I wish to configure Excel 2003 in such a way that it will only run
macros and add-ins that have been signed by a trusted publisher and
permit only one authorised user to extend the list of trusted
publishers. To do this :
- I used Policies to set the Security option to "High" and
clear the "Trust all installed add-ins and templates" check box for
all users.
- I disabled menu options and shortcuts to the Security options
for all users except the authorised user.
- To ensure that only the authorised user can extend the list of
trusted publishers, I used the "Trusted Publishers" policy to set
"Allow the following users to select trusted publishers" to "Enterprise

administrators".

In order to test this, I created a macro and signed it using
Selfcert and used the authorised user to add the certificate to the
list of trusted publishers.

The result is that the authorised user is able to see the new
certificate in the list of trusted publishers, but the other users
can't, and hence they cannot run the macros signed by the trusted
publisher.
If, as an alternative, I set the "Trusted Publishers" policy so
that "Allow the following users to select trusted publishers" is "End
Users", then ALL users can see the trusted publishers, but they can ALL

extend the list, which breaks the requirement.

The original implementation is the preferred method. Any
suggestions as to what is wrong?

Thanks in anticipation.