For eleven years our branches have priced cut timber orders with a workbook. A builder brings in a cutting list, the counter assistant types in the lengths and sections, and the workbook's macros look up current prices, add the cutting and machining charges, and produce a quote in a format our order system can import. It was written in 2014 by an analyst in our commercial team, who still looks after it. Every month he publishes a version with new prices on our intranet, and the branches download it.
In March our branch PCs were replaced, and the new ones run Microsoft 365 Apps. On the first morning every copy of the workbook opened with a red bar across the top, saying that Microsoft had blocked macros from running because the source of the file was untrusted.
That was Office working as designed. Since 2022 it has blocked macros by default in files that Windows has marked as coming from the internet, because macros in downloaded documents are one of the oldest ways for malware to reach a business. Our intranet is a hosted service on its own internet address, which our PCs do not treat as local, so every file downloaded from it carried that mark. The old PCs had never shown the warning, and nobody had gone looking for the automation that the change would stop.
Branches could not quote timber, so they found their own way round within the hour. A branch manager discovered that ticking Unblock in the file's properties removed the mark, and posted the steps in the branch managers' group chat. A month later the instruction had become a habit: if a file shows the red bar, unblock it.
In May a counter assistant received an email that looked like a remittance advice from a customer, with a spreadsheet attached. It opened with the red bar. She unblocked it, as she had been shown, and enabled the content. Our endpoint protection stopped what the macro tried to download and nothing was lost. But the protection Microsoft had added for exactly this case had been removed by our own instruction, and only the next layer down stood between that branch and something much worse.
The workbook's macros are now signed with our own code signing certificate, and our PCs are told by policy to trust that publisher, so the genuine workbook runs without anyone touching its settings. We searched our file shares and the intranet for other macro enabled files in regular use and found forty seven, eleven of which a team depended on. Each now has an owner and is either signed or being replaced. The group chat instruction was withdrawn the same day and replaced by a simpler one: a file with the red bar is a ticket, not a setting to change.
When a platform withdraws its trust from a kind of automation, give the automation you depend on a trusted way to run. Otherwise people will find their own, and the workaround they teach each other removes the protection for everything else as well.
– Serguey Shinder
