none
Rationale for open file (.URL) warning? RRS feed

  • Question

  • In my Favorites folder are (among others)

    2013-07-05  02:35              77  v.url
    2013-07-05  02:35              77  VerizonWireless.URL

    They're identical (the first is a copy of the second); neither contain any alternate data streams.  If, in Explorer, I right-click on the first of them and choose "print", I get the "Open File - Security Warning" ("Do you want to open this file? ...").  If I right-click on the second of them and choose "print", I do not get that warning.

    Can anyone explain this difference in behavior?

    Notes: this behavior is not unique to that pair of files.  Of the ~twenty *.URL in Favorites, many elicit the warning, many do not.  It is also not unique to the "print" action.  It also happens with a custom "OpenWithIE" action (before my EXE is invoked).  FireFox is my default browser; the "open" action never elicits the warning.

    Thanks.

     - Vince

    Friday, July 5, 2013 4:17 PM

All replies

  • Hi,

    The .url files which do not have this warning were cut in to the favorites folder, right?

    This issue is related to two things:

    1. Favorites folder. 2.  The mechanisms for copy and cut.

    When a file is saved or copied to Favorites folder, a file will be given an attribute or a flag which NTFS creates and it is not visible. That marks this file is from Internet and may be not trusted. Thus, the warning will be thrown out. While the mechanisms for copy and cut are different in file explore. If the file was cut into somewhere else, the files will not be changed.

    Here is a scenario 1:

    1. Copy a .url file from Favorites to your Desktop (a local place which is differ from Favorites folder) and no flag was cleared.

    2. Copy it to Favorites folder again, a flag was given. We will get the warning.

    Cut it to your Favorites folder, it is not changed and a flag will not be given. We do not get the warning.

    scenario 2:

    1. Cut a .url file to your Desktop.

    2.  The file is not changed. No matter copy or cut, we will still get the warning.

    Hope it helps.


    Tracy Cai
    TechNet Community Support

    Thursday, July 11, 2013 8:41 AM
    Moderator
  • Thank you for your reply, Tracy.

    What is the name of the NTFS attribute?

    As I said earlier, none of the *.URL in question have alternate streams; in particular, they do not have a Zone.Identifier stream.

    Can we discuss one simple experiment?  XYZ.URL is in "Favorites".  It does not produce the warning.  At a command prompt (current directory = "Favorites") I issue "COPY XYZ.URL XYZ2.URL".  The copy produces the warning.  Neither file has a Zone.Identifier stream.

    Please explain what happened in that simple experiment (which I have done many times with the same result).

    - Vince

    Friday, July 12, 2013 4:36 AM
  • Hi,

    Why Windows gives you the warning is just because the .url file is added with a flag to show it comes from Internet or other network resource so that Windows will warn you when you open such files. Otherwise, File System will treat differently between Copy and Cut command. This function is related to NTFS Internal. You have no need to worry about it. If you really want to avoid showing this warning. Please just copy out all your favorites and delete the originals, then cut back them.


    Tracy Cai
    TechNet Community Support

    Friday, July 12, 2013 5:29 AM
    Moderator
  • Hi,

    Why Windows gives you the warning is just because the .url file is added with a flag to show it comes from Internet or other network resource so that Windows will warn you when you open such files. Otherwise, File System will treat differently between Copy and Cut command. This function is related to NTFS Internal. You have no need to worry about it. If you really want to avoid showing this warning. Please just copy out all your favorites and delete the originals, then cut back them.


    Tracy Cai
    TechNet Community Support

    What flag?  I want to see it.  I want to know how it works.  I will write the program.  The files do not have a Zone.Identifier stream.

    Friday, July 12, 2013 5:46 AM
  • Hi,

    After research, I found that alternative data steam is not the only thing that can trigger the security warning, the other thing we need to notice is integrity level. Please set the level to high or medium.

    Regards,


    Juke Chou
    TechNet Community Support

    Thursday, July 18, 2013 7:47 AM
    Moderator
  • Hi,

    After research, I found that alternative data steam is not the only thing that can trigger the security warning, the other thing we need to notice is integrity level. Please set the level to high or medium.

    Regards,


    Juke Chou
    TechNet Community Support

    I am not complaining about the behavior and it is not my goal to change it.  I want to understand what's happening.

    None of the URLfiles in "Favorites" have a Zone.Identifier stream.  If I right_click\Print on VerizonWireless.URL I do not get a warning.  If I right_click\Print on NationalGrid.URL I do get a warning.  What's happening here?  By what mechanism has Windows decided that my telephone provider is a risk and that my electric utility is not a risk?  They both use "https".

    Further, if with a command prompt, I "COPY VerizonWireless.URL VerizonWireless2.URL" then the newly-created internet shortcut (without a Zone.Identifier stream) causes the warning while the original does not.

    Those files look like this.  I see no reason why they should be treated differently.

    c:\users\vefatica\favorites> type VerizonWireless.URL VerizonWireless2.URL NationalGrid.url

    [InternetShortcut] URL=https://login.verizonwireless.com/amserver/UI/Login [InternetShortcut] URL=https://login.verizonwireless.com/amserver/UI/Login [InternetShortcut] URL=https://www1.nationalgridus.com/StateLandingNY


    Friday, July 19, 2013 4:46 PM
  • Hi,

    As I told you above, all the things in this case happening are just because of  two things.

    1, Alternative data stream. 2, Integrity level

    So, please change all the .url files to high or medium integrity level if you do not want the security warning to appear.

    Otherwise, if you want to learn what is integrity level, pleae refer to the document below.

    http://msdn.microsoft.com/en-us/library/bb625963.aspx 


    Juke Chou
    TechNet Community Support

    Monday, July 22, 2013 3:30 AM
    Moderator
  • Hi,

    As I told you above, all the things in this case happening are just because of  two things.

    1, Alternative data stream. 2, Integrity level

    So, please change all the .url files to high or medium integrity level if you do not want the security warning to appear.

    Otherwise, if you want to learn what is integrity level, pleae refer to the document below.

    http://msdn.microsoft.com/en-us/library/bb625963.aspx 


    Juke Chou
    TechNet Community Support

    And as I said before, they do not have alternative data streams (a few files in Favorites have a "favicon" stream, but not the ones in question).  And a URLfile behaves differently from a copy of the same file.  I read a bit about integrity levels (I'll read more).  This (below) would seem to indicate that both files inherit the level of the Favorites folder.

    c:\users\vefatica\favorites> icacls VerizonWireless.URL
    VerizonWireless.URL NT AUTHORITY\SYSTEM:(I)(F)
                        BUILTIN\Administrators:(I)(F)
                        zz\vefatica:(I)(F)
    
    Successfully processed 1 files; Failed processing 0 files
    
    c:\users\vefatica\favorites> icacls VerizonWireless2.URL
    VerizonWireless2.URL NT AUTHORITY\SYSTEM:(I)(F)
                         BUILTIN\Administrators:(I)(F)
                         zz\vefatica:(I)(F)
    
    Successfully processed 1 files; Failed processing 0 files

    Monday, July 22, 2013 5:20 AM
  • Hi,

    Below is the explaination of why the copy and cut have a very different result.

    When a original file's integrity level is high or medium, then you copy it into Favorite folder, a new file will be created with integrity level inherited from parent folder. If you cut it, the integrity level will remain. This is why you find some files do not prompt for this warning.


    Juke Chou
    TechNet Community Support

    Monday, July 22, 2013 5:27 AM
    Moderator