Embedded Excel document with Macros blocked by new security rules

Question

Regarding some recent security changes discussed in these pages:

https://learn.microsoft.com/en-us/office/troubleshoot/excel/embedded-macros-not-run
https://www.microsoft.com/en-us/security/blog/2016/03/22/new-feature-in-office-2016-can-block-macros-and-help-prevent-infection/

We have spreadsheets embedded in our own data files. We invoke Excel on the spreadsheets via the OLE container mechanism. With the recent changes, spreadsheets with macros are blocked. In the previous versions of Office/Excel, the user was given the option to enable macros. The solution suggested on those URLs is to add Trusted Locations into the Trust Center Settings, but I can add all of the disk drives on my local machine and the macros are still blocked.

Answer 1

Hi @Joe Sherry ,
What version of Office are you using?
If you're using the Microsoft 365 apps, I suggest you refer to this support article to get more information:
https://learn.microsoft.com/en-us/DeployOffice/security/internet-macros-blocked
Just checking in to see if the information was helpful. If my understanding is incorrect, please let us know and I'm glad to help you.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello @Emi Zhang-MSFT ,
Thanks for the reply. We are using the 365 apps. I had found the link you sent, but it mostly has information about security of files from the web etc.

What is different about our situation is that we are embedding Excel files in a storage within our own data files (we use structured storage file format). I can create a brand new Excel spreadsheet locally (never been near the Internet), embed it in our data file via this call:
BOOL COleClientItem::CreateFromFile(LPCTSTR lpszFileName, REFCLSID clsid,
OLERENDER render, CLIPFORMAT cfFormat, LPFORMATETC lpFormatEtc)

We allow our users to edit that spreadsheet via the "DoVerb" OLE mechanism that automatically invokes the application associated with the file type.
If the spreadsheet that was embedded contains macros, that invocation no longer succeeds. This is the error dialog:

Answer 3

1. In the actual workflow, there is no file to check. It is embedded with OLE, and Excel is invoked with DoVerb(), and refuses to open the file
2. If I manually extract the embedded file into a standalone spreadsheet file, there is no Blocked section in the dialog (as expected, as it did not come from outside the machine).