Still Running Office 2019? Reduce the Risk with Group Policy

Microsoft Office 2019 reached the end of extended support on 14 October 2025. The applications will continue to work, but Microsoft no longer provides security fixes for vulnerabilities subsequently discovered in Office 2019.

For organisations that cannot immediately replace Office 2019, Group Policy can be used to reduce some of the risk.

It cannot make an unsupported version of Office secure again, and it cannot fix an unpatched vulnerability in Word, Excel, Outlook or another Office executable.

What it can do is remove or restrict many of the mechanisms commonly used to turn a malicious document into a successful compromise.

These same Group Policy hardening principles can also be applied to Office 2021, Office LTSC 2021/2024 and Microsoft 365 Apps, although the available policy settings and defaults should be checked against the current Office ADMX templates before deployment.

The objective is to put several controls between the document and the operating system.

Internet / Email Document
          |
          v
   Mark of the Web
          |
          v
    Protected View
          |
          v
  Office File Validation
          |
     +----+----+
     |         |
 Macro Block  ActiveX/OLE Block
     |
     v
   Office
     |
     v
 Defender ASR
     |
     +-- X PowerShell
     +-- X CMD
     +-- X WScript
     +-- X Executable creation
     +-- X Process injection

No single setting in this article should be considered a complete defence. The benefit comes from applying the controls together.

A warning before applying these policies

Some of the policies below can prevent legitimate Office functionality.

An organisation may have Excel workbooks using VBA, Word templates containing macros, applications that depend on ActiveX, Excel workbooks using external data connections, Office add-ins supplied by third-party products or internal systems that use DDE, OLE or Trusted Locations.

Turning everything on across the estate without testing could therefore break business processes.

I would strongly recommend deploying the policies to a representative pilot group first. Defender Attack Surface Reduction rules should initially be placed into Audit mode. Existing macros, add-ins, templates and data connections should be identified before the more restrictive settings are enforced.

Where an exception is genuinely required, create a narrowly scoped exception GPO rather than weakening the main Office hardening policy for everyone.

1. Install the Office Administrative Templates

Office 2019 uses the Office 16.0 policy model.

This means that when the Office Administrative Templates are installed, Group Policy paths will normally appear as:

Microsoft Office 2016
Microsoft Word 2016
Microsoft Excel 2016
Microsoft PowerPoint 2016

The latest Office Administrative Templates should be copied into the domain Central Store so that the settings can be managed consistently from Group Policy Management.

A sensible GPO layout would be:

SEC - Office 2019 - Hardening - Computer

SEC - Office 2019 - Hardening - User

The Computer GPO can contain Defender ASR and certificate settings.

The User GPO can contain the Office application policies.

2. Block macros originating from the Internet

Macros remain one of the more obvious routes from a malicious document into executable code.

Microsoft recommends the Block macros from running in Office files from the Internet policy as part of its Office security guidance.

For Word:

User Configuration
  Policies
    Administrative Templates
      Microsoft Word 2016
        Word Options
          Security
            Trust Center

Configure:

Block macros from running in Office files from the Internet
    Enabled

The equivalent policy should be configured for the Office applications installed in the organisation, including:

Microsoft Excel 2016
Microsoft PowerPoint 2016
Microsoft Access 2016 (Application Settings > Security)
Microsoft Visio 2016
Microsoft Project 2016 (No Setting)

Microsoft documents separate Internet macro policies for the individual Office applications.

Compatibility warning

This can prevent macro-enabled documents downloaded through browsers, received by email or otherwise carrying Mark of the Web from running their macros.

Do not solve this by creating a broad Trusted Location or automatically removing Mark of the Web from downloaded files. That would remove much of the protection the policy provides.

3. Require signed VBA macros

If macros are not required at all, the strongest position is:

VBA Macro Notification Settings
    Disable all macros without notification

That is unlikely to be practical everywhere.

Where VBA is required, I would use:

VBA Macro Notification Settings
    Disable all except digitally signed macros

and, where available:

Require macros to be signed by a trusted publisher
    Enabled

Apply the equivalent setting to Word, Excel, PowerPoint and other applications that support VBA.

Trusted publisher certificates should be deployed centrally rather than allowing users to establish their own arbitrary trust relationships.

For example:

Computer Configuration
  Policies
    Windows Settings
      Security Settings
        Public Key Policies
          Trusted Publishers

Only approved code-signing certificates should be placed here.

