We encountered a problem where after applying the recent macro security patch, Word merge documents using an Access database via DDE as a data source and stored on a LAN drive couldn't find their data source. Happens with both Word 97 and Word 2000; don't know about XP.

I've figured this out...

The security patch in fact causes Word to use IE security settings when connecting to an Access mailmerge data source. I'm not sure exactly what setting it needs, but it's a setting thats "off" by default in the Internet Zone, but "on" by default in the Local Intranet Zone. Perhaps "Use ActiveX Controls not marked safe for scripting"?

Anyway, the key is that the LAN directory has to be considered part of the Local Intranet Zone. By default, Word stores network locations as UNCs, and with default IE security settings all UNC references are considered to be in the Local Intranet Zone. However, our company turns this off via an IE autoconfig file (we want all UNCs to be considered in the Internet Zone).

We were able to identify three workarounds :

1) Add our resource servers to the list of sites in the Local Intranet Zone

2) Disable Word's use of UNCs via Q171406. This forces Word to use drive letters - presumably drive letters are considered part of the Local Intranet or My Computer Zones - which makes things awkward if users are sharing a doc and don't all have the same drive letter mappings.

3) Use ODBC access method (non-default).

I've asked Microsoft to document this change to how Word works; we'll have to see if they do.