How to fix "Your Internet security settings prevented one or more files from being opened"?

This Windows Security message, headed "These files can't be opened", means the security zone of the file is set to block programs and other unsafe file types. Either the file is marked as coming from the internet, or it sits on a network share that Windows counts as the Internet zone, or the zone setting itself was changed. Scan the file with Microsoft Defender first, then unblock that one file.

Facts checked on 13 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "Your Internet security settings prevented one or more files from being opened" means

The dialog is titled Windows Security. Its heading reads "These files can't be opened" and the line under it says "Your Internet security settings prevented one or more files from being opened." It appears right after a double-click, and the program, installer or shortcut never starts.

Despite the wording, your internet connection and your browser have nothing to do with it. Windows sorts every file into a security zone: Local computer, Local intranet, Trusted sites, Internet or Restricted sites. Each zone has a setting named Launching applications and unsafe files with three choices: Enable, Prompt and Disable. When the zone of your file is on Disable, Windows shows this message instead of opening the file.

• How Windows knows the zone of a downloaded file: the browser, mail program or messaging app adds a hidden tag to the file, called the Mark of the Web. It is a small text stream named Zone.Identifier with a line such as ZoneId=3.
• How Windows knows the zone of a file on a share: it looks at the address. A share opened by its short name is Local intranet. An address with dots in it, such as an IP address or a full domain name, is treated as Internet.
• What the numbers mean: 0 is Local computer, 1 Local intranet, 2 Trusted sites, 3 Internet, 4 Restricted sites.
• Which files are checked: Microsoft's setting covers "executable files or other potentially unsafe files". Programs, installers and scripts are the usual ones.

Why Windows blocks the file: the causes, from most to least common

Most often one downloaded file or one extracted folder carries the Mark of the Web and the Internet zone on your PC is stricter than the default. Less often the file lives on a network share that Windows files under Internet. Rarely the setting was changed for every zone, and then every program is blocked.

Microsoft's own description of the policy behind this setting confirms the order. If the setting is disabled for a zone, "these files don't open". When nothing is configured, files are "blocked in the Restricted zone, enabled in the Intranet and Local Computer zones, and set to prompt in the Internet and Trusted zones".

Before you unblock anything: check where the file came from

The message is a real protection, so spend one minute on the file before you remove it. Microsoft's advice for a blocked download is short: verify where the file came from, scan it with Microsoft Defender Antivirus or your own antivirus, and make sure the file type is what you expected.

To see which case is yours, read the mark on the file. Right-click Start, select Terminal and run the command below with the path of your own file.

Read the Mark of the Web of one file (PowerShell)

Get-Content "C:\Users\you\Downloads\setup.exe" -Stream Zone.Identifier

• ZoneId=3: the file came from the Internet zone. Fix 1 removes the mark. If the mild warning never shows and you get the block, also do Fix 4.
• ZoneId=4: the file came from a site in your Restricted sites list. Think twice. If the site is one you trust, use Fix 1 and take it off the list in Fix 4.
• An error that the stream cannot be found: the file has no mark. The block comes from its location (Fix 3) or from the zone settings (Fix 4 to Fix 7).

How to fix "Your Internet security settings prevented one or more files from being opened"

Fixes 1 and 2 remove the block from the files you trust and change nothing else. Fix 3 is for files on a network share. Fixes 4 to 6 put the zone setting back to Microsoft's default, first in Internet Options, then in the registry and in Group Policy. Fix 7 tests whether the damage is limited to your user account.

Fix 1. Scan the file with Microsoft Defender, then unblock it in Properties

2 minutesLow riskOne file you downloaded or received is blocked and you know where it came from.

The Unblock box removes the Mark of the Web from this one file. Windows then treats it as a local file, and local files are not subject to the Internet zone setting. Nothing else on the PC changes.

1. Open File Explorer and find the blocked file. For a shortcut on the desktop, right-click it and select Open file location to get to the real file.
2. Right-click the file, select Show more options and then Scan with Microsoft Defender. On Windows 10 the command is in the first right-click menu.
3. Wait for the Scan options page of Windows Security to show the result. If a threat is found, stop here and let Defender remove the file.
4. Right-click the file again and select Properties.
5. On the General tab, look at the bottom for the text "This file came from another computer and might be blocked to help protect this computer."
6. Tick Unblock next to that text.
7. Select Apply, then OK, and open the file again.

• No security text and no Unblock box: the file is not marked. Its location or the zone settings cause the block, so go to Fix 3 or Fix 4.
• A ZIP file: unblock the ZIP itself before you extract it. Files extracted with File Explorer inherit the mark from the archive, so extract again after unblocking.
• Undo: download the file again. The new copy is marked.