Compatibility warning

This is likely to expose old internal spreadsheets and templates containing unsigned VBA.

Before enforcement, identify which macros are still required and sign the ones that have a legitimate business purpose.

Do not simply allow unsigned macros because several old spreadsheets fail.

4. Disable ActiveX

ActiveX can provide legitimate functionality, but it also substantially increases the amount of executable behaviour available inside an Office document.

ACSC recommends disabling ActiveX when hardening Office.

Configure:

User Configuration
  Policies
    Administrative Templates
      Microsoft Office 2016
        Security Settings

Set:

Disable All ActiveX
    Enabled

The corresponding policy registry location is:

HKCU\Software\Policies\Microsoft\Office\Common\Security

with:

DisableAllActiveX = 1

Compatibility warning

Older Excel workbooks, Access applications and internally developed Office solutions may depend on ActiveX controls.

This is one of the settings I would specifically test against Finance, engineering and legacy line-of-business applications before general enforcement.

5. Enforce Protected View

Protected View provides another barrier between an untrusted document and the local system.

For Word:

User Configuration
  Policies
    Administrative Templates
      Microsoft Word 2016
        Word Options
          Security
            Trust Center
              Protected View

Configure:

Do not open files from the Internet zone in Protected View
    Disabled

Do not open files in unsafe locations in Protected View
    Disabled

Turn off Protected View for attachments opened from Outlook
    Disabled

The wording is slightly counter-intuitive.

The policies say Do not open, so setting them to Disabled ensures that Protected View remains active.

Also configure:

Set document behaviour if file validation fails
    Enabled
    Block files

Apply the equivalent settings to Excel and PowerPoint.

For Excel, also consider:

Always open untrusted database files in Protected View
    Enabled

6. Enforce Office File Validation

Office File Validation checks older binary Office formats before allowing Office to process them normally.

For Word:

Microsoft Word 2016
  Word Options
    Security

Configure:

Turn off file validation
    Disabled

For Excel:

Microsoft Excel 2016
  Excel Options
    Security

Configure:

Turn off file validation
    Disabled

For PowerPoint:

Microsoft PowerPoint 2016
  PowerPoint Options
    Security

Configure:

Turn off file validation
    Disabled

The intention is to ensure validation cannot simply be disabled.

7. Preserve Mark of the Web

Mark of the Web, or MOTW, is particularly important because Office uses it to determine that a document originated from an untrusted Internet location.

Microsoft explains that files downloaded from Internet or Restricted zones can carry this information and that Office uses it when deciding whether macros should run.

Configure:

User Configuration
  Policies
    Administrative Templates
      Windows Components
        Attachment Manager

Set:

Do not preserve zone information in file attachments
    Disabled

Because the policy is negatively worded, Disabled means Windows continues to preserve zone information.

I would also configure:

Hide mechanisms to remove zone information
    Enabled

This removes the normal Explorer mechanism that allows a user to unblock a downloaded file.

It does not make MOTW impossible to remove by an administrator or other tooling, but it stops the normal user workflow from casually bypassing the protection.

8. Disable Trusted Documents

When a user chooses to trust a document, Office can remember that decision.

For an unsupported Office installation, I would avoid allowing that previous user decision to become a persistent security bypass.

For Word:

Microsoft Word 2016
  Word Options
    Security
      Trust Center

Configure:

Turn off trusted documents
    Enabled

Turn off Trusted Documents on the network
    Enabled

Repeat for Excel and PowerPoint.

Where installed, review the equivalent settings for Visio and the other Office applications.

9. Restrict Trusted Locations

Trusted Locations deserve particular attention.

Microsoft explains that files in a Trusted Location can bypass some Office security checks, including the handling normally applied to files carrying Mark of the Web. Microsoft recommends using Trusted Locations sparingly and does not recommend network Trusted Locations.

For Word, Excel, PowerPoint and the other relevant applications, locate:

Trust Center
  Trusted Locations

Configure:

Allow Trusted Locations on the network
    Disabled

Where practical:

Disable all trusted locations
    Enabled

This is the preferred security position.

If a Trusted Location is genuinely required, define the exact location through a dedicated exception policy.

Avoid creating Trusted Locations such as:

C:\Users

C:\Users\Public

C:\Temp

%APPDATA%

%LOCALAPPDATA%

\\FileServer\Shared

\\Domain\DFSRoot

A Trusted Location should contain controlled application content and normal users should ideally not have permission to place arbitrary files into it.

