[{"data":1,"prerenderedAt":292},["ShallowReactive",2],{"doku:en:richtlinien-anhang\u002Fhilfe-office16-office-microsoft-policies-windows-l-macroruntimescanscope":3},{"seite":4,"start":37,"leiste":38,"bereich":291,"zurueck":291,"weiter":291},{"sprache":5,"rel":6,"zu":7,"id":8,"titel":9,"titelHtml":9,"beschreibung":10,"kennzeile":11,"imMenue":12,"html":13,"ueberschriften":14},"en","richtlinien-anhang\u002Fhilfe-office16-office-microsoft-policies-windows-l-macroruntimescanscope","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Fhilfe-office16-office-microsoft-policies-windows-l-macroruntimescanscope","referenz-hilfe-office16-office-microsoft-policies-windows-l-macroruntimescanscope","Macro Runtime Scan Scope","This value determines which macro-enabled files Office submits for runtime inspection through the Antimalware Scan Interface (AMSI).","since 0.9.8.11",false,"\u003Ch2 id=\"purpose\">Purpose\u003C\u002Fh2>\n\u003Cdetails class=\"doku-klappbox\">\u003Csummary>Show registry keys (1)\u003C\u002Fsummary>\u003Cdiv class=\"doku-klappbox-inhalt\">\n\u003Cul>\n\u003Cli>\u003Ccode>HKCU\\software\\policies\\microsoft\\office\\16.0\\common\\security\\macroruntimescanscope\u003C\u002Fcode>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fdiv>\u003C\u002Fdetails>\n\u003Cp>This value determines which macro-enabled files Office submits for runtime inspection through the Antimalware Scan Interface (AMSI). It applies to VBA macros in supported Office applications and to Excel 4.0 (XLM) macros, which are supported only by Excel.\u003C\u002Fp>\n\u003Cp>The value uses the \u003Ccode>REG_DWORD\u003C\u002Fcode> data type and supports the following data:\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ccode>0\u003C\u002Fcode>: Disables macro runtime scanning for all files.\u003C\u002Fli>\n\u003Cli>\u003Ccode>1\u003C\u002Fcode>: Scans macros in low-trust files. Files are excluded when they are opened with the macro security setting “Enable All Macros,” originate from a Trusted Location, are Trusted Documents, or contain VBA digitally signed by a Trusted Publisher.\u003C\u002Fli>\n\u003Cli>\u003Ccode>2\u003C\u002Fcode>: Scans macros in all macro-enabled files; the trust-based exclusions associated with \u003Ccode>1\u003C\u002Fcode> do not apply.\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>When runtime scanning is active, the VBA or XLM runtime reports certain security-sensitive code behaviors that a macro is about to perform to the registered AMSI provider. If the provider identifies the behavior as malicious, the Office application terminates the affected session, and the antimalware product can quarantine the file. Macro execution continues when the behavior is not classified as malicious.\u003C\u002Fp>\n\u003Ch2 id=\"notes\">Notes\u003C\u002Fh2>\n\u003Ch3 id=\"security\">Security\u003C\u002Fh3>\n\u003Cp>Runtime inspection gives the antimalware provider visibility into a macro’s actual behavior, including parameters resolved during execution. This can expose malicious activity that code obfuscation might conceal from static inspection.\u003C\u002Fp>\n\u003Cp>A value of \u003Ccode>0\u003C\u002Fcode> removes this additional AMSI inspection from enabled macros. A value of \u003Ccode>1\u003C\u002Fcode> retains the documented trust-based exclusions, while \u003Ccode>2\u003C\u002Fcode> extends inspection to those files and therefore provides the broadest runtime coverage.\u003C\u002Fp>\n\u003Cp>This setting does not determine whether macros are permitted to run. It supplements Office macro security and has an effect only when an antimalware product is registered on the device as an AMSI provider.