Details
This policy setting allows you to treat Level 2 errors as warnings instead of errors. Level 2 errors occur when the message signature appears to be valid, but there are other issues with the signature.
If you enable this policy setting, Level 2 errors will be treated as warnings.
If you disable or do not configure this policy setting, Level 2 errors will be treated as errors
When you specify a value for PromoteErrorsAsWarnings, note that potential Level 2 error conditions include the following:
* Unknown Signature Algorithm
* No Signing Certification Found
* Bad Attribute Sets
* No Issuer Certificate found
* No CRL Found
* Out-of-date CRL
* Root Trust Problem
* Out-of-date CTL
The recommended state for this setting is: Disabled.
Rationale:
Cryptographic errors in Outlook are classified as Level 1 (serious errors) or Level 2 (not as serious). By default, Outlook generates a warning, rather than an error, when a level 2 condition occurs: the certificate that generated the warning is treated as valid, and the user is not informed of the problem unless he or she opens the Signature Details dialog box and examines the certificate. Potential level 2 conditions include the following:
* Unknown Signature Algorithm
* No Signing Certification Found
* Bad Attribute Sets
* No Issuer Cert found
* No CRL Found
* Out of Date CRL
* Root Trust Problem
* Out of Date CRT
In some cases, treating level 2 conditions as warnings can cause users to overlook potentially significant signature problems.
Solution
To implement the recommended configuration state, set the following Group Policy setting to Disabled.
User ConfigurationAdministrative TemplatesMicrosoft Outlook 2016SecurityCryptographySignature Status dialog boxPromote Level 2 errors as errors, not warnings
Impact:
Disabling this setting can cause disruptions for users who work with digital certificates in Outlook. These users may experience an increased number of errors that prevent them from working effectively with e-mail, which could increase desktop support requests.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Information Integrity.This control applies to the following type of system Windows.