• Notice regarding image hosts and attachments. See here.

Damn You Microsoft!!

Soldato
Joined
31 Jan 2022
Posts
3,658
Location
UK
What on Earth are they thinking? I use backups on my system, frequently transfer files, and have multiple PC's that I share information with. And Microsoft go an implement a security system that marks files as "not from this PC" with a nest of warnings, flags, blocks and who knows what?! Thanks Microsoft. Another piece of totally useless junk that spread like a virus all over my PC's and backups.
Anyway, for anyone else who wants to end the madness, here are the CMD files I used.


@Echo off
title Stop Windows preserving zone information
echo.
echo This changes the setting for the CURRENT Windows user.
echo It prevents future downloads and attachments from retaining Zone.Identifier.
echo.
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v SaveZoneInformation /t REG_DWORD /d 1 /f
echo.
if errorlevel 1 (
echo The registry change failed.
) else (
echo The registry change succeeded.
echo Sign out or restart Windows after running both cleanup files.
)
echo.
pause



and....



echo off
setlocal
title Remove existing Windows zone marks from all local drives

net session >nul 2>&1
if not "%errorlevel%"=="0" (
echo Requesting administrator permission...
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath '%~f0' -Verb RunAs"
exit /b
)

echo.
echo This will remove Zone.Identifier from every accessible file
echo on all FIXED and REMOVABLE local drives.
echo Network drives and optical drives are not included.
echo This may take a long time.
echo.
pause

powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$drives = Get-CimInstance Win32_LogicalDisk | Where-Object { $_.DriveType -in 2,3 -and $_.DeviceID }; foreach ($d in $drives) { $root = $d.DeviceID + '\'; Write-Host ('Cleaning ' + $root) -ForegroundColor Cyan; Get-ChildItem -LiteralPath $root -Recurse -File -Force -ErrorAction SilentlyContinue | Unblock-File -ErrorAction SilentlyContinue }; Write-Host 'Finished.' -ForegroundColor Green"

echo.
echo Cleanup finished. Some protected files may have been skipped.
echo Sign out or restart Windows.
echo.
pause
endlocal
 
I use backups, automatic file syncing at boot up,file transfer
to multiple drives sequencially
though not multiple PCs
not seen this happen (yet)
nice to see already a solution should it happen
so this may come in handy
 
Yeah can't say I've seen this either outside of from an email and I'm moving stuff around all the time too.... even to linux, android and os-x...
 
It's not a thing. I suspect OP has some poorly written app or AV which is triggering this based upon the registry values

Lol. It most certainly is a thing. And I quote...



Microsoft change to downloaded files – October 2025​

Starting with Windows security updates released on 14 October 2025, Microsoft changed the way File Explorer treats files that Windows considers to have come from the Internet.

Windows has long added hidden zone information, commonly called Mark of the Web (MotW), to files downloaded through browsers, email and some other applications. This identifies the file as originating outside the local computer.

Previously, most users rarely noticed this information. Following the October 2025 security change, Windows began treating these marked files more restrictively. In particular, File Explorer disables Preview Pane previews for files carrying Mark of the Web, displaying a warning that the file could potentially harm the computer and requiring the user to unblock or otherwise trust the file before normal preview behaviour is restored.

Microsoft introduced the change to protect against a vulnerability in which specially constructed files could cause NTLM credential information to be leaked simply by being previewed in File Explorer.

A file can normally be trusted individually by right-clicking it, selecting Properties, and choosing Unblock. However, for people who routinely download large numbers of trusted files, this can result in a considerable number of files requiring manual intervention.

Windows also has an existing Attachment Manager policy called “Do not preserve zone information in file attachments.” When this policy is enabled, Windows stops attaching the Internet-zone information to newly saved files. Microsoft notes that doing this also means Windows can no longer use that zone information when assessing the potential risk of those files, so it represents a reduction in that layer of security.

In short: Mark of the Web was not introduced in October 2025. What Microsoft recently changed was how aggressively File Explorer responds to files already carrying that mark.
 
Last edited:
Back
Top Bottom