MS Office: Policy to disable macros

[jlbrown]

I'd like to disable Microsoft Office macros from being able to be run on users' computers.

Any ideas how to do this? I know they get a warning when opening files with macros, but most would click Allow without even thinking.

Is there a script that can set a preference or something like that?

Thanks,

James.

[aamjohns]

Hello,
I am looking for a similar option too. For PCs, we can use a group policy to 'block macros from running in Office files from the Internet'. This is very helpful when trying to prevent things like Ransomware.

The only thing I see in Office for Mac is to warn about running macros.

If I find something I will post back to you.

Thanks,
AJ.

[iamkmc]

Just wondering, did either of you managed to figure out how to compose a policy for this?

Thanks,

Kev

[aamjohns]

The only option to enable is in Office and it is the checkbox for Warn before opening a file that contains macros which is enabled by default. Office 2016 is supposed to have some additional sandboxing for macros (added security they say).

About all you can do is summed up here (link)

[talkingmoose]

Test Insider Fast 15.32.

It will have support for disabling macros. You cannot use a configuration profile to manage this (yet), but you can enable this via script.

For more information, see Erik Schwiebert's message in Slack: https://macadmins.slack.com/files/schwieb/F49LUC62Z/macroenabledsettings.png.

[aamjohns]

Thank you for the heads up. That is good news. And it should help.

Thanks again,
AJ.

[skinford]

Good morning, @talkingmoose,

Love your MacAdmin's presentations at PSU. I looked at the slack piece you quoted above but couldn't find the information about the actual scripting part, unless I missed something. Could you point me in the right direction to script the macros disablement in MS office 2016?

Thank you, my friend, hope to see you again at MacAdmins next year!

[talkingmoose]

@skinford, thanks for the kudos!

Looks like the necessary keys were put into a manageable area a little while back. An example scripted deployment would be something like this per each user account:

defaults write com.microsoft.office VisualBasicMacroExecutionState -string DisabledWithoutWarnings

However, I would instead put this into a configuration profile and deploy through Jamf Pro. Much easier.

[ralphaelhollins]