Opening .exe Attachments with the Outlook E-mail Security Update

Short URL: http://slipstick.me/getexe

The Outlook E-Mail Security Update (included in Office 2000 Service Pack 2 and later versions) blocks access to .exe, .com and other "dangerous" files. See Attachment Security for a list of the affected file types. You cannot open these files from Outlook, nor can you use Outlook to save them to your system. If you try to forward a message containing an .exe file, Outlook does not include the attachment in the forwarded message.

With the rash of recent viruses using *.zip files to get past antivirus filters and bypass Outlook's attachment block, you may want to add the zip extension to the Level1Remove key to force users to save zips to their hard drive before opening or block access to zip files completely by adding zip to the Level1Add key.

So what do you do when you receive an .exe file and must find a way to open it? There are several methods, depending on your version of Outlook.

Recent Outlook Versions | Import to Outlook Express | Outlook Web Access | Tools | More Information

Recent Outlook Versions

1. Run Regedit, and go to this key:
   
   HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security (change 10.0 to 9.0 for Outlook 2000 SP3 or to 11.0 for Outlook 2003, 12.0 for Outlook 2007 )
2. Under that key, add a new string value named Level1Remove.
3. For the value for Level1Remove, enter a semicolon-delimited list of file extensions. For example, entering this:
   
   .mdb;.url
   
   would unblock Microsoft Access files and Internet shortcuts. Note that the use of a leading dot was not previously required, however, new security patches may require it. If you are using  "mdb;url" format and extensions are blocked, add a dot to each extension. Note also that there is not a space between extensions.

If you are using this registry entry, a glance at Help | About Microsoft Outlook will show Security Mode: User Controlled above the license information. See OL2002 You Cannot Open Attachments for more information on this registry entry.

To force users to save *.zip files to the hard drive before opening, add .zip to the extensions step 3. See How to configure Outlook to block additional attachment file name extensions for more information.

If you prefer not to edit the registry directly, you can use one of the tools below to make the change; not all support both Outlook 2002 and 2000.

After applying this registry fix or using one of the tools, the user still has to save the attached file to a system drive before opening it. In effect, the fix rolls the attachment behavior back to Outlook 2000 SR-1, with its included Attachment Security Fix. An end-user cannot bypass this "save to disk" behavior and open the file directly from the mail message, though an Exchange administrator can.

Import to Outlook Express

You can use either of the above methods to access .exe files from Outlook messages imported to OE. To make this process easier, consider creating a separate folder in Outlook to which you copy messages with attachments that you want to import. To import into OE, use OE's File | Import command.  

Outlook Web Access

Tools

Notes

We've heard of some other approaches:

However, these methods put Outlook into an unsupported, potentially unstable configuration, and we don't recommend them. In particular, the last two ensure that you do not get any of the Outlook in Office 2000 SP2.

More Information