The answers in "This file came from another computer..." - how can I unblock all the files in a folder without having to unblock them individually? explain how to "Unblock" a file that came from a remote source. For testing purposes, I would like to accomplish the reverse. How do I set a file's zone identifier so that Windows will "block" it?

I'm partial to a PowerShell solution, but other mechanisms are acceptable.

  • You would have to set the zone identifier, to a zone, you have blocked. What zones are actually blocked, would entirely be based, on your network configuration
    – Ramhound
    Jul 24, 2018 at 20:11
  • You could do the following, in this case for the file dunozone.exe: set-content -path .\dunozone.exe -stream Zone.Identifier Then in the prompts type: [ZoneTransfer] for Value[0], then type ZoneId=3 for Value[1]. Then hit Enter for Value[2]. You can confirm the stream with the command: get-item -path .\dunozone.exe -stream *, Checking the properties of the file will give you the Unblock option. Jul 24, 2018 at 20:23
  • 3
    Or I guess just: set-content -path .\file.exe -stream Zone.Identifier -value [ZoneTransfer],ZoneId=3 where: 0="Local machine",1="Local intranet",2="Trusted sites",3="Internet",4="Restricted sites". Jul 24, 2018 at 20:39
  • @HelpingHand Looks like that does it, under the assumption that the computer is configured to block the Internet zone as Ramhound mentions. (Kinda wonder what would happen if you used Restricted.) Add that assumption, add some quotes for clarity/safety ('[ZoneTransfer]','ZoneId=3', since it's a string array), and stick it in an answer?
    – jpmc26
    Jul 24, 2018 at 20:54

1 Answer 1


When a file is downloaded to a NTFS file system, you may notice in the file properties dialog there is an additional Security section with an Unblock checkbox: enter image description here

This additional data about the file is stored in an Alternate Data Stream (ADS). The file is typically written to by the browser process at the end of the download. E.g. Chrome.exe, Msedge.exe, etc. This operation can be observed with a file system monitoring tool such as Process Monitor.

Process Monitor trace showing Chrome.exe writing the Zone.Identifier stream to add the 'mark-of-the-web' to the file

With the public symbols, the full stack reveals the code in the Chromium project to add this information is here: https://source.chromium.org/chromium/chromium/src/+/main:components/services/quarantine/quarantine_win.cc;l=225

Alternate Data Streams can be viewed in a number of ways, with tools such as Streams but now more conveniently with PowerShell.

For example, to view all the streams of a file, the following PowerShell command can be used:

Get-Item -Path Autologon.exe -Stream *

The output is as follows:

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\ads\Autologon.exe::$DATA
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\ads
PSChildName   : Autologon.exe::$DATA
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\ads\Autologon.exe
Stream        : :$DATA
Length        : 138920

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\ads\Autologon.exe:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\ads
PSChildName   : Autologon.exe:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\ads\Autologon.exe
Stream        : Zone.Identifier
Length        : 26

For the purposes of this question, it is the Zone.Identifier stream that we are interested in. Keeping with PowerShell, we can view it using the get-content command:

Get-Content .\Autologon.exe:zone.identifier


To manually add or update a Zone.Identifier named stream and set the value of the stream, we can run the following PowerShell command:

Set-Content -Path .\file.exe -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'

Where the ZoneId specified can be one of the following values:

0 = "Local machine"
1 = "Local intranet"
2 = "Trusted sites"
3 = "Internet"
4 = "Restricted sites"

Note: To remove a ZoneTransfer stream from a file and therefore perform the same operation as unblocking the file from the file properties dialog, you can run either of the following commands:

  • Unblock-File -path .\file.exe
  • Remove-Item -Path .\file.exe -Stream Zone.Identifier

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .