Security settings that are based on distribution lists may not be correctly synchronized to the local Offline Store file in Outlook 2003

In Microsoft Office Outlook 2003, you configure the security settings, and you base these settings on distribution list (DL) membership. You move users from one DL to another DL. However, the security settings are not applied correctly when users use Outlook 2003 in cached mode. In this case, the users can still access attachments that the users should be unable to access.

To resolve this problem, apply the hotfix rollup package that is described in the following Microsoft Knowledge Base article:

Microsoft has confirmed that this is a bug in the Microsoft products that are listed in the "Applies to" section.

Generally, distribution list (DL)-based security groups are an acceptable way to configure security settings. It is only in the specific scenario that is described in this article where the security settings are not applied correctly. When users use Outlook 2003 in cached mode, Outlook 2003 synchronizes the security settings from the server and stores the security settings in the local Offline Store (OST) file. In this scenario, when you move a user from one DL to another DL, there is no actual change to the security setting message on the server. Therefore, Outlook 2003 does not recognize that anything has to be newly synchronized to the OST.

After you apply this hotfix, Outlook 2003 compares the security settings from the server to the security settings in the OST. If the security settings are different, a forced synchronization of the security settings from the server to the OST occurs. Because of the timing of this check, users may have to start Outlook 2003 two times before the updated security settings from the new DL are applied correctly.

For more information about how to use the Outlook security template in Outlook 2003 to customize security settings, visit the following Microsoft Web site: