Fix PDF Preview in File Explorer on Windows 11 (25H2 and Later)
File Explorer stopped previewing PDF files on Windows 11 after the October 2025 update (KB5066835), and it did it on purpose: the update made Explorer refuse to preview any file that carries the Mark of the Web, the tag Windows puts on anything downloaded from the internet or saved from email. Instead of the page you get "The file you are attempting to preview could harm your computer." This guide gives the two-second fix for one file, the setting that fixes it for every file from a source you trust, and, for the people looking after other people's PCs, the Group Policy and Intune way to do this across an office without switching off the protection that was added for a reason.
The invoice Jake couldn't see, and the fix he almost shipped to six PCs
Jake's phone-repair shop lives on PDFs: supplier invoices, courier labels, warranty forms. He reads them in File Explorer's preview pane, twenty a day, without opening a single one. After the October update, every PDF in his Downloads folder showed the same gray box: the file you are attempting to preview could harm your computer.
He found a registry tweak online that "restores previews". It worked. Then he started typing it into the second PC.
"Stop," Ethan said, reading over his shoulder. "You know what that tweak does? It tells Windows to stop writing down where files came from. Every file. Forever. The preview is the least of what uses that note. Word uses it to decide whether a document's macros run. Windows uses it to decide whether an installer gets the SmartScreen check. You'd be switching all of that off on six machines to save one right-click."
"Then what do I do with twenty invoices a day?"
"Twenty invoices from the same three suppliers, that arrive from the same mail server, and land in the same folder. Tell Windows those three sources are trusted. Then the note never gets written for them, and every other file keeps its protection. Ten minutes on one PC, and the same ten minutes as a policy for the others."
That's the whole guide: the difference between removing a warning and removing the reason for it.
What actually changed, and why the preview pane says a PDF could harm you
Windows tags every file that arrives from the internet, from email, or from a network share it doesn't trust with a small piece of metadata called the Mark of the Web (MotW): a hidden data stream named Zone.Identifier that records which security zone the file came from. SmartScreen reads it before running installers; Office reads it before enabling macros; and since KB5066835 (October 14, 2025, OS builds 26200.6899 and 26100.6899), File Explorer reads it before rendering a preview. It shipped as an improvement, not a bug: File Explorer automatically disables the preview feature for files downloaded from the internet.
The reason is a class of attack that used the preview pane itself. Previewing a file means parsing it. A crafted document can contain references to a remote server (a UNC path, an image link, a font); when the previewer follows that reference, Windows may try to authenticate to the attacker's server, leaking an NTLM hash of the signed-in user's password without a single click. Blocking previews of untrusted files closes that door. The cost is that every legitimate invoice from your supplier now looks untrusted too, because the tag doesn't know the difference between a supplier and an attacker. Only you do, which is why the fixes below are about telling Windows which sources you trust.
What is affected: PDFs, Office documents, images and text files that carry the tag, in the preview pane and in some cases thumbnails. What is not: files you created locally, files from a trusted zone, files copied from a USB stick (no tag), and files whose tag you removed.
Fix 1: Unblock the file (one file, or a whole folder)
One file. Right-click the PDF → Properties → on the General tab, at the bottom, tick Unblock → Apply. The checkbox only appears when the tag is present, so if you don't see it, this file isn't tagged and the preview problem is something else (see the fix table). Click the file again in Explorer; the preview renders.
A folder. Open Terminal and run:
Get-ChildItem "$env:USERPROFILE\Downloads" -Recurse -File | Unblock-FileUnblock-File removes the Zone.Identifier stream from each file, which is exactly what the checkbox does. Point it at any folder; it's safe to re-run. To see which files are tagged before you touch them:
Get-ChildItem "$env:USERPROFILE\Downloads" -File | Where-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } | Select-Object NameWhat Unblock does and doesn't do. It removes the mark from files that already exist. Tomorrow's downloads arrive tagged again. That's correct behavior, and it's why the folder command is a habit, not a fix. For files that keep coming from the same place, Fix 2 stops the tag at the source.
🙋♂️ Jake's Reality Check
"Is unblocking a PDF from my supplier dangerous?"
