[unnouinceput]

All of the above means a poorly configured system. A correctly configured Windows system would not allow any of that to happen.

1- For network privileges you can restrict user to strict network location and nothing else.

2 - For scanning it also needs privileges that can be restricted using policies.

3 - Can't send anything if it doesn't have the correct privileges.

Who's stopping you to create your own version of VBA, release it and replace Microsoft Office suite with your own defined version as you said. And in the process of doing this you'll become billionaire too.

Until then, a correctly configured Windows system is immune to all of the above.

[dementiapatent]

I salute the IT team who keeps all of those security policies in place while not interfering with daily operations.

>Who's stopping you to create your own version of VBA, release it and replace Microsoft Office suite with your own defined version as you said.

I'm stopping myself because nobody would use it :)