The developers have disabled the preview feature in File Explorer (formerly Windows Explorer) for files downloaded from the internet. Now previews are automatically blocked to prevent credential theft via malicious documents.
The change has already taken effect for users who have installed the October updates for Windows 11 and Windows Server.
As the company explains, the preview feature is disabled by default only for files from network folders that Windows classifies as external (Internet zone), and for files that have the Mark of the Web (MotW), which indicates that the file was downloaded via a browser, received as an email attachment, and so on.
When you try to preview such a file, the preview pane will display a warning: “The file you’re trying to preview might harm your computer. If you trust the file and the source you got it from, open it to view its contents.”
This safeguard is designed to prevent attackers from exploiting vulnerabilities that allow the extraction of NTLM hashes when users view files containing HTML tags (such as <link>, <src>, and others) that reference external paths on attackers’ servers.
This attack vector requires virtually no user interaction beyond selecting a file for preview, and eliminates the need to trick the victim into opening or executing a file on the system.
“Starting with Windows updates released on October 14, 2025 and later, File Explorer will automatically disable the preview feature for files downloaded from the internet,” Microsoft reports. “This change is intended to improve security by preventing exploitation of a vulnerability that could lead to NTLM hash leakage when previewing potentially unsafe files.”
If necessary, you can manually remove the block for an individual file. To do this, right-click the file in File Explorer, select Properties, and click the Unblock button at the bottom of the General tab.
You can also disable the blocking for an entire network folder at once by adding its address to Trusted sites via Internet Options in the Windows Control Panel (Security tab).