A Signed Template, Blocked Macros, and Stale Header Fields
The document support team at a 900-person engineering firm maintains a macro-enabled template, BidPackage.dotm, that inserts a signature block, refreshes all fields in the body, headers, and footers, and stamps a revision number. The template sits in a shared network folder. Since the latest rollout, 20 users see a red 'BLOCKED MACROS' banner and cannot run the template; 6 others can run it only after clicking Enable Content every time. One user's machine runs the macro but only updates fields in the body - headers and footers keep stale dates. The security team will not approve lowering the macro setting to 'Enable all macros,' and the firm's auditor wants evidence that the template has not been altered since approval. The template must work offline on laptops that connect to the network folder only once a week, and new hires must be able to use it on day one.
1. Twenty users see a red BLOCKED MACROS banner, six get repeated Enable Content prompts, and the template must work on laptops that reach the network folder only weekly. What deployment and trust design do you recommend, and why?
Read the worked answer
Treat the two symptoms as different trust states.
- Red 'BLOCKED MACROS' usually means the file is blocked by policy or by Mark of the Web, not merely waiting for a click. Check the file's Properties or the Trust Center policy Block macros from running in Office files from the Internet. If the .dotm was downloaded, Unblock it in Properties; if policy blocks internet macros, signing and trusted locations are the supported route.
- Repeated Enable Content means the macro setting is Disable all macros with notification and the file is neither in a trusted location nor signed by a trusted publisher. A click is per session, so it will recur.
Recommended design: sign the VBA project with the firm's code-signing certificate, deploy the certificate to Trusted Publishers by policy, set macro settings to Disable all macros except digitally signed macros, and place a copy of BidPackage.dotm in a local trusted folder such as C:\\ProgramData\\Firm\\Templates that is refreshed from the network. A network trusted location fails offline and can be disabled by policy; a signature plus a local trusted path works on the weekly-connected laptops.
2. The macro updates body fields but leaves stale dates in headers and footers. What is wrong with the code, and how do you fix it?
Read the worked answer
ActiveDocument.Fields.Update updates only the main text story. Headers, footers, text boxes, footnotes, and endnotes are separate stories, each with its own Fields collection, so a body-only call leaves them untouched.
A robust pattern walks every story range, including linked story ranges:
Dim r As Range
For Each r In ActiveDocument.StoryRanges
r.Fields.Update
Do While Not r.NextStoryRange Is Nothing
Set r = r.NextStoryRange
r.Fields.Update
Loop
Next r
The inner loop matters because a header linked to a previous section can expose additional story ranges through NextStoryRange; without it, some sections are skipped. Also check that header fields are not locked by document protection, because Fields.Update raises an error on a protected range. If the template is protected, unprotect around the update or update only unprotected stories. Test with a document that has three sections, different first-page headers, and a text box before calling the fix complete.
3. The auditor wants proof the template has not changed since approval, and new hires must run it on day one. What do you sign, what does the signature actually prove, and how do you distribute trust?
Read the worked answer
Sign the VBA project, not just the document. In the Visual Basic Editor, choose Tools > Digital Signature > Choose, select the firm's code-signing certificate, and save. Then distribute the certificate's public key to Trusted Publishers on each machine, or by Group Policy, and set the macro policy to Disable all macros except digitally signed macros.
What this proves: any change to the signed code invalidates the signature the next time the project is opened or saved, so the auditor can open the VBA project's Digital Signature dialog and see whether the signature is valid and who signed it. A timestamp from a time-stamping authority keeps the signature valid after the certificate expires. It does not prove the document body is unchanged, so if that matters, apply a separate document signature or compare a stored hash.
For new hires, include the certificate in the standard image, put the .dotm in the local trusted folder, and add the Workgroup Templates path. They then get a signed, trusted template without clicking anything or rebuilding settings.