MS Office Policy Settings

[Policy] > [Basic Decontamination Policy] > [MS Office] Settings

MS Office tab defines a decontamination policy specific to Microsoft Office documents such as Word, Excel, and PowerPoint.
This setting allows you to fine-tune whether to remove or retain security threat elements (macros, OLE objects, ActiveX, etc.) that may be included in the document.

⚠️ The basic declassification policy setting authority is granted to [Administrator Type - Super Administrator], and
Administrator permission settings can be done in [Administrator] > [Administrator List].

---

Detailed Description of Settings Items

Policy Name	Explanation
Object Deletion Settings in Document	Set whether to remove OLE objects (images, shapes, charts, etc.) included in MS Office documents. --- OLE (Object Linking and Embedding) is a feature that allows you to insert or link objects from other programs within a document. OLE objects can execute external programs, posing a risk of malware execution.
Object Specification Settings to Maintain in the Document	Specifies the types of OLE objects to keep without deleting when using "Document Object Deletion Settings." Pbrush and Picture are classified as graphic objects by default and are recommended to be kept. Input example) Pbrush;Picture;
Macro Processing Settings in the Document	Set whether to remove VBA (Visual Basic for Applications) macros included in MS Office documents. VBA macros are codes that run automatically when the document is opened, and they are a major pathway for the execution of malicious code.
Remove DDEAUTO Setting in Document	Set whether to remove the automatic data connection feature between documents, DDEAUTO (Dynamic Data Exchange Automatic Update). DDEAUTO can automatically launch external programs when documents are viewed, which is considered a security threat.
Remove ActiveX Control Settings in Document	Set whether to remove ActiveX controls included in the document. ActiveX controls are executable objects such as buttons and checkboxes, and are considered a security threat due to the possibility of executing external code.
Setting ActiveX Content to be Maintained in the Document	Specify the name of the ActiveX control to be excluded from removal. PictureFrame is classified as a picture object by default and is recommended to be retained. Input example) PictureFrame;
Blocking settings for documents prior to MS Office 97	Set whether to import legacy documents saved in formats prior to MS Office 97. Legacy document formats such as Word 6.0 and Excel 95 are considered security threats due to their fragile document structure and numerous known security vulnerabilities.
Remove OLE External Links in Document Settings	Set whether to remove OLE external links included in the document. OLE external links can automatically reference or execute external files or links when the document is viewed, which is considered a security threat.
Remove Hyperlink Settings in Document	Set whether to remove hyperlinks included in the document. Hyperlinks can lead to malicious sites or pose security threats through external connections.
Setting Maximum Number of PowerPoint Slides	Limits the number of decontamination processes for PowerPoint slides. It is used to prevent processing delays caused by large files with many slides.
Setting the Handling Method When Exceeding PowerPoint Slides	Set the handling method for PowerPoint documents that exceed the specified number of slides. (Import original / Block)

Input Rules and Precautions

• When specifying objects or ActiveX content, the input is세미콜론(;)divided by,Distinguishes between uppercase and lowercase letters.
• 'Specify objects to retain in the document' or 'Specify ActiveX content to retain' refers to each removal setting that isONIt only applies when.
• Files prior to MS Office 97 are structurally unstable and have a high possibility of containing malware, soRecommended to blockdoes.
• Hyperlinks and OLE links can introduce malicious files through external paths, so removing them is advantageous for security.
• The maximum number of PowerPoint slides that can be processed is set considering the system processing performance and the number of slides in a typical operating environment.

Reference Note

Terminology	Definition	Security Threats	example
OLE (Object Linking and Embedding)	Inside the document, other documents or filesInsert or Linkfunction	The inserted executable file or object isAutomatically run when opening the documentcan perform malicious actions	Included in the Word document.exe, Excel file
VBA (Visual Basic for Applications)	Used in MS OfficeMacro Programming Language	Malicious VBA code can execute automatically and affect the system.	Excel macro button, automated processing script
macro (Macro)	Automating repetitive tasksCommand CollectionMost are written in VBA.	Malware can operate without the user knowing during execution.	Execute command immediately upon document opening
DDEAUTO (Dynamic Data Exchange Auto)	Data between documentsAutomatic synchronizationfunction	External documents can execute malicious scripts or commands.	Automatically Reflecting Data from External Word Documents in Excel
ActiveX	For feature expansion within the documentControl Tools(button, media, etc.)	External code execution is possible, allowing for the inclusion of malicious control code.	Execute external URL on control click in Excel
hyperlink (Hyperlink)	To external websites or files within the documentLink to connect	malicious site or fileInducing Connectionpossible	"Click here" and similar links
Documents before MS Office 97	.doc, .xlsand older version MS Office documents	structurally weak,Lack of security features	Word 97 document, Excel 95 document, etc.

• This setting applies only to MS Office file types (DOC, DOCX, XLS, PPT, etc.).
• After changing the settings, you can check the records and restore them in the [Policy Change History] menu.