SCCM Package Deployment Issue Files Getting Blocked

Let’s try to fix the issue – SCCM Package Deployment Issue Files Getting Blocked. In this post, we will learn how to fix one of the SCCM deployment-related issues.

I have seen an interesting issue on all my SCCM servers. We have deployed a package to all our SCCM servers and created advertisements for targeted users. However, users are not able to download some particular files from DP (Files Getting Blocked).

***Updated on 24th Feb 2020

Issue – Files Getting Blocked

When we checked the DP servers, we found that those files were blocked by Windows Group Policy. The blog below explains the problem in detail. We can also get details from the forum below.

Patch My PC

“This file came from another computer and might be blocked to help protect this computer”

In my case, the problem affected all the servers, which number around 400+. The following are suggestions to avoid this kind of issue.

  • At the packaging level, we need to avoid this kind of settings in the files.
  • Apply the group policy below to the servers (please ensure it does not create any security breaches in your environment).
  • Remove the package from all the DPs.
  • Distribute the package to the DPs after an hour.
SCCM Package Deployment Issue Files Getting Blocked
SCCM Package Deployment Issue Files Getting Blocked

Resolution – Group Policy Details

This file came from another computer and might be blocked to help protect this computer

This file came from another computer and might be blocked to help protect this computer.

Adaptiva

There is no “might be” about it, it is blocked, so the message is wrong.

This is related to the problem described in the section Open File – Security Warning. You downloaded the file or copied it from another computer on your network and now Microsoft says you are not allowed to access it.

You have two choices. Switch to Linux or Mac.

No, actually, you have these two choices: click the Unblock button, and that changes the security setting for that single file. If you happened to have downloaded 137 files, you have to do this 137 times because Microsoft, in its infinite wisdom, did not provide a method to make a mass change to this setting.

To disable this stupidity for future downloads, you have to run the Group Policy Editor, which should be in the Administrative Tools section of the Control Panel but isn’t. (Why not? Only Microsoft knows and they ain’t talking.) The only way to invoke it is:

  • Start
  • Run
  • type gpedit.msc
  • Press OK
  • Then navigate to User Configuration – Administrative Templates – Windows Components – Attachment Manager
  • Then right-click on the line Do not preserve zone information in file attachments and choose Properties.
  • Click on Enabled and then OK. You don’t need to reboot.

Now how do you get rid of the block on all the files you downloaded for the last few months? The only thing I can think of is to copy them to a drive with FAT32 because this security setting is only implemented on drives with NTFS.

If you copy them to a FAT32 drive, the security is removed, so when you copy them back to the NTFS drive, they will have no security setting.

But first, you have to identify the blocked files and there is no easy way to do that, except by date.

And by the way, if you have Windows XP Home or Vista Home, they are both crippled versions of Windows and neither has Group Policy Editor, so you are stuck with this problem.

FIX – Using PowerShell

SCCM Package Deployment Issue Files Getting Blocked issue can be resolved using the PowerShell commandlet. You can deploy these PowerShell scripts using SCCM| ConfigMgr’s new feature called Run Script.

Unblock CHM file - Unblock-File -Path C:\Users\User01\Documents\Downloads\PowerShellTips.chm
Unblock All the files include "PowerShell - "PS C:\> dir C:\Downloads\*PowerShell* | Unblock-File

Unblock Files Using Streams

I have received another helpful tip from the SCCM Community: You can use STREAMS.EXE to unblock files. Streams are part of SysInternals. Thank you, Glenn Turner, for the tip.

Resources

Author

Anoop is Microsoft MVP! He is a Solution Architect in enterprise client management with more than 17 years of experience (calculation done in the year 2018) in IT. He is a Blogger, Speaker, and Local User Group Community leader. His main focus is on Device Management technologies like SCCM 2012, Current Branch, and Intune. He writes about technologies like SCCM, SCOM, Windows 10, Azure AD, Microsoft Intune, RMS, Hyper-V etc…

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.