Microsoft’s quiet but sweeping change to File Explorer — disabling the Preview pane for files flagged as coming from the Internet — is a security-first response to a proven NTLM credential‑theft vector that landed in the October 2025 Patch Tuesday updates and immediately rippled through enterprises and knowledge‑worker workflows.
Background / Overview
Windows has long used a small provenance marker called Mark of the Web (MoTW) — implemented as a Zone.Identifier alternate data stream on NTFS — to record that a file originated from the Internet, an email attachment, or another untrusted source. That metadata is consumed by Attachment Manager, SmartScreen, Office Protected View and other subsystems to decide whether content should be sandboxed, warned about, or blocked. Starting with security updates released around October 14–15, 2025, Microsoft changed File Explorer’s behavior so that any file still carrying MoTW is no longer handed to preview handlers; instead the Preview pane displays a protective message: “The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents.”This is not a cosmetic bug. The change was explicitly framed as a mitigation for a class of Shell/preview‑related vulnerabilities that can force a Windows client to resolve attacker‑controlled network paths during a seemingly innocuous preview operation, thereby triggering NTLM authentication flows and leaking negotiable authentication material. Several security outlets and Microsoft’s update notes associate the behavioral hardening with the October 2025 cumulative security packages (community references commonly point at KB5066835 and related October rollups).
How the attack works: preview → network → NTLM leakage
The preview handler attack chain
- Many preview handlers (for PDFs, Office files, images and other formats) run inside File Explorer’s process space to render content inline. That performance choice historically improved productivity but increases the attack surface.
- Some file formats or embedded HTML/CSS/image references can contain external URLs or UNC paths (file:// or \server\share). When Explorer or a preview handler resolves those references, the OS may attempt to access the remote resource.
- If the remote resource requires Windows authentication (SMB/NTLM), the client can negotiate authentication automatically, sending negotiable NTLM material (challenge/response data, hashes or session tokens) that an attacker controlling the endpoint can capture. Those artifacts can be cracked, relayed, or reused to pivot laterally in a corporate environment.
Why previewing is especially dangerous
- The attack requires minimal user interaction: simply selecting a file or letting Explorer enumerate and generate thumbnails/previews is often sufficient to trigger name resolution and a network authentication attempt.
- Because Explorer invokes rendering in-process, a large and diverse set of parsers and third‑party preview handlers are implicated. Fixing individual parsers would be slow and error‑prone; a behavior change is a fast, high‑impact mitigation.
Timeline and technical verification
- Microsoft rolled October 2025 cumulative security updates (Patch Tuesday) beginning October 14, 2025; these packages included multiple fixes for Shell and Explorer issues and were followed by out‑of‑band patches to address regressions.
- The behavioral hardening — File Explorer no longer handing Internet‑zoned (MoTW) files to preview handlers — was documented in update notes and observed in the field by multiple security vendors and community researchers.
- Microsoft framed the change as a fix to prevent NTLM hash leakage when previewing files that contain external references (HTML tags like <link> and <src> or UNC paths). Security vendors and patch‑tracking blogs tied the change to several CVEs patched in October 2025, including vulnerabilities that previously enabled similar credential leakage patterns.
Who and what is affected
- Affected systems: Windows client and server SKUs that installed October 14–15, 2025 security updates and later cumulative packages — in practice this includes Windows 11 builds receiving the October rollups (commonly referenced as versions 24H2 and 25H2 in community threads) and matching Server SKUs. Enterprise release‑health pages and KB entries list the relevant build updates.
- Affected files: Any file that retains the Mark of the Web (ZoneId = Internet) — that includes files downloaded from web browsers, saved attachments from email clients, and many files synced from cloud services or accessed from Internet‑zoned network shares. Local files created directly on the machine and files in Trusted or Local Intranet zones continue to preview normally.
- Impacted users: High‑volume document triage teams (accounts payable, legal, HR, procurement), administrators who relied on quick local previewing, service desks fielding increased tickets, and any workflow that depended on the Preview pane for efficiency.
What admin and users are seeing — symptoms and immediate workarounds
Symptom: Instead of a rendered preview, Explorer’s Preview pane shows the protective message described above when a file has MoTW.Immediate per‑file workaround:
- Right‑click the file → Properties.
- Under the General tab, check Unblock (if present), Apply → OK.
- Refresh Explorer or sign out/sign back in if the change doesn’t appear immediately.
- Use PowerShell to unblock many files in a controlled folder:
- Run as appropriate: Get‑ChildItem -Path "C:\path\to\folder" -Recurse | Unblock‑File
- Log and audit the operation before applying at scale.
- Add trusted network share URLs to the Local intranet or Trusted sites zone via Internet Options → Security, which prevents MoTW being applied to files saved from those locations.
- Group Policy: for controlled environments, administrators can use Attachment Manager policies (for example, “Do not preserve zone information in file attachments”) — this is high‑impact and erases an OS‑level provenance signal, so it must be paired with compensating controls and logging.
Strengths of Microsoft’s approach
- Immediate attack surface reduction: By changing Explorer’s decision logic to deny Preview for Internet‑zoned files, Microsoft removed a low‑interaction trigger that could be exploited at scale. This is a rapid, high‑leverage mitigation compared with waiting for every parser or third‑party preview handler to be fixed.
- Defense‑first posture: Prioritizing credential protection over convenience is aligned with modern secure‑by‑default thinking. Preventing credential leakage (NTLM hashes) protects downstream resources and reduces the ability of attackers to mount relay or pass‑the‑hash attacks from harvested artifacts.
- Configurable exceptions exist: Windows already exposes zoning and Attachment Manager controls that let IT teams target trusted sources cleanly if needed, instead of forcing a global rollback of protections.
