MS Office: Policy to disable macros

jlbrown
New Contributor

I'd like to disable Microsoft Office macros from being able to be run on users' computers.

Any ideas how to do this? I know they get a warning when opening files with macros, but most would click Allow without even thinking.

Is there a script that can set a preference or something like that?

Thanks,

James.

9 REPLIES 9

aamjohns
Contributor II

Hello,
I am looking for a similar option too. For PCs, we can use a group policy to 'block macros from running in Office files from the Internet'. This is very helpful when trying to prevent things like Ransomware.

The only thing I see in Office for Mac is to warn about running macros.

If I find something I will post back to you.

Thanks,
AJ.

iamkmc
New Contributor III

Just wondering, did either of you managed to figure out how to compose a policy for this?

Thanks,

Kev

aamjohns
Contributor II

The only option to enable is in Office and it is the checkbox for Warn before opening a file that contains macros which is enabled by default. Office 2016 is supposed to have some additional sandboxing for macros (added security they say).

About all you can do is summed up here (link)

aamjohns
Contributor II
 

talkingmoose
Moderator
Moderator

Test Insider Fast 15.32.

It will have support for disabling macros. You cannot use a configuration profile to manage this (yet), but you can enable this via script.

For more information, see Erik Schwiebert's message in Slack: https://macadmins.slack.com/files/schwieb/F49LUC62Z/macroenabledsettings.png.

aamjohns
Contributor II

Thank you for the heads up. That is good news. And it should help.

Thanks again,
AJ.

skinford
Contributor III

Good morning, @talkingmoose,

Love your MacAdmin's presentations at PSU. I looked at the slack piece you quoted above but couldn't find the information about the actual scripting part, unless I missed something. Could you point me in the right direction to script the macros disablement in MS office 2016?

Thank you, my friend, hope to see you again at MacAdmins next year!

talkingmoose
Moderator
Moderator

@skinford, thanks for the kudos!

Looks like the necessary keys were put into a manageable area a little while back. An example scripted deployment would be something like this per each user account:

defaults write com.microsoft.office VisualBasicMacroExecutionState -string DisabledWithoutWarnings

However, I would instead put this into a configuration profile and deploy through Jamf Pro. Much easier.

ralphaelhollins
New Contributor III

340522069ab44eecb6ace1c25a4b6c64