Group Policy Management
body { font-size:68%;font-family:MS Shell Dlg; margin:0px,0px,0px,0px; border: 1px solid #666666; background:#F6F6F6; width:100%; word-break:normal; word-wrap:break-word; } .head { font-weight:bold; font-size:160%; font-family:MS Shell Dlg; width:100%; color:#6587DC; background:#E3EAF9; border:1px solid #5582D2; padding-left:8px; height:24px; } .path { margin-left: 10px; margin-top: 10px; margin-bottom:5px;width:100%; } .info { padding-left:10px;width:100%; } table { font-size:100%; width:100%; border:1px solid #999999; } th { border-bottom:1px solid #999999; text-align:left; padding-left:10px; height:24px; } td { background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; } .btn { width:100%; text-align:right; margin-top:16px; } .hdr { font-weight:bold; border:1px solid #999999; text-align:left; padding-top: 4px; padding-left:10px; height:24px; margin-bottom:-1px; width:100%; } .bdy { width:100%; height:182px; display:block; overflow:scroll; z-index:2; background:#FFFFFF; padding-left:10px; padding-bottom:10px; padding-top:10px; border:1px solid #999999; } button { width:6.9em; height:2.1em; font-size:100%; font-family:MS Shell Dlg; margin-right:15px; } @media print { .bdy { display:block; overflow:visible; } button { display:none; } .head { color:#000000; background:#FFFFFF; border:1px solid #000000; } }
Setting Path:
Explanation
No explanation is available for this setting.
Supported On:
Not available

DoD Office 2019-M365 Apps STIG User v3r4
Data collected on: 9/12/2025 10:23:45 AM |

General
Details

Domain | security.local
Owner | SECURITY\Domain Admins
Created | 9/12/2025 7:18:10 AM
Modified | 9/12/2025 7:24:40 AM
User Revisions | 6 (AD), 6 (SYSVOL)
Computer Revisions | 1 (AD), 1 (SYSVOL)
Unique ID | {9EA36A0D-D759-4AEF-8BDA-3F8682FD9246}
GPO Status | Computer settings disabled

Links

Location | Enforced | Link Status | Path
--- | --- | --- | ---
None

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and computers:

Name
NT AUTHORITY\Authenticated Users

Delegation
These groups and users have the specified permission for this GPO

Name | Allowed Permissions | Inherited
--- | --- | ---
NT AUTHORITY\Authenticated Users | Read (from Security Filtering) | No
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS | Read | No
NT AUTHORITY\SYSTEM | Edit settings, delete, modify security | No
SECURITY\Domain Admins | Edit settings, delete, modify security | No
SECURITY\Enterprise Admins | Edit settings, delete, modify security | No

Computer Configuration (Disabled)
No settings defined.
User Configuration (Enabled)
Policies
Administrative Templates
Policy definitions (ADMX files) retrieved from the local computer.
Microsoft Access 2016/Application Settings/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Block macros from running in Office files from the Internet | Enabled |
Disable Trust Bar Notification for unsigned application add-ins and block them | Enabled |
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros
Require macros to be signed by a trusted publisher |
Block certificates from trusted publishers that are only installed in the current user certificate store |
Require Extended Key Usage (EKU) for certificates from trusted publishers |

Microsoft Excel 2016/Data Recovery

Policy | Setting | Comment
--- | --- | ---
Do not show data extraction options when opening corrupt workbooks | Enabled |

Microsoft Excel 2016/Excel Options/Advanced

Policy | Setting | Comment
--- | --- | ---
Ask to update automatic links | Enabled |

Microsoft Excel 2016/Excel Options/Advanced/Web Options.../General

Policy | Setting | Comment
--- | --- | ---
Load pictures from Web pages not created in Excel | Disabled |

Microsoft Excel 2016/Excel Options/Save

Policy | Setting | Comment
--- | --- | ---
Disable AutoRepublish | Enabled |
Do not show AutoRepublish warning alert | Disabled |

Microsoft Excel 2016/Excel Options/Security

Policy | Setting | Comment
--- | --- | ---
Force file extension to match file type | Enabled |
| Always match file type
Policy | Setting | Comment
Scan encrypted macros in Excel Open XML workbooks | Enabled |
| Scan encrypted macros (default)
Policy | Setting | Comment
Turn off file validation | Disabled |
WEBSERVICE Function Notification Settings | Enabled |
| Disable all with notification

