I have seen an interesting issue on all my SCCM servers. We have deployed a package to all our SCCM servers and created advertisement for targeted users. However, users are not able to download some particular files from DP (Files Getting Blocked).
***Updated on 24th Feb 2020
Issue – Files Getting Blocked
When we checked the DP servers those files are getting blocked by windows Group policy. The below blog explains the problem in details. Also we can get details from below forum.
“This file came from another computer and might be blocked to help protect this computer”
In my case the problem was for all the servers and the count of the server is around 400+. The following are the suggestions to avoid these kind of issues.
- At the packaging level we need to avoid these kind of settings in the files.
- Apply the below mentioned group policy on the servers (please make sure it is not creating any security breaches in your environment).
- Remove the package from all the DPs.
- Distribute the package to the DPs after an hour.
Resolution – Group Policy Details
This file came from another computer and might be blocked to help protect this computer
This file came from another computer and might be blocked to help protect this computer.
There is no “might be” about it, it is blocked, so the message is wrong.
This is related to the problem described in the section Open File – Security Warning. You downloaded the file or copied it from another computer on your network and now Microsoft says you are not allowed to access it.
You have two choices. Switch to Linux or Mac.
No, actually, you have these two choices: click the Unblock button, and that changes the security setting for that single file. If you happened to have downloaded 137 files, you have to do this 137 times because Microsoft, in its infinite wisdom, did not provide a method to make a mass change to this setting.
To disable this stupidity for future downloads, you have to run the Group Policy Editor, which should be in the Administrative Tools section of Control Panel but isn’t. (Why not? Only Microsoft knows and they ain’t talking.) The only way to invoke it is:
- type gpedit.msc
- press OK
- Then navigate to User Configuration – Administrative Templates – Windows Components – Attachment Manager
- Then right-click on the line Do not preserve zone information in file attachments and choose Properties.
- Click on Enabled and then OK. You don’t need to reboot.
Now how do you get rid of the block on all the files you downloaded for the last few months? The only thing I can think of is to copy them to a drive with FAT32 because this security setting is only implemented on drives with NTFS.
If you copy them to a FAT32 drive, the security is removed, so when you copy them back to the NTFS drive, they will have no security setting.
But first, you have to identify the blocked files and there is no easy way to do that, except by date.
And by the way, if you have Windows XP Home or Vista Home, they are both crippled versions of Windows and neither has Group Policy Editor, so you are stuck with this problem.
FIX – Using PowerShell
SCCM Package Deployment Issue Files Getting Blocked issue can be resolved using PowerShell commandlet. You can deploy these PowerShell scripts using SCCM|ConfigMgr new feature called Run Script.
Unblock CHM file - Unblock-File -Path C:\Users\User01\Documents\Downloads\PowerShellTips.chm Unblock All the files include "PowerShell - "PS C:\> dir C:\Downloads\*PowerShell* | Unblock-File
More details from Microsoft Doc – https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7
Special thanks to Nathan Hamblin for pointing this out.
Unblock Files Using Streams
I have received another helpful tip from SCCM Community that you can use STREAMS.EXE to unblock files. Streams is part of SysInternals. Thank you Glenn Turner for the tip.
- SCCM Related Posts – https://www.anoopcnair.com/sccm/
- Disable downloaded files from being blocked in Windows 10 – https://winaero.com/blog/disable-downloaded-files-from-being-blocked-in-windows-10/