\u003C\u002Fp>\n\u003Ch3 id=\"possible-side-effects\">Possible side effects\u003C\u002Fh3>\n\u003Cp>Runtime scanning can reduce the execution performance of affected VBA projects and XLM macro sheets. The impact depends on the macro’s behavior and the antimalware provider performing the inspection.\u003C\u002Fp>\n\u003Ch3 id=\"notes-1\">Notes\u003C\u002Fh3>\n\u003Cp>If the policy is not configured, Microsoft documents “Enable for low trust files,” corresponding to the behavior of value \u003Ccode>1\u003C\u002Fcode>, as the default.\u003C\u002Fp>\n\u003Cp>Microsoft documents this policy as applying only to subscription versions of Office, such as Microsoft 365 Apps for enterprise. The “Microsoft Office 2016” category name therefore does not by itself indicate support in the perpetual Office 2016 product.\u003C\u002Fp>\n\u003Ch3 id=\"microsoft-documentation\">Microsoft documentation\u003C\u002Fh3>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-security\u002Fsecurity-baselines\u002Fref-v2-office-settings\">Microsoft Learn: Settings for the Microsoft 365 Apps for Enterprise security baseline\u003C\u002Fa>\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2021\u002F03\u002F03\u002Fxlm-amsi-new-runtime-defense-against-excel-4-0-macro-malware\u002F\">Microsoft Security Blog: XLM + AMSI—New runtime defense against Excel 4.0 macro malware\u003C\u002Fa>\u003C\u002Fp>\n\u003Ch2 id=\"see-also\">See also\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung#e-362d802402\">Entry in the reference\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n",[15,19,22,26,29,31,34],{"ebene":16,"id":17,"text":18},2,"purpose","Purpose",{"ebene":16,"id":20,"text":21},"notes","Notes",{"ebene":23,"id":24,"text":25},3,"security","Security",{"ebene":23,"id":27,"text":28},"possible-side-effects","Possible side effects",{"ebene":23,"id":30,"text":21},"notes-1",{"ebene":23,"id":32,"text":33},"microsoft-documentation","Microsoft documentation",{"ebene":16,"id":35,"text":36},"see-also","See also","\u002Fen\u002Fdocumentation",[39,59,71,79,127,147,163,179,203,219,235],{"titel":40,"pfad":41,"seiten":42},"Getting started","erste-schritte",[43,47,51,55],{"rel":44,"titel":45,"zu":46},"erste-schritte\u002Fwas-ist-setup-foundry","Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fwas-ist-setup-foundry",{"rel":48,"titel":49,"zu":50},"erste-schritte\u002Finstallation","Installing Setup Foundry","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Finstallation",{"rel":52,"titel":53,"zu":54},"erste-schritte\u002Fschnellstart","Quick start","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fschnellstart",{"rel":56,"titel":57,"zu":58},"erste-schritte\u002Fablauf","How it works","\u002Fen\u002Fdocumentation\u002Ferste-schritte\u002Fablauf",{"titel":60,"pfad":61,"seiten":62},"Setup","wizard",[63,67],{"rel":64,"titel":65,"zu":66},"wizard\u002Fuebersicht","The setup wizard","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fuebersicht",{"rel":68,"titel":69,"zu":70},"wizard\u002Fsystemanforderungen","System requirements","\u002Fen\u002Fdocumentation\u002Fwizard\u002Fsystemanforderungen",{"titel":72,"pfad":73,"seiten":74},"Setup in detail","einrichtung-detail",[75],{"rel":76,"titel":77,"zu":78},"einrichtung-detail\u002Fwindows-quelle","Import an ISO","\u002Fen\u002Fdocumentation\u002Feinrichtung-detail\u002Fwindows-quelle",{"titel":80,"pfad":81,"seiten":82},"Foundry","konfiguration",[83,87,91,95,99,103,107,111,115,119,123],{"rel":84,"titel":85,"zu":86},"konfiguration\u002Fprofile","Profiles","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fprofile",{"rel":88,"titel":89,"zu":90},"konfiguration\u002Fquellen","Sources","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fquellen",{"rel":92,"titel":93,"zu":94},"konfiguration\u002Fbenutzer","Configuring users","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbenutzer",{"rel":96,"titel":97,"zu":98},"konfiguration\u002Fbilder","Background