File Explorer's preview pane no longer shows your downloaded PDFs, documents or HTML files, and instead says: "The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents." This is neither a virus nor a bug: it is a protection added by Microsoft with the October 2025 security updates, relaxed since then by the September and October 2026 updates.
Problem
- Message "The file you are attempting to preview could harm your computer" in the preview pane.
- Preview works for your own files, but not for downloaded files or email attachments.
- Files on a network share are no longer previewed.
- Preview stays blocked even though the file was unblocked.
Why the preview is blocked
Since the Windows security updates of October 14, 2025, File Explorer disables the preview of files that carry the Mark of the Web, meaning files downloaded from the Internet. Microsoft explains that a file containing certain HTML tags pointing to an external path could, just by being previewed, leak an NTLM hash (a fingerprint of your Windows credentials) that an attacker could capture. The block also applies to files shown from a network share classified in the Internet zone.
Observe before acting
| What you see | Most likely cause | Step |
|---|---|---|
| Message on a downloaded file, PC not updated since September 2026 | October 2025 behavior | Step 1 |
| Message on an HTML file, with a Preview anyway button | New 2026 behavior | Step 2 |
| You trust this specific file | Mark of the Web | Step 3 |
| Files on a trusted network share | Share classified in the Internet zone | Step 4 |
To find out whether a file carries the Mark of the Web, open its Properties: an Unblock checkbox appears at the bottom of the General tab. In PowerShell (replace the path):
Get-Item "C:\Users\nom\Downloads\document.pdf" -Stream Zone.Identifier
If a Zone.Identifier stream is shown, the file carries the mark.
Step 1: install the 2026 updates
When to use it: preview of downloaded PDFs or other non-HTML files is blocked.
The optional update KB5124010 (September 22, 2026), included in the security update KB5127648 (October 13, 2026), changes this behavior for Windows 11 24H2, 25H2 and 26H2: non-HTML files, such as PDFs, are previewed automatically again, and HTML files get a Preview anyway button. Microsoft delivers this change through a gradual rollout: it may reach your PC a little later.
Suggested solution
- Settings > Windows Update: install the offered updates and restart.
- Check in Update history that KB5127648 or a more recent cumulative update is installed.
- Reopen File Explorer and select the file again.
Expected result: downloaded PDFs and other non-HTML files are shown in the preview pane.
Rollback: not recommended (uninstalling an update also removes its security fixes).
Step 2: HTML files, the "Preview anyway" button
When to use it: the selected file is a downloaded HTML page and the button is offered.
Suggested solution
Click Preview anyway only if you know where the file comes from. This button is used to acknowledge the warning; HTML files are precisely the type of file where the NTLM leak was possible.
Expected result: the preview of the HTML file is shown.
Rollback: none; the warning will come back for the next downloaded HTML files.
Step 3: unblock a trusted file
When to use it: you trust the file and its source, and the preview stays blocked (PC without the 2026 updates, or HTML file).
Suggested solution
- In File Explorer, right-click the file > Properties.
- General tab: tick Unblock, then OK.
- If the preview stays blocked, sign out and sign back in: Microsoft states that the change may only take effect at the next sign-in.
PowerShell equivalent:
Unblock-File -Path "C:\Users\nom\Downloads\document.pdf"
Expected result: the file is shown in the preview pane.
Rollback: no checkbox puts the Mark of the Web back; delete the copy and download the file again if needed.
Do not mass-unblock the whole Downloads folder: the protection would disappear for all those files.
Step 4: trusted network share
When to use it: files on a server or NAS that you control are no longer previewed.
Suggested solution
- Open the Start menu, type Internet Options and open it.
- Security tab: select Local intranet or Trusted sites, then Sites.
- Add the share address, then confirm. For a network share in Trusted sites, clear Require server verification (https:) for all sites in this zone.
- Reopen File Explorer.
Expected result: preview works for files on this share.
Rollback: same window, select the address and Remove.
Warning: Microsoft cautions that this setting relaxes security for all files on the share concerned. Only apply it to a share whose content you control.
What not to do
Do not try to disable the protection for the whole system: it fixes a real credential theft flaw. For a file you have doubts about, opening it is not safer: delete it or scan it first.
Final check
- ☐ KB5127648 or a more recent cumulative update is installed.
- ☐ Downloaded PDFs are shown in the preview pane.
- ☐ Unblocked files are only files whose origin is known.
- ☐ Shares added to trusted zones are only your own.
Sources
- Microsoft Support: File Explorer automatically disables the preview feature for files downloaded from the internet (KB 5070960)
- Microsoft Support: KB5124010, optional update of September 22, 2026
- Microsoft Support: KB5127648, security update of October 13, 2026
- Microsoft Learn: Unblock-File
If the file also refuses to be deleted or renamed, see File cannot be deleted because it is open in another program.
Still having the problem?
Reply to this topic with the Windows version and build (winver), the file type (PDF, Word, HTML…), where it comes from (download, attachment, network share), and whether the exact message or the Preview anyway button appears. Remove your user name from paths.