VBA Code Signing on Windows 11: What Changed and What to Do

Your VBA macros worked on Windows 10. Now they don't. You've checked the Trust Center, lowered the macro security setting, and the workbook still won't run its code. You might have even tried re-enabling the macro in the security warning bar — only to see it blocked again the next time.

This happens to a lot of organizations after a Windows 11 upgrade, and the fix isn't always obvious. Code signing is usually part of the answer — but signing alone doesn't solve everything if you're also dealing with legacy .xls files that need to be migrated. If your macros are also failing because of 64-bit API declarations, see our guide on fixing VBA PtrSafe errors on Windows 11. This post covers both the signing and migration sides.

Why Macros Break on Windows 11

Two things changed that affect macro behavior on Windows 11:

1. Mark of the Web (MOTW) enforcement is stricter

When you download a file from the internet or receive it via email, Windows attaches a hidden attribute called the Mark of the Web (MOTW). Starting with Microsoft 365 updates in 2022 (and enforced more broadly on Windows 11), Office automatically disables VBA macros in MOTW-flagged files with no prompt to enable them.

If your workbooks are distributed via SharePoint, email, or downloaded from internal portals, they may be picking up this flag. Even files copied from a USB drive to a non-trusted location can trigger it.

2. Self-signed certificate trust is machine-specific

If you've been using SelfCert.exe to sign your VBA projects — Office's built-in self-signing tool — your signature only works on the machine that generated the certificate. Other machines must have that certificate manually added to their Trusted Publishers certificate store, or the macro will be blocked regardless of security settings.

This wasn't a problem when everyone worked on the same machine or a small number of shared workstations. It becomes a problem the moment someone gets a new laptop with a fresh Windows 11 install.

What Code Signing Actually Does

A digital signature on a VBA project proves two things:

1. Identity: the code was signed by a specific publisher (you, your company, or a known vendor)
2. Integrity: the code hasn't been modified since it was signed

When Office detects a signed macro from a Trusted Publisher, it runs it without prompting. When it detects an unsigned macro (or a macro from an untrusted publisher), it blocks it — more aggressively on Windows 11 than on previous versions.

Code signing is the right long-term solution. It's also a prerequisite if your organization's Group Policy enforces the "Disable all macros except digitally signed macros" setting.

Your Two Options: Self-Signed vs. Commercial Certificate

Factor	Self-Signed (SelfCert.exe)	Commercial Code Signing Cert
Cost	Free	$100–$500/year (DigiCert, Sectigo, etc.)
Trusted by default	Only on the machine that created it	All Windows machines (via chain of trust)
Deployment	Manual cert import on each machine	Works immediately everywhere
Best for	Single machine, personal use	Distributed workbooks, IT teams, organizations
MOTW files	May still be blocked	Trusted publisher status bypasses MOTW block

If you're deploying workbooks to more than one machine, a commercial certificate is the right choice. The cost is low relative to the time saved managing manual certificate imports.

How to Sign a VBA Project (Step-by-Step)

Whether you're using a self-signed certificate or a commercial one, the signing process in Excel is the same.

Step 1: Get or create your certificate

Self-signed: Open the Start menu and search for "Digital Certificate for VBA Projects" (or find SelfCert.exe in your Office installation folder, typically C:\Program Files\Microsoft Office\root\Office16\). Run it, enter a name for your certificate, and click OK.

Commercial: Purchase from DigiCert, Sectigo, or GlobalSign. They'll provide a .pfx file. Import it to your certificate store via certmgr.msc → Personal → Certificates → Import.

Step 2: Open the VBA Editor in Excel

Open your workbook. Press Alt + F11 to open the Visual Basic Editor.

Step 3: Sign the project

1. In the VBA Editor, go to Tools → Digital Signature
2. Click Choose to select your certificate
3. Select your certificate from the list and click OK
4. Click OK to apply the signature
5. Save the workbook (Ctrl + S)

Step 4: Add the publisher to Trusted Publishers

On each machine that needs to run the macro, a user must see the certificate at least once and choose "Trust all documents from this publisher." This can also be pushed via Group Policy using the certificate's thumbprint — ask your IT team.

