The Outlook View Control is an ActiveX® control that allows you to view Outlook e-mail folders on Web pages in Microsoft® Outlook® 2000. The Outlook 2000 SR-1 View Control Security Update helps protect you from attackers who attempt to exploit the vulnerability in the Microsoft Outlook mail client.

You can use the Microsoft Outlook View Control on Web sites that are outside the Outlook mail client. This update prevents the control from being invoked by scripting or Hypertext Markup Language (HTML) code on a Web page potentially controlled by someone with malicious intent.

Toolbox    There is no administrative version of the Outlook 2000 SR-1 View Control Security Update. The update consists of one executable file (Outlctlx.exe) that must be run on each client machine that runs Outlook 2000. You can find this downloadable file on the Office 2000 Resource Kit Downloads page.

Deploying the Outlook 2000 SR-1 View Control Security Update

To deploy the Outlook 2000 SR-1 View Control Security Update, you can use any of the following methods:

• Send the executable in an e-mail to all users, and have them run the program on their computers.
• Save the executable to a file server and do one of the following:
  • Add a line to the NT logon script that instructs the user's computer to run the file.

    - or -

  • Add a line to a Systems Management Server script that instructs the file to be run on all users' computers.

    - or -

  • Send e-mail to all users to run the file from the specified location.

    - or -

  • Send e-mail to all users with a batch file that runs the file from the specified location.

For users who install Outlook 2000 from an administrative installation point in the future, you can do the following:

• Include an entry in the Custom Installation Wizard to run the executable after Office 2000 or Outlook 2000 is installed.
• Save the executable on each administrative installation point and send users an e-mail with instructions on how to run the program after Outlook 2000 is installed.
• Include a command-line entry in a batch file when you run a Custom Maintenance Wizard update or when you apply an Office Profile Wizard update to a user's computer.

Related link

For more information on the Outlook View Control issue, see the Microsoft Security Bulletin MS01-038 Outlook View Control Exposes Unsafe Functionality.