Compatibility warning

Trusted Locations are frequently used to make old Office applications work without constant security prompts.

Disabling them may therefore reveal dependencies that have existed unnoticed for years.

Identify and correct those dependencies rather than automatically turning the Trusted Location back on for the whole organisation.

10. Disable Excel DDE

Dynamic Data Exchange is old technology and may still exist in some business processes.

It also provides functionality that can be abused.

For Excel:

User Configuration
  Policies
    Administrative Templates
      Microsoft Excel 2016
        Excel Options
          Security
            Trust Center
              External Content

Configure:

Don't allow Dynamic Data Exchange (DDE) server launch in Excel
    Enabled

Don't allow Dynamic Data Exchange (DDE) server lookup in Excel
    Enabled

Also configure:

Always prevent untrusted Microsoft Query files from opening
    Enabled

ACSC includes DDE and external-content restrictions in its Office hardening recommendations.

Compatibility warning

There are still applications that use DDE to pass information into Excel.

This setting therefore needs testing against applications that generate spreadsheets or interact directly with a running Excel instance.

11. Prevent Word automatically updating external links

For Word:

User Configuration
  Policies
    Administrative Templates
      Microsoft Word 2016
        Word Options
          Advanced

Configure:

Update automatic links at Open
    Disabled

This reduces automatic retrieval or updating of linked external content when a document is opened.

12. Harden Excel external content

Where the Administrative Templates do not provide the required control directly, Group Policy Preferences can be used.

Create:

User Configuration
  Preferences
    Windows Settings
      Registry

Under:

HKCU\Software\Microsoft\Office\16.0\Excel\Security

create:

DataConnectionWarnings
    REG_DWORD
    2

RichDataConnectionWarnings
    REG_DWORD
    2

WorkbookLinkWarnings
    REG_DWORD
    2

For Word:

HKCU\Software\Microsoft\Office\16.0\Word\Security

create:

AllowDDE
    REG_DWORD
    0

Compatibility warning

Excel is often used as a front end for databases, SQL Server, web services, Power Query and other external sources.

Do not assume that every external connection is malicious.

This area should be tested against users who depend heavily on Excel for reporting.

13. Disable OLE package activation

Object Linking and Embedding provides another way of placing active content inside Office documents.

The following registry settings can be deployed through Group Policy Preferences.

For Word:

HKCU\Software\Microsoft\Office\16.0\Word\Security

PackagerPrompt
    REG_DWORD
    2

For Excel:

HKCU\Software\Microsoft\Office\16.0\Excel\Security

PackagerPrompt
    REG_DWORD
    2

For PowerPoint:

HKCU\Software\Microsoft\Office\16.0\PowerPoint\Security

PackagerPrompt
    REG_DWORD
    2

Compatibility warning

Documents containing legitimate embedded packages may no longer behave as users expect.

Again, test rather than assuming the feature is unused.

14. Control Office add-ins

Add-ins are another source of executable code inside an Office process.

Where add-ins are required, configure the relevant Office applications to require signed add-ins.

For example:

Require that application add-ins are signed by Trusted Publishers
    Enabled

Disable Trust Bar Notification for unsigned application add-ins and block them
    Enabled

Where an Office application does not require add-ins at all:

Disable all application add-ins
    Enabled

Repeat this for the installed Office applications where the corresponding policy is available.

Compatibility warning

This is another policy likely to affect third-party software.

PDF products, document management systems, finance applications, CRM systems and other products may install Office add-ins.

Inventory them before blocking unsigned add-ins.

15. Prevent PowerPoint launching programs

PowerPoint presentations can contain actions designed to execute external programs.

Configure:

User Configuration
  Policies
    Administrative Templates
      Microsoft PowerPoint 2016
        PowerPoint Options
          Security

Set the program execution policy so PowerPoint cannot run external programs.

Where presented as:

Run Programs

configure:

Disable - don't run any programs

16. Force Excel file extensions to match the file type

A file presented as one format should not silently contain a different format internally.

For Excel:

User Configuration
  Policies
    Administrative Templates
      Microsoft Excel 2016
        Excel Options
          Security

Configure:

Force file extension to match file type
    Enabled

Select:

Always match file type

17. Review legacy Office file formats

Old Office formats increase the amount of legacy parsing code that Office must expose.

Review:

Word 2016
  Word Options
    Security
      Trust Center
        File Block Settings

And the equivalent locations for Excel and PowerPoint.

