File Explorer Preview Pane Not Working for Network Share Files After Recent Windows Update

Question

Environment:

• Windows 11 domain-joined workstations
• Windows Server 2019 file server
• Active Directory domain
• Adobe Acrobat DC installed on workstations

Referenced article: https://support.microsoft.com/en-us/topic/file-explorer-automatically-disables-the-preview-feature-for-files-downloaded-from-the-internet-56d55920-6187-4aae-a4f6-102454ef61fb

Issue:

After a Windows security update (KB5070960) , users are unable to preview files in the File Explorer preview pane when accessing files from a mapped network share. Local files on C: preview fine. All file types are affected on the network share (PDFs, Word docs, etc.). The preview pane displays the message: "The file you are attempting to preview could harm your computer."

Steps Already Tried:

1. Added file server to the Trusted ZoneMap via Group Policy (HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains_-ServerName-_ - file DWORD value 1)
2. Ran Unblock-File via PowerShell recursively on the entire network share
3. Manually unchecked the "Unblock" checkbox on individual files via Properties
4. Applied the 180F DWORD registry fix for Internet Zone (Zones\3) under both HKCU and HKLM
5. Enabled GPO policy "Do not preserve zone information in file attachments" under User Configuration > Administrative Templates > Windows Components > Attachment Manager

None of the above have resolved the issue. GPUpdate /force on workstations is also failing with "User Policy could not be updated successfully" and a SYSVOL access timeout error. In addition tried to add the file server to local intranet or trusted sites security zone but it's completely grayed out with a message at the bottom "Some settings are managed by your system administrator"

Question:

What is the correct fix to restore File Explorer preview pane functionality for files on a domain-joined network file share after this Windows security update?

Any help would be greatly appreciated. Thank you.

Answer 1

KB5070960 introduces a security change: File Explorer automatically disables preview for files that are treated as coming from the Internet Zone (MotW or Internet Zone file shares). This is by design and affects network locations that Windows classifies as Internet Zone.

To restore preview pane functionality for files on a domain file server, the files or the share must no longer be treated as Internet Zone content. The supported ways to override this behavior are:

1. Unblock individual downloaded files
   For files that actually have Mark of the Web:
   1. Right-click the file in File Explorer.
   2. Select Properties.
   3. On the General tab, select Unblock.
   4. Select OK. Note: The change might not take effect immediately but will be effective after the next sign-in.
2. Treat the file server share as Local intranet or Trusted site
   For files accessed over a share that is currently in the Internet Zone:
   1. Open Internet Options (inetcpl.cpl) on the client.
   2. Go to the Security tab.
   3. Select Local intranet or Trusted sites.
   4. Select Sites and add the file share’s address (for example, \\ServerName or its FQDN) to that zone. After this, files from that share are no longer treated as Internet Zone, and File Explorer preview will work again.
   Warning: This relaxes security for all files from that share. Only do this for trusted internal servers.

Because the Internet Options UI is currently locked down by domain policy in this environment (grayed out, “Some settings are managed by your system administrator”), the effective fix is:

• Adjust the relevant domain Group Policy so that the file server’s UNC path or FQDN is added to Local intranet or Trusted sites for users, instead of leaving it in the Internet Zone. Once that policy is corrected and successfully applied (GPUpdate issue resolved), File Explorer will stop treating that share as Internet Zone and previews will be restored.

The GPUpdate failure and SYSVOL timeout indicate Group Policy is not applying correctly; until that is fixed, any registry-based or user-side changes that conflict with enforced zone mappings will not reliably override the security behavior.

Summary of required actions in this scenario:

1. Fix Group Policy replication/permissions so that user policies apply successfully (resolve SYSVOL access timeout).
2. In the domain GPO that manages Internet Explorer/Internet Options security zones, add the file server’s UNC/FQDN to Local intranet or Trusted sites and ensure it is not mapped to the Internet Zone.
3. Allow that policy to apply to the affected users; after sign-out/sign-in, File Explorer preview should work again for files on that share.

---

References:

• File Explorer automatically disables the preview feature for files downloaded from the internet

Answer 2

Hello Prajal Bhagat, thank you for posting in the Microsoft Q&A community.

The behavior you are seeing is expected following recent security updates. Windows File Explorer strictly disables the preview pane for files originating from the Internet Zone or carrying the Mark of the Web (MotW). However, the root cause of why your attempted fixes are not applying lies in the gpupdate /force failure and the SYSVOL access timeout. Because the workstation cannot communicate with the SYSVOL share on your Domain Controllers, it cannot pull the updated Group Policy that would accurately map your file server to the Local Intranet or Trusted Sites zone. Furthermore, the existing stale policies applied to the machine are actively locking down the Internet Options UI and preventing your manual overrides from taking effect.

We must first restore Group Policy processing on the affected endpoints. Please verify that the client can correctly resolve the domain and reach the Domain Controller. You can test this by running a simple test to access the SYSVOL path directly from the Run prompt by typing \yourdomain.com\SYSVOL. If this fails, investigate the DNS configuration on the client, ensure the Network Connection Profile is set to Domain rather than Public or Private, and check for any firewall rules blocking SMB (Port 445) traffic between the client and the Domain Controllers.

Once SYSVOL connectivity is restored, ensure your Group Policy is configured using the official method for zone mapping. Navigate to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List. Enable this policy and add the file server's FQDN and NetBIOS name (for example \\ServerName or \\ServerName.domain.local) with a value of 1 (Local Intranet).

If you need an immediate workaround for a single workstation while you troubleshoot the domain connectivity issue, you can temporarily override the local policy registry keys by running the following command in an elevated PowerShell to force the file server into the Intranet Zone for the current user:

New-ItemProperty -Path "HKCU:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey" -Name "\\ServerName" -Value 1 -PropertyType DWORD -Force

(Important: Please note that modifying the registry carries risks, so back up the key before proceeding)

To help me further isolate the timeout issue, could you please run the following command on an affected workstation and share the output or any specific error codes it throws?

gpresult /h C:\temp\gpreport.html

Additionally, please check the System event log on the workstation for Event ID 1058 (Group Policy processing failure) and provide the exact error description detailed there so we can pinpoint the network block.

Official Microsoft Documentation: Group Policy Site to Zone Assignment List configuration