Fix 2. Unblock a whole folder with the Unblock-File command

5 minutesLow riskA program folder, an extracted archive or a set of scripts holds many marked files.

A program that starts but then fails on its own helper files is often blocked file by file. Microsoft's Unblock-File command does the same as the Unblock box: it removes the Zone.Identifier stream, and it can take a list of files at once.

1. Scan the folder first: right-click it, select Show more options and then Scan with Microsoft Defender.
2. Right-click Start and select Terminal. On Windows 10 select Windows PowerShell.
3. List the marked files with the first command below, with the path of your own folder.
4. Check that the list holds only files you expect to be there.
5. Remove the mark from one file with the second command, or from every file in the folder with the third.
6. Close the window and start the program again.

1. List the files that carry the mark

Get-ChildItem "C:\Users\you\Downloads\tool" -Recurse | Get-Item -Stream "Zone.Identifier" -ErrorAction SilentlyContinue

2. Unblock one file

Unblock-File -Path "C:\Users\you\Downloads\tool\setup.exe"

3. Unblock every file in the folder

Get-ChildItem "C:\Users\you\Downloads\tool" -Recurse | Unblock-File

The command returns no output. On a file that is not blocked it does nothing and shows no error, so it is safe to repeat.

Fix 3. Add the trusted file server to the Local intranet zone

5 minutesLow riskThe blocked file is on a NAS, a file server or a mapped drive, and a copy on the desktop opens normally.

Microsoft documents that a share addressed by IP address or by a full domain name is identified as the Internet zone, because the address contains periods. Listing that one server under Local intranet moves its files to a zone where they are allowed by default.

1. Select Start, type Internet Options and open it. The window is titled Internet Properties.
2. Open the Security tab, select Local intranet and then Sites.
3. Check that Include all network paths (UNCs) is ticked, then select Advanced.
4. Clear Require server verification (https:) for all sites in this zone. Microsoft says this is needed for network shares.
5. In Add this website to the zone, type the address of the server, for example \\nas01.example.local or *.example.local.
6. Select Add, then Close or OK in each window.
7. Restart the PC and open the file from the share again.

• Shares opened by IP address: Microsoft states that adding an IP address range does not work for UNC paths such as \\192.168.1.20\share. Open or map the share by the name of the server instead, for example \\nas01\share.
• Short names: with Include all network paths (UNCs) ticked, a share opened as \\nas01\share is already Local intranet. Mapping the drive again by the short name can be the whole fix.

Fix 4. Set "Launching applications and unsafe files" back to Prompt in Internet Options

5 minutesNo riskEvery newly downloaded program is blocked, or the file had no Unblock box and is not on a network share.

This is the setting named in the message. Putting the Internet zone back to Prompt (recommended) restores Microsoft's default: Windows asks before it opens a downloaded program instead of refusing it. It raises nothing above the default.

1. Select Start, type Internet Options and open it. You can also open Control Panel > Network and Internet > Internet Options.
2. Open the Security tab and select the Internet zone, the globe icon.
3. Select Custom level....
4. Scroll down to Miscellaneous and find Launching applications and unsafe files.
5. Select Prompt (recommended) and then OK. Confirm if Windows asks whether you want to change the settings of the zone.
6. Back on the Security tab, select Restricted sites and then Sites. Remove an entry only if you added it by mistake.
7. Select Apply, then OK, and restart the PC.

The Run command inetcpl.cpl opens the same window. We know that from answers on Microsoft Q&A, not from a Microsoft help page. A file with ZoneId=4 stays blocked after this fix, because Restricted sites is meant to block: unblock that one file with Fix 1 if you trust it.

Fix 5. Check value 1806 of the zones in the registry

10 minutesLow riskEvery program is blocked, Fix 4 showed Prompt already, or the setting returns to Disable after a restart.

Internet Options shows four zones, but the registry holds five. The Local computer zone, number 0, is hidden in the window, and Microsoft's default for it is Enable. If value 1806 there is 3, even programs that were never downloaded are blocked, and no button in Internet Options shows it.

1. Press Win + R, type regedit, press Enter and select Yes.
2. Paste the first path below into the address bar and press Enter.
3. Select File > Export and save the Zones key as a backup file.
4. In the right pane, find the value named 1806 and double-click it.
5. For zone 3, the Internet zone, type 1 and select OK. 1 is Prompt, 0 is Enable and 3 is Disable.
6. Open the second path. For zone 0, the Local computer zone, value 1806 should be 0. Change it only if it is 3.
7. Look at the two policy paths. If a value 1806 exists there, a policy sets it: go to Fix 6 and do not edit it here.
8. Close Registry Editor, restart the PC and try the file again.

Your own zone settings: Internet zone (3) and Local computer zone (0)

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0

Policy settings: look, do not edit

HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

If the value Security_HKLM_only is set to 1 under HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings, Windows uses the machine settings for every user instead of yours. Leave that value alone on a managed PC.

Fix 6. Check the Group Policy settings that can force the block

10 minutesLow riskThe settings on the Security tab are greyed out, a policy value exists in the registry, or the PC belongs to an employer or school.

A policy wins over what you choose in Internet Options. Microsoft's policy Show security warning for potentially unsafe files controls the same setting: set to Disabled, in Microsoft's words, "these files don't open". On your own PC you can set it back to Not Configured.

1. Press Win + R, type gpedit.msc and select OK. This editor exists in the Pro, Enterprise and Education editions only.
2. Go to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Internet Zone.
3. Double-click Show security warning for potentially unsafe files.
4. Select Not Configured, or select Enabled and choose Prompt in the drop-down box. Then select OK.
5. Repeat steps 2 to 4 under Computer Configuration, which holds the same folder.
6. Open User Configuration > Administrative Templates > Windows Components > Attachment Manager and set Hide mechanisms to remove zone information to Not Configured. That policy hides the Unblock box.
7. Restart the PC.

Save a report of every policy that applies to you (Terminal or Command Prompt)

gpresult /h "%USERPROFILE%\Desktop\policy-report.html"

• Windows Home: the editor is missing. A policy shows up as value 1806 under the two policy paths of Fix 5.
• Work or school PC: do not change policies yourself. Send the report from gpresult and the name of the file to the administrator, who can add the server or site to the Site to Zone Assignment List.

How to find and edit a policy, with the screens of the editor: Open the Local Group Policy Editor

Fix 7. Test with a new user account

10 minutesNo riskEvery program is blocked in your account, including Registry Editor, or the fixes above did not hold.

Microsoft stores the zone settings in the part of the registry that is loaded per user, so one user's settings do not affect another's. A new account starts with the default zones. If files open there, the fault is in your profile, not in Windows.

1. Open Other users. Open Settings > Accounts > Other users. You can also press Windows key + R and run the command below.

   ms-settings:otherusers

2. Add an account. Next to Add other user, select Add account.

   

3. Skip the Microsoft account. Select I don't have this person's sign-in information.

   

4. Choose a local account. Select Add a user without a Microsoft account.
5. Name the account. Type a user name and, if you want one, a password. If you set a password, Windows also asks for answers to security questions. Select Next.
6. Make it an administrator (optional). Back in Other users, select the new account, then Change account type next to Account options. Choose Administrator and select OK. For testing a problem, a standard account is usually enough.
7. Sign in to the new account. Open Start, select your account picture and choose the new account. The first sign-in takes a few minutes while Windows sets up the profile.

These steps were written for Windows 11 24H2, 25H2 and 26H2. The full page with the other versions and what each result means: Create a new user account to test a problem

• The file opens in the new account: your own profile holds the bad zone settings. Sign back in to your account and repeat Fix 5. If Registry Editor is blocked there, move your files to the new account and keep using it.
• The file is blocked there too: the setting applies to the whole PC. That points to a policy (Fix 6) or to the Security_HKLM_only value named in Fix 5.

If the files still cannot be opened

Windows writes no log for this dialog that we could find, and Microsoft's pages name no Event Viewer entry for it. The cause is still readable, because it sits in three places you can look at. Collect them before you ask anyone for help.

1. The mark on the file: run the Get-Content command from the section on checking the file and note the ZoneId line, or the error that no stream exists.
2. The full path of the file, including the server name or drive letter. It shows whether the file is local or on a share.
3. Value 1806 under Zones\0 and Zones\3 from Fix 5, and whether the same value exists under the policy paths.
4. The policy report from gpresult in Fix 6.
5. Whether a second user account shows the same message (Fix 7).

• Work or school PC: give these five things to the administrator. The zone is almost always set on purpose there, and only the administrator can add your server or program to the allowed list.
• The setting keeps coming back on your own PC: something on the PC rewrites it. Run a full scan with Microsoft Defender, then look at recently installed tuning, privacy or security tools. Steps for the scan: How to scan for malware with Microsoft Defender
• Nothing can be started at all: System Restore can return the registry to a day before the problem began. We did not test it on this error. Steps: Undo recent changes with System Restore
• The message appears at sign-in, with no file opened by you: a startup entry points to a marked or blocked file. The dialog lists the file. Find that file and decide with Fix 1 whether it should run at all.

