Plan COM object categorization settings for Office 2013

Applies to: Office 365 ProPlus

Summary Explains how to use COM object categorization to control the behavior of certain COM objects in Office 2013.

Audience: IT Professionals

COM objects can include ActiveX, Object Linking and Embedding (OLE), Excel RealTimeData (RTD) servers, and Office Web Components (OWC) data source providers. You can control the behavior of certain COM objects in Office 2013 by using COM object categorization. For example, you can create a security allow list, which will only allow the specified COM objects to load or you could choose to override the Internet Explorer kill bit.

In this article:

• About COM object categorization

• Configure Group Policy security settings for COM object categorization

• Add COM object categorization in registry

About COM object categorization

Office 2013 first checks whether any of the Group Policy settings for COM object categorization are configured. If any of the settings are enabled to use COM object categorization, Office 2013 verifies that the specified COM objects are categorized correctly within the registry.

To enable COM object categorization within your organization, first determine which Group Policy security settings fit the needs of your organization. Then, add the category ID for the targeted COM objects within the registry.

Configure Group Policy security settings for COM object categorization

There are four COM object categorization Group Policy settings:

• Check OWC data source providers

• Check Excel RTD servers

• Check OLE objects

• Check ActiveX objects

You can configure Check OWC data source providers and Check Excel RTD servers to be either enabled or disabled. If you enable these settings, Office 2013 will load only the COM objects that are categorized correctly.

When you select Enabled, you'll notice that Check OLE objects and Check ActiveX objects have additional options. These options are listed in the following table.

Options for Check OLE objects and Check ActiveX objects settings

The Override IE kill bit list option lets you specifically list which OLE or ActiveX controls will be allowed to load within Office 2013 as long as they are categorized correctly, even if they are on the Internet Explorer kill bit list. Use this control when you want to allow a COM object that is designated as unsafe to load in Internet Explorer but which you know is safe to load in Office. Office also checks whether the Office COM kill bit is enabled. For more information about the Office COM kill bit and how it affects ActiveX control settings, see Plan security settings for ActiveX controls for Office 2013. If the Office COM kill bit is enabled and there is no alternate CLSID, also known as a “Phoenix bit,” the COM object won’t load. For more information about kill bit behavior, see the How to stop an ActiveX control from running in Internet Explorer article.

Use the Strict allow list option when you want to create a security allow list that only allows the specified controls to load and disallows any OLE or ActiveX objects that aren’t on the list.

If you enable any of the COM object categorization settings within Group Policy, the next step is to add the COM object categorization in the registry.

Add COM object categorization in registry

Each Group Policy setting has a corresponding COM object categorization setting within the registry. These settings are listed in the following table.

Group Policy settings and Category IDs

To add the corresponding COM object category ID in the registry

1. Add a correct CATID for the designated COM objects, except when the Group Policy setting is either set to disabled or enabled | Do not check. In the registry, look for a key named Implemented Categories. If it doesn’t already exist, add it to the CLSID of the COM object. Then, add a subkey that contains the CATID to the Implemented Categories key.

   For example, if you create an allow list and allow only the OLE object to be used in Office, you should first look up the CLSID for that COM object in the following location in the registry:

   HKEY_CLASSES_ROOT\CLSID

   Then, if you are looking for the OLE object Microsoft Graph Chart, you can expect the CLSID {00020803-0000-0000-C000-000000000046}. After finding it, either verify that the Implemented Categories key already exists or create one if it doesn’t exist. The path in this example is:

   HKEY_CLASSES_ROOT\CLSID\{00020803-0000-0000-C000-000000000046}\Implemented Categories

2. Finally, add a new subkey for the CATID that corresponds to the Check OLE object Group Policy setting to the Implemented Categories key.

   The final path and values for this example: HKEY_CLASSES_ROOT\CLSID\{00020803-0000-0000-C000-000000000046}\Implemented Categories\{F3E0281E-C257-444E-87E7-F3DC29B62BBD}

See also

Guide to Office 2013 security
Overview of security in Office 2013
Group Policy and Office Customization Tool settings in Office 2013 for OpenDocument and Office Open XML formats

How to stop an ActiveX control from running in Internet Explorer
Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool