People, How can I use the Group Policy settings and AD administrative templates to prohibit or prevent users from changing or updating the Microsoft Office security settings for all the AD users in my domain? Most of the users are using Microsoft 365 MSO and M365 Click to Run. Any assistance and suggestions would be much appreciated.

Hello there, For C2R versions of Office, such as Microsoft 365 apps for enterprise, Office Professioanl Plus 2019, if you want to prevent users changing Macro settings, you could use group policy. Outlook: Administrative Templates (Users) > Microsoft Outlook 2016 > Security > Trust Center > "Security setting for macros", select "Enable" and choose one level you want. Word: Administrative Templates (Users) > Microsoft Word 2016 > Word Options > Security > Trust Center > "VBA Macro Notification Settings", enable it and choose one level. Hope this resolves your Query !! --If the reply is helpful, please Upvote and Accept it as an answer--

Preventing users to change the Microsoft Office 365 security settings?

Accepted answer

Limitless Technology 44,426 Reputation points

2023-06-06T09:28:22.28+00:00

Hello there,

For C2R versions of Office, such as Microsoft 365 apps for enterprise, Office Professioanl Plus 2019, if you want to prevent users changing Macro settings, you could use group policy.

Outlook: Administrative Templates (Users) > Microsoft Outlook 2016 > Security > Trust Center > "Security setting for macros", select "Enable" and choose one level you want.

Word: Administrative Templates (Users) > Microsoft Word 2016 > Word Options > Security > Trust Center > "VBA Macro Notification Settings", enable it and choose one level.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--
Please sign in to rate this answer.

1 person found this answer helpful.
EnterpriseArchitect 5,431 Reputation points

2023-06-06T21:38:16+00:00

@Limitless Technology ,
Do I have to import the latest ADMX to use that GPO feature?

Emi Zhang-MSFT 26,031 Reputation points Microsoft Vendor

2023-06-07T02:15:11.4166667+00:00

You can download from this link: https://www.microsoft.com/en-us/download/details.aspx?id=49030

Ken Lux 0 Reputation points

2024-11-30T11:52:15.44+00:00

Be aware that in Office Home and Business 2021 that for Word, Excel, and PowerPoint, the above mentioned settings DO NOT work. GPO settings for Trust Center are respected ONLY when launching one of these applications by double-clicking on an associated file. Once the application is launched, the GPO settings are ignored and the user-managed settings are used. No Trust Center settings are grayed out.

Suppose that you have a GPO applied that sets the FileBlock settings to block opening of Word 2003 files, and a user has changed the FileBlock settings to allow Word 2003 files to be opened (THERE IS NO WAY TO PREVENT USERS FROM DOING THIS IN OFFICE HOME AND BUSINESS 2021).

If Word is not open and you double-click on a Word 2003 file, you will get a message that Word 2003 files are blocked. Click on "OK" to acknowledge the message and then double click on any Word 2003 file and it will open in regular mode (unless the user has set the FileBlock settings to allow it to open, but use Protected View).

So basically, in Office Home and Business 2021, Microsoft has set up these programs to go through an extra step on startup to to ignore GPO settings that they otherwise would have used and to use the user-defined settings instead!

Interestingly, this does not happen in Outlook. Its TrustCenter settings DO follow the GPO settings and are grayed out if they are defined in a GPO.

I reported this issue to MS's vulnerability submission site, but they closed it saying that it was a support issue, not a vulnerability.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Preventing users to change the Microsoft Office 365 security settings?

0 additional answers

Your answer