Cannot open MMC windows after Windows update on Windows Server 2016

Question

After restarting the server, Server 2016 Standard, I ran through some Windows updates, and I cannot open any MMC windows anymore.

It says "MMC cannot open the file C:\Windows\system32\filename.msc. Opening MMC console files from untrusted network location is blocked for security reasons."

The server is under Active Directory domain and I have no problem with other Windows servers.

Can you please advise?

Answer 1

Hello，

This behavior can be caused by recent changes in Windows security handling that now consider certain system files “untrusted” if they appear to originate from a network or downloaded location. Even though the file (for example, a .msc snap-in in C:\Windows\system32) is local, MMC is blocking its load under the presumption that it comes from an untrusted zone. Here are several steps to troubleshoot and resolve the issue:

1. Check for a “Mark of the Web”

 • Sometimes, files might have an attached alternate data stream (ADS) (a “Zone Identifier”) that marks them as if they were downloaded from the internet. Although uncommon in system files, a Windows update or other management action might add this marker.

 • Right-click the affected .msc file and choose Properties. In the General tab, look near the bottom for an “Unblock” button or checkbox. If it appears, click it to remove the flag, then apply the change.

2. Remove Alternate Data Streams manually

 • Use Microsoft’s Sysinternals tool, Streams, to check and remove any hidden ADS on the file.

  – Download Streams if you haven’t already.

  – Open an elevated command prompt and run:

   streams -d C:\Windows\system32\filename.msc

  This command deletes any attached zone information that could be triggering the block.

3. Add the file location to a trusted zone

 • MMC might be applying security restrictions based on the file location. One workaround is to add the server or the specific folder to your Trusted Sites or Local Intranet zone through Internet Options:

  – Open Internet Explorer (or the Internet Options control panel).

  – Go to Tools (or the gear icon) > Internet Options > Security tab.

  – Click “Local intranet” then “Sites” > “Advanced” and add the server (or, if possible, file://C:\Windows\system32) to the list.

  This tells Windows that files loaded from this location are trusted.

4. Review Group Policy or Local Security Policy settings

 • In environments controlled by Active Directory, a Group Policy update might be causing MMC to enforce a “trusted location” rule.

 • Check your Group Policy settings for any recent policies related to MMC or Internet Explorer security zones, and coordinate with your domain administrator to adjust them if necessary.

5. Consider the impact of a recent Windows update

 • Since the issue started after a Windows update, review the update history. Look for updates that might modify security or MMC behavior.

6. Try launching MMC with elevated privileges

 • Sometimes, user account control (UAC) or other permissions can compound these issues.

 • Right-click on mmc.exe and select “Run as administrator” to see if that makes any difference.

---

If the Answer is helpful, please click "Accept Answer" and upvote it.