W10-1809LTSC, Outlook 2016, UPM -Always ask before opening a file

[Nick Casagrande1709152718]

Perhaps someone can assist here.  All is working well, however Outlook will not save this setting to remove the check mark and open the attachment without popping up this box.  Profile is roaming correctly with no issues.  Any ideas?

[James Kindon]

got me - I thought there was a specific policy under there, but trawling through i cannot find one :(

 

wonder if this works?

https://www.slipstick.com/problems/disable-always-ask-before-opening-dialog/

[James Kindon]

Tried with group policy? Under security form settings\attachments within the outlook mostly can customise the behaviour a little 

 

[Nick Casagrande1709152718]

Thanks for responding, I am currently using the GPO below, but it hasn't given me the results I thought it would.

 

Outlook Security ModeEnabled

Outlook Security Policy:Use Outlook Security Group Policy

[Nick Casagrande1709152718]

thanks, i came across this one too and many others like it, however my problem is that the check mark is NOT greyed out.  users are able to uncheck it, but it is not being remembered between sessions.  

[James Kindon]

Way i read the reg keys in that article is that its two fold....(i could well be missing it, its late)

1) to address the tickbox (which is not your issue) and then

2) to control the default behaviour when that tickbox is ticked on a per file type basis

 

So using them you should be able to force the tickbox and the behaviour via GPP or WEM etc?

 

Otherwise a nice procmon adventure awaits to find the keys that are written when that box is ticked/unticked and then set them via Policy

[Nick Casagrande1709152718]

hey james, you were spot on!  i took a fresh look at this tonight and creating the reg keys solves the issue!  thanks so much.  i got word / excel working but pdf is a challenge b/c there is no acroexch as the article states.  even on my laptop where pdf's open without the dialog (i disabled using the runas admin), i still cant find the proper reg key

[James Kindon]

Hey Nick - is Adobe your PDF viewer? Or is it another product?

[Jeff Riechers]

Are you using folder redirection, and have that path added to the trusted sites in IE?

[Nick Casagrande1709152718]

5 hours ago, James Kindon said:

Hey Nick - is Adobe your PDF viewer? Or is it another product?

adobe is not installed, chrome is the pdf viewer.  

[Nick Casagrande1709152718]

2 minutes ago, Jeff Riechers1709152667 said:

Are you using folder redirection, and have that path added to the trusted sites in IE?

 

i am using folder redirection, however i dont understand what that has to do with the problem.  we have the solution in the link james posted, just trying to figure out where the pdf which pdf classes is being used

[Jeff Riechers]

1 minute ago, Nick Casagrande1709152718 said:

 

i am using folder redirection, however i dont understand what that has to do with the problem.  we have the solution in the link james posted, just trying to figure out where the pdf which pdf classes is being used

Just checking as I have had outlook drop a link into a folder redirected location and then during the call of the application to that item from that location generate similar security errors.

[James Kindon]

There was this comment at the bottom of the article talking about pdf without adobe 

 

"A quick check under HKEY_CLASSES_ROOT under the .pdf Key found "Default = NitroPDF.Document.8" (equivalent to AcroExch.Document). So I searched the Registry for the Key NitroPDF.Document.8, found it under HKEY_CLASSES_ROOT, added the EditFlags value of 00 00 10 00 and presto!"

 

Might be of use 

[Nick Casagrande1709152718]

49 minutes ago, James Kindon said:

There was this comment at the bottom of the article talking about pdf without adobe 

 

"A quick check under HKEY_CLASSES_ROOT under the .pdf Key found "Default = NitroPDF.Document.8" (equivalent to AcroExch.Document). So I searched the Registry for the Key NitroPDF.Document.8, found it under HKEY_CLASSES_ROOT, added the EditFlags value of 00 00 10 00 and presto!"

 

Might be of use 

yes i saw that comment, however i've searched the reg high and low, even did a procmon capture and can't find where the pdf editflags is hiding.  pdf is different that word or excel, those were super easy.  see below.   1st one is pdf, second and third is excel

 

 

