Packager Activation in Office 365 desktop applications

In response to a growing trend in attacks that involve embedding malicious objects inside Office documents using the Object Packager control, Office is introducing a change to the default activation model for Packager objects in Office 365 applications.

Prior to this update, executables/scripts (e.g. EXE, JS, VBS) embedded using the Object Packager control can activate when a user double clicks on the embedded object within the document. For objects considered high risk by Windows, users will see a security warning as shown below.

If you try to open an object that Windows considers high risk, you'll receive a caution.

If the user clicks “Open”, the object executes with the privileges of the signed in user. Attackers abuse this vector to social engineer users to activate malicious programs embedded inside Office documents by persuading them to click through this warning prompt.

To protect users, Office 365 applications will, by default, block activation of objects considered high risk. The list of extensions blocked will be the same one used by Outlook to block attachments. The list of extensions can be found here: File extensions blocked in OLE package.

What does this behavior look like?

With this update, Office clients will no longer allow the activation of objects that link to extensions that are considered high risk. When a user tries to activate such an object, they will be provided with the following notification.

Block notification for Packager Objects

If an embedded extension is not part of the list of extensions blocked by this mitigation, then the object is activated without any warnings from Office.

Can I customize the extensions being blocked?

Yes, Office provides two Group Policy options that allow an administrator to customize which extensions are blocked. You'll find each of them under Office/Security Settings/.

Caution: Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

Allow file extensions for OLE embedding

This policy setting allows you to specify which file extensions Office won’t block when they are embedded as an OLE package in an Office file by using the Object Packager control. If you enable this policy setting, enter the file extensions to allow, separated by semicolons.

For example: exe;vbs;js

Warning: Malicious scripts and executables can be embedded as an OLE package and can cause harm if clicked by the user. If extensions are added to this allow list, they lower the default security of the Office client by opening up attack surface that can be abused by an attacker.

Block additional file extensions for OLE embedding

This policy setting allows you to specify additional file extensions that Office will block when they are embedded as an OLE package in an Office file by using the Object Packager control.

If you enable this policy setting, enter the additional file extensions to block, separated by semicolons.

For example: py;rb

Note: If you add a file extension under both “Allow file extensions for OLE embedding” and “Block file extensions for OLE embedding”, the extension will be blocked.

How do I change this behavior?

To change this behavior for a specific application such as Word or Excel you can modify the following registry key:

HKCU\Software\Microsoft\Office\<Office Version>\<Office application>\Security\PackagerPrompt

The Office version value should be: 16.0

Office application should be one of:

  • Word

  • Excel

  • PowerPoint

  • Visio

  • Publisher

The value options for the registry key are:

  • 0 – No prompt from Office when user clicks, object executes

  • 1 – Prompt from Office when user clicks, object executes

  • 2 – No prompt, Object does not execute

For more information about this registry key see: 

File extensions blocked in OLE package

File name extension

File type


Access Project Extension (Microsoft)


Access Project (Microsoft)


Executable Application


Application Content


Application Manifest


Active Server Page


BASIC Source Code


Batch Processing script


Internet Security Certificate File


Compiled HTML Help


DOS CP/M Command File or Command File for Windows NT


Microsoft Help Workshop Application




Windows Control Panel Extension (Microsoft)


Certificate File


csh Script


DER Encoded X509 Certificate File


Microsoft Support diagnostic tools


Executable File


FoxPro Compiled Source (Microsoft)


Windows Vista gadget


Microsoft program group


Windows Help File


AppWizard Help Project


Hypertext Application


Information or Setup File


IIS Internet Communications Settings (Microsoft)


Disc Image File


IIS Internet Service Provider Settings (Microsoft)


Internet Document Set, Internet Translation


Java Archive


Java Network Launch Protocol


JavaScript Source Code


JScript Encoded Script File


UNIX Shell Script


Windows Shortcut File


Access Module Shortcut (Microsoft)


Access (Microsoft)


Access Diagram Shortcut (Microsoft)


Access Macro Shortcut (Microsoft)


Access Query Shortcut (Microsoft)


Access Report Shortcut (Microsoft)


Access Stored Procedures (Microsoft)


Access Table Shortcut (Microsoft)


Media Attachment Unit


Access View Shortcut (Microsoft)


Access Data Access Page (Microsoft)


Media Container Format


Access Add-in (Microsoft) or MDA Access 2 Workgroup (Microsoft)


Access Application (Microsoft) or MDB Access Database (Microsoft)


Access MDE Database File (Microsoft)


Access Add-in Data (Microsoft)


Access Workgroup Information (Microsoft)


Access Wizard Template (Microsoft)


Microsoft Management Console Snap-in Control File (Microsoft)


Microsoft Shell


Microsoft Shell


Microsoft Shell


Microsoft Shell


Microsoft Shell


Microsoft Shell


Windows Installer File (Microsoft)


Windows Installer Update


Windows SDX Setup Transform Script


Windows Update file


Office Profile Settings File


Open Software Description


Visual Test (Microsoft)


Windows Program Information File (Microsoft)


Perl script


Developer Studio Build Log


Windows System File


Program File


Printer backup file


Windows PowerShell


Windows PowerShell


Windows PowerShell


Windows PowerShell


Windows PowerShell


Windows PowerShell


Windows PowerShell


Windows PowerShell


Microsoft Exchange Address Book File or Outlook Personal Folder File (Microsoft)


Registry Information/Key for Windows 95/98 or Registry Data File


Windows Explorer Command


Windows Screen Saver


Windows Script Component or FoxPro Screen (Microsoft)


Setting content


Windows Shortcut into a Document


Shell Scrap Object File


Desktop theme file settings


Temporary File or Folder


Internet Location


VBScript File or Any Visual Basic Source


VBScript Encoded Script File


Visual Basic Project File


VBScript Script File or Visual Basic for Applications Script


Visual Studio .NET Binary-based Macro Project (Microsoft)


Visio Workspace File (Microsoft)


Internet printing file


Pinned site shortcut from Internet Explorer


Windows Script File


Windows Script Component


Windows Script File


Windows Script Host Settings File


Browser Applications


Excel Add-in


Exchange Public Folder Shortcut

Have a question about Office 2016 that we didn't answer?

Visit the Microsoft Answers Community to see questions and answers posted by others or get answers to your own questions.

See Also

Insert an object (Excel)

Insert an object in Word or Outlook

Expand your Office skills
Explore training
Get new features first
Join Office Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.