If you’ve ever downloaded a script, installer, or even a help file from the internet, you’ve likely encountered a frustrating Windows security feature: the file is “blocked,” preventing it from running or displaying correctly. This is due to the “Mark of the Web,” a security mechanism designed to protect you from potentially malicious content.

PowerShell provides a simple and elegant solution to this problem: the Unblock-File cmdlet. This guide will explain what the Mark of the Web is, how to identify blocked files, and how to use Unblock-File to safely manage them.

What is the “Mark of the Web”?

Whenever you download a file from the internet, Windows adds a hidden piece of metadata to it called an Alternate Data Stream (ADS). This specific stream is named Zone.Identifier, and it contains information about where the file came from.

You can view this hidden data using PowerShell: 

Get-Item -Path "C:\Downloads\MyDownloadedFile.zip" -Stream Zone.Identifier

If the file has the Mark of the Web, you can read the contents of the stream: 

Get-Content -Path "C:\Downloads\MyDownloadedFile.zip" -Stream Zone.Identifier

Example Output: 

[ZoneTransfer]
ZoneId=3

The ZoneId=3 is the key. It tells Windows that the file came from the “Internet Zone,” which is considered untrusted. This triggers various security protections.

ZoneId Zone Name Meaning
0 Local Machine A trusted local file.
1 Intranet A trusted network location.
2 Trusted Sites A whitelisted source.
3 Internet From the web (potentially unsafe).
4 Restricted A high-risk zone.

Symptoms of a Blocked File

When a file is marked with ZoneId=3, you might encounter:

  • PowerShell Scripts: An error message like File C:\scripts\myscript.ps1 cannot be loaded because running scripts is disabled on this system.
  • Executables and Installers: A Windows SmartScreen warning that prevents the file from running.
  • CHM or HTML Files: The file opens, but the content is blank or shows a “Navigation to the webpage was canceled” message.
  • ZIP Files: When you extract the files, all the extracted files inherit the Mark of the Web and are also blocked.

The Solution: The Unblock-File Cmdlet

The Unblock-File cmdlet is the official and safest way to remove the Zone.Identifier stream from a file, effectively telling Windows that you trust it.

Unblocking a Single File

This is the most common use case. If you have downloaded a file that you trust, you can unblock it like this: 

Unblock-File -Path "C:\Downloads\MyDownloadedInstaller.exe"

You can also do this from the GUI by right-clicking the file, selecting Properties, and checking the “Unblock” box at the bottom of the General tab.

Unblock-File in PowerShell

Unblocking All Files in a Directory

If you have downloaded and extracted a ZIP file, you may need to unblock all the files at once. You can do this by piping the output of Get-ChildItem to Unblock-File.

# Unblock all files in a specific directory and all its subdirectories
Get-ChildItem -Path "C:\Downloads\MyExtractedFolder" -Recurse | Unblock-File

Verifying That a File is Unblocked

You can verify that the Zone.Identifier stream has been removed by running Get-Item -Stream * again. After unblocking, the stream will be gone.

Security Considerations: When (and When Not) to Unblock

The Mark of the Web is an important security feature. You should only unblock files when you are certain that they come from a trusted source.

  • Do Unblock:

    • Installers from official vendor websites.
    • PowerShell scripts from your own company or a trusted community source.
    • Documentation files that are failing to display correctly.

  • Do Not Unblock:

    • Files from unknown or suspicious email attachments.
    • Files downloaded from untrusted websites.

Conclusion

The Unblock-File cmdlet is a simple but essential tool for any PowerShell user. It provides a safe and scriptable way to manage the “Mark of the Web” and deal with Windows’ security protections for downloaded files.

By understanding how the Zone.Identifier stream works and how to use Unblock-File to manage it, you can ensure that your trusted scripts and applications run smoothly without compromising your system’s security.

Pro Tip: To make your life easier after downloading a large number of trusted files, you can run this one-liner to unblock everything in your Downloads folder: 

Get-ChildItem -Path "$env:USERPROFILE\Downloads" -Recurse | Unblock-File -Verbose