft Office Macro Hardening

This section describes the design decisions associated with Microsoft Office macros on Windows 10 and 11 endpoints configured according to guidance in ASD's Blueprint for Secure Cloud.

Estimated reading time: 4 minutes

Microsoft Office files can include Visual Basic for Applications (VBA) programming code (macro) embedded into the document.

A macro can comprise of several repeatable actions that can be coded or recorded and rerun later to automate repetitive tasks. Macros are powerful tools that can be easily created by novice users to greatly improve their productivity. However, an adversary can also create macros to perform a variety of malicious activities, such as assisting in the compromise of workstations to exfiltrate or deny access to sensitive information.

ASD’s provides guidelines in securing systems against malicious macros and recommend they are implemented in all Windows environments. ASD’s recommends that one of the following approaches is implemented:

  • All macros are disabled.
  • Only macros from trusted locations or sandboxed environment are enabled.
  • Only macros digitally signed by trusted publishers are enabled.

Where trusted locations are used, ASD’s recommends that when using trusted locations, only privileged users that are responsible for validating that the macros are free from malicious code can write to and modify contents within the trusted location.

Microsoft Office products can log macro execution attempts (both successful and failures) by enabling the Trust Center logging feature. This provides valuable information for incident response and digital forensics activities. The Trust Center logs are not written to the Windows Event Log but instead as an individual file per Microsoft Office product to the C:\Users\USERNAME\AppData\Local\Microsoft\Office\TCDiag directory.

Design Decisions

Decision PointDesign DecisionJustification
Implementation approachOnly macros digitally signed by a trusted publisher are enabledTo align with ASD’s Restricting Microsoft Office Macros guidance and enable organisations to leverage macros securely with the least business impact.
Macro execution loggingEnabled via Trust Center loggingTo align with ASD’s Essential Eight and provide detailed logs in the event of an incident.
Configuration methodOrganisation preferenceMacro hardening (including ASR rules) can be configured via either Group Policies or Intune.
Specific configurationSee belowTo align with the ASD’s Restricting Microsoft Office Macros guidance.
  • Microsoft Office Security Settings
    • Automation Security: Enabled (Use application macro security level)
    • Disable all Trust Bar notifications for security issues: Enabled
    • Disable VBA for Office applications: Disabled
    • Macro Runtime Scan Scope: Enable for all documents
    • Allow mix of policy and user locations: Disabled
  • Microsoft Access
    • Turn off trusted documents: Enabled
    • Turn off Trusted Documents on the network: Enabled
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
    • Allow Trusted Locations on the network: Disabled
    • Disable all trusted locations: Enabled
    • Disable commands: Enabled (19092)
  • Microsoft Excel
    • Disable commands: Enabled (19092)
    • Scan encrypted macros in Excel Open XML workbooks: Scan encrypted macros (default)
    • Block macros from running in Office files from the Internet: Enabled
    • Trust access to Visual Basic Project: Disabled
    • Turn off trusted documents: Enabled
    • Turn off Trusted Documents on the network: Enabled
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
    • Allow Trusted Locations on the network: Disabled
    • Disable all trusted locations: Enabled
  • Microsoft Outlook
    • Disable commands: Enabled (19092)
    • Apply macro security settings to macros, add-ins and additional actions: Enabled
    • Security settings for macros: Enabled (Security Level: Warn for signed, disable unsigned)
  • Microsoft PowerPoint
    • Disable commands: Enabled (19092)
    • Scan encrypted macros in PowerPoint Open XML presentations: Scan encrypted macros (default)
    • Block macros from running in Office files from the Internet: Enabled
    • Trust access to Visual Basic Project: Disabled
    • Turn off trusted documents: Enabled
    • Turn off Trusted Documents on the network: Enabled
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
    • Allow Trusted Locations on the network: Disabled
    • Disable all trusted locations: Enabled
  • Microsoft Project
    • Allow Trusted Locations on the network: Disabled
    • Disable all trusted locations: Enabled
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
  • Microsoft Publisher
    • Disable commands: Enabled (19092)
    • Publisher Automation Security Level: Enabled (By UI (prompted))
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
  • Microsoft Visio
    • Disable commands: Enabled (19092)
    • Enable Microsoft Visual Basic for Applications project creation: Disabled
    • Load Microsoft Visual Basic for Applications projects from text: Disabled
    • Allow Trusted Locations on the network: Disabled
    • Block macros from running in Office files from the Internet: Enabled
    • Disable all trusted locations: Enabled
    • Turn off trusted documents: Enabled
    • Turn off Trusted Documents on the network: Enabled
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
  • Microsoft Word
    • Disable commands: Enabled (19092)
    • Scan encrypted macros in Word Open XML documents: Scan encrypted macros (default)
    • Block macros from running in Office files from the Internet: Enabled
    • Trust access to Visual Basic Project: Disabled
    • Turn off trusted documents: Enabled
    • Turn off Trusted Documents on the network: Enabled
    • VBA Macro Notification Settings: Enabled (Disable all except digitally signed macros)
    • Allow Trusted Locations on the network: Disabled
    • Disable all trusted locations: Enabled

