Configuring a 60-Seat Word Rollout Without Weakening Macro Security
Whitcomb & Reyes, a 60-attorney litigation firm, has just moved to Microsoft 365 Apps. Most written work goes to opposing counsel and courts that still run Word 2016, so the firm wants files that open cleanly there. A signed third-party citation add-in loads on 48 machines but shows as Inactive on the other 12. Separately, attorneys have lost as much as 12 minutes of drafting in three crashes this quarter; AutoRecover is enabled at the 10-minute default but 'Keep the last AutoSaved version' is cleared, and the default save location still points to a decommissioned file server. Finally, every document received from outside the firm triggers a macro warning, which the help desk has been telling users to click through. The managing partner wants one documented configuration, applied through Word Options where possible, without making the firm more vulnerable to malicious documents.
1. The citation add-in is inactive on 12 machines while the other 48 load it. What do you check, in what order, and what change do you make without weakening protection against macros in received documents?
Read the worked answer
The split across machines points to a per-machine setting or a disabled item, not the add-in itself. Work in this order:
- File > Options > Add-ins. In the Manage list, choose COM Add-ins > Go to see whether the add-in is loaded and where it lives. Then choose Disabled Items > Go. Word disables an add-in after a crash or slow load, and it stays inactive until someone re-enables it.
- Trust Center > Trust Center Settings > Add-ins. If Disable all Application Add-ins is selected, often by policy on those 12 machines, no add-in loads regardless of signing. Clear it or change the policy, and keep Require Application Add-ins to be signed by a trusted publisher enabled because this add-in is signed.
- Trust Center > Trusted Publishers. Confirm the signer's certificate is present; add it if it is missing. Trust the publisher, not a broad folder.
Do not add Desktop or Downloads as a trusted location to solve this. Trusted locations bypass macro security for every document opened there. Add-in trust and macro trust are separate controls, so fixing the add-in should not change the macro setting for received documents.
2. The partner proposes setting AutoRecover to 2 minutes and considers the data-loss problem solved. What exactly do you configure, and what residual risk remains?
Read the worked answer
AutoRecover frequency is only one link in the recovery chain. In File > Options > Save:
- Set Save AutoRecover information every to 2 minutes. This reduces the maximum unsaved window, but the last interval can still be lost.
- Select Keep the last AutoSaved version if I close without saving. Without it, a user who clicks Don't Save during crash recovery loses the recovered draft.
- Set a valid AutoRecover file location and a valid Default local file location. Pointing to a decommissioned server can make saves fail or silently redirect to OneDrive.
- Consider Always create backup copy for a second on-disk copy.
Explain the limit clearly: AutoRecover is a crash-recovery cache, not version history or backup. It does not protect against a user saving over content, a corrupted file that opens normally, or a lost laptop. AutoSave is a different feature and works only for files stored on OneDrive or SharePoint. If the firm needs real versioning, put the drafts in a SharePoint library with version history, and test recovery once rather than assuming it works.
3. What is the correct configuration for documents received from outside the firm, and why is the help desk's 'click Enable Content' instruction a security problem?
Read the worked answer
Keep Trust Center > Macro Settings at Disable all macros with notification, or the stricter signed-macros option, and leave Protected View enabled for files from the internet. A received document that needs macros should be handled as an exception, not by a blanket click:
- If the sender is an approved partner and the macro is required, verify the request out of band, save the file to a designated trusted location, or ask the sender to sign the macro with a certificate the firm trusts.
- If it is ordinary content, open it with macros disabled; if it will not render, ask for a macro-free copy.
Enable Content is dangerous because it applies to whatever code is in that file, not just the feature the user expects. A document can run code when opened, and the decision can persist for the session. Broad trusted locations such as Downloads are worse because every file placed there bypasses the warning. The help desk should use Protected View and the Message Bar to make a per-file judgment, not teach users to dismiss security prompts reflexively.