I am trying to run a VBS script which calls a macro and won't run unless I click "Trust Access to the VBA object model" in Microsoft Office Trust Center. I forget where I read it but I thought I read this was extremely unsafe. This project is for work and to be distributed to possibly many terminals, but before I ask them to check this setting I wanted to know if this is something that is considered safe.


2 Answers 2


If you look at the docs at https://support.office.com/en-us/article/enable-or-disable-macros-in-office-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6 macros are disabled by default and there are multiple options to enable them.

Users should be encouraged to use the ”principle of least privilege” which in this case means to only enable macros in documents where they trust the author, and were expecting the document, and for the most limited amount of time. So the option on that page ”Enable macros for one time when the Security Warning appears” is best.

Why? You don't want your users to open spam emails that looked important to trick victim into opening the document to have a macro script steal data or install back doors.

From the user perspective is it unsafe to ever enable macros? If write my own macro and run it on a clean laptop then obviously not. If my mom opens a document that runs a macro that was emailed to her by “[email protected]” then obviously yes.

It is implicit in the fact it asks you to confirm whether you want to enable scripting that the system requires the user to confirm that they know it is safe to trust the origin and author of the VBA script.

One might be able to argue that the VBA engine makes it too easy to attack people in this way. Historically people have argued that Microsoft products are fundamentally unsafe simply because there were so many exploits and victims. Yet clearly they have invested a lot of effort into trying to make it safer for unknowledgable users by blocking scripting by default. Some users might simply always run all scripts without considering the consequences or checking the origin of the documents they are opening. Yet at least they were given a choice and the defaults were secure.

So why might Microsoft let you enable scripting across the board which is less safe than letting users have to confirm for each document? Why let someone disable security features? Probably for backwards compatibility when the security feature was first introduced. They used to not block macros, blocking them might have caused issues for some customers who know they are always secure (eg no external emails allowed to certain users), so there is a opt-out to disable that security feature, which makes sense for a very small number of customers. You should not encourage users to disable any security features.

  • If your writing the code it’s only unsafe if you are the attacker.
    – simbo1905
    Mar 22, 2019 at 6:05
  • unless this forces them to enable scripting for all documents not just yours? in which case then yes, you are removing a defence that makes it more likely that they can be tricked. Ideally, they should only have to enable scripting on a per document basis. Then they can be trained to enable it for your documents as they can trust you but not documents sent by untrustworthy people. Of course of an attacker knows that they open and trust your documents they can spoof your email address to sent a targeted attack document.
    – simbo1905
    Mar 22, 2019 at 6:10
  • support.office.com/en-us/article/… says that they can trust the current document your don't have to have them trust all documents. you should document that they only run macros for content the they trust when they open the document (the first approach on that page). I will update my answer.
    – simbo1905
    Mar 22, 2019 at 6:13

This is really an expansion on @Simbi1905 answer. What I have done to mitigate security risks is create a "Code Signing" certificate and sign all my VBA projects now. This can allow you to leave default or even increase security settings and still have a good flow for end users.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .