Welcome to MSDN Blogs Sign in | Join | Help

Microsoft Excel 2010

The official blog of the Microsoft Excel product team
Safety First: Office 2010 Protected View

When you open workbooks downloaded from the Internet in Excel 2010, you’ll enter into the new Protected View. While in this mode, Excel runs in a “sandbox,” which means that you are now better isolated from any malicious code that could be contained within the file. In the past, you had to decide if you trusted the author/origin of the document before viewing the contents. Now, with Protected View, you can make a more informed decision before exposing your computer to potential vulnerabilities.

As you can tell from the excerpt below, Protected View makes it much more difficult for malware to take over your machine:

“…Protected View is one of the many security defenses in Office 2010. For a malware to actually be able to run in Protected View it will first need to find a way around DEP, ASLR, GS and our new 2010 Office File validation checks. After all that, the malware would need to find a way to break out of the sandbox.”

To learn more about this great feature, check out the full post on the Office 2010 Engineering Blog.

Posted: Friday, August 21, 2009 4:21 PM by Sam Rad

Comments

Ron de Bruin said:

Hi Sam

If you download a zip file and extract one file out of this zip for example it will open in protected view.

But if you extract all files to a folder on your desktop and open the files from this folder it will not open in protected view.

And I see VBA errors with events running after you trust it.

# August 23, 2009 4:50 PM

Harlan Grove said:

When Outlook is handing off a file to Excel, since both Outlook and Excel are Office apps, a tighter level of interoperation is allowed. But when Windows itself is telling Excel to open a file, that's all Windows is doing.

How could Windows distinguish between files unzipped from an e-mail attachment and files copied from another drive?

Which begs the question whether Outlook should default to saving file attachments to 'untrusted' locations, and only other Office apps would realize that these locations were untrusted.

# August 23, 2009 11:47 PM

Vikas Malhotra [MSFT] said:

Ron -

When the file is extracted where is it being placed? If the location is the temporary internet files folder then it certainly will be considered 'unsafe' and the file will open in Protected View.

Harlan -

Outlook attachments are stored in a special folder under the temporary internet files directory which is a untrusted location.

# August 31, 2009 4:42 PM
New Comments to this post are disabled
Page view tracker