Enabling own macros

Question

Hi!

By default all macros in Word are disabled. Moreover this option is recommended.

Don't you think it sounds a little bit senselessly. Like - "you are allowed to create your own macro but it's not recommended to enable it".

What is your opinion? Creating macros or not? Enabling them or not?

Why Office cannot detect and allow macros created by the owner and saved to the Normal.dotm template?

Regards,

Mateo

Answer 1

Macros in templates that are stored in "trusted locations" aren't subject to the prohibition against running. The User Templates location, which is where Normal.dotm is stored, should be on the list of trusted locations by default. You can check this by going to File > Options > Trust Center > Trust Center Options > Trusted Locations.

You could also use the selfcert.exe program (on the Start menu, look in All Programs > Microsoft Office > Office 2010 Tools for "Digital Certificate for VBA Projects") to create a certificate that's valid only on your computer. Then use that certificate to sign your macros -- in the VBA editor, click Tools > Digital Signature > Choose and select the certificate. Signed macros can run from any template in any location. But this should never be necessary for macros in Normal.dotm.

Answer 2

I recommend using the "disable except digitally signed" setting. As I said before, but maybe not explicitly enough, Word is supposed to run even unsigned macros if they're in templates in a trusted location; the "digitally signed" requirement applies only to templates in other locations.

The "access to VBA projects" option won't help. That's for allowing a macro to create or modify other macros, which is normally forbidden because it could be used maliciously.

Macros definitely can -- and should -- be saved in templates other than Normal.dotm. There are two classes of macros, those that apply only to documents based on a specific template (e.g., a form) and those that may apply to any document (http://www.word.mvps.org/FAQs/MacrosVBA/DistributeMacros.htm).

• The macros in the first class should be saved in that specific template; usually the template should be stored in the User Templates folder, so it will appear in the File > New dialog.
• The macros in the second class should be saved in one or more templates that you store in Word's Startup folder (%appdata%\Microsoft\Word\Startup). Any template in that location will be loaded as a global template (also called a template add-in).

Answer 3

I don't know why you're having so much trouble, but it suggests that something isn't correctly configured in Windows' security setup.

As a possible workaround, in certmgr.msc you can copy the certificate in the Personal store and paste it into the Trusted Root store. You'll get a warning about dire consequences of installing an unverified certificate, but since you know where it came from, just ignore the warning and allow it.

Of course, if that doesn't stop the warnings in Word, you can delete the certificate from the Trusted Root store.

Answer 4

Great!

So I used the tool, generated a certificate and signed my macros.

I enabled the 3rd option disabling all except digitally signed.

For the time being all my macros are saved to the default Normal.dotm but probably I will separate them later and copy them to the Startup folder.

Unfortunately every time I open a new document Word displays the warning in a yellow bar telling that macros have been disabled.

I used the certmgr.msc to check whether my cert was correctly installed. It seems the VBA cert was automatically installed as a personal certificate. Maybe I should export all keys and install them once again adding some paths to the Trusted root certificates?

When I try to run some other macros in Outlook the warning appears that the certificate is not on the list of trusted publishers. So maybe there is something wrong with my cert or it was installed in a wrong place?

Answer 5

Hello!!

Wow, thank you for such a professional and detailed answer!!

Yes, the location of my Normal.dotm template is on the list of Trusted Locations:

*C:\Users\Mateo\AppData\Roaming\Microsoft\Templates*

So which of the 4 settings do you recommend me to use?

Disable with notification, except digitally signed or enable all?

Maybe it would be useful to enable the 5th option allowing access to VBA projects?

Do macros need to be saved always in the Normal.dotm? I mean, can I use Normal.dotm as my default template and make macros load from a different location?

Regards,

Mateo