How to prevent Excel 2016 from inserting executables as OLE

Question

Hello,

We have an Excel 2016 published on Citrix for our users. Recent penetration test showed that user can breakout from Excel. He can launch CMD.exe or PowerShell.exe on that server by Inserting them as object from file. And later he just needs to double-click on the object.

How can we prevent inserting binaries into Excel spreadsheet?

Regards
MZ

Answer 1

@MichalZyzak-1432 ,
Have you installed the Office Administrative Template files (ADMX/ADML)?

If yes, please go to Group Policy Editor > User Configuration > Administrative Templates > Microsoft Office 2016 > Security Settings, find the "Allow file extensions for OLE embedding" at right panel, check whether you have enabled the extension of "exe". Please make sure, the extension of "exe" is not enabled.

Generally, if you choose Disabled or Not Configured, or with the policy enabled but not enable "exe" extension, after double-clicking the executables, like cmd.exe, you would get the warning below.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello

Thank you for your response.
However the description of this setting states that it applies to Office 365. Not for Office 2016 stand alone version.

Answer 3

@Michal Zyzak ,
Maybe you could test the following steps to modify registry on one PC.
(Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.
Please refer to this article about how to back up and restore the registry in Windows: https://support.microsoft.com/en-us/kb/322756)

Go to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security, add REG_DWORD (32-bit) which is named PackagerPrompt, data value is 0x00000002 (2)

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Yep, for reference, this is how our GPO looks for the PackagerPrompt setting: