#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : "Microsoft has blocked macros from running because the source of this file is untrusted"
    Fix   : Understand the policy switch before anyone reaches for it
    Source: https://jbtecwiz.com/support/win-office-macro-blocked

    Run as     : Group Policy -- read this before deciding
    Expect     : 15 minutes
    Risk       : high
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    Someone has proposed turning the block off centrally. This fix is here
    to document what that does, not to recommend it. Turning it off
    organisation-wide removes the single most effective control against
    macro-delivered malware -- it is a decision with a security consequence,
    not a configuration tweak, and it should be signed off rather than
    applied to clear a helpdesk ticket.

    HOW TO UNDO IT
    Set the value to 1, or delete it, to restore the default block.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 4"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  "Microsoft has blocked macros from running because the source of this file is untrusted"' -ForegroundColor White
Write-Host '  Understand the policy switch before anyone reaches for it' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: high   Reversible   15 minutes'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Understand what the switch is. "Block macros from running in Office files from the Internet" set to Disabled restores the pre-2022 behaviour, where a user gets an Enable Content button on any file from anywhere.' -Manual

Invoke-Step -Number 2 -Do 'Check whether it is already set, since a policy someone applied years ago can be why an unexpected file ran.' -Why 'A value of 0 means the block has been turned off for Excel. 1, or the value being absent, means it is on.' -Command {
    Get-ItemProperty 'HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security' -Name blockcontentexecutionfrominternet -ErrorAction SilentlyContinue
}

Invoke-Step -Number 3 -Do 'Prefer the alternatives in every case where they fit: unblock the individual file, use a Trusted Location for a controlled folder, or sign the macro project with a certificate and trust the publisher. All three keep the protection for everything else.' -Manual

Invoke-Step -Number 4 -Do 'If it is turned off anyway, scope it to the specific application and the specific user group that needs it, record the decision, and set a date to revisit it.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'The policy state matches what was actually decided, and is documented somewhere other than the registry.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-macro-blocked' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Set the value to 1, or delete it, to restore the default block.' 'DarkGray'
Write-Rule