Windows 10 will not extract zip files; produces an empty folder.

From the s1 support site. Seems to be caused by Intel Optane with S1.

OS: Windows

What you see:

When you open files in a zip file, Explorer crashes. Or the files fail to extract and extraction creates an empty folder.

Cause:

This can happen when an Intel Optane software package is installed on the endpoint with SentinelOne.

**To solve Explorer crash:**This issue is fixed on newer versions of Optane. Update Intel Optane and Intel drivers. If this does not solve the issue, contact Intel Optane Support.

To solve extraction failures and empty folder:

• Enable the Windows feature: Launch folder windows in a separate process

1. On the Windows endpoint, open Control Panel > File Explorer Options > View. 2. Select Launch folder windows in a separate process. 3. Click OK. 4. Reboot the endpoint.

• If that does not solve the issue, contact Intel Optane support.
• If they do not have a solution, uninstall or disable Intel Optane.

We are having the same issue with multiple computers. Any chance you are using SentinelOne for your Antivirus software?

This is what worked for me (taken from Reddit's u/thrnmanz)

• Double click on the zipped folder.
• In the View tab, click on Options.
• Click "Change folder and search options."
• In the View tab, scroll down to "Launch folder windows in a separate process." Check this box.
• Refresh the file explorer and try unzipping your file again.

I literally just heard back from S1 SOC/Support about 3 minutes before this reply. Appears there is known issue with Intel Optane.

This issue is related to Intel Optane, and even if you uninstall it, there are still parts of it left behind that will continue to cause this issue. Using 7zip is the recommended workaround, if you are unable to remove all traces of Optane from the endpoint. I will include more information below. The activity with .zip files extraction leading to the crash of File Explorer is a known issue related to Intel Optane drivers. The chain of events that leads to the crash is as follows:Intel Optane software components erroneously register its ETW providers GUIDs hundreds of times, reaching the Windows imposed per-process registrations limit.SentinelAmsi64.dll is loaded into explorer.exe to do a static scan on the file being opened inside the .ZIP archive.SentinelAmsi64.dll calls EventRegister to register a single ETW provider.The Win32 API EventRegister returns ERROR_OUTOFMEMORY, and the process crashes. Resolution:Please uninstall or disable Intel Optane Memory. If possible, disable just its ShellExtension support. After the changes are made reboot the endpoint and test.Contact Intel for a fix to Intel Optane Memory."

We had heard about this issue and had triggered uninstalls of the Intel Optane drivers remotely and reset the shell defaults back to File Explorer, but a day or so later the behavior came back so we opened a ticket with S1 and just got the above response.

We have the same issue and Yes we use S1 for our AV