Re: Are there security constraints I can modify in my OOXML so the "Enable Editing" prompt does not show in Excel 2010?

We're generating Excel reports in OOXML using XML and XSL, which includes no formulas, but does include charts and chart data. We've noticed that in Excel 2010 we're now getting the "Enable Editing" prompt. Is there something we can change in our XML for the Excel that will prevent this prompt? I gather it has more to do with the fact that the report is being downloaded from the Internet (based upon the Office settings), but it can be confusing to our users since some data doesn't show up in the report until editing is enabled.

I'm not familiar with that prompt, but I can offer a suggestion. Make a copy of the spreadsheet. If you open the spreadsheet, respond to the prompt and save it, does it prompt again when you open it again? If not, then you should be able to compare the original and modified versions to see what has changed. Then you can incorporate the change into your generation. The Open XML productivity tool will allow you to do a full comparison of two Open XML documents.

The prompt only happens when you download the file from an Internet source. So I saved it off, and used WinMerge to diff the files. The only differences are the external URL namespaces are removed, and the standalone attribute is used in the XML declaration at the top. So we have some references to XALAN and some other third party DTDs, but I don't think we can remove those and have the Excel still work. Unfortunately I can't use the productivity tool SDK because we're generating our reports with Java.

The prompt is not controlled through the XML. Downloaded files have what is sometimes called the 'Mark of the Web', an alternate data stream that tells aware applications (such as Excel 2010) that the file came from the web. Excel maintains a list of 'safe' files in the registry but that probably doesn't help if you generate files with different names every time. It's some time since I looked at this and can't remember all the details but, in essence, you need to change something in every users Excel (somewhere in Trust Settings)or you need to download the file with a tool that doesn't mark it (generally non-Microsoft tools) or you need to remove the mark after downloading - I don't know whether your process will allow any of those things.

Thanks for the additional information Tony. It appears that you can only add an MOTW comment inside HTML documents that were downloaded, and according to MS the results are inconsistent. It may be worth noting that this is not an Excel issue, but a "Protected View" issue, and any document for an application that is Protected View aware will suffer from this problem when downloaded from IE. It is interesting also that when opened directly from the download prompt, the Excel will show the enable editing message, however, if you decided to save to your desktop instead of opening the file directly then this message doesn't show.

If you save to a trusted location, the downloaded file will be trusted. Kind of obvious when written like that, I guess :-)