Preventing users to change the Microsoft Office 365 security settings?

Question

Preventing users to change the Microsoft Office 365 security settings?

EnterpriseArchitect 6,041

People,

How can I use the Group Policy settings and AD administrative templates to prohibit or prevent users from changing or updating the Microsoft Office security settings for all the AD users in my domain?

Most of the users are using Microsoft 365 MSO and M365 Click to Run.

Any assistance and suggestions would be much appreciated.

Nick Garver 75 Reputation points Microsoft Employee

2023-06-06T01:55:12.6566667+00:00

Which security settings? Are these admins? Any idea why regular users are able to modify security settings for all users?
EnterpriseArchitect 6,041 Reputation points

2023-06-06T02:01:14.9066667+00:00

Hi @Anonymous ,
This is for the normal non-admin users, to prevent the macro or to reduce the attack surface.

Accepted answer

0 additional answers

Your answer

Nick Garver 75 Reputation points Microsoft Employee

2023-06-06T01:55:12.6566667+00:00

Which security settings? Are these admins? Any idea why regular users are able to modify security settings for all users?
EnterpriseArchitect 6,041 Reputation points

2023-06-06T02:01:14.9066667+00:00

Hi @Anonymous ,
This is for the normal non-admin users, to prevent the macro or to reduce the attack surface.

Answer 1

Limitless Technology 44,766

Hello there,

For C2R versions of Office, such as Microsoft 365 apps for enterprise, Office Professioanl Plus 2019, if you want to prevent users changing Macro settings, you could use group policy.

Outlook: Administrative Templates (Users) > Microsoft Outlook 2016 > Security > Trust Center > "Security setting for macros", select "Enable" and choose one level you want.

Word: Administrative Templates (Users) > Microsoft Word 2016 > Word Options > Security > Trust Center > "VBA Macro Notification Settings", enable it and choose one level.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--

EnterpriseArchitect 6,041 Reputation points

2023-06-06T21:38:16+00:00

@Limitless Technology ,
Do I have to import the latest ADMX to use that GPO feature?
Emi Zhang-MSFT 30,046 Reputation points Microsoft External Staff

2023-06-07T02:15:11.4166667+00:00

You can download from this link: https://www.microsoft.com/en-us/download/details.aspx?id=49030
Ken Lux 0 Reputation points

2024-11-30T11:52:15.44+00:00

Be aware that in Office Home and Business 2021 that for Word, Excel, and PowerPoint, the above mentioned settings DO NOT work. GPO settings for Trust Center are respected ONLY when launching one of these applications by double-clicking on an associated file. Once the application is launched, the GPO settings are ignored and the user-managed settings are used. No Trust Center settings are grayed out.

Suppose that you have a GPO applied that sets the FileBlock settings to block opening of Word 2003 files, and a user has changed the FileBlock settings to allow Word 2003 files to be opened (THERE IS NO WAY TO PREVENT USERS FROM DOING THIS IN OFFICE HOME AND BUSINESS 2021).

If Word is not open and you double-click on a Word 2003 file, you will get a message that Word 2003 files are blocked. Click on "OK" to acknowledge the message and then double click on any Word 2003 file and it will open in regular mode (unless the user has set the FileBlock settings to allow it to open, but use Protected View).

So basically, in Office Home and Business 2021, Microsoft has set up these programs to go through an extra step on startup to to ignore GPO settings that they otherwise would have used and to use the user-defined settings instead!

Interestingly, this does not happen in Outlook. Its TrustCenter settings DO follow the GPO settings and are grayed out if they are defined in a GPO.

I reported this issue to MS's vulnerability submission site, but they closed it saying that it was a support issue, not a vulnerability.

Share via

Preventing users to change the Microsoft Office 365 security settings?

0 additional answers

Your answer