Exchange Messaging Outlook
Volume 5, Number 4

As expected, last week Microsoft released a patch for Outlook 98 and Outlook 2000 (with Office 2000 Service Release 1/1a) that disables many of the features that allowed VBS/Loveletter and similar viruses to spread so quickly. Our page at http://www.slipstick.com/outlook/esecup.htm lists the different types of protection included, the files affected and all the resources you need to evaluate whether this update is right for you.

The new patch makes it impossible to open, save or forward program files in Outlook -- including .exe files and VBScript .vbs files like those that spread Loveletter. This optional patch is also aimed at making it more difficult for a virus to use Outlook to transmit itself via e-mail. The "object model guard" (as Microsoft calls it) feature of the patch means that some Outlook features will no longer function at all. In other cases, a user will need to authorize access by outside programs, including tools for synchronizing with PDAs such as the Palm or Windows CE devices or with web sites. We are maintaining a list of affected applications at http://www.slipstick.com/outlook/esecup/apps.htm and welcome your comments or additions to the list. You can click here to send us your information.

Should you install this update? Never install any patch without reading all the information available about it. This goes double for this update, which has the potential to cripple Outlook add-ins and radically change normal Outlook functions. Our general recommendations:

• If you are a normal standalone user and don't automate Outlook with code, this patch may be a good tradeoff between additional security and the inconvenience you might suffer in having to click the warning when you synchronize with a PDA.

• If you are a power user who automates Outlook with code or installs various Outlook add-ins, do not install this patch until you evaluate its possible effects on your add-ins and code. Chances are that the protection is not worth the annoyance. Instead, you may want to follow our general recommendations on protecting Microsoft Outlook against viruses at http://www.slipstick.com/outlook/antivirus.htm.

• If you are responsible for administering Outlook in an Exchange Server environment, take a look at the customization features described below. They are extensive and flexible, but may not scale well.

• If you are responsible for administering Outlook for use with other enterprise mail systems, wait a while. Microsoft has provided information to Lotus, HP and Novell Groupwise that they can develop administrative tools comparable to those provided by Microsoft for Exchange Server.

In Microsoft Exchange Server environments, administrators can customize the Outlook 98/2000 E-mail Security Update by installing a special Outlook custom form in an Outlook Security Settings public folder, using that form to configure security options for individuals and groups, and setting a registry entry on client workstations. Download the Admpack.exe file from http://www.microsoft.com/office/ork/2000/appndx/toolbox.htm#secupd to get a self-extracting file with the form, detailed instructions, and a new policy file for Outlook 2000. Additional details are available at http://www.microsoft.com/Office/ORK/2000/journ/outsecupdate.htm.

In our tests, this technique worked very well, even for offline users. After installing the Outlook E-mail Security Update and updating the registry, offline users simply need to synchronize twice. They do not need to start Outlook in a full online session with the server. This, by the way, is a brilliant deployment strategy that we'd like to see extended so that administrators can make any public folder available to offline users without the need for a full online session.

Keep in mind that there are some potential limitations to this customization technique:

• It may not scale well. Microsoft specifically says that it is not suitable for managing large numbers of users.

• You cannot use distribution lists to manage security groups. You must enter individual mailboxes on the forms. In fact, you must type the names in, since the custom form does not offer a button to display the Address Book. TIP: Open a regular Outlook message, and use its To button to select mailboxes from the GAL. Then copy and paste the list of mailboxes into the Outlook Security form.

• If you include a mailbox in more than one security group, Outlook will use the settings from the group that was modified most recently. It does not check all items in the Outlook Security Settings folder and try to resolve any discrepancies between the settings for two different groups. This means that you must plan your security groups very carefully.