Prevent Users from Download Files in Windows

The Attachment Manager is included in Microsoft Windows to help protect your computer from unsafe attachments that you might receive with an e-mail message and from unsafe files you might save from the Internet.

While users are unlikely to encounter download interruptions for sites they use every day, they might encounter them for legitimate downloads on sites rarely. To help streamline the user experience for Enterprises, a Group Policy is available.

This policy setting lets you manage the default risk level for file types. To fully customize the risk level for file attachments, you may also have to configure the trust logic for file attachments:

• High Risk – If the attachment is in the list of high risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file.

• Moderate Risk – If the attachment is in the list of Moderate Risk file types, Windows will not prompt the user before accessing the file, regardless of the file’s zone information.

• Low Risk – If the attachment is in the list of low risk file types, Windows will not prompt the user before accessing the file, regardless of the file’s zone information.

Here you can also learn to block Potentially Unwanted Applications in Windows. The potentially unwanted application (PUA) protection feature in Microsoft Defender Antivirus can detect and block PUA on endpoints in your network.

• New Security Features for Windows 11
• Protect Devices with Windows 11 Smart App Control
• Best Antivirus for Windows 11 Microsoft Defender | App Browser Protection | Firewall Protection

Prevent Users from Download Files in Windows using Group Policy

There are several features of the Attachment Manager that can be configured by using Group Policy or the registry.

Let’s check how you can disable Block Files Downloaded from the Internet using Group Policy.

• In Windows 10 or 11 devices, click Start and type gpedit.msc in search to run the Local Group Policy Editor.

• Navigate to User Configuration > Administrative Templates > Windows Components > Attachment Manager​.

Double click on the Do not preserve zone information in file attachments policy to edit it.

• Do not preserve zone information in file attachments –
  • If you enable this policy setting, Windows does not mark file attachments with their zone information.
  • If you disable this policy setting, Windows marks file attachments with their zone information.
  • If you do not configure this policy setting, Windows marks file attachments with their zone information.

Prevent Users from Download Files in Windows using Registry

Let’s follow the steps below to prevent users from downloading files in windows using Registry –

In Windows 10 or 11 devices, Click on the Start button, type regedit.exe, and then press Enter.

Locate the following registry subkeys –

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments

Note – If you do not see the Attachments subkey, create it by right clicking Policies, select New, click Key, and then type Attachments as the key name.

Right-click Attachments, select New, and then click DWORD (32-bit) Value. Type ScanWithAntiVirus as the value name, and then press Enter.

Right-click the new ScanWithAntiVirus DWORD value, and then click Modify.

In the Value data box, type 1, and then click OK.

Restart Windows Explorer or restart Windows 10 or 11 PC to apply the changes.

Prevent Users from Downloading Harmful Files in Windows

Let’s follow the steps below to automate the changes via Registry. To add or import a registry value on Windows 10 or 11 PC, follow these steps –

• Open Notepad, Copy and paste the registry value below into the text editor.

Note – Since adding the registry value manually may lead to an issue, it will take the time taken to process for the system admin. You can also copy the below command and create a batch file to automate the settings.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments]
"SaveZoneInformation"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments]
"SaveZoneInformation"=-

• In the File menu, select Save As and click Browse to your preferred folder or location. In the File name box, provide the appropriate name “FileName.reg” with the .reg extension and Choose Save as type “All” from the drop-down list. Click Save.

• The registry file will appear on your saved location. To start the execution, Double click or Right-click and select the Open option OR press Enter on the protected .reg file content to merge into the local registry.

• A warning box with the following messages prompted, Click Yes to continue.

• Once Information in the path of the Registry (.reg) file has been successfully entered into the registry below prompt will appear. Click OK.

This is especially useful for applying the same setting for multiple users to be distributed across the network.

• Restart Windows Explorer or restart Windows 10 or 11 PC to apply the changes.

Suppose you are blocked by Open File – Security Warning and Windows SmartScreen. Let’s check how to Unblock App Files in Windows.

Important – If an app or file that is safe to use will be identified as harmful as Microsoft wants to keep us safe and secure. While unblocking or running applications or files make sure to check security concerns.

Sometimes using from trusted source might interfere while using your PC. You can add an app or files to the list of safe or allowed apps to prevent them from being blocked.

Author