Microsoft is undoing a decision it made earlier this year to disable macros by default in Microsoft Office applications. In February an update was announced that Microsoft was introducing a new way in which VBA macros would be handled. This change is now being rolled back by Microsoft until further notice. This affects the Microsoft Office applications Access, Excel, PowerPoint, Visio, and Word. 

Microsoft’s original plan was to start in April 2022, where documents downloaded from the internet would begin blocking macros by default in Office applications, with a red Security Risk banner being displayed. This warning explained why the macros have been disabled and offers a link to an article explaining more about this auto-ban. However, there is not an easy way for the macros to be re-enabled in this system, unlike what existed previously. Before this update earlier in the year, instead of a ‘Learn More’ option on the red Security Risk banner, there was a yellow Warning bar displayed, with an ‘Enable Content’ button, making it much easier for macros to be re-enabled. 

The updated earlier this year was welcomed by many, as blocking VBA macros was thought to provide great default protection against any potentially malicious malware stored in Microsoft Office documents. A recent malware known as SVCReady operated in this way through Office documents as email attachments, which utilised VBA macros to run shellcode contained within the properties of the document. Microsoft removing this automatic ban of VBA macros could leave users at risk to these kind of malware attacks, and the change has happened without much news presence, so many end users could be unaware of this change. 

The decision to rollback this change has come about due to negative feedback received by Microsoft about the ease of re-enabling macros since the update, which seemed to launch in June rather than April.  This was not a highly publicised change, and has been announced by Microsoft only as an edit to the February Article. Although this roll back is said to be a temporary change, a date for when it will be rectified has not been given.  

Users should consider a workaround to continue to block VBA macros by default, which involves turning settings on manually in each affected Office application. This can be done by downloading Microsoft Office group policies, and configuring the ‘Block macros from running Office files from the Internet’ policy. This needs to be done for each Office application, and can be found under ‘User Configuration’ > ‘Administrative Templates’ > ‘[Office Application Name]’ > ‘[Office Application Name] Options’ > ‘Security’ > ‘Trust Center’. The policy then needs to be set to ‘Enabled’ in order to run successfully.