The straight answer: unblocking a file you were expecting, from a sender you know, is what the checkbox is for. The risk is in unblocking things you didn't ask for: the "invoice" from a company you've never dealt with, the PDF that arrived with a slightly wrong sender address. The tag is a reminder to think for one second. Unblock the twenty you expected; leave the one you didn't, and open it nowhere.
Fix 2: Trust the source, so its files never get the tag
Windows decides the zone (and therefore the tag) from where a file came from. Files from the Local intranet or Trusted sites zones are not marked, or are treated as trusted when they are. So for the sources that produce your everyday files, tell Windows they're yours:
- Press Win+R, type
inetcpl.cpl, Enter (yes, the old Internet Options dialog still owns the security zones for the whole of Windows, not just a browser). - Security tab → Local intranet → Sites → Advanced. Add your file server or NAS by name (
\\fileserver, orfile://fileserver), and your SharePoint or intranet address (https://yourcompany.sharepoint.com). OK. - For an external service you trust (a supplier portal, a courier's label site), use Trusted sites → Sites instead. Clear Require server verification (https:) only if the site is plain http, which in 2026 it shouldn't be.
- Apply. New files from those sources arrive without the tag. Existing files still need a one-time Unblock.
Email attachments are the awkward one, because the "source" is your mail program, not a site. Outlook saves attachments with the tag from the Internet zone by design. The honest options: save supplier attachments to a folder you Unblock with the PowerShell line above (a scheduled task can do it nightly), or have the supplier deliver to your SharePoint or file server, where the zone rule applies. Don't try to trust "the whole internet".
Network shares by IP address get the Internet zone, not the intranet zone, which is why a NAS opened as \\192.168.1.20 tags everything while \\nas doesn't. Use the name, or add the IP address explicitly to Local intranet.
Update, October 24, 2026: "security pdf preview enable in Windows 11", the question as people type it. There is no single switch called "security PDF preview." What you're enabling is permission for one file, or one source of files, to be previewed despite the "could harm your computer" tag. For one file: right-click it, Properties, tick Unblock, OK, then press F5 in File Explorer. For every file from a source you trust: Fix 2 above adds that source to the Trusted sites zone, so its PDFs arrive without the tag and preview straight away.
What to leave alone: the registry value that disables the tag for everything (the "SaveZoneInformation" tweak that circulates on forums) turns the warning off for files from anywhere, including the ones the warning exists for. On a PC you look after for someone else, use Unblock or the trusted source, never the global switch.
How to tell whether a file is tagged (thirty seconds)
Before changing any setting, confirm the mark is really the cause. Three ways, quickest first:
- Properties. Right-click → Properties. A tagged file shows the Security: This file came from another computer and might be blocked line with the Unblock checkbox at the bottom of the General tab. No line, no tag.
- PowerShell, one file.
Get-Content .\invoice.pdf -Stream Zone.Identifierprints something like[ZoneTransfer],ZoneId=3, and oftenHostUrl=with the address it came from. ZoneId 3 is Internet, 4 is Restricted, 2 is Trusted, 1 is Local intranet. An error saying the stream doesn't exist means the file is clean. - PowerShell, a folder. The listing command in Fix 1 prints every tagged file under a folder; run it against Downloads and Desktop and you'll usually see the pattern (everything from the browser, everything saved from mail) that tells you which source to trust.
If the file has no tag and still won't preview, skip to thumbnails and handlers: the mark isn't your problem, the viewer is.
Automate the folder Unblock for sources you can't put in a zone
Email attachments and a supplier who mails files from a different domain every week can't be trusted by zone, and nobody wants to right-click twenty invoices. A scheduled task that Unblocks one folder nightly is the honest middle ground: the mark still lands on everything else, and only the folder you chose is cleared.
- Create a folder for those files, for example
C:\Users\you\Documents\Invoices, and save attachments there. - Save this as
C:\Scripts\unblock-invoices.ps1:
Get-ChildItem "$env:USERPROFILE\Documents\Invoices" -Recurse -File | Unblock-File- Open Task Scheduler → Create Task → name it, tick Run whether user is logged on or not only if you need it overnight (otherwise leave it per user).
