- block all Office documents with macros - don’t just block all doc files - mark some more Windows executable extensions as bad