picture and logo","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fbilder",{"rel":100,"titel":101,"zu":102},"konfiguration\u002Fwindows-bereinigen","Cleaning up Windows","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fwindows-bereinigen",{"rel":104,"titel":105,"zu":106},"konfiguration\u002Fapps-entfernen","Removing apps","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fapps-entfernen",{"rel":108,"titel":109,"zu":110},"konfiguration\u002Fauswaehlen","Selecting applications","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fauswaehlen",{"rel":112,"titel":113,"zu":114},"konfiguration\u002Frichtlinien","Policies","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Frichtlinien",{"rel":116,"titel":117,"zu":118},"konfiguration\u002Fpc-informationen","PC information","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fpc-informationen",{"rel":120,"titel":121,"zu":122},"konfiguration\u002Fnamensschema","Naming scheme","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Fnamensschema",{"rel":124,"titel":125,"zu":126},"konfiguration\u002Finstall-assist-gestalten","Design the Install Assist","\u002Fen\u002Fdocumentation\u002Fkonfiguration\u002Finstall-assist-gestalten",{"titel":128,"pfad":129,"seiten":130},"Installation","installationsmedien",[131,135,139,143],{"rel":132,"titel":133,"zu":134},"installationsmedien\u002Fusb-stick","Create a USB drive","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fusb-stick",{"rel":136,"titel":137,"zu":138},"installationsmedien\u002Fiso-erstellen","Creating an ISO","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fiso-erstellen",{"rel":140,"titel":141,"zu":142},"installationsmedien\u002Fvhd-erstellen","Create VHD","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Fvhd-erstellen",{"rel":144,"titel":145,"zu":146},"installationsmedien\u002Finstall-assist","Install Assist on the target computer","\u002Fen\u002Fdocumentation\u002Finstallationsmedien\u002Finstall-assist",{"titel":148,"pfad":149,"seiten":150},"Machines","pruefmaschine",[151,155,159],{"rel":152,"titel":153,"zu":154},"pruefmaschine\u002Fhyper-v-berechtigungen","Hyper-V permissions","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fhyper-v-berechtigungen",{"rel":156,"titel":157,"zu":158},"pruefmaschine\u002Fverwenden","Use the test machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Fverwenden",{"rel":160,"titel":161,"zu":162},"pruefmaschine\u002Ferstellen","Create a machine","\u002Fen\u002Fdocumentation\u002Fpruefmaschine\u002Ferstellen",{"titel":164,"pfad":165,"seiten":166},"Editions","editionen",[167,171,175],{"rel":168,"titel":169,"zu":170},"editionen\u002Fvergleich","Editions at a glance","\u002Fen\u002Fdocumentation\u002Feditionen\u002Fvergleich",{"rel":172,"titel":173,"zu":174},"editionen\u002Flizenz-aktivieren","Activate a license","\u002Fen\u002Fdocumentation\u002Feditionen\u002Flizenz-aktivieren",{"rel":176,"titel":177,"zu":178},"editionen\u002Faktivierungen-zuruecksetzen","Reset activations","\u002Fen\u002Fdocumentation\u002Feditionen\u002Faktivierungen-zuruecksetzen",{"titel":180,"pfad":181,"seiten":182},"Troubleshooting","fehler",[183,187,191,195,199],{"rel":184,"titel":185,"zu":186},"fehler\u002Fusb","USB drive problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fusb",{"rel":188,"titel":189,"zu":190},"fehler\u002Fiso","ISO import problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fiso",{"rel":192,"titel":193,"zu":194},"fehler\u002Fhyperv","Hyper-V problems","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fhyperv",{"rel":196,"titel":197,"zu":198},"fehler\u002Finstall-assist","When Setup fails on the target computer","\u002Fen\u002Fdocumentation\u002Ffehler\u002Finstall-assist",{"rel":200,"titel":201,"zu":202},"fehler\u002Fantwortdatei","The