Macro Runtime Scan Scope

This policy setting specifies for which documents the VBA Runtime Scan feature is enabled.

If the feature is disabled for all documents, no runtime scanning of enabled macros will be performed.

If the feature is enabled for low trust documents, the feature will be enabled for all documents for which macros are enabled except:

- Documents opened while macro security settings are set to "Enable All Macros"

- Documents opened from a Trusted Location

- Documents that are Trusted Documents

- Documents that contain VBA that is digitally signed by a Trusted Publisher

If the feature is enabled for all documents, then the above class of documents are not excluded from the behavior.

This protocol allows the VBA runtime to report to the Anti-Virus system certain high-risk code behaviors it is about to execute and allows the Anti-Virus to report back to the process if the sequence of observed behaviors indicates likely malicious activity so the Office application can take appropriate action.

When this feature is enabled, affected VBA projects' runtime performance may be reduced.

Supported on: At least Windows 10 Server, Windows 10 or Windows 10 RT




  1. Disable for all documents
    Registry HiveHKEY_CURRENT_USER
    Registry Pathsoftware\policies\microsoft\office\16.0\common\security
    Value Namemacroruntimescanscope
    Value TypeREG_DWORD
    Value0
  2. Enable for low trust documents
    Registry HiveHKEY_CURRENT_USER
    Registry Pathsoftware\policies\microsoft\office\16.0\common\security
    Value Namemacroruntimescanscope
    Value TypeREG_DWORD
    Value1
  3. Enable for all documents
    Registry HiveHKEY_CURRENT_USER
    Registry Pathsoftware\policies\microsoft\office\16.0\common\security
    Value Namemacroruntimescanscope
    Value TypeREG_DWORD
    Value2


office16.admx

Administrative Templates (Computers)

Administrative Templates (Users)