Double-clicking a .URL file in your user profile’s Favorites or Favorites\Links folder may show up a “Do you want to open this file?” file download security warning as shown below, after installing September 2016 updates, in Windows Vista, 7, 8 or Windows 10.
**Update (October 27, 2016)**
Apparently, the Favorites (*.url) File download security warning is fixed by the October 27 Cumulative Update for Windows 10 v1607 [KB3197954 – Build 14393.351]. You no longer get the security warning after installing this update. For earlier versions of Windows (Windows 7 and 8.1), a hotfix has been released for this issue. Check out Microsoft KB article FIX: “Do you want to open this file” error message after you apply security update 3185319.
Favorites .URL File Download Security Warning
September 2016 Internet Explorer Security Update fixes a critical vulnerability involving .URL files. The vulnerability allowed remote attackers to execute arbitrary code on vulnerable Windows systems by crafting a malicious file with a .URL extension.
If the victim opens the .URL file, the attacker can execute code on the target computer under the context of the user. That is, if you’re an administrator, the bad .URL file containing malicious code would use your administrative privileges. Refer Microsoft Security Bulletin MS16-104 – Critical for more information.
It’s worth mentioning that the vulnerability is categorized as “Critical“.
.URL File Download Security Warning
To remove the Favorites File download security warning that appears after installing the IE Security update, you can do one of the following things:
1 .Set the integrity level (IL) for Favorites and its sub-folders to Medium (from the default “Low” IL).
(or)
2. Set the integrity level for independent *.URL files without changing the IL for the Favorites folder and sub-folders
Option 1: Set Favorites folders Integrity Level to Medium
Open an elevated Command Prompt window and type:
ICACLS "%userprofile%\favorites" /SETINTEGRITYLEVEL (OI)(CI)M
ICACLS "%userprofile%\favorites\links" /SETINTEGRITYLEVEL (OI)(CI)M
Repeat the same procedure for every sub-folder under Favorites. If you have too many sub-folders, you can make a batch file that runs the above commands, and launch it from elevated Command Prompt.
Option 2: Set .URL Files Integrity Level to Medium
Another approach would be to set the Integrity Level for your independent .URL files only, instead of changing the IL for the Favorites folder and sub-folders. To do that, you’d use the following commands:
CD /d %userprofile%\Favorites
ICACLS *.URL /L /T /SETINTEGRITYLEVEL M
If following this method, you should note that any future .URL (bookmarks/favorites shortcuts) you add under IE Favorites will again show the “File download” security warning. You’ll need to repeat the procedure again for the newly added .URL files.
Hint: If you’ll add many favorite URLs every day, it’s better to create a batch file that runs the above commands quickly, and perhaps configure it as a scheduled task or simply place it in your Startup folder.
Start Menu Shortcuts – Open File Security Warning in Windows 7
When launching applications via Start menu – Programs, the “Open File – Security Warning” prompt may appear, containing the text “Do you want to open this file?” with Open and Cancel buttons. Clicking Open may launch the application correctly. The confirmation prompt could be the result of incorrect mandatory integrity level assigned for the Start menu.
By default no integrity level label is explicitly assigned for the Start menu\Programs folder, which means that the “Medium” integrity level is used (implied). I’m still yet to understand what causes this problem in the first place and I was unable to reproduce the problem. But resetting the integrity level using the ICACLS command took care of the problem in a user’s system running Windows 7.
Set Start Menu Programs Integrity Level to Medium
1. Click Start, type cmd.exe
2. Right-click cmd.exe in Start menu search results and click Run as Administrator.
3. Type the following command and press {ENTER}
ICACLS "C:\ProgramData\Microsoft\Windows\Start Menu\Programs" /Setintegritylevel (OI)(CI)M
This sets mandatory integrity level for Start menu Programs folder to “Medium”.
One small request: If you liked this post, please share this?
One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:- Pin it!
- Share it to your favorite blog + Facebook, Reddit
- Tweet it!
Thanks – this fixed my problem with this, without having to lower global settings.
This “fix” worked well for me, and it is appreciated. I already had the “Never Notify” in the UAC employed, but I still received those annoying little dialog boxes.
I feel 96% certain this phenomenon was triggered by the installation of Win7 SP1, however this problem did not occur on a second machine with Win7 pro installed. Go figger!!
Thancks 🙂
For me, the security warning appeared after google chrome install.
Oh gosh, thanks. Solved it! I also did a tweak to add the xp style programs list back to the start menu. Don’t know if that’s what did it though.
In case you are in a domain…here is what I observed and did.
When i launched IE, the shortcut refers to “%HOMEDRIVE%%HOMEPATH%” Therefore, I went into my domain group policy that applied to the machine and specified in USER Configuration > Policies > Admin Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Site to Zone Assignment List….and then specified the address of the server where my users profiles are stored “\\servername.company.com” and assigned a number 1 for intranet site.
Thank you, thank you, thank you, thank you, thank you!
Thank you!!!
Worked perfectly!
Any way to bump this link up to top of Google searches?
We had the same issue with one Windows 7 workstation that was joined to our domain. Nothing I tried would get rid of the Open File Security Warning. I went back to an earlier restore point and it seemed to have fixed the issue.
As Adam said: Thank you, thank you, thank you, thank you, thank you!
Thank you!!!
Worked perfectly!
Cheers, Paul
Thanks! This one worked ;O)
This worked for me!!!
Thank you very much
Unbelieveable that windows has no friggin clue what we are even talking about yet it is a common problem and a 2 step fix.. Amazing I didn’t expect it to work but it did and i thank you.. Course it took me about 3 hours of searching google to find this but in the end i did
Wow. This worked perfectly !
I’m still not sure how the integrity level was changed in the first place.
Hallo,
you DO NOT “reset” the Mandatory Security Integrity Level you “set” (!) the new level.
It is NOT (!) the same.
Regards,
cas
This was driving me crazy. Thanks!
Worked for me, thank you.
Doesn’t work on the Linbks toolbar.
Thanks for the help!!! I had the anoying pop-up message “Open file – security warning” when i trying to open a file from my desktop folder. I changed the startup folder to desktop and the problem disappeared!
Hell yeah! Thanks. Worked perfectly.
Ramesh, thank yo so much for this tip!!! After trying 5 other solutions regarding this issue when starting shortcuts from the desktop, this one finally worked for me.
Maybe the other ones didn’t work because I have moved the location for my desktop from the default location to D:\Data\Desktop
Replacing the [C:\programdata..] location in you command to mine fixed my issue.
As this issue started (seemingly) out of the blue, I’m still curious which (ms update?) caused the issue in the first place, but the solution is here.
Hello.
It works for me but after some days I have the same problem again.
I think that the first time it happened to me was because I tried to change the appearance of the Start Menu by tweaking the favorite folder. But know everything is as supposed and I still have the problem.
Works like a charm but every time I open Internet Explorer the problem starts all over again. Any solutions?
Agreed. The problem came back. Go here and look for the guy who talks about changing Custom Level Internet Options settings, about halfway done.
http://social.technet.microsoft.com/Forums/en-US/w7itproperf/thread/7aaa9657-123e-4b4e-b31b-4e04543c13cf/
That just worked for me.
Thanks, works great. This was driving me crazy.
Excellent! This solved my problem with links on the start bar once I set integrity on the right folder, as follows:
ICACLS “C:\Users\Eric\Favorites\Links” /Setintegritylevel (OI)(CI)M
(If you do this remember to set the right path!)
Thanks!
I am unable to get this resolved with programs pinned to the taskbar on a terminal server on 2008R2 where user profiles are redirected to the file server. I’ve tried running the command against the UNC path on the TS and against the local path on the file server to no avail.
Path to Explorer.lnk is: \\[server]\Redirected\[username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
Any suggestions?
Thanks!
the string to type after ICACLS command needs to end with M and not Medium for win 7 otherwise the command fails…
I had a very similar problem. On my brand new windows 8 laptop.
All of the sudden one day my desktop icons (.lnk)’s gave the same “open file security warning”.
Don’t know why or what happened but what a pain in the a**.
I FINALLY found a solution, at least for the desktop icons doing it.
I didn’t want to fix it with changes to IE10 settings, like some suggest, cuz that just seemed risky.
This worked for me….
Press: “Win button +X” to open the tools menu.
Select: Command Prompt (admin) opens the black dos window with C:\Windows\system32>
Press: CD.. and then Enter, display now says C:\Windows>
Press: CD.. and then Enter, display now says C:>
Press: CD Users and then Enter, display now says C:\Users>
Press: CD YourName and then Enter, display now says C:\Users\YourName>
Press: CD Favorites and then Enter, display now says C:\Users\YourName\Favorites>
Press: CD Desktop and then Enter, display now says C:\Users\YourName\Favorites\Desktop>
Type in: text as below:
C:\Users\YourName\Favorites\Desktop>ICACLS *.LNK /L /SETINTEGRITYLEVEL MED
Then hit Enter.
All the links on your desktop should come up as:
processed file: whatever.lnk successfully processed 10 files; Failed processed 0 files.
Just sayin..it worked for me.
AL
THANKS A LOT!!!
I have tried some of these and they don’t help me!
I need help big time and hope someone can help me I’m about to pull my hair out as I have been trying to figure this out for a week and can’t figure it out. Every time I try and open a website in my favorites I get a Open File – Security Warning.
How can I fix this? Please help me!!
I forgot to say I’m using Windows 8 🙂
Thank you puzzle locked!!! That worked. Man, that was a pain.