#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : "Microsoft has blocked macros from running because the source of this file is untrusted"
    Fix   : Unblock a single file you have verified
    Source: https://jbtecwiz.com/support/win-office-macro-blocked

    Run as     : PowerShell as the affected user
    Expect     : 5 minutes
    Risk       : medium
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    One file, from a sender you have confirmed by some means other than the
    email itself.

    HOW TO UNDO IT
    The mark cannot be restored once removed, but nothing is damaged by its
    absence -- the file simply behaves as a local one. Delete the file if
    the verification turns out to have been wrong.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

# - THIS SCRIPT WILL NOT RUN UNTIL YOU EDIT IT -
# The commands below contain values only you can supply. Search the
# script for each one, replace it, then delete this block.
$script:MustEdit = @(
    'C:\path\to\file.xlsm'   # a placeholder file path
)
if ($script:MustEdit.Count) {
    Write-Host ""
    Write-Host '  This script needs editing before it can run.' -ForegroundColor Yellow
    Write-Host '  Replace each of these with a real value:' -ForegroundColor Yellow
    $script:MustEdit | ForEach-Object { Write-Host ("    " + $_) -ForegroundColor Yellow }
    Write-Host ""
    Write-Host '  Then delete the $script:MustEdit block near the top.'
    Write-Host ""
    exit 2
}

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 4"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  "Microsoft has blocked macros from running because the source of this file is untrusted"' -ForegroundColor White
Write-Host '  Unblock a single file you have verified' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: medium   Reversible   5 minutes'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Stop and confirm the file is what it claims to be. This block exists because macro-enabled attachments are the most common delivery route for ransomware, and the banner is the last thing standing between a convincing email and code execution. Verify the sender by phone or in person, not by replying.' -Manual

Invoke-Step -Number 2 -Do 'Look at the mark before removing it, so you know which zone it came from.' -Why 'ZoneId=3 is the internet zone and ZoneId=4 is restricted. Many files also carry HostUrl or ReferrerUrl, which tells you exactly where it was downloaded from -- often more informative than asking the user.' -Command {
    Get-Content -Path 'C:\path\to\file.xlsm' -Stream Zone.Identifier
}

Invoke-Step -Number 3 -Do 'Remove the mark.' -Command {
    Unblock-File -Path 'C:\path\to\file.xlsm'
}

Invoke-Step -Number 4 -Do 'Reopen the file. The banner is gone and the macros run.' -Manual

Write-Rule "  Confirm it worked"
Show-Prose 'The Zone.Identifier stream no longer exists on the file.' 'White'
Write-Host ''
if (-not $DryRun) {
    Get-Item 'C:\path\to\file.xlsm' -Stream * | Select-Object Stream
}

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/win-office-macro-blocked' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: The mark cannot be restored once removed, but nothing is damaged by its absence -- the file simply behaves as a local one. Delete the file if the verification turns out to have been wrong.' 'DarkGray'
Write-Rule