3

When I download software on Windows they get a security flag that I can see by right-clicking it and selecting Properties. On the General tab there is a section that says "Security: This file came from another computer and might be blocked to help protect this computer.", with a checkbox for unblocking it.

I am a software developer and I want to do some testing with this.

Once I unblock a file the checkbox goes away. How can I manually re-block it?

sourcenouveau
  • 3,666

1 Answers1

6

Files are marked as "from another computer" using NTFS Alternate Data Streams, as James so graciously explained in another question. I also found a nice guide called Introduction to Alternate Data Streams.

You can run commands to read and write ADS data from the Command Prompt:

MORE < "myapp.exe:Zone.Identifier"

(
ECHO [ZoneTransfer]
ECHO ZoneId=4
)>myapp.exe:Zone.Identifier

And from Powershell:

Get-Content -Path .\myapp.exe -Stream Zone.Identifier

Set-Content -Path .\myapp.exe -Stream Zone.Identifier -Value "[ZoneTransfer]`nZoneId=4"

Some browsers also store other metadata there, such as the Referer and Host URLs of a download.

You can read more about zones at About URL Security Zones. The default ones are:

Value    Setting
------------------------------
0        My Computer
1        Local Intranet Zone
2        Trusted sites Zone
3        Internet Zone
4        Restricted Sites Zone

You can read about other known ADS names at Known Alternate Stream Names.

sourcenouveau
  • 3,666