Windows  ·  medium  ·  Microsoft Office

"Microsoft has blocked macros from running because the source of this file is untrusted"

A red banner blocks the macros in a file that came from the internet, an email or a network share. This is deliberate behaviour introduced in 2022, not a fault, and the correct fix is to establish trust in the source rather than to disable the block.

What you see

Opening a .xlsm, .docm or .accdb shows a red banner reading "Microsoft has blocked macros from running because the source of this file is untrusted", with a Learn More button and no Enable Content option. The same file runs correctly for a colleague, or ran correctly before it was emailed.

What is actually wrong

Windows tags files that arrive from outside the machine with a Mark of the Web — an alternate data stream named Zone.Identifier recording the zone they came from. Since 2022 Office refuses to run VBA in any file carrying that tag from the internet zone. Because the tag travels with the file, one download or one copy from a share applies it to every copy made afterwards.

Codes and articles

blocked macros untrusted sourceMark of the WebZone.IdentifierblockcontentexecutionfrominternetVBA macro blocked

Start here — find out which fix applies

A script that runs the 1 inspection command from the write-up below and prints what each one returned. It reads the machine and changes nothing — every command that could write, delete, start or stop is excluded from it by construction. Run this first, then pick the fix its output points at.

Download the read-only diagnosticchanges nothing · safe to run before reading

Fixes (3)

Unblock a single file you have verified
PowerShell as the affected user5 minutesmedium riskreversible

One file, from a sender you have confirmed by some means other than the email itself.

  1. Stop and confirm the file is what it claims to be. This block exists because macro-enabled attachments are the most common delivery route for ransomware, and the banner is the last thing standing between a convincing email and code execution. Verify the sender by phone or in person, not by replying.

  2. Look at the mark before removing it, so you know which zone it came from.

    PowerShell
    Get-Content -Path 'C:\path\to\file.xlsm' -Stream Zone.Identifier

    ZoneId=3 is the internet zone and ZoneId=4 is restricted. Many files also carry HostUrl or ReferrerUrl, which tells you exactly where it was downloaded from — often more informative than asking the user.

  3. Remove the mark.

    PowerShell
    Unblock-File -Path 'C:\path\to\file.xlsm'

  4. Reopen the file. The banner is gone and the macros run.

Confirm it workedThe Zone.Identifier stream no longer exists on the file.
PowerShell
Get-Item 'C:\path\to\file.xlsm' -Stream * | Select-Object Stream
If you need to undo itThe mark cannot be restored once removed, but nothing is damaged by its absence — the file simply behaves as a local one. Delete the file if the verification turns out to have been wrong.
Download this fix as a PowerShell script2 steps you do yourself · asks before each step
Make the source folder a Trusted Location
PowerShell as the affected user, or Group Policy for a fleet30 minutesmedium riskreversible

An internal share or a controlled folder holds macro files people legitimately need. This is the supported answer and the one to prefer. Note before you start: a Trusted Location disables the macro warning for everything in it, permanently. Scope it to a specific folder that is write-controlled — never to a drive root or a user profile folder.

  1. Pick a folder that is genuinely controlled — one where you know who can write to it. A Trusted Location exempts everything in it from the macro block, so a folder everyone can write to is a hole, not a fix.

  2. Add the location for the application that needs it. Change Excel to Word or Access as required, and use the next free LocationN number.

    PowerShell
    $k = 'HKCU:\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations\Location20'New-Item -Path $k -Force | Out-NullSet-ItemProperty -Path $k -Name 'Path' -Value '\\fileserver\finance\macros\'Set-ItemProperty -Path $k -Name 'Description' -Value 'Finance macro workbooks'Set-ItemProperty -Path $k -Name 'AllowSubFolders' -Type DWord -Value 1

  3. A UNC path additionally needs network locations to be permitted, which is off by default.

    PowerShell
    Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Office\16.0\Excel\Security\Trusted Locations' -Name 'AllowNetworkLocations' -Type DWord -Value 1

    Without this, a UNC Trusted Location is accepted silently and then ignored, which looks exactly like the fix not working.

  4. Restart Excel and confirm the location appears under File → Options → Trust Center → Trust Center Settings → Trusted Locations.

  5. For a fleet, deploy the same values through the Office administrative templates rather than by hand — Group Policy writes them under the Policies hive, where a user cannot remove them.

Confirm it workedA macro file opened from that folder runs with no banner, while the same file copied to the desktop is still blocked.
If you need to undo itDelete the LocationN key to withdraw the trust.
Download this fix as a PowerShell script3 steps you do yourself · asks before each step
Understand the policy switch before anyone reaches for it
Group Policy — read this before deciding15 minuteshigh riskreversible

Someone has proposed turning the block off centrally. This fix is here to document what that does, not to recommend it. Turning it off organisation-wide removes the single most effective control against macro-delivered malware — it is a decision with a security consequence, not a configuration tweak, and it should be signed off rather than applied to clear a helpdesk ticket.

  1. Understand what the switch is. "Block macros from running in Office files from the Internet" set to Disabled restores the pre-2022 behaviour, where a user gets an Enable Content button on any file from anywhere.

  2. Check whether it is already set, since a policy someone applied years ago can be why an unexpected file ran.

    PowerShell
    Get-ItemProperty 'HKCU:\Software\Policies\Microsoft\Office\16.0\Excel\Security' -Name blockcontentexecutionfrominternet -ErrorAction SilentlyContinue

    A value of 0 means the block has been turned off for Excel. 1, or the value being absent, means it is on.

  3. Prefer the alternatives in every case where they fit: unblock the individual file, use a Trusted Location for a controlled folder, or sign the macro project with a certificate and trust the publisher. All three keep the protection for everything else.

  4. If it is turned off anyway, scope it to the specific application and the specific user group that needs it, record the decision, and set a date to revisit it.

Confirm it workedThe policy state matches what was actually decided, and is documented somewhere other than the registry.
If you need to undo itSet the value to 1, or delete it, to restore the default block.
Download this fix as a PowerShell script3 steps you do yourself · asks before each step

Related faults

A document will not open — Protected View, "file format is not valid", or a corrupt fileWindowsOffice applications open slowly, hang, or start with a blank windowWindows"File is locked for editing by another user" — including when that user is youWindowsDouble-clicking a file opens Office but not the documentWindowsPrinting from Office fails, prints blank, or goes to the wrong printerWindowsAn add-in keeps disabling itself, or will not stay enabledWindows

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.