Windows 10 security Warning Desktop redirect shortcuts

[bewlay51]

Hi All,

Just setup Windows 10 desktop redirect on my test rig (Server is server 2016). Desktop redirect for students works fine but I am getting a "open file" security warning when I run any of the shortcuts. After I click open it runs fine.

 

Is there a fix to this issue which is similar to the problem I had with Multipoint 2011 years ago - Link HERE.

 

Many thanks....

 

John

[Chuckster]

In a GPO, go to User Config > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page

 

Here, you want the GPO called Site to Zone Assignment List

 

Enter the value of your server and the value 1, e.g. file://fileserver\* 1

[bewlay51]

Hi Chuckster, many thanks for your reply to my question -

Tested this out over the weekend and I am still having problems. If I use the following "file://AP-DC1\*" I can see an error on the GPO when I take a look using RSOP - if i change it to the following "file://AP-DC1" that error disappears and the policy is applied.

 

I have attached a screen shot of the GPO along with the error the user gets when trying to run and shortcut.

 

 

[snagrat]

Try unblocking the file.

 

Right click -> Properties and there should be a button to say Unblock.

[Arthur]

Have you tried it with your domain FQDN (prefixed with \\)? e.g.

 

\\schooldomain.internal

 

Related thread...

 

www.edugeek.net/forums/windows-7/124966-add-network-drive-ie-trusted-zone.html#post1067516

Edited April 20, 2019 by Arthur

[bewlay51]

Hi All,

I'm stumped with this one - none of the suggestion have fixed the problem. Arthur, I did try your suggestion right at the start, but thanks anyway. I think I need a rethink, there must be a way to fix the issue !!??

[Steve21]

If you want to test it, try doing it this way as this would rule out any path issues etc if you still get a warning with this it's gonna be a GPO issue:

 

User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> Inclusion list for low file types

 

add .lnk to it and gpupdate/test etc

 

Steve

[Arthur]

I did try your suggestion right at the start, but thanks anyway.

The following post on Reddit suggests adding both \\your-server and \\your-server.domain.whatever. Have you tried both together?

 

www.reddit.com/r/sysadmin/comments/8jfml1/folder_redirection_how_to_eliminate_open_file/dz03ca0

Edited April 22, 2019 by Arthur

[snagrat]

Have you tried my suggestion?

[Arthur]

Is it possible for a shortcut to get blocked if it wasn't downloaded from the Internet?

[snagrat]

Is it possible for a shortcut to get blocked if it wasn't downloaded from the Internet?

 

Who said it wasn’t downloaded from the internet?

[Steve21]

Who said it wasn’t downloaded from the internet?

 

By default Windows only "blocks" files that come from another security zone, e.g. Downloaded files etc, based on the Alternate Data Streams file attributes that are set

 

Thus his assumption if it's blocked it's downloaded

 

Steve

[Arthur]

Who said it wasn’t downloaded from the internet?

You're right. The .LNKs could have been downloaded, but @bewlay51 mentioned in the first post that the same issue occurs with any of the shortcuts on the desktop (not just File Explorer).

 

It would be unusual to get all of your shortcuts from the Internet when they almost certainly already exist somewhere on the C:\ drive?

Edited April 22, 2019 by Arthur

[Arthur]

Thus his assumption if it's blocked it's downloaded

Yeah. I was thinking of the Zone.Identifier alternate data streams that are added when you download files...

 

https://textslashplain.com/2016/04/04/downloads-and-the-mark-of-the-web

 

The "Unblock-File" PowerShell cmdlet also only mentions files downloaded from the Internet.

 

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file

Edited April 22, 2019 by Arthur

[snagrat]

You're right. The .LNKs could have been downloaded, but @bewlay51 mentioned in the first post that the same issue occurs with any of the shortcuts on the desktop (not just File Explorer).

 

It would be unusual to get all of your shortcuts from the Internet when they almost certainly already exist somewhere on the C:\ drive?

 

I agree it would be unusual, but the error message would suggest the file is blocked.

 

I have in the pass emailed shortcuts to myself which causes this issue

[bewlay51]

Hi all,

First, many thanks for all your help - Steve21 suggestion has fixed the issue, but I think I had already tried many of the fixes with partial success. For example, shortcuts to websites worked, links to software didn't. The fix from Steve21 was....

 

User Configuration -> Administrative Templates -> Windows Components -> Attachment Manager -> Inclusion list for low file types

add .lnk to it and gpupdate/test etc

 

Thank you everyone...

 

John

[mavhc]

Seems like that would introduce risk if someone emails an lnk file

 

https://support.microsoft.com/en-gb/help/883260/information-about-the-attachment-manager-in-microsoft-windows

[bewlay51]

Thanks mavhc,

Yes it does flag up a security risk and I did think about this. The GPO setting will only be apply to students who don't have access to email at the moment and all their shortcuts will be managed. Hopefully the risk should be low.