Microsoft Office Tutorials: Custom form script is now disabled by default

Sunday, January 30, 2022

Custom form script is now disabled by default

Last updated: Oct 13, 2017

ISSUE

Custom form script is now disabled by default and requires setting registry keys to re-enable it.

The new registry key has a default value of 1, which indicates form script should not run.

First create this key:

32 bit Office on 64 bit Windows

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\Security

32 bit Office on 32 bit Windows or 64 bit Office on 64 bit Windows

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Outlook\Security

Then create DWORD (32-bit) Value 0 and set the name to DisableCustomFormItemScript to enable custom form scripts.
Once custom form scripts have been enabled at all, they must then be enabled per form message class. For instance, if you have a form with the message class IPM.Note.Custom, we must register "IPM.Note.Custom" as a trusted form message class. To do this, first create this key:

32 bit Office on 64 bit Windows

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\Forms\TrustedFormScriptList

32 bit Office on 32 bit Windows or 64 bit Office on 64 bit Windows

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Outlook\Forms\TrustedFormScriptList

Then, create REG_SZ values in this key for each form you wish to allow scripts to run. In the above example, you would create a REG_SZ value named "IPM.Note.Custom" with empty data.

When designing a form, Run This Form will run a form using the message class of the base form. So if you started designing an IPM.Note form and want to Run This Form, you will need to have IPM.Note registered. After you publish, the published message class is what will be checked. Once you have finished designing your form and published it to a custom form name, remove the standard "IPM.Note" from the trusted list.

Notes:

You need to restart Outlook after setting the TrustedFormScriptList key.
The example registry keys use 16.0 for Outlook 2016. Use 15.0 for Outlook 2013, 14.0 for Outlook 2010 and 12.0 for Outlook 2007.

After making the above changes the registry keys will look like the following:

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\Security]

DisableCustomFormItemScript"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\Forms\TrustedFormScriptList]

"IPM.Note.Custom"=""

"IPM.Note"=""

Registry keys

NOTE: In some cases forms in secondary mailboxes and Public folders still don't work after the registry key settings. To fix this, enable scripts in the Trust Center:

Click File > Options. Then select Trust Center > Trust Center Settings > Email Security.
Under the Script in Folders section, click the checkbox for Allow script in shared folders and Allow script in Public folders and click OK and OK again to close out the windows.

STATUS

The change was first introduced in the September 12th, 2017 Outlook Public Updates and is included in the following MSI updates which now require the registry keys.

Click to Run status is as follows:

Monthly Channel (Current Channel) will start supporting the registry keys in the update scheduled for September 18th release build 16.0.8431.2079.
Semi-Annual Channel (FRDC) supports the registry keys with build 16.0.8431.2079.
Deferred Channel supports the registry keys with build 16.0.8201.2193.
Deferred Extended status is TBD.
Insider Fast status is TBD.
Insider Slow supports the registry keys with build 16.0.8431.2079.