You’ve downloaded a file from your browser, and Windows has been quietly noting its origin the whole time. That information lives in a feature called the Mark of the Web, and you can pull it up to see exactly where a file came from. Here’s what it does and how to check it.
What is the Mark of the Web?
When you grab a file from the internet through a browser like Microsoft Edge or Google Chrome, Windows attaches a small metadata marker to it. This marker is officially called the Mark of the Web (MotW), and it tells the operating system that the file originated from a web source rather than sitting on your local drive.
The purpose is security. Files from the web are treated as slightly less trustworthy than files already on your machine, so Windows flags them and applies extra caution when you try to open or run them. You’ve probably seen the familiar prompt: This file came from the internet. Do you want to open it? That warning is powered by the Mark of the Web.
How the Mark of the Web works
The marker is stored inside the file itself, tucked away in an NTFS alternate data stream (ADS) under the name Zone.Identifier. Because it lives in a hidden part of the file, the MotW survives even when you copy the file to a USB drive or email it to someone — it travels with the file wherever it goes.
Inside that Zone.Identifier stream are a few key pieces of data. The most important is a Zone ID, which identifies which security zone the file came from. a Zone ID of 3 means the file came from the general Internet zone, while a 4 indicates it came from a Trusted Sites list. You can also find a Referrer URL and a Host URL that point back to the page or server the file was pulled from.
Microsoft’s security components rely on this marker in several ways. It drives the SmartScreen reputation checks, feeds into Smart App Control, and determines whether a file gets a full trust level when you launch it. In short, the Mark of the Web is one of the core signals Windows uses to judge how much you should trust a freshly downloaded file.
How to check the Mark of the Web in File Explorer
The simplest way to see whether a file carries the marker is to open its properties. Just right-click the file in File Explorer and select Properties from the menu.
On the General tab, look near the bottom of the window. If the file was downloaded from the web, you’ll see a line that reads This file came from the internet. Do you want to open it? with an Unblock checkbox beside it. Checking that box removes the Mark of the Web, which tells Windows the file is safe and can be opened without the extra caution.
This is the same checkbox you’ve encountered for years when opening documents, installers, or spreadsheets that suddenly act “locked up.” It’s the most user-friendly way to confirm a file’s web origin, and it works for individual files you want to inspect.
How to check it with PowerShell
If you want to dig deeper — or check a whole folder at once — PowerShell can read the Zone.Identifier stream directly. Open PowerShell and run the following command, replacing the path with your file:
Get-Content -Stream Zone.Identifier -Path "C:\Downloads\file.ext"
This prints the contents of the marker stream, showing the Zone ID, Referrer URL, and Host URL. a Zone ID of 3 confirms the file came from the general Internet zone, while a 4 means it came from Trusted Sites.
To scan an entire folder, you can add a loop to the command. For example, running Get-Content -Stream Zone.Identifier -Path "C:\Downloads\*.exe" will report the marker on every executable in that directory. Sysinternals’ Streams tool offers a similar capability with the command streams.exe -s C:\Downloads, listing every alternate data stream it finds.
What This Means for You
For everyday users, the Mark of the Web is mostly a helpful background safeguard. It’s the reason your browser downloads don’t silently run with full trust, and it’s what powers the “Unblock” prompt you’ve seen for over a decade. If you downloaded a file yourself and know it’s safe, unblocking it is a quick way to remove the warning.
For IT administrators, the marker matters more. Because it travels with the file across drives and networks, a file that was once flagged can still be treated as “from the web” even after it lands on a workstation. That makes it a useful signal when triaging a potential issue, but it also means removing the marker — for example, during a migration or cleanup — requires deliberate action rather than just moving the file.
How to remove or unblock the marker
The easiest removal path is the Properties dialog we covered above. Open the file’s Properties, tick the Unblock box, and click Apply. That clears the Mark of the Web for that single file.
For a batch of files, PowerShell handles it in one go. The command Unblock-File -Path "C:\Downloads\*.exe" removes the marker from every matching file, which is handy after pulling a folder of downloads onto a machine. Just be sure you trust those files before running it — unblocking is essentially Windows saying “yes, go ahead.”
Source: Neowin
Over to you: Do you unblock your downloads to remove the Mark of the Web, or leave it on to be safe — what’s your approach?