Related information

Security & Governance

  • Microsoft Office Macro Hardening
  • Application Control
  • User Application Hardening
  • Essential Eight: Restrict Microsoft Office Macros

Design

  • None identified

Configuration

  • Microsoft Office Macro Hardening
  • Attack Surface Reduction

References

  • None identified
Microsoft Office Macro Hardening | ASD's Blueprint for Secure Cloud (2024)

FAQs

Is Microsoft discontinuing VBA? ›

No. Such rumors have been doing the rounds for more than 20 years, but they're not true. There are millions of users relying on VBA, including large businesses and organizations.

How to fix security risk Microsoft has blocked macros? ›

Remove Mark of the Web from a file

To unblock macros in a file, like one from the internet or an email attachment, remove the Mark of the Web on your local device. To remove, right-click on the file, choose Properties, and then select the Unblock checkbox on the General tab.

Are Excel macros a security risk? ›

Malicious macros can do almost anything that other malware can do to your system, including emulating ransomware, stealing data, and emailing itself out to your contacts.

What is the warning about macros in Office? ›

If you see a security warning when you open a document or try to run a macro, you can choose to make it a trusted document and enable macros. This example is on an Excel workbook. Select Enable Content. In the Security Warning dialog, select Yes to make the document trusted.

What is Microsoft replacing VBA with? ›

Re: Excel Online: replacement for VBA macros...

Scripting allows you to automate repetitive tasks and perform custom operations on your Excel data. It provides a set of JavaScript-based APIs that you can use to manipulate the Excel workbook, worksheets, ranges, and more.

Will VBA become obsolete? ›

Re: Will VBA be obsolete from excel? No, it is extremely unlikely that Microsoft will ditch VBA. There are far too many solutions all over the world that rely on it.

How do you bypass Microsoft has blocked macros from running because the source of this file is untrusted? ›

How to resolve "Microsoft has blocked macros"
  1. Close the workbook containing the blocked macro.
  2. In File Explorer, browser to the location where the workbook is saved.
  3. Right-click the file, and select Properties from the context menu.
  4. In the Properties dialog box, check the Unblock box, and then click OK.
Mar 28, 2023

How do macros pose a cybersecurity risk? ›

While macros may boost productivity, they can also pose a cybersecurity risk, as criminals can manipulate them by adding harmful code. This manipulation converts macros into carriers or pathways for the spread of malicious software, posing a significant threat to the security and integrity of computer systems.

How do I turn off macro security warning in VBA? ›

By default, Excel disables all VBA macros with notification. This means that when you open a workbook that contains VBA macros, you'll see a yellow security warning bar at the top of the sheet. You can choose to enable or disable VBA macros for that workbook by clicking on the warning bar.

Which macro setting is least secure? ›

Enable all macros (not recommended, potentially dangerous code can run) Click this option to allow all macros to run. Using this setting makes your computer vulnerable to potentially malicious code and is not recommended.

What are the disadvantages of macros in Excel? ›

While macros can be recorded in many applications, the macro recorder doesn't actually know what you're trying to do, so it just takes a snapshot of the whole feature. That makes for a very messy chunk of code that does a lot of unnecessary things, some of which you may not want. So you have to learn VBA coding.

How do I stop Microsoft from blocking macros? ›

Excel 2010, 2013, 2016, 2019, and Microsoft 365:
  1. Open the File: Open the Excel file containing the blocked macros.
  2. Go to the File Tab: Click on the "File" tab in the ribbon.
  3. Open Options: ...
  4. Navigate to Trust Center: ...
  5. Open Trust Center Settings: ...
  6. Navigate to Macro Settings: ...
  7. Enable Macros: ...
  8. Click OK:
Mar 19, 2023

Why avoid macros? ›

Macros reduce code readability

In real projects where multiple people work together this will make teamwork extremely hard. Once again, this is competitive programming and if you understand your own code that is all that matters.

Is enabling macros on a Microsoft Office document safe? ›

Be wary of Microsoft Office documents containing macros. Macros are small bits of programming used to automate tasks that can also be used for spreading viruses and malware. Anti-virus programs cannot always catch all malicious macros.

What is the purpose of a macro in Microsoft Office? ›

In Word, you can automate frequently used tasks by creating and running macros. A macro is a series of commands and instructions that you group together as a single command to accomplish a task automatically. To save time on tasks you do often, bundle the steps into a macro. First, you record the macro.

Is VBA still relevant in 2024? ›

Yes, people still use Excel VBA to run their business operations even in 2024. VBA is a powerful tool that allows its users to work efficiently by helping them create custom functions using scripts or codes in Excel.

Has Microsoft stopped supporting VBA? ›

Support for VBA has definitely not gone away. An update to your PC may have failed in a way that makes some of the supporting code not work.

Is Microsoft discontinuing Visual Basic? ›

A post by Microsoft in Feb 23 (7 months ago), stated that Microsoft "remains committed to Visual Basic and continue to invest in maintaining C# interop and Visual Studio features for folks that love Visual Basic." It has been interpreted by the community that VB.Net will not be further evolved but at the time of ...

Is Microsoft moving away from macros? ›

Microsoft said it is still planning to block Visual Basic Applications (VBA) macros by default in Office apps after quietly rolling back the planned change last month.

Top Articles
What Is Smishing? Examples, Protection & More | Proofpoint US
The Best Gilmore Girls Episodes for Academic Motivation
Uca Cheerleading Nationals 2023
Dlnet Retiree Login
Obor Guide Osrs
Identifont Upload
Kokichi's Day At The Zoo
Here are all the MTV VMA winners, even the awards they announced during the ads
Mail Healthcare Uiowa
Learn How to Use X (formerly Twitter) in 15 Minutes or Less
Current Time In Maryland
Conan Exiles Colored Crystal
Weather Rotterdam - Detailed bulletin - Free 15-day Marine forecasts - METEO CONSULT MARINE
All Obituaries | Buie's Funeral Home | Raeford NC funeral home and cremation
Zoe Mintz Adam Duritz
Uta Kinesiology Advising
Music Go Round Music Store
ABCproxy | World-Leading Provider of Residential IP Proxies
Homeaccess.stopandshop
2013 Ford Fusion Serpentine Belt Diagram
Where to eat: the 50 best restaurants in Freiburg im Breisgau
All Breed Database
Sec Baseball Tournament Score
Rogue Lineage Uber Titles
Обзор Joxi: Что это такое? Отзывы, аналоги, сайт и инструкции | APS
Airline Reception Meaning
Jackie Knust Wendel
Netspend Ssi Deposit Dates For 2022 November
Nikki Catsouras: The Tragic Story Behind The Face And Body Images
Poe T4 Aisling
How Much Is An Alignment At Costco
Indiana Jones 5 Showtimes Near Jamaica Multiplex Cinemas
Everything You Need to Know About NLE Choppa
Wednesday Morning Gifs
Closest 24 Hour Walmart
A Man Called Otto Showtimes Near Amc Muncie 12
Reborn Rich Ep 12 Eng Sub
450 Miles Away From Me
Mvnt Merchant Services
140000 Kilometers To Miles
US-amerikanisches Fernsehen 2023 in Deutschland schauen
Dragon Ball Super Super Hero 123Movies
Scythe Banned Combos
Copd Active Learning Template
Zom 100 Mbti
Craigslist Sparta Nj
Blippi Park Carlsbad
Blog Pch
Craiglist.nj
March 2023 Wincalendar
Divisadero Florist
Suzanne Olsen Swift River
Latest Posts
Article information

Author: Tish Haag

Last Updated:

Views: 6183

Rating: 4.7 / 5 (67 voted)

Reviews: 82% of readers found this page helpful

Author information

Name: Tish Haag

Birthday: 1999-11-18

Address: 30256 Tara Expressway, Kutchburgh, VT 92892-0078

Phone: +4215847628708

Job: Internal Consulting Engineer

Hobby: Roller skating, Roller skating, Kayaking, Flying, Graffiti, Ghost hunting, scrapbook

Introduction: My name is Tish Haag, I am a excited, delightful, curious, beautiful, agreeable, enchanting, fancy person who loves writing and wants to share my knowledge and understanding with you.