Microsoft Excel 2016/Excel Options/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Block macros from running in Office files from the Internet | Enabled |
Disable Trust Bar Notification for unsigned application add-ins and block them | Enabled |
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros
Require macros to be signed by a trusted publisher |
Block certificates from trusted publishers that are only installed in the current user certificate store |
Require Extended Key Usage (EKU) for certificates from trusted publishers |

Microsoft Excel 2016/Excel Options/Security/Trust Center/External Content

Policy | Setting | Comment
--- | --- | ---
Always prevent untrusted Microsoft Query files from opening | Enabled |
Don’t allow Dynamic Data Exchange (DDE) server launch in Excel | Enabled |
Don’t allow Dynamic Data Exchange (DDE) server lookup in Excel | Enabled |

Microsoft Excel 2016/Excel Options/Security/Trust Center/File Block Settings

Policy | Setting | Comment
--- | --- | ---
dBase III / IV files | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Dif and Sylk files | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 2 macrosheets and add-in files | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 2 worksheets | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 3 macrosheets and add-in files | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 3 worksheets | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 4 macrosheets and add-in files | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 4 workbooks | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 4 worksheets | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 95 workbooks | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Excel 95-97 workbooks and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Set default file block behavior | Enabled |
| Blocked files are not opened
Policy | Setting | Comment
Web pages and Excel 2003 XML spreadsheets | Enabled |
File block setting: | Open/Save blocked, use open policy

Microsoft Excel 2016/Excel Options/Security/Trust Center/Protected View

Policy | Setting | Comment
--- | --- | ---
Always open untrusted database files in Protected View | Enabled |
Do not open files from the Internet zone in Protected View | Disabled |
Do not open files in unsafe locations in Protected View | Disabled |
Set document behavior if file validation fails | Enabled |
| Open in Protected View
Checked: Allow edit. Unchecked: Do not allow edit. | Disabled
Policy | Setting | Comment
Turn off Protected View for attachments opened from Outlook | Disabled |

Microsoft Excel 2016/Excel Options/Security/Trust Center/Trusted Locations

Policy | Setting | Comment
--- | --- | ---
Allow Trusted Locations on the network | Disabled |

Microsoft Office 2016/Global Options/Customize

Policy | Setting | Comment
--- | --- | ---
Disable UI extending from documents and templates | Enabled |
Disallow in Word | Enabled
Disallow in Excel | Enabled
Disallow in PowerPoint | Enabled
Disallow in Access | Enabled
Disallow in Outlook | Enabled
Disallow in Publisher | Enabled
Disallow in Project | Enabled
Disallow in Visio | Enabled
Disallow in InfoPath | Enabled

Microsoft Office 2016/Privacy/Trust Center

Policy | Setting | Comment
--- | --- | ---
Allow the use of additional optional connected experiences in Office | Disabled |
Allow the use of connected experiences in Office | Disabled |
Allow the use of connected experiences in Office that analyze content | Disabled |
Allow the use of connected experiences in Office that download online content | Disabled |
Configure the level of client software diagnostic data sent by Office to Microsoft | Enabled |
Type of diagnostic data: | Neither

Microsoft Office 2016/Security Settings

Policy | Setting | Comment
--- | --- | ---
ActiveX Control Initialization | Enabled |
ActiveX Control Initialization: | 6
Policy | Setting | Comment
Automation Security | Enabled |
Set the Automation Security level | Use application macro security level
Policy | Setting | Comment
Disable all Trust Bar notifications for security issues | Disabled |
Encryption type for password protected Office 97-2003 files | Enabled |
Encryption type: | Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256
Policy | Setting | Comment
Encryption type for password protected Office Open XML files | Enabled |
Encryption type: | Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256
Policy | Setting | Comment
Load Controls in Forms3 | Enabled |
Load Controls in Forms3: | 1
Policy | Setting | Comment
Macro Runtime Scan Scope | Enabled |
| Enable for all documents
Policy | Setting | Comment
Protect document metadata for rights managed Office Open XML Files | Enabled |

Microsoft Office 2016/Security Settings/Trust Center

Policy | Setting | Comment
--- | --- | ---
Allow mix of policy and user locations | Disabled |

Microsoft Office 2016/Server Settings

Policy | Setting | Comment
--- | --- | ---
Disable the Office client from polling the SharePoint Server for published links | Enabled |

Microsoft Office 2016/Smart Documents (Word, Excel)

Policy | Setting | Comment
--- | --- | ---
Disable Smart Document's use of manifests | Enabled |

