Customizing Security Settings by Using the Outlook Security Template

You can modify default security settings for the Microsoft Office Outlook 2003 client by using the Outlook Security template, which you install as a form in Outlook. The template contains three tabs:

• Outlook Security Settings

• Programmatic Settings

• Trusted Code

Note

You specify a COM add-in as trusted by Outlook’s security features by using the Trusted Code tab in the Outlook Security template. Before you can use the Trusted Code tab, you must first install the Trusted Code Control on the computer you are using to modify the security settings. For more information, see “Installing the Outlook Trusted Code Control” earlier in this chapter.

When you first load the template, the settings are configured to enforce default security settings on the client.

Creating a public folder for the security settings

Before you begin to modify the security settings, you must create a public folder named “Outlook Security Settings” or “Outlook 10 Security Settings” on the public folder Microsoft Exchange Server. You create this folder by using one of those names exactly, in the root folder of the Public Folder tree. You must set the folder access control lists (ACLs) so all users can read all items in the folder. However, only those users for whom you want to create or change security settings should have permission to create, edit, or delete items in the folder.

If you want multiple users to be able to edit or create items, and if the list of users can change at any time, then you must create a security group that includes all users for whom you want to give permission to create or change security settings. This security group should have Owner permissions on the security folder.

After you create the folder, you can install the security settings template, then make the changes you need.

Installing the Outlook Security template

Before you can modify security settings by using the Outlook Security template, you must publish the template as a form in the special public folder you created.

To install the Outlook Security template

1. On a computer running Outlook, open OutlookSecurity.oft from the working directory where you installed the Outlook security tools.

2. When asked to select a folder, select the Outlook Security Settings or Outlook 10 Security Settings public folder that you created on the Exchange server, and then click the Open button.

   The template will open in Compose mode.

3. On the Tools menu of the template, point to Forms, and then click Publish Form.

   The folder selected should be your current folder: Outlook Security Settings or Outlook 10 Security Settings.

4. In the Form Name box, type Outlook Security Form.

   If you are currently using the security form from the e-mail security patch, and if you are publishing the form to the Outlook Security Settings folder, then in the Form Name box, type the same name as the previous security form (that is, you overwrite the previous security form).

5. Click the Publish button to publish the security template in the Security Settings folder.

   You can now close the Outlook Security template. Do not save when prompted to save while closing the template.

Publishing a new security form over a previous version

There are two versions of the Outlook security form. The first version was released with the Outlook 2000 SR-1 security patch. The second version is the Outlook security form that is shipped with later versions of Outlook, starting with Outlook 2002.

If you installed the security update for Outlook 2000, you may have an earlier version of the security form already published to the security folder. In this scenario, you should overwrite the older form with the new copy, using the same name and message class. This will install the new form in place of the old one in the security folder.

If there are other forms in the security folder, you will need to open the other forms in the security folder and close them by using the Close button to correctly register any changes.

Modifying the default security settings

You use one of the following procedures to modify the default security settings in Outlook and store the new settings configuration in the special public folder you created for saving the settings. You can choose to create a configuration for all Outlook users, or you can set up a configuration for a specific set of users.

To specify a default Outlook security setting for all users by using the Outlook Security template

1. In Microsoft Outlook, click the drop-down arrow next to New on the toolbar, and select the Choose Form command from the list.

2. Navigate to the template you created earlier (in the “Installing the Outlook Security template” section), then select the template by name and click Open.

3. Click Default Security Settings for All Users, and specify the security settings you want.

4. Scroll to the bottom of the template and click Close.

Alternatively, you may choose to create a group of customized security settings for a specific set of Outlook users.

To specify a group of custom security settings for a set of Outlook users by using the Outlook Security template

1. In Microsoft Outlook, click the drop-down arrow next to New on the toolbar, and select the Choose Form command from the list.

2. Navigate to the template you created earlier (in the “Installing the Outlook Security template” section), then select the template by name and click Open.

3. Click Security Settings for Exception Group, and then type a name in the Security Group Name box that describes the group.

4. In the Members box, type the name of each user who must have custom security settings.

   If the Exchange server you are running against is an Exchange 2000 or later server, then you can use distribution lists (only server-created security groups, not Outlook Contacts distribution lists) in the Members box. Otherwise, you cannot use distribution lists, and adding users from the Contacts Address Book is not supported.

5. Specify the settings you need and then click Close.

Note

For a security setting to apply to a user who is an administrator of the security settings public folder, the user (administrator) must be added to the member list of the security setting. It is not sufficient to have the administrator be a member of a distribution list that is listed in the member’s box of the setting. You must add each administrator’s name to the security setting. If you are using only a single default security group, then you do not need to add administrators’ names.

If a user’s name is entered as a member of more than one security group, the settings of the most recently created group will apply. Outlook looks for the first item that has the user’s name in the To field.

Details on all fields, values, and settings for the template can be found in “Outlook Security Template Settings” later in this chapter.

Ensuring that security settings are properly created

Every time a security setting is created or saved, the administrator will be prompted twice for credentials (when running on Exchange 2000 or later).

If no credentials are entered or if the wrong credentials are entered, an “Operation Failed” error message will appear. At this point, the security setting has been created but will not work correctly. The administrator must delete the security item and recreate it. If the item created is not deleted, then the item will be applied to everybody, including users to whom you did not intend to apply the item.

Editing security settings

If the administrator adds a user to the Members field of an existing security form, the administrator should make sure that all aliases already present in the form are current and active.

Note

If you add the alias of a new member to an existing security form, the change may not be correctly registered unless you make other changes to the form as well. For example, you might toggle another setting on and off, or otherwise activate the form through some interaction. After you have added the new alias and activated the form, you can choose Save from the File menu of the form to save your changes.