Dont allow Dynamic Data Exchange (DDE) server launch in Excel

Information

This policy setting allows you to control whether Dynamic Data Exchange (DDE) server launch is allowed.
By default, DDE server launch is turned off, but users can turn on DDE server launch by going to File > Options > Trust Center > Trust Center Settings > External Content.
For security reasons, turning on DDE server launch is not recommended.
Note: For DDE server launch to work, Dynamic Data Exchange (DDE) server lookup must be turned on. Be sure that the 'Dont allow Dynamic Data Exchange (DDE) server lookup' policy setting isnt enabled, because enabling that policy setting turns off DDE server lookup.
If you enable this policy setting, DDE server launch isnt allowed, and users cant turn on DDE server launch in the Trust Center.
If you disable this policy setting, DDE server launch is allowed, and users cannot turn off DDE server launch in the Trust Center. For security reasons, this is not recommended.
If you dont configure this policy setting, DDE server launch is turned off, but users can turn on DDE server launch in the Trust Center.
Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.

Solution

Policy Path: Microsoft Excel 2016\Excel Options\Security\Trust Center\External Content
Policy Setting Name: Dont allow Dynamic Data Exchange (DDE) server launch in Excel

See Also

https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-office-365-proplus-v1908-sept-2019-final/ba-p/873084

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(1)

Plugin: Windows

Control ID: c3aa1772a6de450be56b701edc5150d3fc28e76b2d9fc2da13ac23edbff395d7