Topics in this chapter   Understanding System Policies     How to Set System Policies     Office System Policies     Working with Difficult Policies

Working with Difficult Policies

System policies can be difficult to set if you do not know what the policy requires as input parameters, or if you cannot find the input data you need. Furthermore, some policies are confusing. Setting some system policies requires an understanding of the feature the policy controls, what allowable settings can be changed, and how a change will affect an application or feature. Some of the more complex policies are discussed in this section.

Setting a simple policy

In order to understand how to set complex policies, it might be helpful to review setting simple policies. Policies for Microsoft Word and Microsoft PowerPoint are used in this section.

As a form of shortcut notation, the following registry nodes are abbreviated.

HKEY_LOCAL_MACHINE to HKLM

HKEY_CURRENT_USER to HKCU

Note   Consult the Group Policy snap-in Help for information on how to set and enforce policies on Microsoft Windows 2000 operating systems. The processes of setting and enforcing policies using either the Group Policy snap-in or the System Policy Editor are very similar; however, there are differences in how the policy file is postured for use. Search for Active Directory in the Group Policy snap-in Help for enabling the Registry.pol files.

Allow background saves in Word

In Word, you can determine whether or not files can be saved in the background (automatically) while a user is working. If you want to enable this feature through a policy, you can enforce the Allow background saves policy.

To configure a policy to allow background saves in Word

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Double-click the Default User policy profile icon.
   
   
4. Expand the Microsoft Word 2002 node (click the plus (+) sign or double-click Microsoft Word 2002).
   
   
5. Expand the Tools | Options… node.
   
   
6. Expand the Save node.
   
   
7. Set the Allow background saves check box to checked.
   
   
8. In the Settings for Allow background saves work area, set the Check to enforce setting on; uncheck to enforce setting off check box to checked.

If you create this policy and place it on your domain controller, when users log on to the network the logon process will automatically enforce the settings found in the policy file to their computer. It will use the information in the policy file to create the following string registry entry on users’ computers:

HKCU\Software\Policies\Microsoft\Office\10.0\Word\Options

Value name: BackgroundSave

Data type = REG_SZ (string)

Value data = "0" | "1"

When Word starts, it examines this registry setting and checks to see if there is a value present. If the entry is "1", it sets background saves to on.

Changes to some policy settings may cause an update to the Normal.dot template if they are persistent or are related to application settings stored in the template.

Control the recently used file list in PowerPoint

In PowerPoint, you can control whether the user sees a list of recently used documents on the File menu and how many file names to display in the list. This list is technically referred to as the MRU — Most Recently Used file list. The following procedure shows how to configure a system policy to display five recently used files for all users in this list.

To configure a policy for the recently used file list in PowerPoint

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Double-click the Default User policy profile icon.
   
   
4. Expand the Microsoft PowerPoint 2002 node (click the plus (+) sign or double-click Microsoft PowerPoint 2002).
   
   
5. Expand the Tools | Options node.
   
   
6. Expand the General node.
   
   
7. Set the Recently used file list check box to checked.
   
   
8. In the Settings for Recently used file list work area, set the Enable recently used file list check box to checked.
   
   
9. In the Size of recently used file list text box, select 5.

When you save and distribute this policy, all of your PowerPoint users will see a recently used file list of five files on the File menu.

If you create this policy and place it on your domain controller, and users log on to the network, their logon process will automatically enforce the settings found in the policy file to their computers. It will use the information in the policy file to create the following two DWORD registry entries on users’ computers:

HKCU\Software\Policies\Microsoft\Office\10.0\PowerPoint\Options

Value name: MRUListActive

Data type: REG_DWORD (DWORD)

Value data: 0 | 1

HKCU\Software\Policies\Microsoft\Office\10.0\PowerPoint\Options

Value name: SizeOfMRUList

Data type: REG_DWORD (DWORD)

Value data: 0 - 9

When PowerPoint starts, it examines these registry settings and checks to see if there are values present. If the MRUListActive entry is 1, it instructs PowerPoint to use the next SizeOfMRUList registry entry. The SizeOfMRUList can use a maximum value of 9 in the value entry.

Setting difficult policies

Some policies are difficult to set, requiring information that is not easy to find. For instance, you can disable any built-in or custom item on a menu or a toolbar. Some policy settings allow you to disable both the menu command and the corresponding toolbar button at the same time. The toolbars and menu commands that come with Microsoft Office applications “out of the box” are considered predefined. Any menus or commands you add after Office is installed are referred to as custom.

Disable a predefined menu command and toolbar button

Several predefined menu commands and toolbar buttons are available in the Predefined category of many Office application ADM templates. Predefined menu commands and toolbar buttons are considered to be the ones shipping with each application "out of the box". Those menu commands and toolbar buttons created by users or developers and added to the user interface of an Office application through the Tools | Customize dialog are considered custom.

To disable a predefined menu command and toolbar button with a policy

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Double-click the Default User policy profile icon.
   
   
4. Expand the Office application node (click the plus (+) sign or double-click the application name) that has the item you want to disable.
   
   
5. Expand the Disable items in user interface node.
   
   
6. Expand the Predefined node.
   
   
7. Set the Disable command bar buttons and menu items check box to checked.
   
   
8. In the Settings for Disable command bar buttons and menu items work area, set the check box for the menu command you want to enforce a policy setting for, to checked.

For example, to disable the Hyperlink command (Insert menu) and the Insert Hyperlink button (Standard toolbar) in Microsoft Excel, set the Insert | Hyperlink check box to checked.

If you create this policy and place it on your domain controller and users log on to the network, their logon process will automatically enforce the settings found in the policy file on their computers. It will use the information in the policy file to create the following string registry entry on users’ computers:

HKCU\Software\Policies\Microsoft\Office\10.0\Excel\DisabledCmdBarItemsCheckBoxes

Value name: InsertHyperlink

Data type: REG_SZ (string)

Value data: "<control ID>"

When Excel starts, it examines this registry setting and checks to see if there is a value present. If the entry is “1576”, it turns the Hyperlink menu command off. If the value is later changed to “0”, it turns the menu command back on. Actually, you can use any value name in this registry key and supply an appropriate control ID, and it will turn off the menu command.

Disable a custom menu command and toolbar button

In the following example, you will need to know the control ID of the menu command or toolbar button you want to disable. If you do not have access to the documentation that supplies the control IDs, you can run the example programs listed later in this topic to help you find the information if it is in the Word or Excel applications. In many cases, predefined menu commands across Office applications share the same control ID; therefore, you can try to turn off a menu command using the same control ID as found in another application if you are unable to find the control ID using the example programs listed later in this topic.

You can disable custom menu commands and toolbar buttons, even if they are not defined within a policy template. If you have the control ID, you can remove any menu command or toolbar within the application.

To disable a custom menu command and toolbar button with a policy

1. Start the System Policy Editor.
   
   
2. Create a new policy file or open an existing policy file.
   
   
3. Double-click the Default User policy profile icon.
   
   
4. Expand the Office application node (click the plus (+) sign or double-click the application name) that contains the item for which you want to configure a policy.
   
   
5. Expand the Disable items in user interface node.
   
   
6. Expand the Custom node.
   
   
7. Set the Disable command bar buttons and menu items check box to checked.
   
   
8. In the Settings for command bar buttons and menu items work area, click Show.
   
   
9. In the Show Contents box, click Add.
   
   
10. In the Add Item box, enter the control ID for the menu and toolbar item.

If you create this policy and place it on your domain controller, and users log on to the network, their logon process will automatically enforce the settings found in the policy file to their computer. It will use the information in the policy file to create the following string registry entry on the user’s computer:

HKCU\Software\Policies\Microsoft\Office\10.0\Excel\DisabledCmdBarItemsList

Value name: TCIDx

Data type: REG_SZ (string)

Value data: "<control ID>"

When Excel starts, it examines this registry setting and checks to see if there are values present. If the entry is “3”, it turns the Save menu command off. If the value is later removed from the list, it turns the Save menu command back on.

This is a unique registry entry because it is a list of TCIDx entries. The x is incremented by 1 for each entry added to the list. Examples of possible TCIDx entries in the registry are:

TCID1 = "3"
TCID2 = "748"
TCID3 = "20"
TCID4 = "21"

Control IDs for menu commands and toolbar buttons

You can look up control IDs for any item on a menu or toolbar in Microsoft Office XP applications where the CommandBars collection is available by using Visual Basic for Applications (VBA). Supplying the control ID in a specific policy entry allows you to disable that menu command and toolbar button. You can either look up a single control ID or use a macro to find a series of control IDs.

Note   Menu commands and their corresponding toolbar buttons share the same control ID. For example, the control ID for both the Save command (File menu) and the Save button (Standard toolbar) in Microsoft Word is 3.

Finding a single control ID

You can use the Immediate window in VBA to look up the control ID for a single item on a menu if you know the name of the command bar it is on, the name of the control, and if necessary, the name of the sub control (if one exists). For example, the following command prints the control ID for the Save As command (File menu) to the Immediate window (directly below the command you enter). Start Microsoft Word, select Tools, select Macros, then select Visual Basic Editor. Enter the following command in the Immediate Window and press enter.

Example Code #1

? commandbars("menu bar").controls("file").controls("save as...").id

Note   For Microsoft Excel, use “worksheet menu bar” instead of “menu bar” in the previous command.

Example Code #2

Use the following code to find the names of all the command bars in any Office application (replace the MsgBox with Print to obtain a list of names):

For Each cbar In Application.CommandBars
MsgBox cbar.Name
Next

Example Code #3

Use the following code to find all the control captions and control IDs for controls on the “menu bar” in Word. Replace "menu bar" with any of the CommandBar names returned in the example code provided in example #2:

For Each ccntrl In Application.CommandBars("menu bar").Controls
MsgBox ccntrl.Caption & " = " & ccntrl.ID
Next

Example Code #4

Use the following code to find all the control captions and control IDs for sub-controls on the “menu bar — file” control in Word. Replace "menu bar" with any of the command-bar names returned in the example code provided in example #2 and the related control captions provided in the example code provided in example #3:

For Each csubcntrl In Application.CommandBars("menu bar") _
.Controls("file").Controls
msgbox csubcntrl.Caption & " = " & csubcntrl.ID
Next

Example Code #5

If you want to find the control IDs for all the items on a menu or toolbar, you can create a macro in VBA. For example, the following macro opens a series of message boxes to display the commands and corresponding control IDs for each item on the File menu for any Office XP application:

Sub EnumerateControls()
   Dim icbc As Integer
   Dim cbcs As CommandBarControls

Set cbcs = Application.CommandBars("Menu bar") _
.Controls("File").Controls
   For icbc = 1 To cbcs.Count
     MsgBox cbcs(icbc).Caption & " = " & cbcs(icbc).ID
   Next icbc
End Sub

Example Code #6

Based on all the previous code examples, the following code provides a Word document with all the possible command-bar names, controls within the command bar, all sub-controls and their control IDs for Microsoft Word:

Sub ListControls()
For Each cb In Application.CommandBars
Selection.TypeText Text:=cb.Name
Selection.TypeParagraph
For Each cntl In Application.CommandBars(cb.Name).Controls
Selection.TypeText Text:=vbTab & cntl.Caption
Selection.TypeParagraph
On Error GoTo ErrJump1:
For Each subcntl In Application.CommandBars(cb.Name) _
.Controls(cntl.Caption).Controls
Selection.TypeText Text:=vbTab & vbTab & subcntl.Caption & _
" = " & subcntl.ID
Selection.TypeParagraph
Next
PastError:
Next
Next

GoTo bypass:
ErrJump1:
Selection.TypeBackspace
Selection.TypeText Text:=" = " & cntl.ID
Selection.TypeParagraph
Resume PastError:
bypass:
End Sub

Example Code #7

Here is the example code from #6 modified to work with Excel:

Sub ListControls()
Dim icbs As Integer
icbs = 1

Columns("A:A").ColumnWidth = 18
Columns("B:B").ColumnWidth = 21
Columns("C:C").ColumnWidth = 23

Range("A1").Select
ActiveCell.FormulaR1C1 = "Command Bar"
Range("B1").Select
ActiveCell.FormulaR1C1 = "Control caption"
Range("C1").Select
ActiveCell.FormulaR1C1 = "Control caption or ID"
Range("D1").Select
ActiveCell.FormulaR1C1 = "Control ID"

Rows("2:2").Select
ActiveWindow.FreezePanes = True

For Each cb In Application.CommandBars
icbs = icbs + 1
Range("A" & icbs).Select
ActiveCell.FormulaR1C1 = cb.Name
For Each cntl In Application.CommandBars(cb.Name).Controls
icbs = icbs + 1
Range("B" & icbs).Select
ActiveCell.FormulaR1C1 = cntl.Caption
On Error GoTo ErrJump1:
For Each subcntl In Application.CommandBars(cb.Name) _
.Controls(cntl.Caption).Controls
icbs = icbs + 1
Range("C" & icbs).Select
ActiveCell.FormulaR1C1 = subcntl.Caption
Range("D" & icbs).Select
ActiveCell.FormulaR1C1 = subcntl.ID
Next
PastError:
Next
Next
GoTo bypass:
ErrJump1:
Range("C" & icbs).Select
ActiveCell.FormulaR1C1 = cntl.ID
Resume PastError:
bypass:
End Sub

Disable shortcut keys

Disabling predefined (built-in) and custom shortcut keys for commands in Microsoft Office XP requires that you know how to enter the shortcut key ID into the policy editor.

Disable a predefined shortcut key

Several built-in shortcut keys are listed in the Predefined category of most application policy templates.

To disable a predefined shortcut key with a policy

1. Start the System Policy Editor.
   
   
2. Double-click the policy profile you want to work with.
   
   
3. Expand the Office application node (click the plus (+) sign or double-click the application name) that contains the built-in shortcut key you want to disable.
   
   
4. Expand the Disable items in user interface node.
   
   
5. Expand the Predefined node.
   
   
6. Set the Disable shortcut keys check box to checked.
   
   
7. In the Settings for Disable shortcut keys work area, set the check box next to the shortcut key you want to disable to checked.

For example, click the Ctrl+K (Insert | Hyperlink) check box and set it to checked to disable the shortcut key for the Hyperlink command (Insert menu) in Word.

If you create this policy and place it on your domain controller, and users log on, their logon process will automatically enforce the settings found in the policy file to their computers. It will use the information in the policy file to create the following string registry entry on users’ computers.

HKCU\Software\Policies\Microsoft\Office\10.0\Excel\DisabledShortcutKeysCheckBoxes

Value name: InsertHyperlink

Data type: REG_SZ (string)

Value data: "<virtual key code>,<key code modifier>"

When Excel starts, it examines this registry setting and checks to see if there is a value present. If the entry is “75,8”, it turns the Hyperlink shortcut key off. If the value is later changed to “0”, it turns it back on. You can use any value name in this registry key and supply an appropriate shortcut key code combination, and the shortcut key will be turned off. See “Key codes for shortcut keys” later in this topic for more information on virtual key codes.

Disable a custom shortcut key

You can disable any custom shortcut key by using the System Policy Editor, even if the item is not listed in the policy template.

Note   In order to disable a custom shortcut key, you must know the key code for the shortcut key.

To disable a custom shortcut key with a policy

1. Start the System Policy Editor.
   
   
2. Double-click the policy profile you want to work with.
   
   
3. Expand the Office application (click the plus sign (+) or double-click the application name) that contains the custom shortcut key you want to disable.
   
   
4. Expand the Disable items in user interface node.
   
   
5. Expand the Custom node.
   
   
6. Set the Disable shortcut keys check box to checked.
   
   
7. In the Settings for Disable shortcut keys work area, click Show.
   
   
8. In the Show Contents box, click Add….
   
   
9. In the Add Item box, type the key and modifier key values for the shortcut key by using the following syntax:

   key,modifier

   For example, to disable the shortcut key ALT+K, type 75,16

If you create this policy and place it on your domain controller and users log on, their logon process will automatically enforce the settings found in the policy file to their computers. It will use the information in the policy file to create the following string registry entry on users’ computer:

HKCU\Software\Policies\Microsoft\Office\10.0\Excel\DisabledShortcutKeysList

Value name: KeyModx

Data type: REG_SZ (string)

Value data: “75,16”

When Excel starts, it examines this registry setting and checks to see if there is a value present. If the entry is “77,12”, it turns the custom shortcut key off (in this case Ctrl + Shift + M). If the value is later changed to “0”, it turns it back on. Actually, you can use any value name in this registry key and supply an appropriate shortcut key code combination and the shortcut key will be turned off.

This is a unique registry entry because it is a list of KeyModx entries. The x is incremented by 1 for each entry in the list. Examples of KeyModx entries in the registry are:

KeyMod1 = "72,0"
KeyMod2 = "74,4"
KeyMod3 = "81,8"
KeyMod4 = "69,12"
KeyMod5 = "70,16"
KeyMod6 = "73,20"
KeyMod7 = "78,24"
KeyMod8 = "88,28"

Key codes for shortcut keys

Each modifier key and alphanumeric key on a keyboard has an associated key code. You use these codes to identify the unique key you want to control.

In the System Policy Editor, disabling shortcut keys requires you know the key code for alphanumeric keys and modifier keys. Once you have discovered what these key codes are, use the following syntax in policies that disable shortcut keys:

key,modifier

where key is the key code of a key (for example, G = 71) in Windows, and modifier is the value of either a modifier key (for example, ALT = 16) or a combination of modifier keys in Windows (ALT + CTRL = 24).

If you have multiple modifier keys for the shortcut key, you add the values of the modifier keys together to determine the actual modifier key code you will enter in the System Policy Editor (for example, ALT+SHIFT = 16 + 4 = 20).

Use the following values to refer to keys in the System Policy Editor.

Note   The System Policy Editor does not use the literal virtual key codes for ALT, CONTROL, and SHIFT. To refer to these keys in the Office environment, use the values of the modifier keys specified in the table.

If you are not sure what the key code of an entry on the keyboard is, use the following code in the Immediate window of the Visual Basic Editor:

MsgBox BuildKeyCode(wdKeyA)

Substitute the wdKeyA with wdKeyB, wdKeyC, etc., for each letter you want the key code to represent, or select the appropriate key from the list provided through the VBA editor when entering this command.

Example Code

This code provides you with a listing of all the shortcut keys in Word. This program is very helpful in showing what keys have shortcuts assigned to them and what the value of those keys are:

Function FindTheseKeys()
Dim IsValue As String
Dim IsValue2 As String
Dim I As Integer
Dim NoVal as Integer

Selection.TypeText Text:="Single key entries: Modifier value is 0"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(I).Command
IsValue2 = KeyString(I)
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
Selection.TypeText Text:="Shift key entries: Modifier value is 4"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(wdKeyShift, I).Command
IsValue2 = KeyString(wdKeyShift, I)
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
Selection.TypeText Text:="Control key entries: Modifier value is 8"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(wdKeyControl, I).Command
IsValue2 = KeyString(wdKeyControl, I)
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
Selection.TypeText Text:="Alt key entries: Modifier value is 16"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(wdKeyAlt, I).Command
IsValue2 = KeyString(wdKeyAlt, I)
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
Selection.TypeText Text:="Shift + Control key entries: Modifier" & _
" value is 12"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(KeyCode:=BuildKeyCode(wdKeyShift, wdKeyControl, I)) _
.Command
IsValue2 = KeyString(BuildKeyCode(wdKeyShift, wdKeyControl, I))
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
Selection.TypeText Text:="Shift + Alt key entries: Modifier value is 20"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(KeyCode:=BuildKeyCode(wdKeyShift, wdKeyAlt, I)) _
.Command
IsValue2 = KeyString(BuildKeyCode(wdKeyShift, wdKeyAlt, I))
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
Selection.TypeText Text:="Control + Alt key entries: Modifier value is 24"
Selection.TypeParagraph
For I = 1 To 254
IsValue = FindKey(KeyCode:=BuildKeyCode(wdKeyControl, wdKeyAlt, I)) _
.Command
IsValue2 = KeyString(BuildKeyCode(wdKeyControl, wdKeyAlt, I))
NoVal = PrintKey(IsValue, IsValue2, I)
Next I
End Function

Function PrintKey(IsValue As String, IsValue2 As String, I As Integer)
If IsValue <> "" Then
Selection.TypeText Text:=vbTab & "Key value is " & I & _
" defined as " & IsValue2 & " = " & IsValue
Selection.TypeParagraph
End If
End Function

Getting a list of all commands for Word

Use the following code to create a listing of all the commands in Word. If you run this command in a Word macro, Word will create a listing of all the commands, keys, modifiers, and the menus in which they appear. Replace the True with False, and the listing will provide only the custom commands added to Word. This process creates a new document in Word. You can then review the document, add to it, or print it out. You can use this new document to help you create key codes.

Sub GetCommands()
Application.ListCommands ListAllCommands:=True
End Sub

Working with Outlook cryptography policies

Security is a crucial aspect of all applications. As part of the security for Microsoft Outlook, cryptography (encryption schemes) is supported and has policies you can enable by using either the Group Policy snap-in available with Windows 2000, or the System Policy Editor available with the Office Resource Kit.

Microsoft Outlook has unique security requirements because of its interface to the outside world through e-mail servers, and because of the type of secure communication many businesses and government agencies require. To support these security issues, Outlook includes cryptography and certificate validation for macros, ActiveX® controls, and documents. Outlook also has the ability to perform a Certificate Revocation List (CRL) check — much like what Microsoft Internet Explorer can perform when validating a certificate in order to use an executable. A policy is included in the Outlk10.adm to set this behavior. The policies presented below deal with cryptography. These policies, which are typically referred to as federal release features, are considered important for administrators to understand. In many cases, companies are required to use these policies in order to work with government agencies.

