The Outlook E-Mail Security Update (included in Office 2000 Service Pack 2 and later versions) blocks access to .exe, .com and other "dangerous" files. See Attachment Security for a list of the affected file types. You cannot open these files from Outlook, nor can you use Outlook to save them to your system. If you try to forward a message containing an .exe file, Outlook does not include the attachment in the forwarded message.
With the rash of recent viruses using *.zip files to get past antivirus filters and bypass Outlook's attachment block, you may want to add the zip extension to the Level1Remove key to force users to save zips to their hard drive before opening or block access to zip files completely by adding zip to the Level1Add key.
So what do you do when you receive an .exe file and must find a way to open it? There are several methods, depending on your version of Outlook.
Recent Outlook Versions | Import to Outlook Express | Outlook Web Access | Tools | More Information
Recent Outlook Versions
Outlook allows the user (or administrator) to use a registry key to open up access to blocked attachments. (Always make a backup before editing the registry.) To use this key:
- Run Regedit, and go to the appropriate key for your version of Outlook (see list below)
HKEY_CURRENT_USER\Software\Microsoft\Office\xx.0\Outlook\Security - Under that key, add a new string value named Level1Remove.
- For the value for Level1Remove, enter a semicolon-delimited list of file extensions. For example, entering this: .mdb;.url would unblock Microsoft Access files and Internet shortcuts. Note that the use of a leading dot was not previously required, however, new security patches may require it. If you are using "mdb;url" format and extensions are blocked, add a dot to each extension. Note also that there is no space between extensions.
Outlook 2016:
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
Outlook 2013:
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
Outlook 2010:
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
Outlook 2007:
HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
Outlook 2003:
HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
Outlook 2002:
HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
Outlook 2000 SP3:
HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Outlook\Security
String: Level1Remove
Value format: .mdb;.url;
If you are using this registry entry, a glance at Help | About Microsoft Outlook will show Security Mode: User Controlled above the license information.
To force users to save *.zip files to the hard drive before opening, add .zip to the extensions step 3. See Block Additional File Types in Outlook for more information.
If you prefer not to edit the registry directly, you can use one of the tools below to make the change; not all support both Outlook 2002 and 2000.
After applying this registry fix or using one of the tools, the user still has to save the attached file to a system drive before opening it. In effect, the fix rolls the attachment behavior back to Outlook 2000 SR-1, with its included Attachment Security Fix. An end-user cannot bypass this "save to disk" behavior and open the file directly from the mail message, though an Exchange administrator can.
Import to Outlook Express
The newest versions of Outlook Express block attachments by default. To retrieve attachments, click Forward and save the attachment from the message, then close. It can also be disabled in OE's Tools | Options | Security dialog.
You can use either of the above methods to access .exe files from Outlook messages imported to OE. To make this process easier, consider creating a separate folder in Outlook to which you copy messages with attachments that you want to import. To import into OE, use OE's File | Import command.
Outlook Web Access
If you work in a Microsoft Exchange Server environment where Outlook Web Access is deployed, you may be able to use OWA to open messages and get the attachments. Exchange Server 2000's OWA has no attachment security, while Exchange 2003 added attachment security to OWA.
