Q: We’ve noticed that there have been frequent Microsoft security bulletins related to specific file types—especially Microsoft Office documents. Our employees' email communications with people outside of our company rarely require the use of attachments, so we have the luxury of disabling file attachments on our email server (except for a special administrative Inbox, which facilitates the infrequent receipt of attachments). However, several users who are independent contractors have to be able to access other email services, such as their personal POP server, so we can’t prohibit all attachment file types. Is there a way to disable certain attachment file types at the workstation level?

A: Yes, you can disable certain attachment file types. Windows Vista and Windows XP SP2 use Attachment Manager to enforce policies on files received in email messages or saved from the Internet according to the file type and the zone from which the file originated. You can find the Attachment Manager settings in the Microsoft Management Console (MMC) Group Policy Editor (GPE) snap-in by drilling down to User Configuration\Administrative Templates\Windows Components\Attachment Manager.

Attachment Manager classifies files as high, moderate, or low risk depending on the file type. Users can open low-risk file types without any interference from Windows. For moderate-risk file types from the Internet zone or Restricted sites zone, Windows prompts users with a warning before letting them open the file. Windows prevents users from opening high-risk file types from the Restricted sites zone and prompts users with a warning for high-risk files from the Internet zone.

However, for files saved from Web pages in the Internet zone (e.g., Web-based email sites), Windows provides only a warning prompt. To fully control which file types users can download from the Internet, you need to use a Web proxy, such as Microsoft ISA Server, to enforce file-type restrictions at the Internet gateway.

So how do you control which zone Microsoft Office Outlook and Microsoft Office Outlook Express use to evaluate file attachments? By default, Outlook and Outlook Express use the Internet zone. To configure Outlook and Outlook Express to use the more secure Restricted sites zone, click Tools, Options, and then select the Security tab. Under Zone, select the Restricted sites zone.