The .xls Problem: Signing Doesn't Work Until You Migrate

Here's where legacy file formats intersect with the code signing problem.

If your macros live in .xls files (the old binary Excel format), you're dealing with two problems at once:

1. Windows 11 macro security — which requires signed code or Trust Center exceptions
2. Format limitations — .xls handles digital signatures differently than .xlsm, and signature behavior can be unpredictable on modern Office versions

The reliable path is to migrate .xls to .xlsm first, then sign the VBA project. This gives you a properly structured modern container with full support for current Office security mechanisms.

The catch: most conversion tools strip your VBA code when converting from .xls to .xlsm. You end up with a modern format file with no macros — which doesn't help anyone.

What If You Can't Sign the Code?

Sometimes you don't have access to the VBA source — the project is locked, the original developer is gone, or the password is lost. In that case:

• Trust Center workaround: Add the file's location to Trusted Locations (File → Options → Trust Center → Trusted Locations). Macros in trusted locations run without signature requirements. This works for files on local drives or internal network shares — not for files downloaded from the internet.
• Group Policy: IT administrators can configure policy to allow unsigned macros for specific file paths or for the entire organization, though this reduces security posture.
• Done-for-you migration: If the VBA project is locked and the macros need to be preserved and signed, our done-for-you service includes source analysis and clean migration with post-conversion signing guidance.

After You Sign: Testing Your Work

After signing and saving the workbook, test it on a clean machine (one that hasn't previously trusted your publisher):

1. Open the file — you should see a security notification in the message bar
2. Click "Enable Content" (if your certificate is a self-signed cert not yet trusted on this machine)
3. You'll be prompted to trust the publisher — click "Trust all documents from this publisher"
4. Future opens on that machine will run without prompts

If you're using a commercial certificate and the macro still doesn't run, check that the file doesn't have the Mark of the Web attached. Right-click the file → Properties → General tab → look for an "Unblock" checkbox or "Security" section at the bottom. Check Unblock and click OK.

The Right Order of Operations

To summarize the correct sequence when dealing with legacy VBA workbooks on Windows 11:

1. Scan your files — understand what VBA code exists before you do anything else
2. Migrate from .xls to .xlsm — using a tool that preserves VBA (not a cloud converter)
3. Sign the VBA project — using a self-signed cert (single machine) or commercial cert (organization-wide)
4. Distribute to Trusted Publishers — either manually or via Group Policy
5. Unblock downloaded files — use the Properties dialog or Group Policy to manage MOTW for internal distributions

Skipping step 2 — leaving files in .xls while trying to apply Windows 11 security solutions — produces inconsistent results. The .xlsm format is the right container for signed, modern-Excel-compatible VBA code.

Frequently Asked Questions

Why did my signed VBA macros stop working after upgrading to Windows 11?

Windows 11 updated its macro security defaults. Self-signed certificates must be in the Trusted Publishers list of each machine that runs the macro — not just the machine that signed it. If your certificate wasn't distributed to all machines before the upgrade, macros will be blocked even though they were signed. Additionally, files with the Mark of the Web are now blocked by default regardless of signing status.

What's the difference between a self-signed certificate and a commercial code signing certificate?

A self-signed certificate (created with SelfCert.exe) is free and works on a single machine. Other machines must have the certificate manually added to their Trusted Publishers store, which doesn't scale. A commercial code signing certificate from a CA like DigiCert or Sectigo is trusted by all Windows machines automatically, making it the right choice for workbooks distributed across an organization.

Do I need to re-sign my VBA macros after converting .xls to .xlsm?

Yes. Converting a file changes the container format, which invalidates the existing digital signature. After conversion, you must re-sign the VBA project with your certificate. LegacyLeaps preserves the VBA code during migration — you apply the signature as a post-migration step.

← Back to all posts