Microsoft Outlook 2016 Security Technical Implementation Guide

The Microsoft Outlook 2016 Security Technical Implementation Guide (V2 R4) has 64 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

64STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R4

CurrentPublished Mon Jan 05 2026

Text in Outlook that represents internet and network paths must not be automatically turned into hyperlinks.

Microsoft Outlook 2016 Security Technical Implementation Guide

Assessment Title

Rule Text

Text in Outlook that represents internet and network paths must not be automatically turned into hyperlinks.

Description

Discussion Text

The ability of Outlook to automatically turn text that represents internet and network paths into hyperlinks would allow users to click on those hyperlinks in an email message and access malicious or otherwise harmful websites.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-251872

Rule

SV-251872r961863_rule

Severity

medium

Rule Version

DTOO425

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> "Internet and network path into hyperlinks" is set to "Disabled".

Procedure: Use the Windows Registry Editor to navigate to the following key: 

HKCU\software\policies\Microsoft\office\16.0\outlook\options\autoformat

Criteria: If the value pgrfafo_25_1 is REG_DWORD = 0, this is not a finding.

Implementation Procedure

Fix Text

Set the policy User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Outlook Options >> "Internet and network path into hyperlinks" must be set to "Disabled".

STIG check 63 of 64 in the Microsoft Outlook 2016 STIG checklist

← Previous · V-251867Outlook Rich Text options must be set for converting to plain text format.Next · V-279945 →The version of Outlook running on the system must be a supported version.