“Macros have been disabled”: Troubleshooting the “Trusted Locations” security block.

The message “Macros have been disabled” appears when Excel blocks Visual Basic for Applications (VBA) code from executing because the workbook resides in an untrusted directory or carries an untrusted web flag. Even after adding a folder to your Trusted Locations list, Excel may continue blocking macros if network security rules, Mark of the Web (MotW) metadata, or Group Policy settings override your local trust settings.

Quick Answer

To clear the block, move your file into a registered trusted directory by navigating to File > Options > Trust Center > Trust Center Settings > Trusted Locations, clicking Add new location, and browsing to your local folder. If the file was downloaded from email, the web, or a chat client, close Excel, right-click the file in Windows Explorer, select Properties, check the Unblock checkbox under the General tab, and click Apply.

---

Understanding the Trusted Locations Security Model

Excel uses a layered security perimeter to decide whether VBA code can run. The highest level of implicit permission comes from Trusted Locations. Workbooks stored within an authorized directory bypass regular macro warnings and run without prompting the user.

However, modern versions of Excel enforce strict security boundaries. A folder designated as a Trusted Location will fail to execute code under three specific circumstances:

1. The location is on a remote share without intranet authorization: Excel disables network-based trusted locations by default.
2. The file carries the Windows “Mark of the Web” (Zone.Identifier): Windows attaches an alternate data stream to files originating from outside your local intranet.
3. Enterprise Group Policy (GPO) enforces centralized macro restrictions: Administrative templates can silence or disable user-defined trust lists.

When this security block triggers, troubleshooting requires verifying the directory path structure, inspecting file-level metadata, and confirming Windows security zones.

---

Step 1: Configure Local and Subfolder Trust Correctly

A common reason a workbook gets blocked inside an intended directory is that it sits inside a subfolder that was never explicitly trusted.

1. In Excel, go to File > Options > Trust Center.
2. Click Trust Center Settings, then select Trusted Locations from the left navigation.
3. Highlight your target path and click Modify (or click Add new location if setting up a new path).
4. Verify the folder path matches your file’s actual physical location.
5. Check the box labeled Subfolders of this location are also trusted.
6. Click OK to commit the change.

Avoid setting broad, system-level directories—such as your entire C:\ drive, C:\Users\, or C:\Program Files—as trusted locations. Excel explicitly prevents or flags top-level directories because doing so creates an open vector for unvetted scripts to run automatically.

---

Step 2: Resolve the Network Share Block (UNC vs. Mapped Drives)

If your workbook sits on a corporate file server, network-attached storage (NAS), or shared server drive, Excel disables macro execution by default, even if the folder path appears in your list.

Enable Network Locations in Trust Center

At the bottom of the Trusted Locations menu, locate the checkbox labeled:
“Allow Trusted Locations on my network (not recommended)”.

If this box is unchecked, Excel ignores all network paths entered in the list above it. Check this box, click OK, and reopen the workbook.

Use Universal Naming Convention (UNC) Paths

Excel often fails to validate mapped drive letters (such as Z:\Finance\Models) because Windows treats mapped drive letters as dynamic user sessions. Instead of using the mapped drive letter:

1. Identify the full UNC path of the share (for example: \\server01\finance\Models).
2. Add the UNC path directly to Trusted Locations.
3. In Windows Internet Options (inetcpl.cpl), go to the Security tab, select Local Intranet > Sites > Advanced, and add the server name (\\server01) to confirm Windows treats the host as an internal asset.

If your workbook path is managed by cloud storage rather than a local file server, refer to Fixing VBA errors caused by “OneDrive” autosave and temp file paths. to handle cloud-synced local caching issues.

---

Step 3: Remove the “Mark of the Web” (MotW) Attribute

If you downloaded the macro-enabled workbook (.xlsm or .xlsb) from SharePoint, an email attachment, Slack, Teams, or an external portal, Windows flags the file with an alternate NTFS data stream (Zone.Identifier=3). This flag triggers a persistent red banner: “SECURITY RISK: Microsoft has blocked macros from running because the source of this file is untrusted.”

In modern Office builds, this block takes precedence over local Trusted Location rules.

[File Downloaded from Internet/Email]
                 │
                 ▼
       Windows adds MotW Stream
        (ZoneIdentifier = 3)
                 │
                 ▼
       Excel ignores local trust
                 │
      ┌──────────┴──────────┐
      ▼                     ▼
Manual File Unblock    PowerShell Unblock
(Properties Dialog)    (Unblock-File Command)

Manual Unblock

1. Close Excel completely.
2. Open Windows File Explorer and locate the workbook.
3. Right-click the file and choose Properties.
4. In the General tab, look at the bottom section labeled Security.
5. Check the box labeled Unblock.
6. Click Apply, then OK.

Bulk Unblock via PowerShell

If an entire directory of files is blocked by Zone Identifier metadata, open PowerShell and run:

Get-ChildItem -Path "C:\YourMacroFolder" -Recurse | Unblock-File

This command strips the Zone.Identifier stream from all workbooks in the directory, allowing Excel’s Trusted Locations settings to recognize them again.

---

Step 4: Check for Group Policy (GPO) Overrides

If the Add new location button is greyed out, or if macros remain disabled despite completing the previous steps, your computer is governed by an organizational Group Policy that overrides user settings.

To verify whether your system is under GPO macro enforcement:

1. Press Win + R, type regedit, and hit Enter.
2. Navigate to:
   HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\excel\security
3. Look for the following DWORD values:
   • blockcontentexecutionfrominternet: If set to 1, macros in files downloaded from external origins are unconditionally blocked regardless of Trusted Locations.
   • disablerecommendedcheck or vbawarnings: If vbawarnings is set to 4, all macros run disabled without notification.
   • notrustedlocations: If set to 1, the entire Trusted Locations feature is disabled at the registry level.

When administrative policies enforce these controls, local adjustments will not persist. The file must either be signed with an enterprise-approved certificate—see Digital Signatures: Fixing “The VBA project is not digitally signed.”—or moved to an administratively managed central share designated by your network administrator.

If your security settings are correct but Excel reports that it cannot find the routine when triggered, consult Fixing “Cannot run the macro… The macro may not be available in this workbook.” to diagnose project naming and scoping issues. For an overview of other common environmental blocks, read the VBA Environment & System Guide: Fixing Security, Version, and Compatibility Errors.