How Does Microsoft Office knows if a document was downloaded from the internet?

Question

Does anyone knows how Microsoft Office knows if a document was downloaded from the internet?

When I open a Word document that was downloaded from the internet, for example, it opens it in some kind of a safe mode..

1. How Does Office knows the file was downloaded from the internet?

2. Is it possible to bypass this protected view (by signature for example)?

Answer 1

As explained in the Microsoft Office 2010 Engineering Blog:

When a file is downloaded from the Internet the Windows Attachment Execution Service places a marker in the file’s alternate data stream to indicate it came from the Internet zone. When a Word, Excel or PowerPoint file is opened and has this marker it will open in Protected View until the user decides to trust and edit it.

The blog linked above goes into more detail as does this document:

Plan Protected View settings for Office 2013

You can bypass protected view manually within Word by going to

File|Options|Trust Center|Protected View

And then clearing the check box for "Enable Protected View for files originating from the Internet"

For additional information see:

How to Disable Protected View in Microsoft Office While Opening Email Attachments or Downloaded Files

On an enterprise level, use the Office Customization Tool and Group Policy to change registry keys to permanently disable the protected view for Internet files. This should get you started:

Office Customization Tool (OCT) reference for Office 2013