Microsoft Enhances Windows Security by Turning Off File Previews for Downloads

On Mon, Oct 14, 2025, Microsoft implemented a significant security update to Windows File Explorer to enhance protection against credential theft.

This update automatically disables the preview pane for files downloaded from the internet. The aim is to mitigate a vulnerability that could expose users' NTLM hashes, which are sensitive credentials used for network authentication .

The adjustment addresses a long-standing risk where malicious files, particularly those embedding HTML elements like <link> or <src> tags pointing to external resources, could initiate unauthorized network requests during previews.

Historically, attackers have exploited this vulnerability to harvest hashes, which could lead to lateral movement within networks or full account takeovers.

Microsoft's default approach now prioritizes proactive security without requiring user intervention, aligning with the increasing need for protection amid rising phishing and malware threats targeting Windows users.

The new behavior utilizes the "Mark of the Web" (MotW) attribute, which Windows applies to files from untrusted sources such as the Internet or Internet Zone file shares. Once tagged, these files will not display previews in File Explorer. Instead, users will receive a warning message: "The file you are attempting to preview could harm your computer. If you trust the file and the source from which you received it, you may open it to view its contents."

For general users, this change represents a minor workflow adjustment: previews are deactivated for potentially risky files, while local documents or trusted shares remain unaffected. This security measure is automatically enabled post-update without requiring additional user actions.

IT administrators and advanced users will benefit from reduced attack surfaces in enterprise environments, particularly where NTLMv2 vulnerabilities persist despite the adoption of modern authentication methods like Kerberos .

Although this is not a complete lockdown, it encourages safer practices. Previews remain available for verified files, promoting source verification before file access.

To override the default setting for a trusted download, users can right-click the file in File Explorer, select Properties, and check the "Unblock" box. Note that changes may not take effect until the next login.

For entire file shares in Internet Zones, users can adjust Internet Options in the Control Panel by navigating to the Security tab and adding the share's address to the Local Intranet or Trusted Sites zone. Caution is advised, as this reduces defenses for all files from that source and should be reserved for verified networks.

Microsoft's FAQ emphasizes the importance of trusting files only from known origins, highlighting that this update is about risk mitigation rather than elimination. As cyber threats evolve, such incremental updates help maintain Windows' resilience while simplifying daily use.

Based on reporting by Cyber Security News.