[sims] SIMS Report Macros and protecting against Cryptolocker

[5tu]

Hi All

 

As part of our defence against malware such as Cryptolocker, we have disabled all macros in all office documents / locations and explicity set (via gpo) a couple of trusted locations where macro enabled documents must be saved in order to be allowed to run. This has been working well for many months.

 

However, we have come to that time of year when we need to print Individual Reports from SIMS which uses the macro enabled IndRepStudentTemplate.dot document. When printing inidividual reports, the IndRepStudentTemplate.dot document gets opened in the following location....

 

c:\users\\AppData\Local\Temp

 

For obvious reason I don't want to add this as a trusted location but somehow need to permit macros to run on IndRepStudentTemplate.dot.

 

What are our options here? Any (and all) creative solutions gratefully received!

 

Stuart

[bobsmith]

Get some decent anti malware installed on those stations that are going to run the reports and then relax the macro running GPO on them?

[5tu]

Yep - I think the only solution is to relax Macro settings for just the users that need to produce the Individual Reports in SIMS.

[Esteban_Child_of_the_Sun]

You could set your system to only run Digitally signed macros from Capita no mater what location they are in.

[Arthur]

I don't think Capita digitally sign their macros.

[5tu]

I don't think Capita digitally sign their macros.

Correct - sadly they don't.

[Esteban_Child_of_the_Sun]

Patch 21751 [3.62.377-3.62.377] PRB13039 - Assessment individual report templates gives error if macro setting is Disable all except digitally signed. Patch will provide required digital signature to the template.

[Arthur]

Patch 21751 [3.62.377-3.62.377] PRB13039 - Assessment individual report templates gives error if macro setting is Disable all except digitally signed. Patch will provide required digital signature to the template.

@PhilNeal. We were told by Capita that patch 21751 is only for schools with hosted SIMS. Is that correct?

[3s-gtech]

We're hoping to get this shortly - the details don't suggest it is for hosted only:

 

What is the issue?

There is an issue with macro’s being blocked when running Individual Reports within the Spring release.

 

Who is affected?

Schools on the Spring 7.168 release and using Individual Reports within Assessment Manager with macro settings restricted to “Disable All except digitally signed macros” or more.

 

How is this being fixed?

Patch 21751 is available for you to apply via SOLUS3 and includes resolution to this issue

 

If you have any queries or require a copy of the patch please contact the Service Desk.

 

Edit: just scheduled it in SOLUS 3, so it seems to be available for all of us.

Edited April 21, 2016 by 3s-gtech

[3s-gtech]

Just testing this today, will update if it still causes issues (GPOs for Word and Excel now set to Disable all except digitally signed macros).

[5tu]

Patch 21751 has sorted this for us. Users are now able to set Individual Report Templates as Trusted Documents as they are now signed with valid SSL certificates.

[5tu]

Resurrecting this thread as since applying the Summer 2017 update users can no longer edit Individual Report Templates as macros are disabled due to templates being unsigned (I think). Anyone else got the same problem?

[pete]

Resurrecting this thread as since applying the Summer 2017 update users can no longer edit Individual Report Templates as macros are disabled due to templates being unsigned (I think). Anyone else got the same problem?

 

There's a patch out for the same thing - 23191, IIRC.