@b0l assuming you want this for office2016 the setting is going to be stored inside a SQLite database. The office team did some work to allow admins to force the macros setting to be enabled/disabled/prompt but changes aren’t going to be in CFPreferences (plist file that osquery can pick up easy). I might have time to poke at the SQLite db tmrw to see if it’s even easy to find that setting.