Upgrading to Outlook 2003 Security | Microsoft Office 2003 Editions Resource Kit (Pro-Resource Kit)

If you are upgrading to Microsoft Office Outlook 2003 from a version earlier than Outlook 2000, Outlook 2003 triggers a security upgrade feature the first time a user attempts to read or send cryptographic e-mail messages. To upgrade from Outlook 97 or Microsoft Exchange Client to Outlook 2003 security, the user’s security file (EPF file) must exist on the computer, and the user must know the password. To upgrade from Outlook 98 security, the user must know the digital ID password. (Users upgrading from Outlook 2000 already have the updated security features.)

Note

Users create a security file by making a backup copy of their digital IDs. Backup files for Microsoft Exchange digital IDs have an .epf extension. Backup files for Internet e-mail digital IDs have a .pfx extension.

During the upgrade process, a digital ID name is generated for the security keys of each user, which includes one signing key and one encryption key. The user must select a password to associate with the digital ID name.

The Outlook 2003 upgrade feature attempts to save the security information in a secure-enhanced store. If the EPF file cannot be found, or the user cannot remember the password, the upgrade feature can be canceled.

If you are using Microsoft Exchange Advanced Security, you can recover the security keys (that is, enroll again in Exchange Advanced Security) by asking for a new security token from the administrator. The upgrade process must occur before you are enabled to send and receive cryptographic e-mail messages.

If you are using Microsoft Certificate Server, or a public certification authority such as VeriSign™, Inc., and you forget your password, the following restrictions occur:

You cannot gain access to your keys.
You cannot read encrypted e-mail messages previously sent to you.
You must re-enroll to get new digital IDs.

The following procedure describes how Outlook 2003 users can enroll in security by using Microsoft Exchange Key Management Server (KMS). Before you begin this procedure, contact the system administrator for a security token. The request for security enrollment uses this token.

To enroll in security or obtain a certificate using Microsoft Exchange KMS

On the Tools menu, click Options, and then click the Security tab.
Click Get a Digital ID, select Set up Security for me on the Exchange Server, and then click OK.
In the Digital ID name box, type the name you want to use; in the Token box, type your security token, and then click OK.

A message is sent to Microsoft Exchange KMS. After you receive a reply, Outlook 2003 attempts to store your security keys in the security-enhanced store.
Select a password for your digital ID.

You are prompted for the password every time you gain access to the keys. However, you can choose to have Outlook 2003 remember the password for a limited period of time.
Click OK to save your changes.
To add the certificate to the Root Store, click Yes.

The dialog box provides the required information about the certificate. If you click No, you experience problems when you attempt to read and send security-enhanced messages, and you must repeat the entire enrollment process.

The following procedure describes how Outlook 2003 users can enroll in security by using public certification authorities.

To enroll in security or obtain a certificate by using external certification authorities

On the Tools menu, click Options, and then click the Security tab.
Click Get a Digital ID, select Get a S/MIME certificate from an external Certification Authority, and then click OK.

A Microsoft Web page provides information about obtaining a certificate. The page lists a number of certification authorities.
Select the link to the certification authority that you want to use to obtain a certificate.

While your Web browser is storing your certificate and keys on your computer, you might be prompted to select the security level to associate with your keys.
When prompted, select a password for your digital ID.

You are prompted for the password every time you gain access to the keys. However, you can choose to have Outlook 2003 remember the password for a limited period of time.
To add this certificate to the Root Store, click Yes.

While storing the certificates, you might be prompted to save the root certificate. The dialog box provides the required information about the certificate. If you click No, you will experience problems when you attempt to read and send secure-enhanced messages. When you experience such problems, contact your certification authority to install another copy of the root certificate.

After the certificate and keys are installed, Outlook can access and use them.

Resources and related information

There are several options to choose from when you set up security for your Outlook 2003 users. For more information about Outlook security, see Chapter 11, “Administering Cryptography in Outlook 2003.”

You can configure security options to reduce the likelihood that your users will encounter viruses. For more information, see Chapter 12, “Customizing Outlook 2003 to Help Prevent Viruses.”