Embedded Excel document with Macros blocked by new security rules

Question

Regarding some recent security changes discussed in these pages:

https://learn.microsoft.com/en-us/office/troubleshoot/excel/embedded-macros-not-run
https://www.microsoft.com/en-us/security/blog/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection/

We have spreadsheets embedded in our own data files. We invoke Excel on the spreadsheets via the OLE container mechanism. With the recent changes, spreadsheets with macros are blocked. In the previous versions of Office/Excel, the user was given the option to enable macros. The solution suggested on those URLs is to add Trusted Locations into the Trust Center Settings, but I can add all of the disk drives on my local machine and the macros are still blocked.

Answer 1

Hello @Emi Zhang-MSFT ,
Thanks for the reply. We are using the 365 apps. I had found the link you sent, but it mostly has information about security of files from the web etc.

What is different about our situation is that we are embedding Excel files in a storage within our own data files (we use structured storage file format). I can create a brand new Excel spreadsheet locally (never been near the Internet), embed it in our data file via this call:
BOOL COleClientItem::CreateFromFile(LPCTSTR lpszFileName, REFCLSID clsid,
OLERENDER render, CLIPFORMAT cfFormat, LPFORMATETC lpFormatEtc)

We allow our users to edit that spreadsheet via the "DoVerb" OLE mechanism that automatically invokes the application associated with the file type.
If the spreadsheet that was embedded contains macros, that invocation no longer succeeds. This is the error dialog:

Answer 2

Hi @Joe Sherry ,
What version of Office are you using?
If you're using the Microsoft 365 apps, I suggest you refer to this support article to get more information:
https://learn.microsoft.com/en-us/DeployOffice/security/internet-macros-blocked
Just checking in to see if the information was helpful. If my understanding is incorrect, please let us know and I'm glad to help you.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

1. In the actual workflow, there is no file to check. It is embedded with OLE, and Excel is invoked with DoVerb(), and refuses to open the file
2. If I manually extract the embedded file into a standalone spreadsheet file, there is no Blocked section in the dialog (as expected, as it did not come from outside the machine).

Answer 4

I have had a very similar problem with a custom written app that calls Excel via OLE and was giving me the exact same error dialog as you are showing above.

A work around I found, on another post, was to open a separate macro enabled spreadsheet in Excel first, before starting my custom app. The OLE Container created spreadsheet was then happy, as macros were already enabled, as Excel was already running.

Another tip is the OLE Container worksheet initially appears both unreadable and uneditable. However, a right click in the sheet gives the choice to "Open" the worksheet. A fully useable Excel version appears for me at that point.