Sign in Subscribe
File sharing

Windows Updates Disable File Explorer Preview for Internet-Downloaded Files

Strategic Insights

— 1 min read

The October 2025 Windows updates, aimed at fixing code-based vulnerabilities, introduce a significant change in how File Explorer handles files downloaded from the internet. A crucial aspect of this update is the disabling of the Preview Pane feature, which allows users to view file contents without opening them. This feature is disabled for files marked with the Mark of the Web (MotW) and those viewed on an Internet Zone file share, where the risk of NTLM hash leakage is mitigated.

Key Takeaways:

  • The Windows updates in October 2025 introduce a change in how File Explorer handles files downloaded from the internet, specifically disabling the Preview Pane feature for files with the Mark of the Web (MotW) and Internet Zone file share files.
  • This change is designed to prevent NTLM hash leakage when previewing files containing HTML tags referencing external paths, a vulnerability that attackers could exploit to capture sensitive credentials.
  • Compromised NTLM hashes can be cracked offline to reveal the hashed password and reused by attackers to authenticate to other services.
  • The change can be reversed by removing the Mark of the Web (MotW) from a file or adding its location to the Local intranet or Trusted sites security zone.
  • Microsoft introduced this security change to close a dangerous attack route that doesn't require users to open/run downloaded files.
  • The update may cause inconvenience to users who rely on quick previews of email attachments or downloads, especially considering the former method to reverse the block involves opening the file properties.

Statistics:

  • The change affects the Preview Pane feature in Windows File Explorer.
  • The Preview Pane is disabled for files marked with MotW and Internet Zone file share files.
  • The update mitigates a vulnerability where NTLM hash leakage might occur if users preview files containing HTML tags.
  • The NTLM hashes can be cracked offline and reused to authenticate to other services.
  • The update introduces a safety message displayed in the preview pane, suggesting alternatives for users to safely view contents.

Sources:

  • "Microsoft".
  • "October 2025 Windows updates".

Read more