Blocked File Types
Extension | File Type | Extension | File Type |
---|---|---|---|
.ade | Access Project Extension | .mdz | Access Wizard Template |
.adp | Access Project | .msc | Microsoft Management Console Control File |
.app | Executable Application | .msh | Microsoft Shell |
.asp | Active Server Page | .msh1 | Microsoft Shell |
.bas | BASIC Source Code | .msh2 | Microsoft Shell |
.bat | Batch Processing | .mshxml | Microsoft Shell |
.cer | Internet Security Certificate | .msh1xml | Microsoft Shell |
.chm | Compiled HTML Help | .msh2xml | Microsoft Shell |
.cmd | Command File | .msi | Windows Installer File |
.cnt | Microsoft Help Workshop | .msp | Windows Installer Update |
.com | Command | .mst | Windows SDK Transform Script |
.cpl | Windows Control Panel Extension | .ops | Office Profile Settings File |
.crt | Certificate File | .osd | Open Software Description |
.csh | csh Script | .pcd | Visual Test |
.der | DER Encoded X509 Certificate File | .pif | Windows Program Information File |
.exe | Executable File | .pl | Perl script |
.fxp | FoxPro Compiled Source | .plg | Developer Studio Build Log |
.gadget | Windows Vista gadget | .prf | Windows System File |
.grp | Microsoft program group | .prg | Program File |
.hlp | Windows Help File | .ps1 | Windows PowerShell |
.hpj | AppWizard Help project | .ps1xml | Windows PowerShell |
.hta | Hypertext Application | .ps2 | Windows PowerShell |
.inf | Information or Setup File | .ps2xml | Windows PowerShell |
.ins | IIS Internet Settings | .psc1 | Windows PowerShell |
.isp | IIS Internet Settings | .psc2 | Windows PowerShell |
.its | Internet Document Set, Internet Translation | .pst | Outlook Personal Folder File |
.jar | Java Archive | .reg | Registry Data File |
.jnlp | Java Network Launch Protocol | .scf | Windows Explorer Command |
.js | JavaScript Source Code | .scr | Windows Screen Saver |
.jse | JScript Encoded Script File | .sct | Windows Script Component, Foxpro Screen |
.ksh | UNIX Shell Script | .shb | Windows Shortcut into a Document |
.lnk | Windows Shortcut File | .shs | Shell Scrap Object File |
.mad | Access Module Shortcut | .tmp | Temporary File/Folder |
.maf | Access | .url | Internet Location |
.mag | Access Diagram Shortcut | .vb | VBScript File or Any Visual Basic Source |
.mam | Access Macro Shortcut | .vbe | VBScript Encoded Script File |
.maq | Access Query Shortcut | .vbp | Visual Basic project file |
.mar | Access Report Shortcut | .vbs | VBScript Script File |
.mas | Access Stored Procedures | .vsmacros | Visual Studio .NET Macro Project |
.mat | Access Table Shortcut | .vsw | Visio Workspace File |
.mau | Media Attachment Unit | .ws | Windows Script File |
.mav | Access View Shortcut | .wsc | Windows Script Component |
.maw | Access Data Access Page | .wsf | Windows Script File |
.mcf | Media Container Format | .wsh | Windows Script Host Settings File |
.mda | Access Add-in , MDA Access 2 Workgroup | .xbap | Browser applications |
.mdb | MDB Access Database | .xll | Excel add-in |
.mde | Access MDE Database File | .xnk | Exchange Public Folder Shortcut |
.mdt | Access Add-in Data | ||
.mdw | Access Workgroup Information | ||
I tried your solution to unblock PDF attachments in a customer's computer but it didn't work still getting Attachment security warning and the attachment is removed. They still use windows xp and outlook 2003..
Version wouldn't affect it, as long as you used the correct key for that version. (You might need to restart Outlook for it to take affect.)
Try one of the addins - such as this one - https://www.codetwo.com/freeware/attach-unblocker/ - they set the same key but eliminate possible typos. If it still doesn't work, what antivirus/security software do you use?
I tried your method of stopping outlook from blocking .com. Nothing even close. There must be many updates since your post. Thanks; God Bless you and yours.
The Level1Remove method still works. You are talking about files ending in the .com extension? You need to add .com to the Level1Remove value. Links to .com websites are lnk or url extension.
Love the site, thanks :)
With Outlook 2003 (SP3) I get 'Outlook blocked access to the following potentially unsafe attachments...". This happens with .pdf files which I generated myself and attached to outgoing mail. Incoming .pdf attachments are not affected and open with a click, just not my own. I attach my invoices and receipts as PDFs and would like to review them before sending, but the security prevents this.
I tried the standard Registry "fix" offered by Microsoft, but that just seemd to have the opposite effect.
Any suggestions on how to turn this security warning off in outgoing mail?
PDF's should not be blocked at all. Which registry fix did you try? Do not use Level1Add or Level1Remove keys. If you did, delete those keys.
I am unable to open any links in outlook it blocks everything says I have no access. What can I do to get this reversed. If I want to look at a job posting it will not let me access that job description
Is that the 'this operation has been cancelled due to restrictions in effect' error? If so, see Restrictions in Effect information - Edit Registry part 2 or Alan's solution work for most people.
This Help page doesn't help. I wanted to know how to prevent the "security concern" messages from popping up again and again---even after the items of concerrn have been disabled.? I have to cancel them each time I go into my email. How do youget rid of those things?
I'm not sure which dialog that is. Can you post the screenshot somewhere and post the url here or email me a screenshot? (diane at slipstick)