Microsoft has updated File Explorer to automatically block file previews for items downloaded from the internet, aiming to prevent credential theft via malicious documents.<\/p>\n
The feature, active after the October 2025 security update, disables previews for files marked with \u201cMark of the Web\u201d or accessed from other places on the Internet.<\/p>\n
This change protects against NTLM hash leaks that can occur when previewing compromised files, though users can manually unblock trusted items if needed.<\/p>\n
This update addresses a security flaw that could expose NTLM hashes when users preview files containing HTML elements like\u00a0 Starting with the October 2025 Windows security update, File Explorer will now display a warning message in the preview pane for certain files:<\/p>\n \u201cThe file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents.\u201d<\/em><\/p>\n This message appears for files tagged with the\u00a0Mark of the Web (MotW), <\/strong>indicating they were downloaded from the internet\u2014or those accessed from an Internet Zone<\/strong> file share. The update is designed to enhance user protection by restricting previews of potentially unsafe files.<\/p>\n If you trust the file and its origin, Windows allows you to remove the Internet security block. To do this for a downloaded file, right-click it in File Explorer, choose\u00a0Properties<\/strong>, and select\u00a0Unblock<\/strong>.<\/p>\n Note that this change may not apply instantly, it becomes active after your next login.<\/p>\n For files stored on an Internet Zone network share, open the\u00a0Internet Options<\/strong>\u00a0control panel, go to the\u00a0Security<\/strong>\u00a0tab, and add the file share\u2019s address to the\u00a0Local intranet<\/strong>\u00a0or\u00a0Trusted sites<\/strong> zone.<\/p>\n However, keep in mind that doing this reduces security for all files from that source, so it should only be used for trusted locations.<\/p>\n","protected":false},"excerpt":{"rendered":" Microsoft has updated File Explorer to automatically block file previews for items downloaded from the internet, aiming to prevent credential theft via malicious documents. The feature, active after the October 2025 security update, disables previews for files marked with \u201cMark of the Web\u201d or accessed from other places on the Internet. This change protects against […]<\/p>\n","protected":false},"author":56,"featured_media":127937,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[319],"tags":[64582,64583,64462],"class_list":{"0":"post-127934","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-windows","8":"tag-internet-zone-file-share","9":"tag-mark-of-the-web","10":"tag-windows-11-file-explorer"},"yoast_head":"\n<link><\/code>\u00a0or\u00a0<src><\/code>\u00a0that connect to external resources. Attackers could exploit this behavior in File Explorer\u2019s preview pane to intercept authentication data and steal user credentials.<\/p>\nComing with October 2025 Update<\/strong><\/h3>\n
How to Disable This?<\/strong><\/h3>\n