XCLN: Improving the Security of PST Files (143241)


The information in this article applies to:

  • Microsoft Exchange Client 4.0
  • Microsoft Exchange Client 5.0
  • Microsoft Exchange Windows NT client 4.0
  • Microsoft Exchange Windows NT client 5.0
  • Microsoft Outlook 97 8.0
  • Microsoft Outlook 97 8.01
  • Microsoft Outlook 97 8.02
This article was previously published under Q143241

SUMMARY

The password protection for Microsoft personal information store (PST) files provides only limited security. Adopting certain practices can increase this security. Utilities that can remove or bypass the password on a PST have been posted on the Internet. None of these utilities are endorsed or supported by Microsoft.

MORE INFORMATION

Limiting physical access to a PST file increases the security of the data. Anyone who has physical access to a PST file and has one of these utilities can remove or bypass the PST password. These utilities will remove or bypass the PST password even for PSTs created with the Compressible Encryption and Best Encryption options.

In order to protect sensitive e-mail against unauthorized access, consider the following practices:
  • Do not use a PST file. Store all sensitive e-mail in the Exchange Server Information Store. This is the default configuration for all clients that are used with Exchange Server.

  • If you need to use a PST file that is located on a file server or is in a shared directory, use file-level permissions to control which users can access the PST file.

  • If you use a PST file that is located on your local computer, limit access to the computer by using password-protected screen savers, locking the computer, or locking the office where the computer resides. If you are running Microsoft Windows NT, you can use the Windows NT File System (NTFS) to limit access to the owner of the PST.
Modification Type:MinorLast Reviewed:8/16/2005
Keywords:kbusage KB143241
©2004 Microsoft Corporation. All rights reserved.