- Trigger: Daily, at a time the PC is on. Action: Start a program,
powershell.exe, arguments-NoProfile -ExecutionPolicy Bypass -File C:\Scripts\unblock-invoices.ps1. - Run it once from the task list to confirm; then check a file's Properties: the Unblock line is gone.
Keep the folder narrow. The whole point is that the task touches the one place your expected files land, and nothing in Downloads.
The registry tweak everyone shares, and why an admin shouldn't ship it
The tweak that circulates (including in the earlier version of this very page) sets SaveZoneInformation = 1 under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments. It maps to the Group Policy Do not preserve zone information in file attachments, and it does exactly that: Windows stops writing the Mark of the Web on every file that user downloads. Previews come back. So does everything else the mark protected:
| Protection that reads the mark | What happens with the tweak on |
|---|---|
| Office Protected View and the macro block for internet files | Documents from anywhere open fully trusted; macros run on a click |
| SmartScreen's check on downloaded installers and scripts | Skipped; an unknown .exe runs like a local one |
| Explorer's "this file came from another computer" prompt | Gone |
| Defender's attachment reputation and some EDR rules | Weakened; they key on the zone stream |
| The preview-pane NTLM protection this page is about | Off |
For a home PC where one careful person downloads from three known places, that's a trade someone might make knowingly. For an office, it undoes a layer of the security baseline on every machine at once, and it's the kind of change that shows up in an audit as "who turned this off, and why". The zone approach in Fix 2 gives the same previews for the files you actually need, and nothing else changes. If you already applied the tweak and want it gone: delete the SaveZoneInformation value (or set it to 0) and sign out and in. Windows resumes tagging new downloads; existing untagged files stay untagged.
For IT admins: fix it for the whole office without weakening it
The office version of Fix 2 is one policy, and it's the one to reach for before anyone types regedit on a user's PC.
Group Policy: Site to Zone Assignment List
Computer Configuration → Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Site to Zone Assignment List → Enabled → Show. Add each source with its zone number:
| Value name | Value | Meaning |
|---|---|---|
file://fileserver | 1 | Local intranet: your file server by name |
file://nas.yourcompany.local | 1 | Local intranet: the NAS |
https://yourcompany.sharepoint.com | 2 | Trusted sites: your SharePoint tenant |
https://portal.supplier.example | 2 | Trusted sites: a supplier portal you rely on |
Zone 1 is Local intranet, 2 is Trusted sites, 3 is Internet, 4 is Restricted. The policy applies to Explorer, Office and every app that asks Windows for a zone, not only the browser (the Internet Explorer folder name is historical). Run gpupdate /force on a test PC and download a file from one of those sources: no tag, preview works, everything from anywhere else still carries the mark.
Intune: the same list through the settings catalog
Devices → Configuration → Create → Windows 10 and later → Settings catalog → search Site to Zone Assignment List (under Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page). Enable it and enter the same name/zone pairs. Assign to the device group. It's the identical policy, delivered by MDM; devices pick it up at the next check-in.
The policy you should not deploy, and how to find it if someone did
Do not preserve zone information in file attachments (User Configuration → Administrative Templates → Windows Components → Attachment Manager) is the Group Policy form of the registry tweak. It's occasionally turned on by a well-meaning ticket. To find it across machines, check for the value it writes:
Invoke-Command -ComputerName (Get-Content C:\temp\pcs.txt) -ScriptBlock {
Get-ChildItem 'Registry::HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments' -ErrorAction SilentlyContinue |
Get-ItemProperty | Select-Object @{n='PC';e={$env:COMPUTERNAME}}, PSParentPath, SaveZoneInformation
}Anything returning SaveZoneInformation = 1 has the tag switched off for that user. Set the policy to Not Configured (or Disabled), and let the zone list carry the previews instead.
Two related knobs worth knowing
- Hide mechanisms to remove zone information (same Attachment Manager folder): stops users from clicking Unblock at all. Pair it with the zone list, or users will be stuck with previews they can't fix. - Defender for Endpoint / third-party EDR often keys attachment rules on the zone stream. Removing the mark fleet-wide can quietly lower detection coverage; the zone list doesn't, because files from untrusted sources keep it.
