لطفا منتظر باشید ...
Setting Consistent Outlook Cryptography Options for an Organization
You can control many aspects of Microsoft Office Outlook 2003 cryptography features to help configure more secure messaging and message encryption for your organization’s needs. To help control these features, you specify settings in the Windows registry or through policies. For example, you can set a policy to require a security label on all outgoing mail or a policy to disable publishing to the Global Address List.| Note | A number of Outlook cryptography registry settings have an equivalent setting on the Security tab in the Options dialog box (Tools menu) or other user setting. However, setting the value in the user interface does not create or set the equivalent setting in the Windows registry. You can use the Windows registry to change these settings. |
The settings described in this chapter are not related to virus prevention. Virus prevention settings include options for trusted code or changes to the default list of e-mail attachment types that cannot be received or opened by your users. To find out more about configuring virus prevention features, see Chapter 12, “Customizing Outlook 2003 to Help Prevent Viruses.”
| Tip | You can use group policies to set security levels in Outlook. In Group Policy, set the Required Certificate Authority, Minimum encryption settings, S/MIME interoperability with external clients, and Outlook Rich Text in S/MIME messages policies under Microsoft Office Outlook 2003\Tools | Options\Security\Cryptography. For more information about using Group Policy to lock down Microsoft Office 2003 settings, see “Managing Users’ Configurations by Policy” in Chapter 18, “Updating Users’ Office 2003 Configurations.” |
Corresponding user interface options for Outlook security policies
Some of the security policies listed in this chapter correspond to user interface buttons or settings on user interface dialogs. This section lists the policies that correspond to these buttons or to options on one or more of these dialogs, grouped by the user interface button or dialog. Some policies affect settings in more than one area and appear on multiple lists.For information about setting the policies, see the sections that follow this one. The specific setting that is affected by a policy is included for many policies in the “Corresponding UI option” column of the tables of policy settings.Policies that affect settings on the Tools | Options | Security dialog:
AlwaysEncrypt
AlwaysSign
ClearSign
RequestSecurityEnhancedReceipt
PublishtoGalDisabled
EnrollPageURLPolicies that affect settings on the Tools | Options | Security | Settings dialog:
FIPSMode
MinEncKey (restricts encryption algorithms available to users)Policies that affect settings on the Tools | Options | Security | Settings | Security labels dialog:
ForceSecurityLabel
ForceSecurityLabelX
Policies that affect settings on the Options | Security | Settings dialog in a new e-mail message:
AlwaysEncrypt
AlwaysSign
ClearSign
RequestSecureReceipt
ForceSecurityLabel
ForceSecurityLabelXPolicies that affect the toolbar buttons for encrypting and signing e-mail messages:
AlwaysEncrypt
AlwaysSign
Outlook security policies
The following table lists the Windows registry settings in the Policies tree that you can configure for your custom installation. You add these value entries in the following subkey:HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\10.0\Outlook \Security
When you specify a value for PromoteErrorsAsWarnings, note that potential Error Level 2 conditions include the following:
Unknown Signature Algorithm
No Signing Certification Found
Bad Attribute Sets
No Issuer Certificate Found
No CRL Found
Out of Date CRL
Root Trust Problem
Out of Date CTL
When you specify a value for EnrollPageURL, use the following parameters to send information about the user to the enrollment Web page.
Parameter | Placeholder in URL string |
|---|---|
User display name | %1 |
SMTP e-mail name | %2 |
User interface language ID | %3 |
For example, to send user information to the Microsoft enrollment Web page, set the EnrollPageURL entry to the following value, including the parameters:www.microsoft.com/ie/certpage?name=%1&email=%2&helplcid=%3
If the user’s name is Jeff Smith, his e-mail address is someone@example.com, and his user interface language ID is 1033, then the placeholders are resolved as follows:www.microsoft.com/ie/certpage?name=Jeff%20Smith&email=someone@example.com&helplcid=1033
Security policies for general cryptography
The following table lists additional Windows registry settings that you can use for your custom configuration. These settings are contained in the following subkey:HKEY_CURRENT_USER\Software\Microsoft\Cryptography\SMIME\SecurityPolicies\Default
Value name | Value data (Data type) | Description | Correspond-ing UI option |
|---|---|---|---|
ShowWithMultiLabels | 0, 1, (DWORD) | Set to 0 to attempt to display a message when the signature layer has different labels set in different signatures. | None |
Set to 1 to prevent display of message. | |||
Default is 0. | |||
CertErrorWithLabel | 0, 1, 2 (DWORD) | Set to 0 to process a message with a certificate error when the message has a label. | None |
Set to 1 to deny access to a message with a certificate error. | |||
Set to 2 to ignore the message label and grant access to the message. (The user still sees a certificate error.) | |||
Default is 0. |
Security policies for KMS-issued certificates
The values below only apply to KMS-issued certificates. The following table lists additional Windows registry settings that you can use for your custom configuration. These settings are contained in the following subkey:HKEY_CURRENT_USER\Software\Microsoft\Cryptography\Defaults\Provider
Value name | Value data(Data type) | Description | Corresponding UI option |
|---|---|---|---|
MaxPWDTime | 0, number (DWORD) | Set to 0 to remove user’s ability to save a password (user is required to enter a password each time a key set is required). | None |
Set to a positive number to specify a maximum password time in minutes. | |||
Default is 999. | |||
DefPWDTime | Number (DWORD) | Set to the default value for the amount of time a password is saved. | None |
