Unblock a file with PowerShell?

G

13

37

I am trying to have PowerShell unblock a file in Win2K8 R2.

Does anyone have a pointer as to the syntax?

Gastrotomy answered 24/10, 2009 at 9:44 Comment(0)

N

50

If you are using PowerShell v3, you can use the Unblock-File cmdlet.

The "blocking" part is simply an alternate data stream of the file, named "Zone.Identifier". You can display it in CMD by using input redirection (no other way to get to a stream in CMD, though):

H:\Downloads> more < test.exe:Zone.Identifier
[ZoneTransfer]
ZoneId=3

You can find them using dir /r on Windows Vista and later:

2009-10-24  12:18        54.538.056 test.exe
                                 24 test.exe:Zone.Identifier:$DATA

Also in CMD you can easily get rid of that by overwriting it (using output redirection, this time):

echo.>myDownloadedFile.exe:Zone.Identifier

which isn't quite the same as removing the ADS completely, but works in that Explorer doesn't complain anymore.

There doesn't seem to be native support for handling ADS from within PowerShell (as mentioned on The PowerShell Guy's blog here. That article also has some information how to get that functionality in PowerShell). You could, however, simply call cmd:

cmd /c "echo.>test.exe:Zone.Identifier"

That works from PowerShell as well.

Another option would be Mark Russinovich's streams utility which allows you to inspect a file's ADS and also to delete them. So

streams -d myDownloadedFile.exe

does work as well.

Nuri answered 24/10, 2009 at 10:18 Comment(7)

I felt @Geert's pain that this post didnt make it explicit that it's as simple as \\live.sysinternals.com\tools\streams -d myDownloadedFile.exe (inspired by [hanselman.com/blog/… summary) – Hanhana 13/10, 2011 at 8:30

FYI - Powershell 3 adds this finally via the Unblock-File cmdlet - technet.microsoft.com/en-us/library/hh849924.aspx – Lolalolande 27/4, 2012 at 13:56

Use this to flush a wipe-out-this-crap all the way down a folder structure -- for /F %a in ('dir /r/b/s') do @echo .>%a:Zone.Identifier:$DATA – Wastage 28/6, 2012 at 10:31

Luke, the question was how to unblock one file, not everything below the current directory. This one would still need cmd /c from PowerShell as well. Besides, while dir /r displays the ADS all of this is lost with /b anyway so you don't need the additional problems of using for /f to iterate over dir output. E.g. your code fails for files with Unicode names and for names with spaces. All in all a fairly poor solution for the question. – Nuri 28/6, 2012 at 10:35

here a one liner to unblock: get-childitem -rec | Unblock-File – Urethroscope 25/11, 2015 at 0:21

PowerShell 1+ can use this pinvoke method: andyarismendi.blogspot.com.au/2012/02/…, which is the same code used by Pash in the opensourced Powershell 3+ repository on GitHub (I checked!) – Bordy 14/12, 2016 at 4:13

@OzBob: I wasn't even aware that Pash had that functionality, besides it's no longer maintained since PowerShell has been open-sourced. – Nuri 14/12, 2016 at 7:8

N

9

The PoshCode module includes Set-DownloadFlag and Remove-DownloadFlag functions which work as advertised. :) I've just pulled that piece out into it's own script contribution http://poshcode.org/1430 ... it will work on PowerShell 1 too, if you use the New-Type function in place of Add-Type ( http://poshcode.org/720 )

Nationalism answered 29/10, 2009 at 6:43 Comment(0)

D

5

Oneliner to remove zone informarion(inspired by accepted answer) for all children (with correct quoting).

get-childitem -rec | % { cmd /c "echo.>""$($_.FullName)"":Zone.Identifier" }

Not strictly answer to the question, just want to make sure when I next come up with this problem there is solution already :).

PS. Works in PS 2.0

Dualistic answered 23/4, 2014 at 9:9 Comment(2)

Note: DOES NOT WORK in PS2.0 – Sweepstakes 12/5, 2015 at 20:42

Server2008 R2 $host.version.tostring() -eq '2.0' True Set-Executionpolicy 'Bypass' then go get-childitem -rec | % { cmd /c "echo.>""$($_.FullName)"":Zone.Identifier" } did the job – Lichenology 25/1, 2017 at 14:59

D

4

new to posting in forums like this and this might be an old topic but here is what you are looking for.

get-item -Path "path to file(s)" -Stream "Zone.Identifier" -ErrorAction "SilentlyContinue"

This should list out files that are blocked only.

Unblock-File -Path "Path to blocked file(s)"

This will unblock them.

Dagda answered 23/12, 2015 at 14:42 Comment(0)

V

4

To unblock a folder and it's subfolder recursive (>= PowerShell v3) you can use the Get-ChildItem (gci) command:

Get-ChildItem "C:\Temp\" -recurse | Unblock-File

where C:\Temp is the starting folder.

