Office Trusted Documents (TrustRecords)

Documents trusted with Enable Editing, or with Enable Content, which lets macros run.

Use it to prove a user clicked Enable Content on a document, which lets its macros run, and when they did it.

  • NTUSER.DAT
  • File and Folder Access

What It Is

When a user clicks Enable Editing or Enable Content on an Office document that opened in Protected View, Office records the file as trusted here so it will not ask again. The key proves a user clicked Enable Content, which lets a document's macros run, and when they did it. This matters because a trusted macro document is a common first step in an intrusion. It lives in the user's own NTUSER.DAT.

What It Proves

The user trusted that document, where the value name is its path and the data says when and how. Data ending FF FF FF 7F means Enable Content was clicked, so the document's macros could run.

What It Does Not Prove

It shows the user trusted the file, not that a macro ran or what it did. The record stays after the file has gone.

Where It Lives

Office Trusted Documents (TrustRecords) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Office\<version>\<app>\Security\Trusted Documents\TrustRecords
Hive file: C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Office Trusted Documents (TrustRecords), each with what it tells you
Registry ValueWhat It Tells You

%USERPROFILE%/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/7KQ2ZD4M/Invoice_4471.docm

REG_BINARY00 FE 34 F5 2A 5A DD 01 ... FF FF FF 7F

alice clicked Enable Content on Invoice_4471.docm, an email attachment, at 12 Oct 2026 09:20 UTC, so its macros could run. Check EDR for what Word started next.

%USERPROFILE%/Downloads/Remittance_Oct.xlsx

REG_BINARY80 78 7F 8D C8 57 DD 01 ... 01 00 00 00

alice lifted Protected View on Remittance_Oct.xlsx at 9 Oct 2026 08:31 UTC, with Enable Editing only. Its Zone.Identifier stream shows where it came from.

How to Read It

Each value name is the path of a trusted document, often starting %USERPROFILE%, and the data records the time and the action. The first 8 bytes of the data are a FILETIME in UTC, the moment the user trusted the file. The last 4 bytes give the action, with 01 00 00 00 for Enable Editing and FF FF FF 7F for Enable Content.

When Windows Writes It
When the user clicks Enable Editing or Enable Content on a document.
Which Windows Versions
Office 2010 to Microsoft 365 on Windows
Tools That Parse It
Registry Explorer, RECmd

Hunt It

The trust decision is kept in this per-user key, so parse the hive, or read it live with Velociraptor. What the document did next is in EDR process data for the Office app.

Sees Related ActivityDeviceProcessEvents (documentation, opens in a new tab)

Shows what a macro started, which TrustRecords cannot. It does not read the key, and a macro that starts nothing leaves no trace here.

KQLDefender XDR, Advanced hunting
// Office apps starting shells and script hosts: what enabled macros often lead toDeviceProcessEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where InitiatingProcessFileName in~ ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe")| project Timestamp, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Office Trusted Documents (TrustRecords) shows.

  • Outlook Attachment FolderShows whether the document came as an email attachment, and may still hold a copy.
  • Office Child Processes, Security Event 4688Not in the RegistryShows whether Word or Excel started another program, the sign a macro ran.
  • Zone.Identifier Stream on a Downloaded FileNot in the RegistryShows where the file was downloaded from, when it came from the internet.

Sources

The facts on this page come from these public pages, which say more on each point.