Office: file opens in protected view, how to find out why?

Question

When a open a certain DOC file, it opens in protected view. The message says

Protected View: Office has detected a problem with this file. Editing it may harm your computer. Click for more details

but gives me no hint as to what specific problem there is with this file or what specific risk there is if I edit this file.

Microsoft says that this means "the file didn’t pass file validation" but gives no more details.

Question: How do I find out what specifically the problem with this file is -- what specifically did Word not like in it?

In my case the file has no additional data streams (dir /R) and seemingly no macros (or Protected View might not show them).

Notes:

My question is not how to open this file, or what protected view is, or how to disable protected view.

My question is also not whether it is good practice not to open this file (or any files at all). I do need to open it, but I want to know the specific risk or specific cleaning actions after I open it.

Solution

What type of Word document is it? If it's an old .doc file rather than the newer .docx format then that will cause Protected View to kick in.

In the newer .docx format all the data is stored as text in an xml format, as such it's not possible to insert macros or other malicious content into the document which could be dangerous. That's why you also have the .docm format, which does allow things like that to be included, while obviously giving appropriate warnings and allowing admins to add extra protections for those documents.

In the old .doc format the data was stored in a binary format which could include anything, so there's no way to know from just looking at it whether it only contains text or has macros of malicious content, which is why ALL .doc files generate that message.

If it is a .doc file and it doesn't contain any macros etc then the easiest option is probably to simply save it as a newer .docx file, which then eliminates the issue entirely.

Comments

[Rich Michaels]

If you look in Word Options > Trust Center > Trust Center Settings > Protected View it will give you some information about what would trigger that message. Location of the file being opened is probably the most common trigger.

[Alexander Gelbukh]

@RichMichaels There I see all three ticks set. None is my case: (1) the file is not from Internet, and anyway it has no ADS in which this information could be stored; (2) the file is in the same directory where all other files open perfectly; (3) it is not open from Outlook. So Word dislikes something else about it, and my question is what it can be.

[OOOO]

If we get the message about risk, it does not mean that it really has issue. If you can trust the file, just edit it.

[Alexander Gelbukh]

The whole point is that I don't know whether I can trust this file.

[Alexander Gelbukh]

No, this warning is not just because of the .DOC format. I have 9000 .DOC files in that directory, of which 2 produce this warning and others open just fine. BTW, it is certainly possible for Word to tell whether there are macros in a .DOC file. Also, to save a file in another format you have to unlock it for editing first.

[StormRyder]

I had a locked .doc file and couldn't figure out how to unlock it until I tried to save it as Keith wrote. Clicking File, the "save as" option was grayed out but the "save" option was available, so I clicked it. A dialog box popped up saying something about it being locked from saving, but it gave me the option to unlock it! One of the options was "enable saving" and then I was able to save it as .docx. Even the original .doc file became unlocked after doing this. I closed the original .doc file (without saving changes) and re-opened it, and it opened in normal mode.