Vickers answered 6/12, 2018 at 13:35 Comment(0)

S

1

Remove the alternate file stream using Streams.exe see this post: http://www.paraesthesia.com/archive/2010/05/19/unblocking-multiple-files-at-once.aspx

Sagittarius answered 17/1, 2011 at 12:37 Comment(1)

@Nationalism "Joey already mentioned that". Maybe flag the answer ? – Clicker 29/1, 2015 at 10:48

C

1

I wrote a little function that uses the Win32 API to delete the Zone.Identifier NTFS alternate data stream which is what Windows uses to determine whether a file is to be blocked.

.NET doesn't have access to alternate data streams so the function uses a technique called platform invoking to call the native Win32 API. The benefit of this over the some other solutions for PowerShell is that it supports the PowerShell pipeline so you can pipe a list of file paths or System.IO.FileInfo objects to the function. The function also doesn't have any external dependencies and actually deletes the alternate data stream instead of just deleting it's contents.

http://andyarismendi.blogspot.com/2012/02/unblocking-files-with-powershell.html

Casement answered 25/2, 2012 at 19:35 Comment(1)

The code posted at this link does not include a license statement. Would you be willing add one to clarify how it may be used? Thanks – Billon 4/2, 2019 at 13:30

S

1

I'll have to amend @Mike 's answer: this won't work if there are spaces in $_.FullName (e.g. like in "C:\Program Files") so it has to be:

get-childitem -rec | % { cmd /c "echo.>""$($_.FullName)"":Zone.Identifier" }

Substratum answered 6/1, 2017 at 16:7 Comment(0)

B

1

If you server does not have Powershell > v3 ($PSVersionTable.PSVersion.Major -ge 3). Then use good old reliable DOS:

for /f "tokens=*" %f in ('dir /b *.*') do echo.>"%f":Zone.Identifier

Bordy answered 19/7, 2017 at 9:18 Comment(0)

I

0

I haven't seen any answer yet that seems to use the proper powershell cmdlets to do this.

Here we can find DLLs in the current folder that contain the zone.identifier:

Get-Item -Path .\*.dll -stream * | where {$_.Stream -eq "Zone.Identifier" }

Here we zap just only the unwanted streams, unlike some answers above that might damage other streams:

Remove-Item  -Path .\*.dll -stream Zone.Identifier

Impropriate answered 10/3, 2017 at 19:11 Comment(1)

Remove-Item "-streams" introduced in PS3 msdn.microsoft.com/powershell/reference/4.0/… – Bordy 19/7, 2017 at 8:4

D

0

If you are using PowerShell 3.0 or above vesion, Unblock-file PowerShell cmdlet should solve this problem with unblocking the file, even though if you don't have unblock button on the file properties window.

The Unblock-File cmdlet lets you open files that were downloaded from the Internet. It unblocks Windows PowerShell script files that were downloaded from the Internet so you can run them, even when the Windows PowerShell execution policy is RemoteSigned. By default, these files are blocked to protect the computer from untrusted files.

Just open the powerShell window and follow below syntax. To find more information about the syntax go to here

Example :

unblock-file -path C:\Downloads\MyFileName.chm

Unblock file with PowerShell screen shot

Warning: Do not unblock unsecure files.

Dives answered 24/3, 2017 at 16:19 Comment(4)

Hi @Chaithanya, I have link for the unblock-file and added an image. which kind of explanation should I add more. Do you mean how to open PowerShell window? – Dives 24/3, 2017 at 17:33

Hello Dinch, I meant to ask for adding some context to the answer, like some sort of explanation of what that code does, and as such. Please take a look here for more information on best practices for answering on SO. – Sagerman 24/3, 2017 at 19:42

Updated. How this sounds now? – Dives 24/3, 2017 at 22:26

The Unblock-File command was released in powershell version 3. OP specifically asked for a solution in powershell version 2. – Soraya 30/7, 2018 at 13:19

K

-1

Do you mean this:

set-executionpolicy remotesigned

This will allow you to execute local scripts without them being signed, and remote ones if they are signed. More info available here.

Kahn answered 24/10, 2009 at 9:48 Comment(2)

Not quite Kent. Looking to do the scripting equivalent of right click on file in explorer and choosing unblock. +1'ed though as I can see folks arriving here needing exactly that – Gastrotomy 24/10, 2009 at 9:53

This was the hint that I needet. Thank You. The warning-message when executing a script from another host demanded the "unblock-file" method, which does not solve my problem. – Inerasable 25/9, 2019 at 7:52

H

-1

You can search for blocked files like this:

get-item * -stream zone*

Then to unblock the files, pipe that to remove-item or "rm" to delete the zone.identifier streams:

get-item * -stream zone* | Remove-Item -whatif

In case you want recursive search:

get-childitem -recurse | get-item -stream zone*

Hesper answered 13/9, 2019 at 21:46 Comment(2)

There is a huge difference between unblocking and deleting files. Piping the list of blocked files to the Remove-Item cmd-let for deletion is not the way. – Intercede 1/5 at 4:32

@ObsidianJackal It only removes the stream. – Hesper 9/7 at 17:44

Recommended topics

Hot tags