answer file","\u002Fen\u002Fdocumentation\u002Ffehler\u002Fantwortdatei",{"titel":204,"pfad":205,"seiten":206},"Reference","referenz",[207,211,215],{"rel":208,"titel":209,"zu":210},"referenz\u002Fbekannte-probleme","Known issues","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fbekannte-probleme",{"rel":212,"titel":213,"zu":214},"referenz\u002Fdiagnose-und-protokolle","Diagnostics and logs","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fdiagnose-und-protokolle",{"rel":216,"titel":217,"zu":218},"referenz\u002Fglossar","Glossary","\u002Fen\u002Fdocumentation\u002Freferenz\u002Fglossar",{"titel":220,"pfad":221,"seiten":222},"Windows appendix","windows-anhang",[223,227,231],{"rel":224,"titel":225,"zu":226},"windows-anhang\u002Fdienste","Services","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fdienste",{"rel":228,"titel":229,"zu":230},"windows-anhang\u002Faufgaben","Scheduled tasks","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Faufgaben",{"rel":232,"titel":233,"zu":234},"windows-anhang\u002Fapps","App packages","\u002Fen\u002Fdocumentation\u002Fwindows-anhang\u002Fapps",{"titel":236,"pfad":237,"seiten":238},"Policy appendix","richtlinien-anhang",[239,243,247,251,255,259,263,267,271,275,279,283,287],{"rel":240,"titel":241,"zu":242},"richtlinien-anhang\u002Frichtlinien","Policy reference","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien",{"rel":244,"titel":245,"zu":246},"richtlinien-anhang\u002Frichtlinien-office-haertung","Office hardening","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-office-haertung",{"rel":248,"titel":249,"zu":250},"richtlinien-anhang\u002Frichtlinien-edge-internet-explorer","Edge and Internet Explorer","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-edge-internet-explorer",{"rel":252,"titel":253,"zu":254},"richtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen","Virus protection and attack surface","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-virenschutz-angriffsflaechen",{"rel":256,"titel":257,"zu":258},"richtlinien-anhang\u002Frichtlinien-netzwerk-freigaben","Network and file sharing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-netzwerk-freigaben",{"rel":260,"titel":261,"zu":262},"richtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie","Privacy and telemetry","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-datenschutz-telemetrie",{"rel":264,"titel":265,"zu":266},"richtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung","Logging and auditing","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-protokollierung-ueberwachung",{"rel":268,"titel":269,"zu":270},"richtlinien-anhang\u002Frichtlinien-anmeldung-konten","Sign-in and accounts","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-anmeldung-konten",{"rel":272,"titel":273,"zu":274},"richtlinien-anhang\u002Frichtlinien-geraete-wechselmedien","Devices and removable media","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-geraete-wechselmedien",{"rel":276,"titel":277,"zu":278},"richtlinien-anhang\u002Frichtlinien-kernschutz","Kernel protection","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-kernschutz",{"rel":280,"titel":281,"zu":282},"richtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung","Drive encryption","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-laufwerksverschluesselung",{"rel":284,"titel":285,"zu":286},"richtlinien-anhang\u002Frichtlinien-windows-update","Windows Update","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-windows-update",{"rel":288,"titel":289,"zu":290},"richtlinien-anhang\u002Frichtlinien-grundeinstellungen","Defaults and privacy settings","\u002Fen\u002Fdocumentation\u002Frichtlinien-anhang\u002Frichtlinien-grundeinstellungen",null,1793199132426]