> Source: [sk183710](https://support.checkpoint.com/results/sk/sk183710)

# sk183710 - File upload or download fails with "Documents with macro and code are prohibited" error, although CLI for macros and code is disabled

| Property | Value |
|----------|-------|
| Solution ID | sk183710 |
| Date Created | 2025-08-09 |
| Last Modified | 2025-08-19 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- The CLI parameter `unsafe_docs` is enabled, but CLI for macros and code is disabled. File upload or download fails with "Documents with macro and code are prohibited" error.

## Cause

There are two types of CLI settings related to macros, code, and unsafe documents:  

`unsafe_docs` -- This covers:  

* Macros and code
* Database queries
* Sensitive hyperlinks

Specific CLIs which control:   

* Macros and code
* Sensitive hyperlinks

When `unsafe_docs` is enabled, it overrides the individual CLI settings, rendering them ineffective---regardless of whether the individual settings for macros, code, or hyperlinks are enabled or disabled.

## Solution

The `te_file_analyzer` is a component of the Threat Emulation Blade which is responsible for analyzing files for potential threats before they are emulated in a sandbox environment. The `te_file_analyzer` acts as a pre-filter for files submitted to Threat Emulation, blocking or flagging files that are encrypted, contain macros, or have suspicious embedded content, thereby improving the overall security posture.   

We have a `tecli` CLI interface that allows users to configure which embedded content is allowed and which is blocked. This is a user-defined configuration that you can manually adjust to control the behavior regarding embedded document content.

If you want granular control over macros, code, or sensitive hyperlinks:

1. Disable `unsafe_docs`
2. Enable/disable individual CLI settings according to your specific needs.
3. If you do not want to block macros and code, turn off both `unsafe_docs` and the individual CLI settings. Run:  
   `tecli advanced analyzer prohibited unsafe_docs 0`  
   `tecli advanced analyzer prohibited macro 0`

**Related SKs**:

* [sk114806 - ATRG: Threat Emulation](https://support.checkpoint.com/results/sk/sk114806)
* [sk112312 - Threat Emulation File Analyzer](https://support.checkpoint.com/results/sk/sk112312)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content