Block macros from running in Office files from the internet
This per-user policy setting controls whether Microsoft Project can run VBA macros in files that Windows or Office identifies as originating from the internet.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\ms project\security\blockcontentexecutionfrominternet
This per-user policy setting controls whether Microsoft Project can run VBA macros in files that Windows or Office identifies as originating from the internet. This primarily includes files carrying Mark of the Web (MOTW), such as browser downloads and email attachments. Files opened from network shares can also be affected when the location is assigned to the Internet zone and is not considered trusted.
The value uses the REG_DWORD type. A value of 1 causes Project to block the affected macros. Project displays a security notice about the untrusted source, and the normal option to enable the content is not available while the policy block applies. A value of 0 does not enforce this registry-based block; macro execution is then determined by the remaining macro security settings and the default behavior of the installed Office version.
The setting applies only to Project for the current user. Equivalent policies for other Office applications use separate registry paths.
Notes
Security
Blocking these macros reduces exposure to attacks in which a crafted Project file is used to persuade a user to run malicious VBA code. Such code can be used to deploy malware or ransomware and can access resources available in the user's security context.
The policy does not inspect or remove macro code. Its protection also depends on the file being recognized as originating from the internet. Files in Trusted Locations and correctly signed macros from a Trusted Publisher can pass the internet-macro checks under the Office trust evaluation process.
Setting the value to 0 does not necessarily enable macros immediately, but it removes this additional origin-based block. Depending on other macro settings, users might then regain the ability to enable macros from untrusted sources.
Possible side effects
Project files obtained from the internet can still be opened, but their macros and any automation that depends on those macros are unavailable. Legitimate Project templates, reports, or workflows containing VBA code might therefore provide reduced functionality.
Files on internal network shares can also be affected if Windows does not classify the location as part of the Local intranet zone or as a Trusted site.
Notes
For locally stored files, Mark of the Web is carried in NTFS metadata. This marking is not available on FAT32 volumes. For network files and web-based storage, Windows security-zone assignments also influence whether Office treats a file as originating from the internet.
The Office\16.0 branch is used not only by Office and Project 2016, but also by later Windows desktop releases that retain the same Office major version. Behavior when the policy is not configured can vary with the Project release and update level and is not equivalent to an explicitly configured value.
Microsoft documentation
Microsoft Learn: Macros from the internet are blocked by default in Office
Microsoft Download Center: Administrative Template files for Microsoft Office