Alexander’s Blog

I had a client who asked me the other day if it is possbile to prevent out-of-office messages in Exchange 2007 from being sent to anyone not on the users’ contacts list. Luckily, in Outlook 2007 Microsoft allows us to set two different out-of-office messages.

Sending out-of-office messages to anyone could be a security risk and can also help spammers who are ableto verify your e-mail address. Bad guys can benefit from information about you that they shouldn’t have. For example, there are known cases of people getting robbed when out-of-office message informed the would-be robbers that people will be out of town on certain dates. Out-of-office messages also pose additional social engineering threats.

In Outlook 2007, you have much better control over out-of-office replies. Not only can you send out-of-office replies during specific dates, which is very helpful, you can configure one auto-reply for people that are inside your organization and another for people who are outside your organization. For example, you can configure the dates for when you are out-of-office ahead of time and Outlook 2007 will automatically turn on the feature during the dates that you are out of office. To configure out-of-office auto replies in Outlook 2007 you go to Tools, Out of Office Assistant. Notice that when you enable the feature by clicking “Send Out of Office auto-replies” you have two tabs: one for “Inside My Organization” and another for “Outside My Organization: When you type a message for users “Outside My Organization”, you can choose to either select “My contacts only” or “Anyone outside my organization” (which is the default setting).

The ability to limit out-of-office replies only to users that are on your contacts list is a major improvement in Outlook 2007.