That is in IE. Open Internet Explorer - Tools - Internet Options - Security
tab - see button "Custom Level" (click it) - scroll down, Java is near end
of list.
Scripting is blocked in email by default as it is considered less secure.
So prior to enabling javascript, make sure that the friend intentionally
included the script in the email. If so, then you can go to Tools | Options
| Security in WinMail and put Winmail into the Internet zone. Then you can
open the message and the script will work. Subsequently, you may wish to
put Winmail back into the Restricted zone to block any other scripts.