Digitally signing macros

[stemar]

I produce a number of automated forms in Excel, using VB. These are used by people of, err, well, let's just say, variable levels of computer literacy. This causes problems when they miss the "macros are disabled" warning, or are scared off by the warnings about dangerous content and I get irate messages about how my files don't work.

I'd like to set up a digital signature, probably using selfcert and get all logins on all PCs on our network set to Disable all macros except digitally signed macros and Automatically trust Stemar's macros, which I believe will solve the problems.

But

I'm not part of our IT department and their default position on anything like this is usually, "It can't be done." I have sponsors who are high enough that they can make it happen if I can prove "It can't be done" to be incorrect. So, here are my questions:

1. Will a home brew signature from selfcert work across a big network (2000+ PCs)?

2. Can access to this certificate be controlled so a list of no more than half a dozen users can access it to sign their projects?

3. IT currently does security & version updates remotely and in bulk. Would they be able to change settings in the Security Centre the same way?

Thanks for your help

 

[WaxonWaxov]

Are you using Office 2007 or later?

You could set-up a Trusted Location on each person's hard drive, then whenever they open a file in that folder, it would open and enable macros automatcially.

 

[Joe4]

1. Will a home brew signature from selfcert work across a big network (2000+ PCs)?

Doesn't really matter how many users there are. Each one will just have to go through the process of accepting the signature once for it to work on their computers.

2. Can access to this certificate be controlled so a list of no more than half a dozen users can access it to sign their projects?

A signature is specific to the individual PC that created it. That means that someone else using another computer will NOT be able to use your same signature to sign things. Each "creator" user would have their own signature, and each user would have to be anything signed by that user in order for that to work. So I don't think you can have a single "multi-user" signature. Each programmer would have his/her own.

3. IT currently does security & version updates remotely and in bulk. Would they be able to change settings in the Security Centre the same way?

I don't believe this shouldn't affect any accepted signatures.