[ms office - 2016] Outlook OST Files in LocalAppData

[HereIGoAgain2601]

Hello,

 

I have read a few threads over the last couple of years, and experimented with our Office 365 / Outlook 2016 settings regarding the download of email. We have tried both Cached Exchange Mode, and Online mode with various combinations of local and roaming profiles.

 

We are currently using the default "Cached Exchange" mode, and we seem to have got rid of most of the headaches we were having. We have had to leave it stored on the default local drive, as when we tried using the GPO to redirect the OST to a network drive, but unfortunately we ended up with 20-30 duplicate files. Even with data de-dup turned on our file server, it started eating up all the data drives.

 

My question is whether anyone has managed to get it successfully redirecting to a network drive, or found a way to encrypt the data? We are considering options as are concerned about personal data being left on the machines. Our laptops are already encrypted, but we have been asked a question about data security on the physical desktop PCs. Want to try and avoid bitlockering them if possible.

 

Thank you

[DSapseid]

I have my OST redirected to my home drive. I did it manually though not via gpo it seems to work nicely with no issues at all as yet.

 

It hosts a small .nst file in the profile still which apparently is to do with O365 groups.

 

I have just googled about nst files and 365 and found this technet link about how to redirect ost files to a server share.

[Boredguy]

We use a mixture of GPO and Registry tweaks for our Outlook to store the OST on a central file server so that when users move between workstations they don't have to redownload the e-mail all the time.

It's been working nicely for the last few years.

[psydii]

Do not redirect the OST to a network share. It is not designed for this, and for large number of users it will destroy your fileserver performance. Microsoft put it in AppData\Local for a very good reason.

 

To ensure that it is encrypted on disk Bitlocker would be the best option (but is dependent on a hardware TPM to solve the shared machine in a school usecase).

 

If Bitlocker isn't an option I'd look at EFS (https://msdn.microsoft.com/library/cc875821.aspx) but that would be some work to ensure the necessary folders got encrypted

(see: https://technet.microsoft.com/en-us/library/2007.03.securitywatch.aspx for some 'how to' tips)

 

Alternatively on shared machines you could simply remove outlook.exe and require people to use OWA instead. We've got several people using OWA who don't even realise they aren't using the full Outlook client.

[DJ-1701]

Do not redirect the OST to a network share. It is not designed for this, and for large number of users it will destroy your fileserver performance. Microsoft put it in AppData\Local for a very good reason.

 

Never had an issue with it hosted on our server to be honest.

 

To ensure that it is encrypted on disk Bitlocker would be the best option (but is dependent on a hardware TPM to solve the shared machine in a school usecase).

 

Technically from Windows 8 up you don't need a TPM to use Bitlocker, and could use a password. I've done this on a few Windows 10 machines which didn't have TPM replacing CompuSec which we used for Windows 7.

[psydii]

Never had an issue with it hosted on our server to be honest.

 

https://support.microsoft.com/en-gb/help/297019/limits-to-using-personal-folders--pst-files-over-lan-and-wan-links

" Offline Folders (.ost) files and Personal Address Book (.pab) files on a network share that are accessed remotely are also unsupported configurations. "

 

"Microsoft will not assist in troubleshooting slow performance due to networked .pst or .ost files. Microsoft will only assist if the performance issue is reproduced while the .pst or .ost file is located on either a hard disk that is physically attached to the computer that is running Outlook, or on a virtual hard disk (VHD) that is attached to the virtual machine that is running Outlook."

 

Technically from Windows 8 up you don't need a TPM to use Bitlocker, and could use a password. I've done this on a few Windows 10 machines which didn't have TPM replacing CompuSec which we used for Windows 7.

Is this viable on shared computers?