2.5.14.2.1.4 (L1) Ensure 'Promote Level 2 errors as errors, not warnings' is set to 'Disabled'

Information

This policy setting allows the configuration of Level 2 errors as warnings instead of errors. Level 2 errors occur when the message signature appears to be valid, but there are other issues with the signature.

Note: Potential Level 2 error conditions include the following:

- Unknown Signature Algorithm
- No Signing Certification Found
- Bad Attribute Sets
- No Issuer Certificate found
- No CRL Found
- Out-of-date CRL
- Root Trust Problem
- Out-of-date CTL

The recommended state for this setting is: Disabled

Note: The title of the Group Policy text is slightly misleading. Promote Level 2 errors as errors, not warnings should actually read Promote Level 2 errors as warnings, not errors which would align more closely with the description of the various states Enable/Disable.

Cryptographic errors in Outlook are classified as Level 1 (serious errors) or Level 2 (not as serious). By default, Outlook generates a warning, rather than an error, when a level 2 condition occurs: the certificate that generated the warning is treated as valid, and the user is not informed of the problem unless he or she opens the Signature Details dialog box and examines the certificate.

In some cases, treating level 2 conditions as warnings can cause users to overlook potentially significant signature problems.

Solution

To establish the recommended state via configuration profiles, set the following Settings Catalog path to Disabled :

Microsoft Outlook 2016\Security\Cryptography\Signature Status dialog box\Promote Level 2 errors as errors, not warnings

Impact:

Disabling this setting can cause disruptions for users who work with digital certificates in Outlook. These users may experience an increased number of errors that prevent them from working effectively with e-mail, which could increase desktop support requests.

See Also

https://workbench.cisecurity.org/benchmarks/15808

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11

Plugin: Windows

Control ID: 57e30abb2c660c624cd5823d2e4e7bec7d6ec130b5bf01812fddbda2cf6d0e27