Encrypted File Rule Not Working for Password Protected Microsoft Office Documents in Symantec Mail Security for Microsoft Exchange

Products

• Mail Security for Microsoft Exchange

Issue/Introduction

The encrypted file rule in the exceptions section of the Symantec Mail Security for Microsoft Exchange console is set to quarantine, yet password protected Microsoft Office documents (.docx, .xlsx, .pptx) are allowed through and no action is taken against them.

 

Cause

In Symantec Mail Security for Microsoft Exchange 7.5.5 and earlier, password protected office files are not treated as encrypted by default. SMSMSE 7.5.6 and later treat encrypted office documents as encrypted by default. This behavior can be changed if desired in both cases.

Resolution

To enable the encrypted file rule for password protected office files in SMSMSE 7.5.5 and earlier:

1. Open the registry editor (Start -> Run -> Regedit). 
2. Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SMSMSE\7.5\Server\Components\NaveSp\"
3. Create  a new DWORD registry key with the name "DetectEncryptionForOfficeFiles".
4. Set the value to 1.
5. Re-start the Symantec Mail Security for Microsoft Exchange service.

To disable the encrypted file rule for password protected office files in SMSMSE 7.5.6 and later:

1. Open the registry editor (Start -> Run -> Regedit​). 
2. Navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\SMSMSE\7.5\Server\Components\NaveSp\"
3. Create  a new DWORD registry key with the name "DetectEncryptionForOfficeFiles".
4. Set the value to 0.
5. Re-start the Symantec Mail Security for Microsoft Exchange service.