Encrypt-Only and Do Not Forward Managment

I was recently tasked with achieving a better understanding of our Office 365 setup after our Information Security Officer left for another position. This includes the way we are encrypting our email...

security

Rafael Dominguez
Mar 22, 2019
Thanks Ryan Heffernan.

DNF is a built in function within the Outlook client and must be disabled via GPO/Registry keys as follows:

Open the following registry location using Registry Editor:

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM

On the Edit menu, point to New, and then click DWORD (32-bit) Value.

Type DisableDNF, and then press ENTER.

In the Details pane, right-click DisableDNF, and then click Modify.

In the Value data box, type 1, and then click OK.

Exit Registry Editor.

If you previously disabled the Do Not Forward command by using a Group Policy setting, remove that policy setting.

(Note the registry location will be different based on the Office version.)

14.0 = 2010

15.0 = 2013

16.0 = 2016

Once the policy is applied, this is what the UI shows. (Note the DNF options is greyed out.)

More information about DNF is found here: https://docs.microsoft.com/en-us/azure/information-protection/configure-usage-rights#do-not-forward-option-for-emails

We plan to allow admins to disable/hide Encrypt Only within Office later this year.

Rafael Dominguez

Iron Contributor

Mar 22, 2019

Thanks Ryan Heffernan.

DNF is a built in function within the Outlook client and must be disabled via GPO/Registry keys as follows:

Open the following registry location using Registry Editor:

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\DRM

On the Edit menu, point to New, and then click DWORD (32-bit) Value.
Type DisableDNF, and then press ENTER.
In the Details pane, right-click DisableDNF, and then click Modify.
In the Value data box, type 1, and then click OK.
Exit Registry Editor.
If you previously disabled the Do Not Forward command by using a Group Policy setting, remove that policy setting.