#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : "Microsoft has blocked macros from running because the source of this file is untrusted"
    Fix   : Make the source folder a Trusted Location
    Source: https://jbtecwiz.com/support/win-office-macro-blocked

    Run as     : PowerShell as the affected user, or Group Policy for a fleet
    Expect     : 30 minutes
    Risk       : medium
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    An internal share or a controlled folder holds macro files people
    legitimately need. This is the supported answer and the one to prefer.
    Note before you start: a Trusted Location disables the macro warning for
    everything in it, permanently. Scope it to a specific folder that is
    write-controlled -- never to a drive root or a user profile folder.

    HOW TO UNDO IT
    Delete the LocationN key to withdraw the trust.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

# - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT -
# The commands below contain values only you can supply. Search the
# script for each one, replace it, then delete this block.
$script:MustEdit = @(
    '\\fileserver\finance\macros\'   # a placeholder network path
)
if ($script:MustEdit.Count) {
    Write-Host ""
    Write-Host '  This script needs editing before it can run.' -ForegroundColor Yellow
    Write-Host '  Replace each of these with a real value:' -ForegroundColor Yellow
    $script:MustEdit | ForEach-Object { Write-Host ("    " + $_) -ForegroundColor Yellow }
    Write-Host ""
    Write-Host '  Then delete the $script:MustEdit block near the top.'
    Write-Host ""
    exit 2
}

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 5"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  "Microsoft has blocked macros from running because the source of this file is untrusted"' -ForegroundColor White
Write-Host '  Make the source folder a Trusted Location' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: medium   Reversible   30 minutes'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Pick a folder that is genuinely controlled -- one where you know who can write to it. A Trusted Location exempts everything in it from the macro block, so a folder everyone can write to is a hole, not a fix.' -Manual

Invoke-Step -Number 2 -Do 'Add the location for the application that needs it. Change Excel to Word or Access as required, and use the next free LocationN number.' -Command {
    $k = 'HKCU:\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location20'
    New-Item -Path $k -Force | Out-Null
    Set-ItemProperty -Path $k -Name 'Path' -Value '\\fileserver\finance\macros\'
    Set-ItemProperty -Path $k -Name 'Description' -Value 'Finance macro workbooks'
    Set-ItemProperty -Path $k -Name 'AllowSubFolders' -Type DWord -Value 1
}

Invoke-Step -Number 3 -Do 'A UNC path additionally needs network locations to be permitted, which is off by default.' -Why 'Without this, a UNC Trusted Location is accepted silently and then ignored, which looks exactly like the fix not working.' -Command {
    Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations' -Name 'AllowNetworkLocations' -Type DWord -Value 1
}

Invoke-Step -Number 4 -Do 'Restart Excel and confirm the location appears under File -> Options -> Trust Center -> Trust Center Settings -> Trusted Locations.' -Manual

Invoke-Step -Number 5 -Do 'For a fleet, deploy the same values through the Office administrative templates rather than by hand -- Group Policy writes them under the Policies hive, where a user cannot remove them.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'A macro file opened from that folder runs with no banner, while the same file copied to the desktop is still blocked.' 'White'

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-macro-blocked' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: Delete the LocationN key to withdraw the trust.' 'DarkGray'
Write-Rule