- Microsoft disabled the preview of downloaded files to prevent the leakage of NTLM credentials.
- The block applies to files with the Mark of the Web (MotW) label following the October security updates.
- It is possible to enable the function manually from the file properties or in bulk using PowerShell commands.
You've probably experienced this: you open File Explorer, click on a PDF or image you just downloaded, and suddenly the preview pane goes blank or displays a warning that the file might be dangerous. Don't panic looking for problems with your PC or assume something is broken, because the truth is that Microsoft has recently improved the security of Windows 11 and Windows 10 with some updates.
Basically, the Redmond company has decided it's better to err on the side of caution than risk a nasty surprise, disabling by default the preview of any document labeled "downloaded from the internet." While this might inconvenience us on a daily basis, it serves a serious purpose related to protecting our credentials and the privacy of our system.
What exactly has happened and why does it affect us?
This whole mess started with the rollout of the October 14th security patches, specifically updates KB5066793 for versions 22H2 and 23H2 , and KB5066835 for versions 24H2 and 25H2 . From then on, the system marks files from the web with a tag called Mark of the Web (MotW), which acts as a security barrier.
The technical reason is that a vulnerability existed that allowed NTLM hash leaks . In simpler terms: some malicious files with HTML tags could trick the preview pane into attempting to connect to an external server. By doing so, Windows would automatically send the user's authentication data, allowing an attacker to steal sensitive credentials without the user noticing. To stop these attacks, Microsoft has blocked the preview of these files by default.
How to recover the preview step by step
If you fully trust the source of your files and want to recover that useful functionality, you have several ways to do so, from the slowest and safest to more automated solutions.
Manual method: file by file
This is the best option if you only need to glance at a couple of documents and don't want to take any risks. Simply right-click on the file , go to "Properties," and in the "General" tab, find the security section where you'll see a checkbox that says "Unblock ." Check it and click OK, and the preview will magically reappear.
Bulk method: using PowerShell
If you have a folder full of PDFs or images and don't have time to go through them one by one, you can use a PowerShell script. However, only do this if you trust all the contents of that folder. The steps are as follows:
- Press Windows + X and open the Windows Terminal or PowerShell as administrator.
- To unlock all PDFs in a specific path, type the following command:
Get-ChildItem "C:\Tu\Ruta\A\La\Carpeta" -Recurse -Filter *.pdf | Unblock-File - If you prefer to unlock absolutely everything on that path regardless of its length, use:
Get-ChildItem -Path "C:\Tu\Ruta\La\Carpeta" -Recurse | Unblock-File
It's essential that you replace the path in quotation marks with the actual location of your files (for example, your Downloads folder). Once executed, you will likely need to restart File Explorer or your computer for the changes to take effect.
External Alternative: QuickLook
If you find unlocking files a hassle, there's a wonderful alternative called QuickLook , available in the Microsoft Store. It's an open-source tool that mimics the macOS function: you select a file, press the spacebar , and get an instant preview, regardless of whether the file is from the internet, saving you the trouble of using the native Windows preview panel.
Special considerations and limitations
It's important to note that this block also affects those working with network drives or NAS devices . In these cases, PowerShell sometimes fails to recognize mapped paths or server IP addresses, complicating the bulk removal of the MotW tag. To resolve this on shared resources, it's recommended to add the server address to the Local Intranet security zone or to Trusted Sites via Internet Options in the Control Panel.
This change in behavior is a drastic but necessary measure to prevent the operating system from becoming a gateway for identity theft. Whether through manual unlocking in the properties, running PowerShell commands to clean entire folders, or installing complementary software like QuickLook, it's possible to view the contents of downloaded documents again, provided it's done with awareness of the security risks involved.