If MetaCompliance phishing emails are not being recorded as opened, this may be due to automatic image downloading being disabled within Exchange or Outlook.

Your organisation’s IT or Exchange administrators can configure Group Policies to enable Automatic Picture Download for Exchange email communications.

Automatic Picture Download allows MetaCompliance to track email opens by placing a small image within the email content. When the email client downloads the image, an open is recorded within the MetaCompliance Reporting for the email.

See the following article for further information on this:

• How is an 'Open' audit for a simulated phish recorded?

Two Common Solutions to Enable Automatic Image Download

There are two recommended approaches to ensure images download automatically, allowing accurate tracking of email opens:

1. Allow automatic download of images across your organisation.
2. Use Group Policy to add MetaCompliance domains to the Safe Senders List.

1. Allow Automatic Download of Images across your Organisation.

• In Group Policy, load the Outlook {{version}} template.
• Navigate to User Configuration → Administrative Templates → Microsoft Outlook {{version}} > Security.
• Click Automatic Picture Download Settings.
• Open Display pictures and external content in HTML e-mail.
• Select Enabled, then click OK.

(a) Using the Office Customization Tool to allow automatic download of Internet content.

• Navigate to the Modify user settings page.
• Go to Microsoft Outlook {{version}} → Security → Automatic Picture Download Settings.
• Open Display pictures and external content in HTML e-mail and click OK.
• On the File menu, click Save to create the customisation file for deployment.

(b) Automatically download content from people in Safe Senders and Safe Recipients Lists.

This policy setting controls whether Outlook automatically downloads external content from Safe Senders or Safe Recipients.

If Enabled, Outlook will automatically download this content.

Registry Hive:          HKEY_CURRENT_USER

Registry Path:          software\policies\microsoft\office\{{version}}\outlook\options\mail

Value Name:           unblockspecificsenders

Value Type:             REG_DWORD

Enabled Value:       1

Disabled Value:      0

(c) Display pictures and external content in HTML email.

This policy setting controls whether Outlook downloads untrusted pictures and external content located in HTML email messages without users explicitly choosing to download them.

• Enabled: Content will not download automatically unless the sender is in Safe Senders. 
• Disabled: Content will download automatically for all HTML emails. 
• Not configured: Outlook downloads only content considered safe.

⚠️ Note: Setting this to Enabled allows blanket downloading for all organisational messages. It does not need to be enabled if Safe Senders is already configured.

Registry Hive:         HKEY_CURRENT_USERRegistry

Path:                       software\policies\microsoft\office\{{version}}\outlook\options\mail

Value Name:           blockextcontent

Value Type:             REG_DWORD

Enabled Value:       1

Disabled Value:      0

2. Using Group Policy to add MetaCompliance domains to the Safe Senders List. 

This method adjusts your Safe Senders List to allow accurate tracking of phishing email opens.
If your organisation does not already have a Safe Senders List, you must create one.

(a) Creating a Safe Senders List

1. Create a .txt file listing safe senders (domains or addresses), each on a new line.
2. Save it to a file share that is accessible by all clients; for example, \\FileServer\sharedfiles\
3. Add the appropriate Office version Administrative Template to Group Policy:
   • Office 2010 Administrative Template: https://www.microsoft.com/en-us/download/details.aspx?id=18968
   • Office 2013 Administrative Template: https://www.microsoft.com/en-au/download/details.aspx?id=35554
   • Office 2016 Administrative Template: https://www.microsoft.com/en-us/download/details.aspx?id=49030
4. Create a new GPO for customising Outlook or Office.
5. In the GPO, go to User Configuration → Policies → Administrative Templates → Microsoft Office Outlook {{version}} → Options → Preferences → Junk Email.
6. Open Specify path to Safe Senders List; for example, \\FileServer\sharedfiles\safesenderslist.txt
7. Set this policy to 'Enabled' and specify the path to the .txt file that you've just saved in Step 2 above.
8. The above setting tells Outlook where to locate the import file; however, it does not tell Outlook to import the file. This is done through a registry key entry.
   • You can add this in the same GPO by navigating to User Configuration → Preferences → Windows Settings → Registry.
9. Right-click Registry and select New Registry Item.
10. Set the properties to the following:
    • Action: Update
    • Hive: HKEY_CURRENT_USER
    • Key Path: Software\Policies\Microsoft\Office\1x.0\Outlook\Options\Mail
    • Value Name: JunkMailImportLists
    • Value Type: REG_DWORD
    • Value Data:1
    • Base: Decimal

⚠️ Note: The 1x.0 placeholder represents your version of Outlook (11.0 = Outlook 2003, 12.0 = Outlook 2007, 14.0 = Outlook 2010, 15.0 = Outlook 2013, and 16.0 = Outlook 2016).

For example, the key path for Outlook 2010 will be:

• Software → Policies → Microsoft → Office → 14.0 → Outlook → Options → Mail.

(b) Configure Junk Email settings and save the Junk Email filter file changes.

• Use Group Policy to configure Junk Email filter files for users. In Group Policy, load the Outlook 2013 template, and open the following:
  • User Configuration → Administrative Templates → Microsoft Outlook {{version}} → Outlook Options → Preferences → Junk Email.
• Configure the appropriate Junk Email settings:

• Click OK.

(c) Configure Automatic Picture Download - Web Beacon Protection

In Group Policy:

1. Load the Outlook {{version}} template.
2. Navigate to User Configuration > Administrative Templates → Microsoft Outlook {{version}} → Security.
3. Click Automatic Picture Download Settings.
4. Open Automatically Download Content for E-Mail from People in Safe Senders and Safe Recipients Lists.
5. Click Enabled, followed by OK.

(d) Custom Send From Domains and IP Addresses for Safe Senders

• MetaCompliance Mail Server IP Addresses