Retrieve a Certificate Revocation List (CRL)

Used to retrieve CRLs (Certificate Revocation Lists)

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: UseCRLChasing

Data type: REG_DWORD

Value data: [ 0 | 1 | 2 ]

Can be set to the following:

0 - Use system Default

1 - When online always retrieve the CRL

2 - Never retrieve the CRL

This policy can slow the system down when it performs a CRL check. Use of this policy can adversely affect system performance.

Always Encrypt

Used to encrypt all e-mail messages.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: AlwaysEncrypt

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the AlwaysEncrypt key value to 1 to enable encryption on all e-mail messages. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Always Sign

Used to sign all e-mail messages

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: AlwaysSign

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the AlwaysSign key value to 1 to enable the signing of all e-mail messages created by a user. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Clear Sign

Used to send all signed messages as clear signed messages.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: ClearSign

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the ClearSign key value to 1 to enable the sending of all signed messages as clear signed messages. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Request Secure Receipts

Used to request a secure receipt for all S/MIME-signed messages.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: RequestSecureReceipt

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the RequestSecureReceipt key value to 1 to enable the sending of an acknowledgment from the recipient of an e-mail message. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Force Security Label

Used to ensure all S/MIME-signed messages have a label.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: ForceSecurityLabel

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the ForceSecurityLabel to 1 to enable the labeling of all S/MIME messages that are signed. Enforces the labeling of all outgoing signed mail. It does not indicate what kind of label to use, only that one must be attached. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Signature Status for no valid CRL

Used to indicate a missing CRL as a warning or error.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: SigStatusNoCRL

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the SigStatusNoCRL to either "warning" or "error" (0 or 1) to report missing CRLs as either a warning or an error. Default is to report it as a warning. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Promote Errors as Warnings

Used to elevate errors to the same level as a warning so the error is reported as a warning to users.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: PromoteErrorsAsWarnings

Data type: REG_DWORD

Value data: [ 0 | 1 ]

This policy controls whether level 2 errors are promoted to warnings to the user. Set the PromoteErrorsAsWarnings key value to 1 to promote errors to warnings, 0 to not promote them. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Possible error 2 conditions are:

Unknown Signature Algorithm

No Signing Certification Found

Bad Attribute Sets

No Issuer Certificate Found

No CRL found

Out of Date Certificate

Root Trust Problem

Out of Date CTL

Publish to GAL

Used to allow access to the Publish to GAL button.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: PublishToGALDisabled

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Hides the Publish to GAL button in the user interface. Set the PublishToGALDisabled key value to 1 to disable the Publish to GAL button. Within the System Policy Editor, use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

FIPS Mode

Run in FIPS compliant mode.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: FIPSMode

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Set the FIPSMode value key to 1 to enforce this setting. Within the System Policy Editor, use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Warn About Invalid signature

Used as a signature warning.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: WarnAboutInvalid

Data type: REG_DWORD

Value data: [ 0 | 1 | 2 ]

Set the WarnAboutInvalid value key to:

0 - to let users decide if they want to be warned about invalid signatures

1 - to always warn about invalid signatures

2 - to never warn about invalid signatures

This policy provides the administrator the option of presenting users with a choice of whether or not they want to be warned, or if they should always or never be warned about any invalid received signatures.

Disable Continue button

Used to disable the Continue button on all encryption warning dialogs.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: DisableContinueEncryption

Data type: REG_DWORD

Value data: [ 0 | 1 ]

Hides the continue and ignore errors buttons for encryption problem dialogs so messages cannot be sent to recipients who are unable to decrypt them. Within the System Policy Editor use the Check to enforce setting on; uncheck to enforce setting off option at the bottom of the policy dialog.

Respond to Receipt Requests by senders

Used to acknowledge a response to a received e-mail.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: RespondToReceiptRequests

Data type: REG_DWORD

Value data: [ 0 | 1 | 2 | 3 ]

Handles an e-mail message in the following manner:

0 - Open message if receipt can't be sent

1 - Always prompt before sending receipt

2 - Never send secure receipts

3 – Do not open message if receipt can't be sent

Need Encryption String Message

Used to display a message if Outlook cannot find the Digital ID to decode a message.

HKCU\Software\Policies\Microsoft\Office\10.0\Outlook\Security

Value name: NeedEncryptionString

Data type: REG_STRING

Value data: [<error message>]

This string should be less than 255 characters in length.

Displays a message to the user if Outlook is unable to find the digital ID for decoding the received message.