Block Excel XLL Add-ins that come from an untrusted source

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\excel\security\blockxllfrominternet

This per-user Excel policy controls whether XLL add-ins from untrusted sources can run. XLL files contain executable add-in code and can extend Excel with custom functions and other capabilities.

The registry value uses the REG_DWORD type and supports these policy values:

• 1 – Block: Excel prevents the XLL add-in from running and notifies the user that it was blocked.
• 0 – Show Additional Warning: Excel displays another security warning after the user chooses to enable an XLL add-in from an untrusted source. The user can still allow it to run.
• 2 – Allow: This policy does not block XLL add-ins from untrusted sources.

For this setting, a value of 0 therefore selects the warning behavior; it does not mean that the policy is disabled.

Notes

Security

XLL add-ins can load executable code into Excel. Malicious XLL files have been used to distribute malware. Setting the value to 1 closes this execution path for untrusted sources and prevents users from bypassing the block directly in Excel.

Values 0 and especially 2 provide less protection. With 0, execution ultimately depends on the user's response to the warning. With 2, this policy provides no blocking barrier. Other applicable security controls remain in effect.

Even when blocking is selected, an XLL add-in can run if it is stored in a Trusted Location or is digitally signed and the corresponding Trusted Publisher certificate is installed on the device.

Possible side effects

A value of 1 can block legitimate XLL add-ins obtained from the internet, delivered as attachments, or opened from locations that are not trusted. Functions, calculations, or integrations supplied by such an add-in are then unavailable.

Notes

Disabling or not configuring the policy does not automatically allow XLL add-ins from untrusted sources. Excel's default behavior and other Trust Center settings determine the result instead. Current supported Excel versions block untrusted XLL add-ins by default, but users can influence that default behavior when it is not enforced through policy.

A change takes effect after Excel has been completely closed and reopened. Microsoft lists this behavior as applying to Excel for Microsoft 365 and Excel 2024, 2021, 2019, and 2016.

Microsoft documentation

Microsoft Support: Excel is blocking untrusted XLL add-ins by default

Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference

See also

• Entry in the reference