Security with Windows 2000

Outlook® Service Release 1 provides several new security features when used with Microsoft Windows® 2000.

  • You do not have to configure settings for security profiles because they are automatically configured for you.

  • You can add to the Global Address List your default encryption certificate, so you can easily exchange encrypted e-mail within your organization.

  • You can send secure receipt requests with messages to check that your digital signature is recognized by the recipient.

  • You can add security labels to your messages, subject to the controls on secure messages that are defined by the security policy modules your administrator has set.


About secure receipt requests

Use secure receipt requests to check that your digital signature is being validated by recipients. When you send a message with a secure return receipt request, a notification is returned to your Inbox when the signature on the message is verified by the recipient's security system. This lets you know that your digital signature is trusted by the recipient's security system. If the signature is not verified, you will not receive a return receipt, in which case you might want to contact the recipient. If the signature is verified and the message is saved, but not read, you will still receive a secure receipt. Secure receipt notifications are always returned to your Inbox regardless of where your regular return receipts are sent.

How to send a message with a secure receipt request.


About security labels

A security label lets you add to the message's header information about the sensitivity of the message's content. A security label may also restrict which recipients can open, forward, or send a specific message. The use of security labels in your organization is controlled by one or more security policies, details of which will come from your administrator. For example, the security label Top Secret may be applied to e-mail that cannot be sent outside your company.

How to use security labels.


Add a certificate to the Global Address List

  1. On the Tools menu, click Options, and then click the Security tab.

  2. Click Publish to GAL.

Note Outlook adds the certificate used for your default security settings to the Global Address List. When you want to replace your certificate in the Global Address List, such as when it expires, replace the certificate on your computer, and then when you add your certificate again by using the steps above, the new certificate will replace the old one in the Global Address List.


Create a security label for a message

  1. Open a new message.

  2. On the File menu, click Properties, and then click the Security tab.

  3. Click the Add digital signature to message check box.

  4. Click a policy module.

  5. Click a classification.

  6. Enter a privacy mark.

    Whether you can enter a privacy mark or classification depends on the settings of your policy module.

  7. If it is available, click the Configure button to choose any advanced settings you want.

Tip To create a security label for every message you send, on the Tools menu, click Options, and then click the Security tab. Click Settings, click Security Labels, and then follow steps 4 through 6 above.

Learn more about security labels.


Send a message with a secure receipt request

  1. Open a message.

  2. On the File menu, click Properties, and then click the Security tab.

  3. Select the Add digital signature to message check box.

  4. Select the Request secure receipt for this message check box.

Tip To request a secure receipt for every message you send, on the Tools menu, click Options, and then click the Security tab. Select the Request secure receipts for all S/MIME signed messages check box.

Learn more about secure receipt requests.


Send a digitally signed message to recipients who don't use S/MIME security

  1. Open a new message.

  2. On the File menu, click Properties, and then click the Security tab.

  3. Select the Add digital signature to message check box.

  4. Select the Send message as clear text signed check box.

Tip To send every message as clear text signed, on the Tools menu, click Options, and then click the Security tab. Select the Send message as clear text signed check box.


I can't open a secure message that was sent to me.

When a secure e-mail message does not open properly, a message appears describing the problem.

  • You may have to change the trust level for the sender. In the message that appears, click Edit Trust, and then click Explicitly trust this certificate.

  • The sender's certificate may have expired. In the message that appears, click Details, (if available) and then click View Certificate. Check the Valid from end date.

  • Your certificate may have expired or have been removed. If your certificate has expired, has been removed from your system, or has become invalid, you will not be able to open encrypted e-mail that is sent to you. If you receive the message: “Can’t open this item. Your digital ID name cannot be found in the underlying security system”, you will not be able to open the e-mail message. You must renew your certificate, and the sender must get a new copy of your certificate and resend the message.

  • The security policy module you are using may have settings that deny you access to the message. Contact your administrator.


I receive an error message when trying to send secure mail

I receive an error message when I try to send secure e-mail.

If you receive the message: “The Security Policy you selected does not allow one of the certificates in this security profile to be used” it means the certificate in your default security settings has expired or has otherwise become invalid, or your security policy does not accept your certificate. If you have set your security options to use labels on every message you send, the automatic configuration available with Outlook® Service Release 1 will not automatically notify you that your certificate has become invalid. To ensure that the automatic configuration notifies you of problems with your default certificates, on the Tools menu, click Options, and then click the Security tab. Click Settings, and then click Security Labels. In the Policy module list, click None. If your security system does not allow you to choose None, contact your administrator to get the correct certificates for your system.

If you receive the message: “Microsoft Outlook had problems encrypting this message because the following recipients had missing or invalid certificates, or conflicting or unsupported encryption capabilities" the most common cause is that you tried to send encrypted e-mail without having a copy of a valid certificate for the recipient. If you have multiple contacts for the recipient, you must send e-mail using the contact that has the certificate.


I sent a message with a secure receipt request but received no return receipt.

A secure receipt is not returned if:

  • The recipient does not have Outlook® Service Release 1 and Windows® 2000 security installed.

  • Your signature on the message is not verified by the recipient's security system. This happens if the certificate is not trusted.

  • The recipient may have chosen not to send receipts when requested.


My security label settings have disappeared from Outlook.

You have changed your default security setting from S/MIME to Exchange Server Security. Security labels, clear text signed messages, and secure receipt requests require that S/MIME be your default security format. On the Tools menu, click Options and then click the Security tab. Click the Settings button. In the Secure message Format list, click S/MIME.


Why are the security label settings unavailable?

  • You must have a security policy module installed. Contact your administrator.

  • You must digitally sign the message. In the message, on the File menu, click Properties, and then click the Security tab. Click the Add digital signature to message check box.

  • If the privacy mark, classification, or other settings are not available, it may be because of settings specific to the policy module. Contact your administrator.

  • You must be using S/MIME as your default security format. To change your default security format, on the Tools menu, click Options and then click the Security tab. Click the Settings button. In the Secure message format list, click S/MIME.


Why can't I publish my certificates to the Global Address List?

  • Your server may be unavailable. Send a test message addressed to yourself to see if your server is working.

  • You may not have permission to write to the Global Address List. Contact your administrator.

  • The security policy you are using may not allow the Publish to GAL button to appear. If the button is unavailable, contact your administrator.


Why can't I send a secure receipt request?

You must have a valid security profile, including a valid certificate, to send a secure receipt request. To get a valid certificate, on the Tools menu, click Options, and then click the Security tab. Click Get a Digital ID, and then follow the instructions. When you receive your certificate, on the Security tab of the Options dialog box (Tools menu, Options command), click Settings to automatically configure your security profile.

Note If you are using the Internet Only configuration of Outlook, a secure receipt request is not sent until you click the Send/Receive button on the Outlook toolbar.


Why can't the recipient of my labeled message open the message?

  • Security labels appear only on messages sent and received by users who have Outlook® Service Release 1 and Windows® 2000 security installed. If you send a message with a security label to a recipient who has Windows 2000 installed, but not Outlook Service Release 1 or the security labels feature, they will not be able to open the message.

  • If recipients do not have the appropriate policy module, they may not be able to open the message.

  • The policy module settings may deny access for certain recipients. Contact your administrator.


Troubleshooting Windows 2000 security

Why are the security label settings unavailable?

Why can’t the recipient of my labeled message open the message?

Why can’t I publish my certificates to the Global Address List?

I can’t open a secure message that was sent to me.

Why can’t I send a secure receipt request?

I sent a message with a secure receipt request but received no return receipt.

I receive an error message when I try to send secure e-mail.

My security label settings have disappeared from Outlook.