Security Settings for COM objects in Office

Office COM kill bit 

The Office COM kill bit was introduced in the security update MS10-036 to prevent specific COM objects from running when embedded or linked from Office documents.  

The COM Kill bit functionality has been updated in KB3178703 to completely block COM objects from being activated in-process by Office. This update is a superset of the original behavior wherein, in addition to blocking COM objects embedded or linked in Office documents, this will block any instances of COM objects being loaded within the Office process through other means like Add-Ins. 

These specific COM objects include ActiveX controls and OLE objects. Through the registry, you can independently control which COM objects are blocked when you use Office. 

Note: We do not recommend that you remove the kill bit that's set for a COM object. If you do this, you might create security vulnerabilities. The kill bit is typically set for a reason that might be critical. Therefore, you must be extremely careful when you unkill an ActiveX control.  
 
You can add an AlternateCLSID (also known as a “Phoenix bit”) when you have to relate the CLSID of a new ActiveX control (and this ActiveX control was modified to reduce the security threat), to the CLSID of the ActiveX control to which the Office COM kill bit was applied. Office supports the AlternateCLSID only when ActiveX control COM objects are used.  
 
Note: The kill bit list for Office takes precedence over the kill bit list for Internet Explorer. For example, the Office COM kill bit and Internet Explorer ActiveX kill bit may be set for the same ActiveX control. But the AlternateCLSID is set on only the list for Internet Explorer. In this scenario, there is a conflict between the two settings. In such instances, the Office COM kill bit settings take precedence, and the control is not loaded. 

Setting the Office COM kill bit

The location for setting the Office COM kill bit in the registry is as follows:  

For Office 2013 and Office 2010:

• For 64-bit Office on 64-bit Windows (or 32-bit Office on 32-bit Windows).

  HKEY_LOCAL_MACHINE\Software\Microsoft\Office\Common\COM Compatibility\{CLSID}

For 32-bit Office on 64-bit Windows:

HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Office\Common\COM Compatibility\{CLSID}

For Office 2016:

• For 64-bit Office on 64-bit Windows (or 32-bit Office on 32-bit Windows):

  HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\Common\COM Compatibility\{CLSID}

• For 32-bit Office on 64-bit Windows:

  HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Office\16.0\Common\COM Compatibility\{CLSID}

In this case, CLSID is the class identifier of the COM object.  

To enable the Office COM kill bit, follow these steps:

1. Add the registry subkey together with the CLSID of the ActiveX control or OLE object that you want to block from loading.

2. Add a REG_DWORD to this subkey called Compatibility Flags and set its value to 0x00000400.

For example, to set the Office COM kill bit for an object that has CLSID {77061A9C-2F18-4f38-B294-F6BCC8443D24} on Office 2016, follow these steps: 

1. Locate the following registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility

2. Add a subkey with the value {77061A9C-2F18-4f38-B294-F6BCC8443D24}. In this case, the resulting path is as follows:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{77061A9C-2F18-4f38-B294-F6BCC8443D24}

3. Add a REG_DWORD to this subkey that's named Compatibility Flags, and set its value to 0x00000400.

The Office COM kill bit is now set to block this object from being activated within Office. 

How to only block COM in linking and embedding scenarios 

As mentioned, the COM kill bit functionality has been updated to block all activation of specified COM objects from within Office.  

In order to only block COM objects that are embedded or linked from within Office documents, follow these steps:  

1. Add the CLSID to the COM kill bit per the instructions under "Setting the Office Kill Bit" (if it's not on the list already)

2. Under the subkey for the CLSID that's blocked, add a REG_DWORD value that's named ActivationFilterOverride, and set its value to 0x00000001.

For example, to configure the COM kill bit to block only in linking and embedding scenarios for an object that has CLSID {77061A9C-2F18-4f38-B294-F6BCC8443D24} on Office 2016, follow these steps:

1. Locate the following registry subkey:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility 

2. Add a subkey that has the value {77061A9C-2F18-4f38-B294-F6BCC8443D24}. In this case, the resulting path is as follows: 
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{77061A9C-2F18-4f38-B294-F6BCC8443D24} 

3. Add a REG_DWORD value to this subkey that's named Compatibility Flags, and set its value to 0x00000400. 

4. Add a REG_DWORD to this subkey called ActivationFilterOverride, and set its value to 0x00000001. 

The Office COM kill bit is now set to block this COM object only if it's linked or embedded in Office documents.