Macros use ZoneInfo NTFS hidden properties to determine the source of the document (local, trusted, internet, etc). I'm unsure of the default for local, but internet downloaded macros are prompt by default.
Group policy can be used to explicitly deny or globally permit. I believe there's also the ability to cryptographically sign macros if required.
Group policy can be used to explicitly deny or globally permit. I believe there's also the ability to cryptographically sign macros if required.