Outlook Security Patch Trades Functionality for Security

Last week, I reported good news and bad news about Microsoft's release of a security patch for Outlook 2000 and Outlook 98. The good news was that the patch was finally ready, and the bad news was that installing it required Office Service Release 1a (SR1a), which is an extremely large download.

This week, I again have good news and bad news. The good news is that those of you who have a Microsoft TechNet subscription can get SR1a from TechNet Service Packs CD4 (thanks to UPDATE reader Kenneth Kang-Hui for that tip). The bad news is that the Outlook security patch restricts so many Outlook features that many users are unable (or unwilling) to use it.

Basically, the patch restricts the functionality of programs that interact with Outlook—and in the process, either prevents you from doing certain things or requires you to confirm them interactively. Among the features the patch affects are Mail Merge, Team Folders, Digital Dashboards, Net Folders, Journal Items, Custom Folders, and synchronization with Personal Digital Assistants (PDAs). Most of these features continue to work, but many require you to manually confirm that you in fact want to do what you've asked to do—and you must make that confirmation each and every time you start Outlook.

Mail administrators can modify some of these restrictions if they are using Outlook in a Microsoft Exchange Server environment, but for standalone users such as me, it's an all-or-nothing proposition; you either install the patch and put up with the limitations or ignore the patch and accept the risk of virus infection. Perhaps the most aggravating thing about the patch is that it has no uninstall—like a service pack, it modifies the underlying application. After you install the patch, the only way to uninstall it is to completely remove Outlook and reinstall it from the original media.

Given all this, I recommend that you check out the limitations and concerns regarding this patch before installing it (I also recommend making a full backup of your existing installation first). For details about the patch, check out Microsoft article Q262634.

I'd like to hear from people who are using the patch (I've already heard from quite a few who aren't, for the obvious reasons). How much trouble did you have installing it, and how easy is it to live with the limitations?

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.