Fix: Excel 97-2003 Files Blocked by Attack Surface Reduction (ASR) Rules

An engineering customer contacted us because they could not open government-supplied Excel 97-2003 spreadsheets required for a Department of Transport and Main Roads contract. The files were being blocked immediately on open, and even when one team member managed to get them open through a workaround, she could not save changes back to the original format. The root cause turned out to be two separate security controls working together: Microsoft Defender’s Attack Surface Reduction (ASR) rules and the Excel Trust Center File Block settings.

Symptoms

When opening an .xls file (Excel 97-2003 format), users may see one or more of the following:

Editing this file type is not recommended due to your File Block settings in the Trust Center. Click for more.

When trying to save changes back to the .xls format:

You are attempting to save a file type (Excel 97-2003 Workbooks and Templates) that has been blocked by your File Block settings in the Trust Center.

In Windows Security under Protection History, you may also see:

Risky action blocked

Expanding the entry shows:

App or process blocked: EXCEL.EXE
Blocked by: Attack surface reduction
Rule: Block Win32 API calls from Office macros

Cause

Two separate security controls are involved:

1. Attack Surface Reduction (ASR) rules deployed through Microsoft Defender for Endpoint block Excel from making Win32 API calls when processing legacy macro-enabled formats. The Block Win32 API calls from Office macros rule treats .xls files as potentially risky because the legacy format supports embedded macros by default, unlike the modern .xlsx format which separates macros into .xlsm.
2. Excel Trust Center File Block settings separately block opening or saving legacy Excel formats. When both controls are active, users cannot open or save .xls files.

This commonly affects organisations that receive government or regulatory documents in legacy Excel formats, such as transport compliance spreadsheets, council tender forms, or ATO reporting templates.

Resolution

Step 1: Confirm ASR is the blocker

1. Open Windows Security from the Start menu.
2. Go to Virus & threat protection then Protection history.
3. Look for entries showing Risky action blocked with the rule Block Win32 API calls from Office macros and EXCEL.EXE as the blocked process.

Step 2: Add an ASR exclusion for the trusted folder

If your organisation manages devices through Microsoft Intune:

1. Open the Microsoft Intune admin center.
2. Go to Endpoint security > Attack surface reduction.
3. Edit the ASR policy applied to the affected devices.
4. Under Attack Surface Reduction Only Exclusions, add the folder path where the .xls files are stored (for example, C:\Users\*\OneDrive - Company\Projects\).
5. Save the policy and wait for the device to sync, or force a sync from Company Portal.

For a quick local fix on a single workstation, run this in an elevated PowerShell window:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Users\*\OneDrive - Company\Projects\"

Step 3: Unblock legacy formats in the Trust Center

1. Open Excel and go to File > Options > Trust Center > Trust Center Settings.
2. Click File Block Settings in the left panel.
3. Uncheck Open and Save for Excel 97-2003 Workbooks and Templates.
4. Click OK twice to save.
5. Try opening and saving the .xls file again.

Step 4: Verify Intune enrolment

If the ASR exclusion does not apply after syncing, check that the device is properly enrolled in Intune rather than only showing as MDE (Microsoft Defender for Endpoint) managed:

1. On the affected PC, go to Settings > Accounts > Access work or school.
2. If it shows Connected to [company] Entra ID but Intune shows the device as MDE managed, disconnect and reconnect the device to Entra ID.
3. Verify the device now appears as Intune managed in the Intune portal.
4. Force a sync and confirm the ASR exclusion policy applies.

Important Notes

• ASR exclusions should be scoped to specific folders, not broad paths like C:\. Only exclude the directories where you know legitimate legacy files are stored.
• If you receive .xls files regularly from a government agency or external partner, consider asking them for .xlsx versions. Many agencies have migrated but still distribute legacy templates.
• The Trust Center File Block fix is per-user and per-machine. For fleet-wide deployment, use an Intune Settings Catalog profile with the policy Block legacy Excel file formats set to the appropriate level.
• If other users on the same network can open the files without issues, check whether their devices are enrolled in Intune and receiving the same ASR policy. Devices managed only by MDE may not receive Intune-configured exclusions.

Related Resources

• Fix: Business Application Blocked by Attack Surface Reduction (ASR) Rules
• Fix: “Action Blocked” When Opening Email Attachments in Outlook (ASR)
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Office file format reference
• Microsoft Support: File blocked by Trust Center settings

If you need help configuring ASR exclusions or Trust Center policies across your fleet, get in touch with our team.