Allow scripts in one-off Outlook forms
This user-scoped Outlook policy controls whether scripts may run in one-off Outlook forms.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\outlook\security\enableoneoffformscripts
This user-scoped Outlook policy controls whether scripts may run in one-off Outlook forms. A one-off form stores its form definition—including its layout and any VBScript code—inside an individual Outlook item. The item therefore does not rely solely on a separately published form in a forms library.
The value uses the REG_DWORD type. A value of 1 permits scripts to run in one-off forms; 0 prevents their execution. The setting applies to embedded form script. It does not automatically permit ActiveX controls or every action protected by the Outlook object model, which are governed by separate security settings.
Notes
Security
Allowing scripts means that a received Outlook item can carry code that Outlook executes when it uses the embedded form. A maliciously constructed form can abuse this capability to perform unwanted actions. Microsoft documents custom Outlook forms more generally as a possible persistence and code-execution mechanism following mailbox compromise.
This setting does not disable all other Outlook security checks. Depending on the form and the remaining security configuration, Outlook can still display warnings or block specific programmatic actions. In particular, a separate policy controls which ActiveX controls, if any, may run in one-off forms.
Possible side effects
When script execution is blocked, legitimate one-off forms that depend on embedded VBScript might provide only partial functionality. Outlook may still display the form or its data while script-driven events, calculations, or other automation do not run.
Notes
For this and other dependent Outlook security policies to be managed through Group Policy, Outlook Security Mode must be configured to use Outlook Security Group Policy. Consequently, this registry value alone does not determine the effective behavior under every Outlook security configuration.
The policy applies to the Office 16.0 policy branch used by classic Outlook for Windows. One-off forms are distinct from published forms because their form definition is stored directly in the individual Outlook item.
Microsoft documentation
Microsoft Learn: Save a Form with the Item (One-off Forms)
Microsoft Learn: Detect and remediate Outlook rules and custom forms injection attacks
Microsoft Learn: Information for administrators about e-mail security settings in Outlook 2007