Deny_MOTW_Files.ps1

#run as Administrator, copy/paste the below 

# Mount HKU  
mount -PSProvider Registry -Name HKU -Root HKEY_USERS;

# Loop through each HKU/user's HKCU, loop though each Office version and application, and implement defences
(gci -path "HKU:\*\Software\Microsoft\Office\*\*\Security\").PsPath | 
Foreach-Object {Set-ItemProperty -path $_ -name "blockcontentexecutionfrominternet" -value 1 -Type DWord -verbose}