Block macros from running in Office files from the internet
This per-user policy value controls whether PowerPoint can run VBA macros in files that Windows identifies as originating from the internet or another untrusted zone.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\powerpoint\security\blockcontentexecutionfrominternet
This per-user policy value controls whether PowerPoint can run VBA macros in files that Windows identifies as originating from the internet or another untrusted zone. Windows commonly records that origin by applying Mark of the Web (MOTW), for example to browser downloads and email attachments.
The value uses the REG_DWORD type. A value of 1 causes PowerPoint to block the affected macros and notify the user of the security risk. The block applies even when “Enable all macros” is selected in the Trust Center. A value of 0 does not enforce this policy block; macro execution is then governed by PowerPoint’s other macro and trust settings. Consequently, setting the value to 0 does not by itself enable macros.
The setting applies only to PowerPoint for the affected user. The corresponding policies for other Office applications use separate registry paths.
Notes
Security
Macros can execute program code and are commonly abused to deliver malware and ransomware. This policy reduces the risk of a user running malicious VBA code from a downloaded presentation, template, or PowerPoint add-in.
The policy neither removes nor inspects the macro code. Its protection depends on PowerPoint recognizing the file as originating from an untrusted zone. Files without the relevant origin information are not blocked solely by this value and remain subject to the other macro security settings.
Trusted Locations and macros signed with a certificate belonging to a Trusted Publisher can be exempt from the internet-based block. Because these trust decisions broaden where active content can run, they affect the effective protection provided by the policy.
Possible side effects
Legitimate macro-enabled presentations and templates obtained from the internet can lose their automated functionality. PowerPoint add-ins downloaded from the internet, including .ppa and .ppam files, can be loaded in a disabled state and remain unavailable.
Files on network shares can also be affected when Windows does not identify the location as part of the Local intranet zone or as a Trusted site. This can disrupt internal workflows even when the files are hosted on an organization-managed server.
Notes
Mark of the Web is applied by default to files from the Internet and Restricted sites zones and requires a file system capable of retaining the associated origin information. For example, the marker is not available on FAT32 volumes.
Current Microsoft 365 Apps releases on Windows also block macros from the internet by default when this policy is not configured. That application default is distinct from explicitly setting the value to 1, which enforces the block independently of later changes to the default behavior.
Microsoft documentation
Microsoft Learn: Macros from the internet are blocked by default in Office
Microsoft Download Center: Administrative Template files for Microsoft Office