Candidates for blocking include obsolete formats such as:

Excel 2.x

Excel 3.x

legacy macro sheets

obsolete Word converters

old PowerPoint formats

DIF and SYLK where not required

I would not automatically block:

.doc

.xls

.ppt

Without first determining whether the organisation still has legitimate business documents in those formats.

A surprising amount of historical corporate information can still exist as Office 97-2003 files.

18. Add Defender Attack Surface Reduction rules

The Office policies above try to prevent malicious content from running.

Attack Surface Reduction provides another control if something gets further than expected.

Microsoft's current ASR rule set includes several rules specifically targeting Office behaviour.

The complete list of ASR rules is located at the end of this blog.

Configure:

Computer Configuration
  Policies
    Administrative Templates
      Windows Components
        Microsoft Defender Antivirus
          Microsoft Defender Exploit Guard
            Attack Surface Reduction

Enable:

Configure Attack Surface Reduction rules

I would consider the following Office-related rules.

Block all Office applications from creating child processes

D4F940AB-401B-4EFC-AADC-AD5F3C50688A

This is one of the most useful rules in the baseline.

It can prevent behaviour such as:

WINWORD.EXE
   |
   +-- powershell.exe

or:

EXCEL.EXE
   |
   +-- cmd.exe

or:

WINWORD.EXE
   |
   +-- wscript.exe

Block Office applications from creating executable content

3B576869-A4EC-4529-8536-B80A7769E899

This makes it harder for Office processes to drop executable payloads.

Block Office applications from injecting code into other processes

75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84

Block Win32 API calls from Office macros

92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B

Block executable content from email client and webmail

BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550

Block Office communication applications from creating child processes

26190899-1602-49E8-8B27-EB1D0A1CE869

Microsoft lists these rules and GUIDs in the current ASR documentation.

19. Start ASR in Audit mode

Do not immediately place these rules into Block across the organisation.

ASR uses:

1 = Block
2 = Audit
6 = Warn

Microsoft documents both the rule modes and Group Policy deployment.

Start with:

2

for the Office-related rules.

This allows legitimate behaviour to be identified without immediately breaking it.

Once the environment has been reviewed, change clean rules to:

1

for Block.

Compatibility warning

The child-process rule can block legitimate Office automation.

For example, an internal Excel macro may deliberately launch:

powershell.exe
cmd.exe
cscript.exe
wscript.exe

That does not mean the ASR rule should be abandoned. It means the dependency needs to be identified and assessed.

Avoid broad ASR exclusions such as:

C:\Users\*

C:\ProgramData\*

C:\Windows\Temp\*

An exclusion should be as narrow as possible.

20. Consider restricting Office network access

This is not something I would automatically deploy everywhere, but it can be useful on particularly restricted systems.

If Word or PowerPoint has no legitimate reason to communicate directly with the Internet, outbound firewall rules could be considered for:

WINWORD.EXE

POWERPNT.EXE

MSPUB.EXE

VISIO.EXE

Potentially also:

EXCEL.EXE

Excel may legitimately access:

SQL Server

Power Query sources

internal web services

SharePoint

linked workbooks

REST APIs

external data feeds

Network restrictions should therefore be treated as an additional hardening layer rather than part of the initial deployment.

21. Create separate exception GPOs

Avoid changing the baseline because one application stops working.

For example:

SEC - Office 2019 - Exception - Finance Signed Macro

SEC - Office 2019 - Exception - Approved Trusted Location

SEC - Office 2019 - Exception - Legacy Add-in

Scope them using dedicated security groups such as:

GG-Office2019-Exception-FinanceMacro

An exception should record:

Application

Business owner

Reason

Affected users

Policy being relaxed

Compensating controls

Review date

An exception should be exactly that: an exception.

It should not gradually become the configuration used by most of the organisation.

22. Review ASR events

ASR events are recorded in:

Applications and Services Logs
  Microsoft
    Windows
      Windows Defender
        Operational

Useful events include:

1121
ASR rule blocked activity

1122
ASR rule audit activity

Microsoft documents Audit and Block behaviour and provides troubleshooting guidance for ASR deployments.

These events can also be collected centrally using Windows Event Forwarding.

That makes it possible to see which Office applications are attempting behaviour that would be blocked before moving the rule into enforcement.

