Allow users to demote attachments to Level 2

Purpose

Show registry keys (1)

• HKCU\software\policies\microsoft\office\16.0\outlook\security\allowuserstolowerattachments

This per-user policy value controls whether users of classic Outlook may reclassify attachment file types from Level 1 to Level 2.

Outlook blocks access to Level 1 attachments. A Level 2 attachment remains restricted: it cannot be opened directly from the Outlook item and must first be saved to disk before it can be opened from that location.

allowuserstolowerattachments is a REG_DWORD value:

• 1 permits user-controlled demotion.
• 0 prevents it.

The value does not identify any file name extensions itself. When demotion is permitted, the user specifies the affected extensions through the Level1Remove value under HKCU\Software\Microsoft\Office\16.0\Outlook\Security. If the policy is disabled, that user-defined list is not honored for demotion.

Notes

Security

Enabling this policy weakens Level 1 protection for file types selected by the user. These can include executable files and other formats capable of carrying scripts or program code. Users can save the affected attachments and subsequently open or execute them outside Outlook.

Demotion does not remove every attachment restriction. The attachment is treated as Level 2 and still cannot be opened directly from the message. It does, however, replace the complete Level 1 access block with a save-before-open restriction, making potentially harmful content accessible on the local system.

Notes

The setting is scoped to the current user and applies to classic Outlook products that use the Office 16.0 registry branch, including Outlook 2016 and corresponding classic Outlook desktop applications in later Office releases.

For this policy value to govern attachment handling, Outlook Security Mode must be set to use Outlook Security Group Policy. If Outlook obtains its security settings from another source, that source determines the effective attachment behavior.

Microsoft’s page dedicated to this policy value documents the equivalent Outlook 2007 setting under the former 12.0 registry branch. Current Office administrative templates use the 16.0 path shown here for Outlook 2016 and other Office products in the version 16 family.

Microsoft documentation

Microsoft Learn: Information about e-mail security settings — Let users demote attachments to Level 2

Microsoft Support: Outlook blocked access to the following potentially unsafe attachments

Microsoft Download Center: Administrative Template files for Microsoft Office

See also

• Entry in the reference