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.pdf]
"Content Type"="application/pdf"
"FullDetails"="prop:Tracker.PDF.PDFXChange.PropGroup.Securitry;Tracker.PDFXChange.IsEncrypted;*Tracker.PDF.PDFXChange.EncryptionLevel;*Tracker.PDF.PDFXChange.Perm.Printing;*Tracker.PDF.PDFXChange.Perm.Changing;*Tracker.PDF.PDFXChange.Perm.Copying;*Tracker.PDF.PDFXChange.Perm.Commenting;*Tracker.PDF.PDFXChange.Perm.FormFilling;*Tracker.PDF.PDFXChange.Perm.Accessibility;*Tracker.PDF.PDFXChange.Perm.Assembly;System.PropGroup.Description;System.Title;System.Subject;System.Author;System.Keywords;Tracker.PDF.PDFXChange.Producer;Tracker.PDF.PDFXChange.Creator;Tracker.PDF.PDFXChange.SpecVersion;System.Document.PageCount;System.PropGroup.FileSystem;System.ItemNameDisplay;System.ItemType;System.ItemFolderPathDisplay;System.Size;System.DateCreated;System.DateModified;System.DateAccessed;System.FileAttributes;System.OfflineAvailability;System.OfflineStatus;System.SharedWith;System.FileOwner;System.ComputerName"
"InfoTip"="prop:System.ItemType;System.Author;System.Title;System.Subject;System.Document.PageCount;System.Size;System.DateChanged"
"PreviewDetails"="prop:System.Author;System.Title;System.Keywords;System.Subject;Tracker.PDF.PDFXChange.Producer;Tracker.PDF.PDFXChange.Creator;Tracker.PDF.PDFXChange.SpecVersion;System.Document.PageCount;System.Size;System.ItemFolderPathDisplay;System.DateCreated;System.DateChanged;Tracker.PDF.PDFXChange.PropGroup.Securitry;Tracker.PDFXChange.IsEncrypted;*Tracker.PDF.PDFXChange.EncryptionLevel;*Tracker.PDF.PDFXChange.Perm.Printing;*Tracker.PDF.PDFXChange.Perm.Changing;*Tracker.PDF.PDFXChange.Perm.Copying;*Tracker.PDF.PDFXChange.Perm.Commenting;*Tracker.PDF.PDFXChange.Perm.FormFilling;*Tracker.PDF.PDFXChange.Perm.Accessibility;*Tracker.PDF.PDFXChange.Perm.Assembly;"
"PreviewTitle"="prop:System.ItemNameDisplay;System.ItemType"

[HKEY_CLASSES_ROOT\.pdf\OpenWithList]

[HKEY_CLASSES_ROOT\.pdf\OpenWithList\winword.exe]
@=""

[HKEY_CLASSES_ROOT\.pdf\OpenWithProgids]
"ChromeHTML"=""

[HKEY_CLASSES_ROOT\.pdf\PersistentHandler]
@="{DDA60C00-9937-453d-99E4-15967383ACE8}"
"Prev"="{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}"

[HKEY_CLASSES_ROOT\.pdf\shellex]

[HKEY_CLASSES_ROOT\.pdf\shellex\PropertyHandler]
@="{67EB453C-1BE1-48EC-AAF3-23B10277FCC1}"

[HKEY_CLASSES_ROOT\.pdf\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\.pdf\shellex\PropertySheetHandlers\InfoPage]
@="{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}"

[HKEY_CLASSES_ROOT\.pdf\shellex\{00021500-0000-0000-C000-000000000046}]
@="{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}"

[HKEY_CLASSES_ROOT\.pdf\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}]
@="{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583}"

[HKEY_CLASSES_ROOT\.pdf\shellex\{E357FCCD-A995-4576-B01F-234630154E96}]
@="{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8}"

 

 

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.xlsx]
"PerceivedType"="document"
"Content Type"="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
@="Excel.Sheet.12"

[HKEY_CLASSES_ROOT\.xlsx\Excel.Sheet.12]

[HKEY_CLASSES_ROOT\.xlsx\Excel.Sheet.12\ShellNew]
"FileName"="excel12.xlsx"

[HKEY_CLASSES_ROOT\.xlsx\PersistentHandler]
@="{4887767F-7ADC-4983-B576-88FB643D6F79}"

[HKEY_CLASSES_ROOT\.xlsx\ShellEx]

[HKEY_CLASSES_ROOT\.xlsx\ShellEx\PropertyHandler]
@="{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}"

[HKEY_CLASSES_ROOT\.xlsx\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}]
@="{00020827-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\.xlsx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}"

 

 

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\Excel.Sheet.12]
@="Microsoft Excel Worksheet"
"BrowserFlags"=dword:00000008
"EditFlags"=hex:00,00,01,00
"FriendlyTypeName"=hex(2):40,00,25,00,43,00,6f,00,6d,00,6d,00,6f,00,6e,00,50,\
  00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,00,6c,00,65,00,73,00,25,00,\
  5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,66,00,74,00,20,00,53,00,68,\
  00,61,00,72,00,65,00,64,00,5c,00,4f,00,66,00,66,00,69,00,63,00,65,00,31,00,\
  36,00,5c,00,6f,00,72,00,65,00,67,00,72,00,65,00,73,00,2e,00,64,00,6c,00,6c,\
  00,2c,00,2d,00,31,00,30,00,31,00,00,00
 

[James Kindon]

Hmmm I'll check in my lab tomorrow and see if things change with a pdf handler like foxit - might need an actual viewer to get round this 

[Nick Casagrande1709152718]

6 minutes ago, James Kindon said:

Hmmm I'll check in my lab tomorrow and see if things change with a pdf handler like foxit - might need an actual viewer to get round this 

Ty.  It works fine on my laptop and I use chrome for pdf viewing as well.  I just can't find where the key is that supports this.  I have the procmon dump if you like.  About 40mb so I gotta email it to you

[Nick Casagrande1709152718]

So I took the easy way out and forced a gpo to use pdfxchange viewer for .pdf's and threw the editflags on that application, works like a charm.  Thanks to James for the helping hand here.  Chrome must do some black magic in the registry to make this work outside the norm, perhaps b/c it is tightly integrated into the o/s.  Hopefully this post will help someone in the future save a few hours from their day.  

[James Kindon]

Nice one mate, glad you are all sorted :)