23. Verify the deployed GPO

Generate a Group Policy report:

gpresult /h C:\Temp\Office2019-GPO.html

RSoP can also be used:

rsop.msc

What the hardened Office path looks like

Once the policies are applied, an untrusted Office document has considerably more work to do.

Untrusted Office document
          |
          v
    Mark of the Web
          |
          v
     Protected View
          |
          v
 Office File Validation
          |
          +----> Internet macro? -------- BLOCK
          |
          +----> Unsigned VBA? ---------- BLOCK
          |
          +----> ActiveX? --------------- BLOCK
          |
          +----> OLE package? ----------- BLOCK
          |
          +----> DDE? ------------------- BLOCK
          |
          v
       Office
          |
          +----> PowerShell? ------------ ASR BLOCK
          |
          +----> CMD? ------------------- ASR BLOCK
          |
          +----> WScript? --------------- ASR BLOCK
          |
          +----> Create executable? ----- ASR BLOCK
          |
          +----> Process injection? ----- ASR BLOCK

That is a very different proposition from leaving an unsupported Office installation with its default configuration.

Final thoughts

Office 2019 being out of support does not mean every installation will immediately be compromised. It does mean that the security position has changed. A newly discovered Office 2019 vulnerability may no longer receive a security update from Microsoft.

If Office 2019 has to remain installed for a period of time, it makes sense to reduce the amount of functionality available to an attacker.

Block Internet macros. Require signatures for the macros that genuinely need to remain. Disable ActiveX where possible. Keep documents in Protected View. Preserve Mark of the Web. Restrict Trusted Locations. Disable unnecessary DDE and OLE functionality. Control add-ins and put Defender ASR around the Office processes.

Just as importantly, test the configuration before enforcing it.

A hardened Office deployment that breaks a critical finance workbook is ikely to survive longer than your job.

Audit first, understand what the organisation actually uses, enforce the controls that work and create tightly scoped exceptions for the things that genuinely need them.

Office 2019 should be replaced with a supported version, eg LibreOffice.

Complete list of ASR Rules

Rule name in Microsoft Intune	Rule name in Microsoft Configuration Manager	GUID	Category
Standard protection rules
Block abuse of exploited vulnerable signed drivers (Device)	n/a	56a863a9-875e-4185-98a7-b882c64b5ce5	Misc
Block credential stealing from the Windows local security authority subsystem	same	9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2	Lateral movement & credential theft
Block persistence through WMI event subscription	n/a	e6db77e5-3df2-4cf1-b95a-636979351e5b	Lateral movement & credential theft
Block Adobe Reader from creating child processes	n/a	7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c	Productivity apps
Block all Office applications from creating child processes	Block Office application from creating child processes	d4f940ab-401b-4efc-aadc-ad5f3c50688a	Productivity apps
Block executable content from email client and webmail	same	be9ba2d9-53ea-4cdc-84e5-9b1eeee46550	Email
Block executable files from running unless they meet a prevalence, age, or trusted list criterion	Block executable files from running unless they meet a prevalence, age, or trusted list criteria	01443614-cd74-433a-b99e-2ecdc07bfc25	Polymorphic threats
Block execution of potentially obfuscated scripts	same	5beb7efe-fd9a-4556-801d-275e5ffc04cc	Script
Block JavaScript or VBScript from launching downloaded executable content	same	d3e037e1-3eb8-44c8-a917-57927947596d	Script
Block Office applications from creating executable content	same	3b576869-a4ec-4529-8536-b80a7769e899	Productivity apps
Block Office applications from injecting code into other processes	same	75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84	Productivity apps
Block Office communication application from creating child processes	n/a	26190899-1602-49e8-8b27-eb1d0a1ce869	Email, Productivity apps
Block process creations originating from PSExec and WMI commands	n/a	d1e49aac-8f56-4280-b9ba-993a6d77406c	Lateral movement & credential theft
Block rebooting machine in Safe Mode	n/a	33ddedf1-c6e0-47cb-833e-de6133960387	Misc
Block untrusted and unsigned processes that run from USB	same	b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4	Polymorphic threats
Block use of copied or impersonated system tools	n/a	c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb	Misc
Block Webshell creation for Servers	n/a	a8f5898e-1dc8-49a9-9878-85004b8a61e6	Misc
Block Win32 API calls from Office macros	same	92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b	Productivity apps
Use advanced protection against ransomware	same	c1db55ab-c21a-4637-bb3f-a12568109d35	Polymorphic threats