Microsoft Security Baselines provide a set of recommended configuration settings for securing your environment. However, sometimes these settings can interfere with normal operations, causing unexpected issues. Recently, we encountered a problem where enabling the security baseline caused Excel macros to stop working. Here’s a detailed account of the issue and how we resolved it.
The Problem After turning on the Microsoft Security Baseline for Windows 10 and later, macros in Excel stopped functioning. Typically, this problem can be resolved by creating a trusted location for the file share. However, in our case, we were using DFS (Distributed File System) namespaces, and adding the file path to the DFS namespace as a trusted location did not solve the issue. Even though File Explorer recognized the DFS namespace as a trusted location, Excel continued to block the macros.
Here’s what normally fixes it when using a normal file share. Create a configuration profile to add the trusted location:
The Initial Attempt Our initial troubleshooting steps included the following:
- Ensuring that the file path for the DFS namespace was correctly added as a trusted location.
- Verifying that File Explorer acknowledged the DFS path as trusted.
Despite these efforts, Excel still blocked the macros, indicating that the issue lay deeper within the configuration settings. To resolve the issue, we decided to create a configuration profile using administrative templates, which mirrors group policy settings. Here’s the step-by-step solution:
- Create a Configuration Profile: We created a configuration profile in Microsoft Endpoint Manager using administrative templates.
- Set Intranet Zone to Low Security:
o We configured the intranet zone template to have low security settings. - Add DFS Namespace to Trusted Sites:
o Instead of adding the DFS namespace as a trusted location, we added it as a trusted site.
o The format used was file://. For example, file://corp.site.com instead of \corp.site.com for the DFS location. - Include All Local Intranet Sites:
o We enabled the setting to include all local intranet sites not listed in other zones. This ensures that any other network resources are also trusted. - Apply the Settings:
o We applied these settings, ensuring that the DFS namespace location was recognized as a trusted site.
This approach effectively resolved the issue. Excel macros started functioning correctly once the DFS namespace was added as a trusted intranet site instead of just a trusted location. Below are some screenshots:
