Surely any template that uses macros has a potential security risk? Templates are usually stored (and in Word 2016 at least) saved by default in the user templates folder (or used as add-ins in the Word startup folder). These folders will by default be trusted folders, so the macro stored in the template will run from those locations and present no greater potential risk than any other macro that may be in the document created from the template.



Some documents require macros to perform specific tasks, and if there is no connection back to the template (as would be the case if the document was mailed or otherwise passed to someone for completion) to run the macros from the template, then the macros need to be in the document.

Clearly the user would require that macro enabled document to be trusted in order to run it, and that presents no more security issues whether the code is copied manually or by using a macro to copy it, but it is certainly more convenient to use macros to copy then save the document as macro enabled, than to do so manually.

Macros in documents and templates (especially when prepared by others) do indeed present a potential danger and some end users may be unwilling to run them. That is universally true of all macros, but it remains a fact that some processes cannot be completed without macros.

This of course requires users to take a leap of faith, depending on who has supplied the document, to enable the macros in order to run the process, and this remains true whether you supply just the document or make available the template to provide the macro functions.

__________________
Graham Mayor - MS MVP (Word) (2002-2019)
Visit my web site for more programming tips and ready made processes www.gmayor.com

Agreed. I was hoping there would be some way to sign the document, with a pgp key or cerificate of some description, and that our IT department would be able to set up a list of trusted developers which MSOffice would refer to when deciding whether to enable macros or not.

If that kind of solution were possible, most users could have macros disabled by default, except when a document with a good signature from a trusted source is opened.

From my experience so far, there isn't really a good solution for this.

Anyway, a bit off-topic.

Thanks both for your responses.