Miscellaneous topics that do not fit into specific categories.
When the Unblock checkbox is missing in a file’s Properties dialog, Windows is not exposing Mark of the Web (MOTW) in that way. There are several supported alternatives depending on where the file is stored and how it is accessed.
- Confirm the file’s source and location
- If the file is on a network share or a website, the Unblock checkbox might not appear at all, or selecting it may have no effect if the share is treated as Internet zone.
- If the file is local (on the device’s drive) and still shows macros blocked, it may have a ZoneId marking it as Internet/Restricted.
- Use PowerShell to remove Mark of the Web If the Unblock checkbox is not available, use the Unblock-File cmdlet to remove the ZoneId:
Unblock-File -Path "C:\Path\To\YourFile.xlsm"
Removing the ZoneId value allows VBA macros to run by default and is equivalent to using the Unblock checkbox.
- Adjust for network shares or trusted websites If files are centrally stored and users open them from a network share or trusted internal website:
- Option A: Unblock individual files using Unblock-File as above.
- Option B: If the location is trusted and should allow macros for all files:
- Designate the location as a Trusted site, or
- Add the location to the Local intranet zone.
Note:
- If a share is considered in the Internet zone, even if Unblock appears, it will not be effective.
- Adding a Trusted site gives the entire site elevated permissions beyond Office.
- Use Trusted Locations for frequently used macro files For files that must always run macros without MOTW checks:
- Save them to a Trusted Location on the device. Files in Trusted Locations ignore Mark of the Web and open with macros enabled.
- Use Trusted Locations sparingly and manage them carefully, especially for any network locations.
- OneDrive/SharePoint-specific behavior For files stored on OneDrive or SharePoint:
- Opening via “Open in Desktop App” from OneDrive/SharePoint means the file will not have Mark of the Web.
- If files are synced by the OneDrive sync client or stored in known folders (Desktop, Documents, etc.) that are synced, they also do not get Mark of the Web.
- For groups that regularly use macro files from OneDrive/SharePoint:
- Have them use “Open in Desktop App”, or
- Download to a Trusted Location, or
- Admins can place the SharePoint/OneDrive domains into the Trusted Sites zone using the “Site to Zone Assignment List” policy.
- Policy-based macro control If macros are still blocked even after removing MOTW, a macro policy may be configured:
- Admins can use the “VBA Macro Notification Settings” policy to control behavior (for example, “Disable all except digitally signed macros” with “Require macros to be signed by a trusted publisher”).
- If this policy is enabled, removing MOTW alone will not allow unsigned macros to run.
- Template and add-in files For macro-enabled templates (.dotm, .xltm, .potm, etc.) and add-ins (.xlam, .ppam, etc.) downloaded from the internet:
- Remove Mark of the Web (via Unblock-File or Unblock checkbox where available), then reopen the Office app.
- Alternatively, store them in a Trusted Location.
- For signed macros, add the certificate as a trusted publisher after removing MOTW.
Because macros are a common malware vector, use these unblocking methods only for files and locations that are fully trusted.
References: