none
June security patch and issue with custom forms

    Question

  • Hi, hope this is the right forum to post this in.

    I'm having an issue with my custom form not working after the June security patch a couple of days ago.

    I have MS Office Professional Plus 2010 installed but I'm seeing this with 2007, 2013 and 2016 as well.  This issue happened after KB3203467 was installed.  For 2007 it's kb3191898, for 2013 it's KB3191938, and for 2016 it's KB3191932.

    I have a custom form that's published to my personal forms library that I use for new contacts.  When I create a new contact I get the below message and none of my VBScript behind the form will run.  If I uninstall the security update the problem goes away.

    "To help prevent malicious code from running, one or more objects in this form were not loaded. For more information, contact your administrator."

    It looks like it thinks the form is a one-off, however, "send form definition with item" is unchecked and it is published to my personal forms library.

    Any ideas or suggestions?




    • Edited by Nick at Home Friday, June 16, 2017 1:12 PM Added 2007 to the list of versions affected.
    Thursday, June 15, 2017 4:17 PM

All replies

  • Thanks for the reply!  So far the only thing that has worked is to uninstall the security update.
    Thursday, June 15, 2017 5:29 PM
  • Hi

    I have the exact same problem.

    I use an office calendar custom form that visualize a webpage, used to plan the the staff in the entire organization. To interact with this page, the GUID of the appointment is send to the web server using a few lines of script.

    Now the form is blocked, and today no one could follow up on their schedule.

    It just shows the error message mentioned by Nick. Why block code embedded in installed custom forms??? It there for a reason, and intended to run.

    I tried to insert the "EnableUnsafeClientMailRules" in regedit, but with no effect.

    Uninstalling the patch does the job, but is not the way to go.

    I urgent need a solution, just like Nick .. please someone help!!

    Is there any alternative way to interact between the calendar item and the web element?

    Thursday, June 15, 2017 6:32 PM
  • We have the same issue as PhiFra once the June update is installed in Office 2010, 2013, or 2016. Vbscripts in our custom forms are ignored. Uninstalling the update resolves it.
    Thursday, June 15, 2017 7:40 PM
  • Hi All,

    Thank you for the feedback. We have received several reports about some issues caused after installing KB3203467 update in Outlook 2010. The engineering team is investigating this issue.

    I'll submit a feedback regarding this particular issue via internal way. Currently, you can try to uninstall the update to temporarily work around this issue. Hope the issue could be fixed soon.

    Thank you again for your understanding and support.

    Regards,

    Steve Fan


    Please remember to mark the replies as answers if they helped.

    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 16, 2017 7:27 AM
    Moderator
  • Hi Steve

    This issue does not only affect Office 2010.

    I have tested on both 2010 and 2013.

    Friday, June 16, 2017 8:36 AM
  • Thank you for the information. I noticed it and have involved this in my internal feedback :)

    Regards,

    Steve Fan


    Please remember to mark the replies as answers if they helped.

    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 16, 2017 8:41 AM
    Moderator
  • Thanks Steve
    Friday, June 16, 2017 12:58 PM
  • Hello all,

    Do any of you have a sample solution that you could send me that repro's the issue?  Or, if its really complicated I might need to assist in opening a support case.  I have checked with the Outlook MVPs and they do not have a repro to check this with and we don't have one internally right now.  If you have something straight forward and willing to share please email me.  My alias is gbratton at Microsoft dot com.  

    Friday, June 16, 2017 10:28 PM
  • Thanks Gabriel!

    I've sent you an email to your Microsoft account which has a link to a video that shows the steps to reproduce the problem.   I will post the link to the video here as well but am waiting for my account to be verified.  I will link it here as soon as that happens.

    Let me know if there's anything else you need from me and thanks again for your help!

    Saturday, June 17, 2017 4:03 PM
  • Thank you Nick.  We will look into this and I'll update after we know next steps.
    Sunday, June 18, 2017 7:01 PM
  • Did you add controls to the form or just code? 


    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter

    Monday, June 19, 2017 1:48 PM
  • I did both. 

    In the first version, the only change I made was to add this line of VBScript:  MsgBox "Hello"

    In the second version, I added a line of VBScript, and added a Microsoft Outlook Contact Photo Control.

    In both versions, the VBScript will not run.

    In the version where I add the control I get the malicious code warning.

    Monday, June 19, 2017 1:52 PM
  • FYI, 2016 as well.
    Monday, June 19, 2017 1:53 PM
  • Here's the video that shows the steps to reproduce the problem.  I'm using Outlook 2016 in the video but I have the same behavior in 2007, 2010, & 2013.  In the video I create 2 custom forms. 

    For form 1 I do the following:

    • Design a new form based on the Contact form in the Standard Forms Library
    • Add a Microsoft Outlook Contact Photo Control
    • Add this line of VBScript: MsgBox "Hello"
    • Publish the form to the Personal Forms Library

    When the new form is opened it shows the malicious forms warning and the VBScript is blocked.  The message box is not displayed.  When I rollback to the June 7th version of Outlook the form works fine and the message box pops up.

    For form2 I do this:

    • Design a new form based on the Contact form in the Standard Forms Library
    • Add this line of VBScript: MsgBox "Hello - No Control"
    • Publish the form to the Personal Forms Library

    When the new form is opened the VBScript is blocked.  No message box is displayed.  When I rollback to the June 7th version the form works fine and the message box pops up.

    https://youtu.be/MrjOswIfGs8

    Thanks again for the help!


    Tuesday, June 20, 2017 12:13 PM
  • Thank you for your video.

    I have the same problem for Outlook 2013 and 2016. Remove KB solve problem.

    Tuesday, June 20, 2017 1:11 PM
  • I uninstalled KB3203467 and still getting same message

    "To help prevent malicious code from running, one or more objects in this form were not loaded. For more information, contact your administrator."

    any other suggestions?

    Tuesday, June 20, 2017 5:08 PM
  • The issue is being tracked on this page, https://support.office.com/en-us/article/You-receive-an-error-when-opening-attachments-in-Outlook-3f6dbffd-8505-492d-b19f-b3b89369ed9b?ui=en-US&rs=en-US&ad=US.  It is also added to each of the security update KBs.  The Outlook Team is working on it and hopefully will have an update soon on next steps.  
    Tuesday, June 20, 2017 6:02 PM
  • Thanks Gabe!
    Tuesday, June 20, 2017 6:14 PM
  • Hi,

    I see the same issue on a computer which has O365 installed.

    Could someone suggest me what can be done for O365.

    Regards,

    Sumukh

    Friday, June 23, 2017 4:36 PM
  • We are trialing rolling back to the June 7 update for 2016 and May update for 2010 and will advice is this helps.

    using methods from https://www.msoutlook.info/question/784


    RobR


    • Edited by robrbaron Sunday, June 25, 2017 11:56 PM
    Sunday, June 25, 2017 11:55 PM
  • Hi,

    I see the same issue on a computer which has O365 installed.

    Could someone suggest me what can be done for O365.

    Regards,

    Sumukh

    I have the same issue with O365 (corporate-provided) - I don't have any of those updates listed above.

    We have a corporate form for Out Of Office which no longer works and I get the above-mentioned error: "To help prevent malicious code from running, one or more objects in this form were not loaded. For more information, contact your administrator."

    When I click through the error message and the form loads, it is missing certain fields all of which are drop-down boxes containing specific entries, as well as two calendar controls.

    Looking at "Programs and Features" by Installed On date, I see "Microsoft Office 365 ProPlus - en-us" has an installed On date of 24/06/2017 - just a co9uple of days ago.

    However, our Out Of Office form was working OK for me prior to that date (for instance Monday 19th June 2017

    Monday, June 26, 2017 12:50 PM
  • Greetings:

    We (100 users, 1 admin) have a custom form in Outlook 2013 we use to submit expenses to our Accounting Dept. KB3191938 zapped this form's ability to populate pulldown menu data from Access. At first I just uninstalled the update, assuming Microsoft would, like many times before, fix the KB in time before users re-updated with the problem. Not so much. So now, at least until I get word of a fix, I've hidden the update for all users. This was trickier for Windows 10 users, who I used the Windows 10 Show or Hide Updates Troubleshooter for (Google it...new account I cant link things yet)

    Bummer, but at least for now there's a workaround. 

    Tuesday, June 27, 2017 2:11 PM
  • Hi

    We have the same problems.

    No VB code is running in any custom forms since the security updates in June.

    I noticed that if you open and save the form you can re-open the same and the code behind works.

    Also if you open, design and run the form it works.

    But please, MS, release a fix for this asap.

    Best regards

    Roger

    Tuesday, June 27, 2017 8:15 PM
  • Hi,

    We use Outlook forms extensively as part of our business workflow processes and are crucial to our firm daily operation. Unable to run the programs for the Outlook forms have a huge impact on us.

    Roger's suggestion is not working in our case as we found the form becomes one-off and create other problems for us.

    Microsoft, please provide a fix for this ASAP.

    Regards,

    Raymond

    Thursday, June 29, 2017 3:14 AM
  • The Outlook Team is working on a fix for the forms issue.  It is not checked in yet but should be soon.  Once it is checked in I can update the ship schedule.  If you are using Office 2016 and need to test it the fix will first get to Insider Fast first, https://products.office.com/en-us/office-insider.  The Insider Fast build coming out today is 16.0.8319.1000.  I expect the fix to be in the build that immediately comes after that one.  
    Thursday, June 29, 2017 2:51 PM
  • Thanks for the update Gabe. That's great!
    Thursday, June 29, 2017 3:07 PM
  • Hello.

    If you have ActiveX Controls on the Form, and is a One-Off Form, try this: AllowActiveXOneOffForms

    HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\outlook\Security\AllowActiveXOneOffForms

    Is a DWORD with value 1.

    https://technet.microsoft.com/en-us/library/ff657852.aspx#BKMK_CustomizingActiveX

    Best Regards.

    Javier

    • Proposed as answer by DoryO Wednesday, September 13, 2017 5:35 PM
    Friday, June 30, 2017 1:41 AM
  • Thanks Javier - that worked for me!  Huge help...
    Friday, June 30, 2017 2:16 PM

  • Is there an update on when we should expect a fix for KB3191938 for Outlook 2013 users?
    Wednesday, July 5, 2017 3:10 PM
  • The fix schedule has not been determined yet.  I am checking on it and will update once I know more.  
    Wednesday, July 5, 2017 3:36 PM
  • The latest update is that the fix is being targeted to the August 8th public updates for MSI versions of Office.  For Click to Run we don't know the schedule yet but it should be sooner.  It will go out first to Insider Fast.  I will post back when I know the Insider Fast build in case anyone wants to test it.  
    Thursday, July 6, 2017 9:59 PM
  • Thanks for the update Gabe!
    Thursday, July 6, 2017 10:38 PM
  • Gabe, have there been any updates on the schedule? When can we expect the Click to Run releases? Has Microsoft locked in the Aug 8th date for the MSI release? Thanks. 
    Thursday, July 13, 2017 2:28 PM
  • I have been playing with this issue this week too. Il removing the update is not an option, you may try to play with GPO. I have set Outlook security ones and now I get a warning message, which match the setting "Warn if macro is signed....". Due to a french environment, I can't tell which settings were changed. There was one about enabling custom form/macro and another one about choosing the setting of the GPO instead of user or public folder ones. Actually, I would not say the update was bugged. It is more liked they patch a huge hole in Office.
    Friday, July 14, 2017 3:49 PM
  • My custom forms no longer work in Outlook 2013; the only code is Outlook's own date selector (OlkDateControl1). I can't uninstall the security update since it isn't listed on my machine; is it possible it was bundled with a Win10 security patch on June 13?

    Any other work arounds? I use custom forms to track communication details with clients

    Tuesday, July 18, 2017 3:53 PM
  • I was able to roll back outlook using the instructions here:

    https://support.microsoft.com/en-ca/help/2770432/how-to-revert-to-an-earlier-version-of-office-2013-or-office-2016-clic

    The May 9th version works fine with my forms as a temporary solution until MS fixes the issue

    Tuesday, July 18, 2017 4:21 PM
  • Hi all,

    The fix for the form issue has shipped to all Click to Run channels and MSI builds today.  We just added the MSI KBs to Issue#4 in the support article, https://support.office.com/en-us/article/Outlook-known-issues-in-the-June-2017-security-updates-3f6dbffd-8505-492d-b19f-b3b89369ed9b?ui=en-US&rs=en-US&ad=US

    Click to Run builds are also starting to go out.  C2R is throttled at first.  If you want to see if it is available yet click File, Office Account, Update Options, Update Now.  To see the fixed versions see the builds released July 27th, https://support.office.com/en-us/article/Version-and-build-numbers-of-update-channel-releases-ae942449-1fca-4484-898b-a933ea23def7?ui=en-US&rs=en-US&ad=US.  

    Thursday, July 27, 2017 10:43 PM
  • Hi, i still have that problem after update latest version.

    Friday, July 28, 2017 2:52 AM
  • We are still having the issue after installing the latest version also
    Friday, July 28, 2017 8:26 PM
  • Hi Gabe, thanks for the update.

    I've updated to Version 1707 (Build 8326.2059 Click-to-Run) but I still have the same behavior.

    When creating a new contact based on a custom form:

    - VBScript does not run.

    - I get a malicious code warning.

    Saturday, July 29, 2017 8:20 PM
  • I am also seeing the issue still even though I am on the latest build 1708 (Build 8417.1000). This is the fast channel.
    Saturday, July 29, 2017 9:35 PM
  • We have the issue after installing the latest version too.

    VB Script does not run when opening a custom appointment form.

    Removing KB on volumn license based Office clients worked.

    Monday, July 31, 2017 10:35 AM
  • After some evaluation:

    With the new patch, the VBS code executes on custom appointment forms when used on user's own calendar. It doesn't work when running the form on other peoples appointments (different calendar).

    (Permissions and options for e-mails in folders are set in Trust Center)

    After uninstallation it works on other peoples calendar as well (no June update or July patch).

    Monday, July 31, 2017 2:41 PM
  • Can also confirm that the Problem is NOT resolved after Upgrade to Version 1707 (Build 8326.2062 Click-to-Run).

    VB Code do not run on Custom Appointment form.
    This is getting a real Problem because we have to install the Security Updates and cannot use our Forms then...

    When will Microsoft Fix this?

    Tuesday, August 1, 2017 10:28 AM
  • Gabe,

    After further testing at least with Outlook 2010 and 2013 and 2016 installed via MSI  and Click to Run, the issue seems to be fixed when using a custom form in my mailbox however now in a shared mailbox the vb script is disabled not only for new items but for existing items as well. This is worse than the initial problem. 

    Please respond to all theses comments to let us know if Microsoft is aware of the new issue, are they going to address it? If so when? Unfortunately our clients that use our custom forms are getting fed up.  

    Wednesday, August 2, 2017 2:06 AM
  • The July 27th patch did not fix the issue in a shared folder as reported. It is actually worse because the error is not only with new contacts but also with existing contacts now. Not only that, but after uninstalling the July 27th update, our shared folders still continue to fail. How can we get back to a working custom form for both personal contact folders AND shared contact folders???
    Wednesday, August 2, 2017 2:29 AM
  • I also am still having this issue in Outlook 8326.2062 (Current Click to Run).

    On a custom form I have the following code:

    Function AdminForm_Click()
      Set Web = CreateObject("InternetExplorer.Application")
      Web.Visible = TRUE
      Web.Navigate "http://intranet/admin/forms/adminform.asp"
    End Function

    When I click the button, it does not launch the application. However, if I go to the Developer toolbar and click Design This Form, then click Run This Form, the form will relaunch and the button will work. But that is an onerous workaround to teach all of my users.

    This is the same issue I have been having since the June 13th update. The July 27th update had no effect on the issue.


    Thursday, August 3, 2017 5:49 PM
  • Javier's solution worked perfectly! Microsoft has the answer right here.
    Wednesday, August 9, 2017 3:26 AM
  • As Gregor616 and Iwhitman have pointed out, there is still an issue with opening custom forms in a shared mailbox. We are seeing this problem in Outlook 2010. I tried Javier's suggestion and added the reg key to allow ActiveX One-Off forms. Was then able to open a form in a shared mailbox without error, but the form still did not look right; labels missing, text boxes overlapping, etc. The form opens fine in my own mailbox.

    • Edited by anthony97 Tuesday, August 15, 2017 3:24 PM
    Tuesday, August 15, 2017 3:23 PM
  • Just noting this is still an issue with ver 1707 build 8326.2096.

    Our forms have a variety of text inputs, radio buttons, and checkboxes. There's a vbscript behind it that chooses recipients and/or populates text in the body of the read page of the form. We do not get an error message when loading or using the form. The vbscript simply does not execute. If we revert back to version 1705 it all works again.

    This is frustrating, because even if we uninstall the buggy update from our workstations, then disable updates under the accounts screen in office 2016, the user still gets prompted periodically that updates are needed. Invariably, the well-meaning user installs it and breaks their outlook forms. This turns it into a (terrible) game of whac-a-mole.

    We rely on forms so heavily I unfortunately wound up opening a ticket with Microsoft when this all started in June. They've been holding my $500 hostage since. This needs to get fixed.

    Friday, September 1, 2017 3:13 AM
  • On build 8326.2107 I still get the malicious code message and vbscript still does not run.
    Wednesday, September 13, 2017 2:33 PM
  • Just applied updates for Outlook 2010 I saw come up on another laptop.
    vbscript is now broken in it also.
    Version 14.0.7188.5002 (32-bit)

    It appears kb4011089 released 9/12/17 broke it.
    After I removed it my vbscript in forms worked again.

    Wednesday, September 13, 2017 3:15 PM
  • KB4011090 broke appointment forms with vbs in peoples own calender now. Now we have a big problem because this is business critical to us.


    Thursday, September 14, 2017 10:33 AM
  • We're seeing KB4011089 break all our custom forms in Outlook 2010 32 and 64.

    When I look a a form in the designer, none of the fields show, it's just a blank form. Uninstall KB4011089 and all the fields reappear so there's something in KB4011089 that's seriously broken. A lot of our forms are really simple i.e. just a bunch of fields with no macros so why this should break that I have no idea.

    Thursday, September 14, 2017 11:30 AM
  • Same issue with O365 based Outlook:

    1708 (16.0.8431.2079) doesn't work

    1705 (16.0.8201.2193) doesn't work

    1701 (16.0.7726.1049) worked

    Thursday, September 14, 2017 12:50 PM
  • Same here.  Even the simplest "hello world" test form is broken.  Uninstalling KB4011089 fixes it.

    Thursday, September 14, 2017 4:10 PM
  • Its mid September now!!

    Any news?

    Is there a fix now?

     
    Thursday, September 14, 2017 11:16 PM
  • You need to set a registry key to allow scripts and one to enable on each custom message class. 

    This is for Outlook 2016 - change the version # for the others. (Microsoft will publish a kb soon with more complete details.)

    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\Security

    If outlook and windows are the same bitness:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Outlook\Security

    DWORD: DisableCustomFormItemScript

    Value: 0 (to enable)

    then for the form itself:

    For 32 Outlook on 64 Windows:

    HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\Forms\TrustedFormScriptList

    32/32 or 64/64 is

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Outlook\Forms\TrustedFormScriptList

    REG_SZ: IPM.Contacts.custom

    Data value: leave blank

    repeat the reg_sz for each custom form name. 




    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter



    Friday, September 15, 2017 1:11 AM
  • KB4011090 took down our Outlook custom forms in 2013, just like KB3191938 did in June/July.

    Will this patch take over a month as well? 

    I love Patch Tuesdays. 

    Friday, September 15, 2017 1:07 PM
  • Diane,

    Your recommendation works wonderfully when the custom form is opened directly. However, we modified the following registry entries to ensure that our custom contact form is always used in place of the standard contact form.  In that case, the script in the custom form is still disabled, even if I add IPM.Contact to the TrustedFormScriptList key.

    [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Custom Forms]

    [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Custom Forms\Compose]
    "IPM.Contact"="IPM.Contact.Custom"

    [HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Outlook\Custom Forms\Read]
    "IPM.Contact"="IPM.Contact.Custom"

    Any thoughts?

    Jason

    Friday, September 15, 2017 4:05 PM
  • Hmm. It's working here with the registry keys forcing the custom form. Both the custom form and the default form are in the TrustedFormScriptList key.  (i had the default in to test 'run this form'.)

    I'm assuming you tested opening it directly on the same computer, which guarantees the new keys are correct and outlook was restarted... misspellings or using the wrong keys for the windows bitness would be the most likely cause otherwise.  (I know those two from experience. :)) 



    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter

    Friday, September 15, 2017 5:31 PM
  • KB4011090 took down our Outlook custom forms in 2013, just like KB3191938 did in June/July.

    Will this patch take over a month as well? 

    I love Patch Tuesdays. 

    This change is permanent - you'll need to set the keys to allow scripting in custom forms. See my post above or Custom Form Security Changes (I have reg files available - edit with your form names and run.)


    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter

    Friday, September 15, 2017 5:57 PM
  • Hi Diane,

    For me, the custom form works if I use Choose Form or Design/Run This Form tools, but if I just double click a contact, it opens in a disabled version of the custom form.  I modified the registry and tested the results in Outlook on the same machine, fwiw.

    I greatly appreciated your efforts in this matter.

    Jason

    Friday, September 15, 2017 6:30 PM
  • if you set it as the default form for the folder, does it work? 


    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter

    Friday, September 15, 2017 7:29 PM
  • thanks for the information Diane. I have been able to get those reg keys to work with 2010 and 2013 but cannot get them to work for 2016. The code still does not run. This is a C2R version using v1707 build 8326.2107 released 9/12/17. Even with the reg keys in place I still get the malicious code error and the code behind the form does not run. This is 32bit Outlook on 64bit Windows. Any thoughts?
    Saturday, September 16, 2017 12:47 AM
  • Same here. I've got Outlook 2016 C2R 1707 (16.0.8326.2096) and 1707 (16.0.8326.2107). I've added the reg keys, but VBScript never runs unless I go to Developer ribbon, Design This Form, Run This Form.
    Saturday, September 16, 2017 6:26 PM
  • Trying out your update and not sure what to put as the name as I do not have it working.
    Our forms are in the Organizational Forms Library.
    One of the forms is 'Arc Vacation Request', I tried 'IPM.Arc Vacation Request' and that didn't work.
    Do I need define it different as it's in the Organizational Forms Library?

    Thank you for your time.

    Monday, September 18, 2017 12:19 PM
  • Diane,

    I set the default form for the folder and created a new contact using that form (which I confirmed via the Message Class field.) Unfortunately, the form still doesn't work. It'll work if I Choose Form, but not otherwise.

    The form name has a space in it (ie. IPM.Contact.Company Contact), so I am trying to publish it without the space to see if that will resolve the issue.  Unfortunately, I am having problems opening the newly published form.  Another day, another problem.

    Jason

    Monday, September 18, 2017 12:32 PM
  • I have added the registry entries as described.

    The custom form is IPM.Appointment.ExacAppt I put that under the TrustedFormScriptList as well as IPM.Appointment

    I added the DisableCustomFormItemScript as well.

    I still cannot get the scripts to execute. They work in designer...just not when I open the custom form manually...or just create an appointment as we have this form set to the default for everyone.

    I am using ClicktoRun and I am adding to the Wow6432Node folder.

    thanks

    UPDATE: My custom form is now working since the update 1708(Build 8431.2079) but the update alone is not the fix...I think the registry edits proposed by Diane are part of the solution. Verifying that now with a clean install as I have tried many fixes on this computer

    • Edited by Thad Beavers Wednesday, September 27, 2017 2:38 PM
    Monday, September 18, 2017 1:32 PM
  • Diane, I got all my forms working on Outlook 2010 with your registry examples. Mine was an IPM.Note not IPM.Contact
    Still not working on Outlook 2016.
    Any ideas?
    --
    Ken


    Monday, September 18, 2017 5:43 PM
  • What is the bitness of Windows and Outlook? 


    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter

    Monday, September 18, 2017 8:53 PM
  • In my case it is 32bit Outlook and 64bit Windows
    Tuesday, September 19, 2017 12:26 AM
  • Same here: 32-bit Outlook 2016 on 64-bit Windows 7 & 64-bit Windows 10. For what it's worth, I even tried adding ALL possible registry entries (for Outlook 12/14/15/16, with and without WOW6432Node, including both my custom Message Class and its parent). Furthermore, since the Click-To-Run environment uses registry virtualization, I also tried duplicating the settings under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\16.0\Outlook. I don't currently have access to MSI-based Outlook 2016 from Volume Licensing, but it definitely looks like the registry solution doesn't work with retail setups of Outlook 2016 based on Click-To-Run.

    Update: Resolved by updating to 16.0.8431.2079, consistent with yesterday's article linked by Amol. Nice timing, Microsoft. Maybe next week, they'll get around to warning the Titanic about an iceberg in the area.

    • Edited by Ronny Ong Thursday, September 21, 2017 3:53 AM Updated
    Tuesday, September 19, 2017 5:44 AM
  • I have 32bit Outlook and 64bit Windows (win10)
    Microsoft Office Home and Business 2016 - Version 1707 (Build 8326.2107 Click-to-Run)
    --
    Ken

    Tuesday, September 19, 2017 12:34 PM
  • Hi Diane,

    I have an update to what I had posted.

    Original post:

    thanks for the information Diane. I have been able to get those reg keys to work with 2010 and 2013 but cannot get them to work for 2016. The code still does not run. This is a C2R version using v1707 build 8326.2107 released 9/12/17. Even with the reg keys in place I still get the malicious code error and the code behind the form does not run. This is 32bit Outlook on 64bit Windows. Any thoughts?

    New post:

    The reg key workaround only fixes the form in shared folders if you open the users contacts folder through opening their full mailbox. It does not work if you simply open their contacts folder as a shared contacts folder.

    Any thoughts?

    Also, it looks like the update released on 9/12/17 is no longer considers a critical update?

    Tuesday, September 19, 2017 12:48 PM
  • I did updates to my Outlook 2016 this morning as it said I had some. No clue what it installed but my outlook 2016 is working with your updates and it does REQUIRE them. I removed one of the reg_sz just to see if your registry updates were required and yes they are.
    I use IPM.Note for my forms but had to leave the IPM.Contact and IPM.Contact.Custom as removing them killed my objMe.AddressEntry.Manager.Name where I get the manager's name from MAPI

    My Outlook now says 8431.2079
    --
    Ken

    Tuesday, September 19, 2017 2:40 PM
  • I was able to get one of my forms working on Office 2016 C2R 64-bit by installing the latest update, adding the first registry DWORD under the security settings and then the separate SZ registry keys for IPM.Note and IPM.Note.Formname. 

    Tuesday, September 19, 2017 10:40 PM
  • MS - Custom form script is now disabled by default

    https://support.office.com/en-gb/article/Custom-form-script-is-now-disabled-by-default-bd8ea308-733f-4728-bfcc-d7cce0120e94



    Amol M

    • Proposed as answer by Ronny Ong Thursday, September 21, 2017 3:37 AM
    Wednesday, September 20, 2017 9:31 AM
  • Thanks Amol. So when they say it is "now" disabled by default, I wonder what they considered its status to be over the past four months.
    Sunday, October 15, 2017 2:34 PM
  • Hi all,

    An Escalation Engineer in Outlook put together a script to help automate setting the registry keys if you have a lot of forms.  I posted the script and his instructions on OneDrive, https://1drv.ms/f/s!AobSYdEz_BdhhrtDqcEulHXTPYXVFw.  I am trying to get it added to the formal documentation but this is where it is for now.  Let me know if you have any issues getting to it.  

    Wednesday, October 18, 2017 9:03 PM
  • Hello,

    I have tried the recommended registry fixes, along with adding each individual form class to the registry list, without success.  At this point, due to the business need of these forms, we have uninstalled KB4011089 from the machines until a fix is released that actually works for us.

    Is everyone having success using the recommended fixes?  Our environment is using x86 Windows 7 OS, and x86 Office 2010.   We are at a loss right now.

    I appreciate you guys and the work you have been doing to provide a resolution to these issues.

    Thanks,

    Dan

    SCCM Admin

    Wednesday, October 18, 2017 9:50 PM
  • We use a custom appointment form in Outlook 2013.
    The form is available in the library for organizational forms.

    This form is provided in shared calendar folders.
    On the one hand, in calendar folders of an additional mailbox that is also included in Outlook and, on the other hand, in shared calendar folders of Exchange users.

    In Outlook version 15.0.4927.1002 (May 2017) this works fine in all calendar folders.

    In Outlook version 15.0.4971.1002 (October 2017), the form works for the calendar folders of the additionally included Mailbox if the registry entries are set according to the instructions above.
    But if the form is called for a shared calendar of an Exchange user, the message appears:
    "To help prevent malicious code from running, one or more objects in this form were not loaded. For more information, contact your administrator."

    Saturday, October 28, 2017 4:46 PM
  • We use a custom appointment form in Outlook 2013.
    The form is available in the library for organizational forms.

    This form is provided in shared calendar folders.
    On the one hand, in calendar folders of an additional mailbox that is also included in Outlook and, on the other hand, in shared calendar folders of Exchange users.

    In Outlook version 15.0.4927.1002 (May 2017) this works fine in all calendar folders.

    In Outlook version 15.0.4971.1002 (October 2017), the form works for the calendar folders of the additionally included Mailbox if the registry entries are set according to the instructions above.
    But if the form is called for a shared calendar of an Exchange user, the message appears:
    "To help prevent malicious code from running, one or more objects in this form were not loaded. For more information, contact your administrator."


    We have exactly the same issue with shared contact custom forms. Could MS please comment on when a patch can be expected?
    Monday, November 6, 2017 6:36 AM
  • We use a custom appointment form in Outlook 2013.
    The form is available in the library for organizational forms.

    This form is provided in shared calendar folders.
    On the one hand, in calendar folders of an additional mailbox that is also included in Outlook and, on the other hand, in shared calendar folders of Exchange users.

    In Outlook version 15.0.4927.1002 (May 2017) this works fine in all calendar folders.

    In Outlook version 15.0.4971.1002 (October 2017), the form works for the calendar folders of the additionally included Mailbox if the registry entries are set according to the instructions above.
    But if the form is called for a shared calendar of an Exchange user, the message appears:
    "To help prevent malicious code from running, one or more objects in this form were not loaded. For more information, contact your administrator."


    We have exactly the same issue with shared contact custom forms. Could MS please comment on when a patch can be expected?
    We have similar issues with custom Appointment forms being used on shared calendars.  I've tried all these registry edits (carefully) and I'm able to get the malicious code message to go away, but the script behind refuses to run except when I enter design mode of the form.  My current version of Outlook is 15.0.4963.1000
    Tuesday, November 21, 2017 7:42 PM
  • same problem here.  I can get the forms to work everywhere except shared calendars.  Hope this is patched soon.
    Tuesday, November 21, 2017 10:56 PM
  • What's happening with this?  Is someone looking at the problem?  Do we need to log an issue somewhere else for Microsoft to pay attention to this?
    Friday, November 24, 2017 8:36 PM
  • KB4011090 took down our Outlook custom forms in 2013, just like KB3191938 did in June/July.

    Will this patch take over a month as well? 

    I love Patch Tuesdays. 

    This change is permanent - you'll need to set the keys to allow scripting in custom forms. See my post above or Custom Form Security Changes (I have reg files available - edit with your form names and run.)


    Diane Poremsky [MVP - Outlook]
    Outlook & Exchange Solutions Center
    Outlook Tips
    Subscribe to Exchange Messaging Outlook weekly newsletter

    Microsoft can't fix this and decided to disable forms scripts altogether? Or forcing customers to switch to Sharepoint and/or JS Addins? Ok, I can understand this. But why there is no option to revert this back with ONE registry setting?

    I just wasted almost an hour investigating this and creating registry keys for 20+ forms (not ready to run an unofficial script against my client's exchange server). And because forms have localized names, I ended up counting characters and replacing them with underscores. Something like:

    IPM.Task.___ __ __

    Hope this helps someone who is also using localized forms.

    And do you have any info about when MS going to drop custom Outlook forms? Such 'features' make me think that this may happen soon.



    Tuesday, December 12, 2017 10:17 AM