Relaxing Outlook 2002 Attachment Security

Microsoft Outlook 2002's built-in attachment blocking prevents users from seeing or opening many valid attachments. Can I restore the functionality users had under Outlook 2000?

Over the past few years, Microsoft has increased Outlook security by restricting access to attached programs and file types that might contain viruses, Trojan horses, or similar threats. Outlook 2000 and some versions of Outlook 98 support optional security patches that you can install to implement these restrictions, but Microsoft Office Outlook 2003 and Outlook 2002 implement the restrictions by default. This increased attachment security is a boon for some organizations, but for others it impedes email functionality and generates high volumes of Help desk calls from frustrated users. To determine whether Outlook attachment security is enabled on a client system, select Help, About Microsoft Outlook from Outlook's menu bar. Any version of Outlook 2003 or Outlook 2002, Outlook 2000 version 9.0.0.4201 or later, or Outlook 98 version 8.5.7806 or later enables attachment-security measures.

Outlook 2002 classifies attachments as Level 1 or Level 2. The client blocks Level 1 attachments; Level 2 attachments trigger a warning and a prompt for the user to decide whether to open the attachment. (For more information about these attachment levels, see http://www.slipstick.com/outlook/esecup.htm#attsec.) You can modify the registry on your client systems to relax the security for Level 1 attachments by redefining them as Level 2 attachments. You must make the registry change manually or by using a script, Group Policy, or third-party utility; Microsoft provides no GUI-based Outlook option for changing the settings. The process involves adding and editing the Level1Remove string value in the HKEY_CURRENT_USERSoftwareMicrosoftOffice10.0OutlookSecurity registry subkey. (For complete instructions, see the Microsoft article "OL2002: You Cannot Open Attachments" at http://support.microsoft.com/?kbid=290497.)

If your organization runs Microsoft Exchange Server, your Exchange administrator can create a form that centrally defines attachment-security settings for all users (including Outlook 2000 and Outlook 98 clients), then publish the form to a special public folder. To implement this method, you need to download and install Microsoft's Outlook Security Features Administrative Package (admpack.exe) from http://www.microsoft.com/office/ork/xp/appndx/appa11.htm (the utility is also part of the Microsoft Office XP Resource Kit). For details about using admpack.exe to control Outlook attachment security, refer to the utility's Help files or see SlipStick Systems' "Administrative Options for the Outlook E-mail Security Update" (http://www.slipstick.com/outlook/esecup/admin.htm).

To relax Outlook attachment security on client machines, I highly recommend Slovak Technical Services' Attachment Options, a free GUI-based add-on utility, which Figure 1, page 92, shows. You can download the utility at http://www.slovaktech.com/attachmentoptions.htm. Be aware, however, that if you install this utility on a user's system, you have no way to prevent the user from resetting the attachment options. WinGuides' Tweak Manager is a similar utility that also provides a wealth of OS and desktop tweaks.

I recommend that you be as conservative as possible when modifying attachment security because of the inherent risk that permitted files might contain viruses or other rogue programs. If you choose to relax Outlook 2002's security measures, be certain to install an antivirus utility that automatically updates itself often. Also remind users to open only expected attachments from known sources—especially if you permit any scripting file types, which often slip by antivirus utilities and can erase data without warning.