Outlook Folder Homepages are missing

In the Outlook update released on October 10 2017, the Folder Homepages setting was deprecated and removed to close a security vulnerability. Removing the folder home page capability "broke" a lot of applications, including Business Contact Manager and Dynamics CRM.

If the home page is in a non-default data file (such as a secondary mailbox), you'll need to set the NonDefaultStoreScript value too. See Folder Home Pages in Non-Default Data files for more information and a ready-to-use reg file.

The vulnerability

When an Exchange mailbox is compromised, e.g. by password spraying, an external attacker can use the Folder Homepage to gain remote code execution within the corporate network by setting the folder homepage to a malicious URL.

The folder homepage roams between clients, which means that an external attacker can set a folder homepage to an arbitrary URL, and then roam that into the Outlook client running within the corporate network.

More information on the exploit is here: Outlook Home Page – Another Ruler Vector

Missing folder Home page tab:

Restore Homepages in default folders

When the folder Home Page that you use is one of Outlook's default folders, it's recommended that you use WebView registry entries and use a URL that points to an internal website instead of an external website.

For example, if you wanted your Inbox to use a home page, add the following WebView registry key and set the URL string:

Outlook 2016

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\WebView\Inbox
String: URL
Value: http://url

Outlook 2013

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\WebView\Inbox
String: URL
Value: http://url

Outlook 2010

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\WebView\Inbox
String: URL
Value: http://url

Use the same format for the other default Outlook folders.

HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Calendar
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Contacts
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Deleted Items
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Drafts
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Journal
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Junk E-mail
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Notes
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Outbox
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\RSS
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Sent Mail
HKCU\Software\Microsoft\Office\nn.0\Outlook\WebView\Tasks

Administrators can use Office Administrator templates to set these keys using Group Policy.

Restore Homepages in non-default folders

If the folder home page is on a non-default folder (as most are), you'll need to set the EnableRoamingFolderHomepages value, which re-enables the original folder tab and rendering behavior, effectively turning off folder home page security.

Outlook 2016

HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Security 
DWORD: EnableRoamingFolderHomepages
Value: 1

Outlook 2013

HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Security 
DWORD: EnableRoamingFolderHomepages
Value: 1

Outlook 2010

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Security 
DWORD: EnableRoamingFolderHomepages
Value: 1

Do it for me

Outlook 2016 Outlook 2013 Outlook 2010

GPO Policy keys

Administrators can set the policy keys using a logon script or using GPO.
Outlook 2016

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\16.0\Outlook\Security
DWORD: EnableRoamingFolderHomepages
Value: 1

Outlook 2013

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\15.0\Outlook\Security
DWORD: EnableRoamingFolderHomepages
Value: 1

Outlook 2010

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Office\14.0\Outlook\Security
DWORD: EnableRoamingFolderHomepages
Value: 1

Outlook 2016 Policies Outlook 2013 Policies
Outlook 2010 Policies