Microsoft Outlook 2016/Account Settings/Exchange

Policy | Setting | Comment
--- | --- | ---
Authentication with Exchange Server | Enabled |
Select the authentication with Exchange server. | Kerberos Password Authentication
Policy | Setting | Comment
Enable RPC encryption | Enabled |

Microsoft Outlook 2016/Outlook Options/Other/Advanced

Policy | Setting | Comment
--- | --- | ---
Do not allow Outlook object model scripts to run for public folders | Enabled |
Do not allow Outlook object model scripts to run for shared folders | Enabled |
Use Unicode format when dragging e-mail message to file system | Disabled |

Microsoft Outlook 2016/Security

Policy | Setting | Comment
--- | --- | ---
Allow Active X One Off Forms | Enabled |
Sets which ActiveX controls to allow.
| Load only Outlook Controls
Policy | Setting | Comment
Prevent users from customizing attachment security settings | Enabled |

Microsoft Outlook 2016/Security/Automatic Picture Download Settings

Policy | Setting | Comment
--- | --- | ---
Include Internet in Safe Zones for Automatic Picture Download | Disabled |

Microsoft Outlook 2016/Security/Cryptography

Policy | Setting | Comment
--- | --- | ---
Do not display 'Publish to GAL' button | Enabled |
Minimum encryption settings | Enabled |
Minimum key size (in bits): | 168
Policy | Setting | Comment
Signature Warning | Enabled |
Signature Warning | Always warn about invalid signatures

Microsoft Outlook 2016/Security/Cryptography/Signature Status dialog box

Policy | Setting | Comment
--- | --- | ---
Retrieving CRLs (Certificate Revocation Lists) | Enabled |
| When online always retreive the CRL

Microsoft Outlook 2016/Security/Security Form Settings

Policy | Setting | Comment
--- | --- | ---
Outlook Security Mode | Enabled |
Outlook Security Policy: | Use Outlook Security Group Policy

Microsoft Outlook 2016/Security/Security Form Settings/Attachment Security

Policy | Setting | Comment
--- | --- | ---
Allow users to demote attachments to Level 2 | Disabled |
Display Level 1 attachments | Disabled |
Remove file extensions blocked as Level 1 | Disabled |
Remove file extensions blocked as Level 2 | Disabled |

Microsoft Outlook 2016/Security/Security Form Settings/Custom Form Security

Policy | Setting | Comment
--- | --- | ---
Allow scripts in one-off Outlook forms | Disabled |
Set Outlook object model custom actions execution prompt | Enabled |
When executing a custom action: | Automatically Deny

Microsoft Outlook 2016/Security/Security Form Settings/Programmatic Security

Policy | Setting | Comment
--- | --- | ---
Configure Outlook object model prompt when accessing an address book | Enabled |
Guard behavior: | Automatically Deny
Policy | Setting | Comment
Configure Outlook object model prompt When accessing the Formula property of a UserProperty object | Enabled |
Guard behavior: | Automatically Deny
Policy | Setting | Comment
Configure Outlook object model prompt when executing Save As | Enabled |
Guard behavior: | Automatically Deny
Policy | Setting | Comment
Configure Outlook object model prompt when reading address information | Enabled |
Guard behavior: | Automatically Deny
Policy | Setting | Comment
Configure Outlook object model prompt when responding to meeting and task requests | Enabled |
Guard behavior: | Automatically Deny
Policy | Setting | Comment
Configure Outlook object model prompt when sending mail | Enabled |
Guard behavior: | Automatically Deny

Microsoft Outlook 2016/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Allow hyperlinks in suspected phishing e-mail messages | Disabled |
Security setting for macros | Enabled |
Security Level | Warn for signed, disable unsigned

Microsoft PowerPoint 2016/PowerPoint Options/Security

Policy | Setting | Comment
--- | --- | ---
Run Programs | Enabled |
| disable (don't run any programs)
Policy | Setting | Comment
Scan encrypted macros in PowerPoint Open XML presentations | Enabled |
| Scan encrypted macros (default)
Policy | Setting | Comment
Turn off file validation | Disabled |

Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Block macros from running in Office files from the Internet | Enabled |
Disable Trust Bar Notification for unsigned application add-ins and block them | Enabled |
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros
Require macros to be signed by a trusted publisher |
Block certificates from trusted publishers that are only installed in the current user certificate store |
Require Extended Key Usage (EKU) for certificates from trusted publishers |

Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/File Block Settings

Policy | Setting | Comment
--- | --- | ---
PowerPoint 97-2003 presentations, shows, templates and add-in files | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Set default file block behavior | Enabled |
| Blocked files are not opened

Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Protected View

Policy | Setting | Comment
--- | --- | ---
Do not open files from the Internet zone in Protected View | Disabled |
Do not open files in unsafe locations in Protected View | Disabled |
Set document behavior if file validation fails | Enabled |
| Open in Protected View
Checked: Allow edit. Unchecked: Do not allow edit. | Disabled
Policy | Setting | Comment
Turn off Protected View for attachments opened from Outlook | Disabled |

Microsoft PowerPoint 2016/PowerPoint Options/Security/Trust Center/Trusted Locations

Policy | Setting | Comment
--- | --- | ---
Allow Trusted Locations on the network | Disabled |

Microsoft Project 2016/Project Options/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Allow Trusted Locations on the network | Disabled |
Disable Trust Bar Notification for unsigned application add-ins and block them | Enabled |
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros

Microsoft Publisher 2016/Security

Policy | Setting | Comment
--- | --- | ---
Publisher Automation Security Level | Enabled |
| By UI (prompted)

Microsoft Publisher 2016/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Disable Trust Bar Notification for unsigned application add-ins | Enabled |
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros
Require macros to be signed by a trusted publisher |
Block certificates from trusted publishers that are only installed in the current user certificate store |
Require Extended Key Usage (EKU) for certificates from trusted publishers |

Microsoft Visio 2016/Visio Options/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Allow Trusted Locations on the network | Disabled |
Block macros from running in Office files from the Internet | Enabled |
Disable Trust Bar Notification for unsigned application add-ins and block them | Enabled |
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros
Require macros to be signed by a trusted publisher |
Block certificates from trusted publishers that are only installed in the current user certificate store |
Require Extended Key Usage (EKU) for certificates from trusted publishers |

Microsoft Visio 2016/Visio Options/Security/Trust Center/File Block Settings

Policy | Setting | Comment
--- | --- | ---
Visio 2000-2002 Binary Drawings, Templates and Stencils | Enabled |
File block setting: | Open/Save blocked
Policy | Setting | Comment
Visio 2003-2010 Binary Drawings, Templates and Stencils | Enabled |
File block setting: | Open/Save blocked
Policy | Setting | Comment
Visio 5.0 or earlier Binary Drawings, Templates and Stencils | Enabled |
File block setting: | Open/Save blocked

Microsoft Word 2016/Word Options/Security

Policy | Setting | Comment
--- | --- | ---
Turn off file validation | Disabled |

Microsoft Word 2016/Word Options/Security/Trust Center

Policy | Setting | Comment
--- | --- | ---
Block macros from running in Office files from the Internet | Enabled |
Disable Trust Bar Notification for unsigned application add-ins and block them | Enabled |
Scan encrypted macros in Word Open XML documents | Enabled |
| Scan encrypted macros (default)
Policy | Setting | Comment
VBA Macro Notification Settings | Enabled |
| Disable all except digitally signed macros
Require macros to be signed by a trusted publisher |
Block certificates from trusted publishers that are only installed in the current user certificate store |
Require Extended Key Usage (EKU) for certificates from trusted publishers |

Microsoft Word 2016/Word Options/Security/Trust Center/File Block Settings

Policy | Setting | Comment
--- | --- | ---
Set default file block behavior | Enabled |
| Blocked files are not opened
Policy | Setting | Comment
Word 2 and earlier binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word 2000 binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word 2003 binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word 2007 and later binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word 6.0 binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word 95 binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word 97 binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy
Policy | Setting | Comment
Word XP binary documents and templates | Enabled |
File block setting: | Open/Save blocked, use open policy

Microsoft Word 2016/Word Options/Security/Trust Center/Protected View

Policy | Setting | Comment
--- | --- | ---
Do not open files from the Internet zone in Protected View | Disabled |
Do not open files in unsafe locations in Protected View | Disabled |
Set document behavior if file validation fails | Enabled |
| Open in Protected View
Checked: Allow edit. Unchecked: Do not allow edit. | Disabled
Policy | Setting | Comment
Turn off Protected View for attachments opened from Outlook | Disabled |

Microsoft Word 2016/Word Options/Security/Trust Center/Trusted Locations

Policy | Setting | Comment
--- | --- | ---
Allow Trusted Locations on the network | Disabled |