Hardening Microsoft Office 2013

Download ASD Protect: Hardening Microsoft Office 2013 (PDF), May 2018
First published 2015; updated 2016, 2017, April and May 2018


Workstations are often targeted by adversaries using malicious web pages, malicious email attachments and removable media with malicious content in an attempt to extract sensitive information. Hardening applications on workstations is an important part of reducing this risk.

This document provides guidance on hardening Microsoft Office 2013 – specifically Microsoft Excel 2013, Microsoft PowerPoint 2013 and Microsoft Word 2013. Before implementing the recommendations in this document, testing should be undertaken to ensure the potential for unintended negative impacts on business processes is reduced as much as possible.

This document is intended for information technology and information security professionals within organisations looking to undertake risk assessments or vulnerability assessments as well as those wishing to develop a hardened standard operating environment for workstations.

The Group Policy Administrative Templates for Microsoft Office 2013 referenced in this document can be obtained from Microsoft's TechNet. Once downloaded, the ADMX and associated ADML files can be placed in %SystemDrive%\Windows\SysVol\domain\Policies\PolicyDefinitions on the Domain Controller and they will automatically be loaded in the Group Policy Management Editor. As Group Policy Administrative Templates for Microsoft Office are periodically updated by Microsoft, care should be taken to ensure the latest version is always used.

Table of contents

Further information

Contact details

Organisations or individuals with questions regarding this advice can contact the ACSC by emailing asd.assist@defence.gov.au or calling 1300 CYBER1 (1300 292 371).