Title

Macro storage must be in personal macro workbooks. (Cat II impact)

Discussion

This policy setting controls the default location for storing macros in Excel. If this policy setting is enabled, Excel stores macros in users' personal macro workbook. If you disable or do not configure this policy setting, Excel stores macros in the active workbook from which they are created. Note: In the user interface (UI), the "Store macro in" drop down list box in the Record Macro dialog box (Macros | Record Macro) allows users to choose whether to store the new macro in the current workbook, a new workbook, or their personal macro workbook (Personal.xlsb), a hidden workbook that opens every time Excel starts. By default, Excel displays the "Store macro in" box with "This Workbook" already selected in the drop-down list. If a user saves a macro in the active workbook and then distributes the workbook to others, the macro is distributed along with the workbook. If you enable this policy setting, Excel displays the "Store macro in" box with "Personal Macro Workbook" already selected. Users can still select one of the other two options in the drop-down menu.

Check Content

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2016 -> Excel Options -> Security -> Trust Center "Store macro in Personal Macro Workbook by default" is set to "Enabled". Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\16.0\excel\options\binaryoptions Criteria: If the value fGlobalSheet_37_1 is REG_DWORD = 1, this is not a finding.

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Excel 2016 -> Excel Options -> Security -> Trust Center "Store macro in Personal Macro Workbook by default" to "Enabled".

Additional Identifiers

Rule ID: SV-238184r879630_rule

Vulnerability ID: V-238184

Group Title: SRG-APP-000210

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.