✅ The admin's version in one line
Trust named sources with the Site to Zone Assignment List; never disable zone information; keep Unblock available for the odd legitimate file. Previews return for the files people actually work with, and the October 2025 protection stays on for everything else.
Thumbnails, Office files, and the preview handlers themselves
Three things get mixed up with this issue and have different fixes:
- Thumbnails (the small image on the file icon) are separate from the preview pane. If PDFs show a generic icon, that's a missing thumbnail handler, not the mark. Adobe Acrobat and the Edge PDF handler install one; Edge's is on by default in Windows 11. Settings → System → Storage → Cleanup recommendations won't help; clearing the thumbnail cache (cleanmgr → Thumbnails) sometimes does. - The preview pane itself must be on: View → Show → Preview pane (Alt+P). And the file type needs a preview handler: Windows 11 previews PDFs through Edge's handler; if a third-party PDF app took over the association and doesn't ship a handler, previews stop for every PDF, tagged or not. Setting Edge or Acrobat as the default for .pdf restores it. - Office documents follow the same mark rule, plus Office's own Protected View. An Unblocked or trusted-zone .docx previews; a tagged one shows the same warning. Word's Trust Center → Protected View settings do not affect Explorer's pane.
A quick way to tell which problem you have: copy a tagged PDF to a USB stick and back (the copy loses the tag). If the copy previews, it was the mark; if it still doesn't, it's the handler or the pane.
When the preview still won't show: the fix table
| What you see | What it means | What to do |
|---|---|---|
| "The file you are attempting to preview could harm your computer" | The file carries the Mark of the Web | Unblock it, or trust its source (Fix 2) |
| No Unblock checkbox in Properties | The file isn't tagged; the block is elsewhere | Check the preview handler and that the pane is on (above) |
| Unblock works, but tomorrow's downloads are blocked again | Expected: new downloads get the tag | Trust the source with zones, or schedule the folder Unblock |
Files from \\192.168.x.x blocked, from \\server fine | IP addresses fall in the Internet zone | Use the name, or add the IP to Local intranet |
| Email attachments always blocked | Outlook saves with the Internet zone | Save to a folder you Unblock, or route via SharePoint/file server |
| Previews blocked on a domain PC even after adding sites | Group Policy overrides the local zone list | Add the source through the Site to Zone Assignment List policy |
| Unblock checkbox is missing on every file, even tagged ones | Hide mechanisms to remove zone information is enabled | Ask the admin, or use Unblock-File (it may be blocked too) |
| Preview pane blank, no warning, for all PDFs | Preview handler missing or wrong default app | Set Edge or Acrobat as default for .pdf; sign out and in |
| Works for PDFs, not for .docx/.xlsx | Office handler or Protected View interaction | Same mark rules; Unblock or trust the source; ensure Office is installed and registered |
| Previews stopped after a Windows update, files aren't from the internet | Occasionally a cumulative update re-registers handlers | Run sfc /scannow and reset the .pdf default; our SFC and DISM guide |
PDF preview in File Explorer: the questions people search
Why does File Explorer say "the file you are attempting to preview could harm your computer"?
Because the file carries the Mark of the Web (it was downloaded or saved from email), and since the October 2025 update (KB5066835) File Explorer refuses to preview tagged files. It's a security feature that blocks preview-based credential theft, not a sign the file is infected.
How do I enable PDF preview in File Explorer on Windows 11?
Turn the pane on (View → Show → Preview pane, or Alt+P), make sure a PDF app with a preview handler is the default (Edge or Acrobat), and for downloaded files either Unblock them (Properties → Unblock) or add their source to the Local intranet or Trusted sites zone.
How do I fix the PDF preview not working after the 25H2 update?
Right-click the file → Properties → tick Unblock → Apply. For a whole Downloads folder, run Get-ChildItem "$env:USERPROFILE\Downloads" -Recurse -File | Unblock-File in PowerShell. For files from your own server or SharePoint, add that source to the Local intranet zone so new files don't get tagged.
Is the SaveZoneInformation registry tweak safe?
It restores previews by stopping Windows from recording where any download came from, which also disables Office's Protected View for internet files, SmartScreen checks on downloaded installers, and other protections. It's a blunt tool; trusting specific sources through security zones gives the same previews without the loss.
How do IT admins fix PDF previews for everyone?
Deploy the Site to Zone Assignment List Group Policy (or the same setting in Intune's settings catalog) listing the file servers, SharePoint tenant and trusted portals as zone 1 or 2. Files from those sources arrive untagged and preview normally; everything else keeps the protection. Don't deploy Do not preserve zone information in file attachments.
What is the Mark of the Web?
A hidden Zone.Identifier data stream Windows attaches to files that came from the internet, email or untrusted network locations, recording their security zone. SmartScreen, Office Protected View and, since October 2025, File Explorer's preview pane all read it.
Why are files from my NAS blocked but not from my file server?
If you open the NAS by IP address (\\192.168.1.20), Windows treats it as the Internet zone; a name (\\nas) lands in Local intranet. Use the name or add the IP address to the Local intranet sites list.
Why don't email attachments preview even after I trust my company sites?
Outlook saves attachments with the Internet zone regardless of sender. Save them to a folder you periodically Unblock, or have documents delivered to SharePoint or a file server where the zone rule applies.
Does this affect Word and Excel files too?
Yes. Any tagged file that has a preview handler (Office documents, images, text) is refused the same way. Office's own Protected View is separate and still applies when you open the file.
How do I check whether a file has the Mark of the Web?
In PowerShell: Get-Item .\file.pdf -Stream Zone.Identifier returns the stream if it's there (and an error if not). Get-Content .\file.pdf -Stream Zone.Identifier shows the zone number, and often the source URL.
Can I turn the preview pane back to the pre-October behavior?
Not with a supported switch for the pane alone. The block is tied to the mark; your choices are to remove the mark per file (Unblock), avoid it per source (zones), or disable it for all downloads (the tweak, not recommended).
Did Microsoft fix this in a later update?
No. It arrived as an improvement in KB5066835, and later updates keep the behavior. The intended path is exactly this page: unblock legitimate files and trust legitimate sources.
Does Unblock-File work on files on a network share?
Yes, if you have write permission there; it removes the stream on the share. Files copied from the share later may be re-tagged depending on the share's zone, so trusting the share by name is the durable fix.
Why does the Unblock checkbox not appear?
Either the file has no mark (the block is something else), or an administrator enabled Hide mechanisms to remove zone information. Copying the file to a FAT-formatted USB stick strips the stream, which is a useful diagnostic and a clumsy workaround.
Does this happen on Windows 10 too?
The October 2025 change shipped for Windows 11 24H2 and 25H2. Windows 10 22H2 machines on ESU received the same hardening in their updates, so the fixes here apply there as well.
Is there a PowerShell command to see all blocked files?
Get-ChildItem <folder> -Recurse -File | Where-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } | Select-Object FullName lists every tagged file under a folder.
Should a small business just disable the mark and move on?
Only if you accept that documents from anywhere will open with macros enabled and downloads will skip SmartScreen. For most small businesses, ten minutes adding the file server and SharePoint to the intranet zone is the better ten minutes.
If this warning has been in your way since October, you weren't doing anything wrong, and neither was Windows; it was protecting you from a real attack with a blunt rule, and nobody explained the rule. Unblock the files you were expecting, trust the places your work comes from, and leave the rest of the protection on. If a screen here has moved by the time you read it, tell me through the contact page; Windows changes these dialogs between versions, and this page stays accurate because readers write in.
📌 If you keep one line from this page
The preview pane isn't broken; it refuses files that carry the Mark of the Web. Unblock fixes one file; trusting the source (Local intranet / Trusted sites, or the Site to Zone Assignment List policy for an office) fixes it for good.
Don't disable zone information for all downloads; it turns off far more than the preview.
Revision note. Originally published October 23, 2025, days after the change; rewritten September 26, 2026, replacing the registry tweak recommendation with the zone-based fix and adding the Group Policy and Intune section. The behavior is current as of KB5066835 and every update since. Next check: if a Windows update adds a preview-pane-specific policy. Unblock what you expected; trust where your work comes from.