Security Baseline for Office 365 July 2017 DRAFT Feedback

Another thing I ran into, which is a bit odd: The baselines configure the option for "Always open untrusted text-based files in Protected View" to "Enabled". I agree with that policy setting, but noticed that when I would open a CSV in Excel from an untrusted location (in this case, attached to an email), Excel would begin to start, state "opening in Protected View" and then never actually finish launching.

To test, I set the policy back to 'Not Configured', and the CSV opened fine, though not in Protected View (as expected). I then set the option via the Trust Center GUI, and opened the file again. This time it opened in Protected View fine, with only a brief delay when it swapped to using Protected View.

So, I reset the GPO back to "Enabled", but then in my 'customization GPO', I set GPP for Registry settings to set:

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\EnableForeignTextFileProtectedView = 1 (DWORD)

Although I did not test the associated file types, I also configured:

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel\Security\ProtectedView\EnableDatabaseFileProtectedView = 1 (DWORD)

just in case it would exhibit the same behavior in the future.

With these settings configured in addition to the Policy key (or in lieu of, if that is the choice), the associated file types will open in Protected View, but Excel will not lock up.

My assumption is there is some policy parsing issue in Excel causing the lock up/freeze, but I would not be able to prove/validate that.