How to undo each change from this guide

Every fix above is narrow on purpose, and each one can be taken back. Keep this table if you changed something on a shared or family PC and want to return to the earlier state.

How to keep the message from coming back

Windows 10 left support on 14 October 2025. The zone check works there as on Windows 11, but the system no longer gets security fixes, so the warning before a download opens matters more there, not less.

Frequently asked questions

What does "Your Internet security settings prevented one or more files from being opened" mean?

It means Windows refused to start a program or another risky file type because of the security zone the file belongs to. Each zone has a setting named Launching applications and unsafe files. On Prompt, Windows asks before opening. On Disable, it shows this Windows Security dialog with the heading "These files can't be opened" and nothing starts. By default only the Restricted sites zone is on Disable, so the message usually means a setting was changed.

Is it safe to unblock a file that Windows blocked?

It is safe when you know where the file came from and a scan finds nothing. Microsoft's own advice is to verify the source, scan the file with Microsoft Defender Antivirus or your antivirus, and check that the file type is what you expected. A setup file from the maker's site passes that test. An attachment you did not expect does not, even when the sender looks familiar.

Why is there no Unblock checkbox in the file's Properties?

Because the file carries no Mark of the Web, or because a policy hides the box. The mark is stored only on NTFS drives, so files from a FAT32 stick, and files that were never downloaded, have none. In that case the block comes from where the file is, for example a network share, or from the zone settings, and Fix 3 or Fix 4 applies. On managed PCs the policy Hide mechanisms to remove zone information removes the box on purpose (Fix 6).

Why do I get the error only for files on a network drive or NAS?

Because Windows decides the zone of a network file from its address. Microsoft documents that a share reached by IP address or by a full domain name is identified as the Internet zone, since the address contains periods. If your Internet zone is strict, programs on that share are blocked while the same file copied to your desktop opens. Open the share by the short name of the server, or add that one server to the Local intranet zone (Fix 3).

Should I turn off SmartScreen or my antivirus to get rid of the message?

No. Neither of them shows this message, so turning them off does not help and leaves the PC less protected. The dialog comes from the security zone check of Windows, and the two things that decide it are the mark on the file and the zone setting. Keep both on, scan the file with Microsoft Defender, and then use Fix 1 or Fix 4.

Where are the Internet security settings in Windows 11 and Windows 10?

They are in Internet Options, on the Security tab. Select Start, type Internet Options and open it, or go through Control Panel. The window is titled Internet Properties. The Security tab shows four zones: Internet, Local intranet, Trusted sites and Restricted sites. Custom level opens the full list of settings for the selected zone, and Launching applications and unsafe files is in the Miscellaneous group. They were made for Internet Explorer, but Windows still uses them for files.

Does this also apply to Windows 7 Internet security settings?

Yes, the mechanism is the same. Windows 7 has the same Internet Options window, the same four zones and the same setting, and reports of this exact message on Windows 7 go back to 2011. The Unblock box, the Local intranet zone and the Custom level list work there too. There is no Terminal app, so use Windows PowerShell for Fix 2. Windows 7 has had no security updates since January 2020, so take the warning before a download opens seriously.

The message is in Spanish ("La configuración de seguridad de Internet impidió la apertura de uno o varios archivos"). Is it the same error?

Yes. It is the same Windows Security dialog in a Spanish edition of Windows, and the cause and the fixes are identical. This page uses the English names of windows and buttons. In another language the buttons are in the same places: the unblock box at the bottom of the first tab of the file's Properties, and the security tab second from the left in Internet Options. Registry paths, value 1806 and the PowerShell commands are the same in every language.

Why does every program show the message, even Notepad or Command Prompt?

Because the block is no longer about downloaded files. When programs that were installed long ago are refused, the setting has most likely been changed for the hidden Local computer zone, number 0, or for all zones by a policy. Internet Options does not show that zone, so the place to look is value 1806 in the registry, as in Fix 5. If Registry Editor is blocked too, sign in with a second account (Fix 7), because zone settings are stored per user.

I searched for "internet security error". Is this page about my antivirus?

Probably not. This page explains one Windows dialog, the one that says your Internet security settings prevented files from being opened. It is produced by Windows itself, and no antivirus product is involved. If a program with Internet Security in its name shows its own error, for example about an expired licence or a failed update, that is a matter for the maker of that product. Do not remove your security program because of this Windows message.