Practical risks and operational downsides
- Productivity hit: The Preview pane is integral to many high‑throughput workflows. For teams that triage dozens of documents per day, the change will produce measurable slowdowns and likely raise help‑desk load and business impact.
- Risky workarounds: The most expedient fixes — mass‑unblocking files or turning off MoTW preservation — remove a valuable OS‑level signal used by multiple protections (Office Protected View, SmartScreen) and therefore increase exposure surface. Bulk unblocking should be auditable, logged, and tightly scoped.
- Incomplete vendor transparency: Microsoft’s public advisory described the behavioral change and the security rationale but did not publish a low‑level engineering postmortem describing the exact registry keys or URLAction changes. Community researchers have produced plausible reconstructions (for example, inferring a change to the Internet Zone’s preview URL action) but treat such inferences as community‑reported until Microsoft provides engineering details. Administrators should avoid undocumented registry edits in production.
Enterprise playbook — balance security and usability
- Patch first, investigate second.
- Deploy October 2025 security updates (and subsequent out‑of‑band fixes) widely to eliminate the underlying vulnerabilities Microsoft fixed. Use the usual phased pilot → broad deploy pipeline and ensure rollback plans are in place for regressions.
- Identify high‑impact user groups.
- Run an inventory of teams that rely heavily on Explorer previews (AP, legal, HR). Treat these groups as pilots for targeted exception policies.
- Implement targeted allowances.
- Add trusted vendor portals and internal file servers to Local intranet/Trusted sites for those pilot groups. Use controlled GPOs and Intune policies to apply exceptions per user or device.
- Use auditable unblocking.
- For controlled bulk unblocking, script Unblock‑File centrally with logging and change control; avoid user‑driven mass unblocking that leaves no trace. 1) Run scripts from managed endpoints, 2) record file hashes and source URLs, 3) require manager approval for bulk operations.
- Harden authentication and network egress.
- Disable NTLM where feasible, require SMB signing, prefer Kerberos, and restrict SMB/NetBIOS egress from endpoints to the Internet. These mitigations reduce the value of any leaked NTLM artifacts.
- Monitor and alert.
- Add detection rules for unusual NTLM/SMB authentication attempts, monitor for outbound SMB connections, and tune EDR rules for preview‑related network activity.
- Prepare communications and training.
- Tell users what changed and why, provide simple step‑by‑step help for unblocking trusted files, and publish policies for submitting files for bulk review/unblock. Clear guidance reduces risky ad‑hoc workarounds.
Could Microsoft have taken a more surgical approach?
Critics suggest more granular mitigations — for example, an AI‑driven content scanner inside the Preview pane or a sandboxed renderer for Internet‑zoned files that disallows network resolution — could restore convenience without rolling back security. Those are legitimate long‑term directions, but they are nontrivial to design and validate across the large surface area of third‑party preview handlers and legacy formats. In the short term, Microsoft chose a fast, broadly effective defensive pivot. Expect vendor engineering to iterate: a future Known Issue Rollback (KIR) or targeted hotfix may restore previewing under narrower, safer conditions once robust mitigations are validated.Notable inaccuracies and unverifiable claims to flag
- Claim: “Unblocking files via Properties requires administrative privileges.” This is not supported by Microsoft’s public guidance or community reproductions; per‑file Unblock typically appears in the General tab to the file owner and does not require admin rights in normal scenarios. If an environment enforces stricter ACLs or endpoint policies, admin consent may be necessary — but that is a site‑specific configuration, not a universal behavior. Treat any reporting that states admin privileges are always required as suspect.
- Claim: “This change only affects Windows 11 24H2 and 25H2.” The change affects Windows 11 and Windows Server systems that received the October 2025 security updates; community notes reference 24H2 and 25H2 builds in field reports, but the underlying mitigation is applied in the cumulative security updates distributed in mid‑October and therefore can affect any SKUs that installed those packages. Administrators should check their release‑health pages and KB details for exact build impact.
Looking ahead — what this sets in motion
- Expect attacker pivoting: with this door closed, adversaries will look for other low‑interaction primitives (thumbnailing, archive indexers, cloud sync clients, third‑party viewers) that may still induce outbound authentication. Security teams must harden egress controls and reduce NTLM reliance to make such pivots less valuable.
- Vendor evolution: Microsoft and third‑party preview handler vendors will be pressured to design safer, sandboxed renderers that cannot cause outbound authentication or that explicitly disallow network resolution when content originates from Internet zones.
- Policy normalization: Organizations that historically tolerated NTLM and wide egress will find stronger impetus to modernize authentication (Kerberos/modern auth), enable SMB signing, and block SMB traffic to the public Internet. These changes are technically demanding but materially reduce attack surface.
Conclusion
Microsoft’s decision to disable File Explorer previews for Internet‑zoned files is blunt but defensible: faced with a class of vulnerabilities that let an attacker harvest NTLM authentication artifacts with almost zero user interaction, the vendor closed the fastest path to compromise. The outcome is a familiar security trade‑off — usability for safety — that will impose real costs on high‑throughput document workflows and force IT teams into tactical decisions about trusted sources, bulk unblocking, and authentication hardening.For administrators, the sensible path is straightforward: patch promptly, identify and pilot exceptions for critical workflows, avoid wholesale disablement of MoTW, and pair any convenience restores with strong auditing and network hardening. In parallel, defenders should treat the change as a prompt to accelerate longer‑term modernization of authentication and to demand safer previewing architectures from vendors.
This is not the end of the story — it is the start of a tighter balance between convenience and credential security across the Windows ecosystem, and the next months will show whether more surgical fixes arrive that return the Preview pane without reopening the credential leak.
Source: WebProNews Microsoft Disables Windows 11 File Explorer Previews to Block NTLM Attacks
