1. Symptoms: the file opens, but Preview Pane is blocked
In a common business scenario, documents sit on a Windows File Server, Synology, QNAP, TrueNAS or another NAS/SMB share. Users can browse folders and open Word, Excel or PowerPoint files normally, but File Explorer does not render them in Preview Pane.
\\FILESERVER\Share\HR
\\NAS01\Data\HR
Z:\HR
smb://NAS01/Data/HRThe warning typically says something like “The file you are attempting to preview could harm your computer…”. Starting with Windows security updates released on 14 October 2025, Microsoft blocks Preview in these cases to reduce the risk of NTLM hash disclosure while previewing unsafe content.
2. Two distinct layers of causes
This distinction is easy to miss. The two layers are separate but related:
| Layer | Indicator | Remedy |
|---|---|---|
| File-level | The file has an Alternate Data Stream named Zone.Identifier, commonly with ZoneId=3. | Use Unblock only after verifying that both the file and its source are safe. |
| Source-level | The SMB/UNC host or file share is classified as Internet Zone. | Add only the verified trusted source to Local Intranet or Trusted Sites. |
3. Mark-of-the-Web and Zone.Identifier
Windows uses Mark-of-the-Web (MotW) to identify an internet origin. On file systems supporting NTFS Alternate Data Streams, this information is commonly stored in Zone.Identifier. Microsoft PowerShell documentation states that Unblock-File removes that stream.
Get-Item "C:\Data\BaoGia.docx" -Stream *Get-Content "C:\Data\BaoGia.docx" -Stream Zone.IdentifierIf the output shows:
[ZoneTransfer]
ZoneId=3the file carries an Internet origin marker. Once the file is verified as safe, you can remove it with:
Unblock-File -LiteralPath "C:\Data\BaoGia.docx"
4. Fast Fix: why scan the entire NAS?
In a large repository, Get-ChildItem -Recurse may enumerate tens or hundreds of thousands of files. Checking the ADS of every file and running Unblock-File can rapidly multiply SMB metadata requests.
If the actual cause is an SMB host assigned to the wrong Security Zone, scanning the whole NAS is slow and misses the layer that caused the problem.
5. TEKFix Office Preview Trust – FAST Edition
TEKFix packages the procedure as a portable tool that a technician can take to another machine without installation. The current package is:
TEKFix_OfficePreview_Trust_Fast_Portable.zip
Run_TEKFix_OfficePreview_Fast.cmdMain modes
- FAST FIX: for UNC / SMB / NAS / Mapped Drive; trust the exact host without scanning files.
- DEEP FIX: trust the network source, then scan Office/PDF files and remove Zone.Identifier when needed.
- SCAN ONLY: audit MOTW without modifying Registry or files.
- UNBLOCK ONLY: process Zone.Identifier without changing Security Zone.
Trust is deliberately limited in scope
The tool does not turn off Protected View, SmartScreen or Attachment Manager across the computer. For a network path, it identifies the specific host and writes settings for the current user (HKCU) instead of weakening protection system-wide.
6. Manual PowerShell diagnostic workflow
Step A — determine whether file-level MOTW is present
Get-Item "\\FILESERVER\Share\HR\BaoGia.docx" -Stream *If Zone.Identifier is present, inspect it and use Unblock only when you trust the source.
Step B — if the file no longer has MOTW but Preview still fails
Investigate the source-level Security Zone. Microsoft says that, for an Internet Zone file share, administrators can add the share address to Local intranet or Trusted sites. For an internal file server managed by the business, TEKFix prefers Local Intranet instead of granting unnecessarily broad trust.
Step C — refresh the shell or session
Close and reopen Explorer after changing the configuration. If the old state is cached, sign out and sign back in once; Microsoft also notes that an Unblock action may only take effect after the next sign-in.
7. Security recommendations
- Trust only a NAS/File Server that your organization controls, after verifying its hostname/IP.
- Do not trust public shares, unknown servers or temporary sources merely to make Preview work.
- Do not run Fast Fix on a malware/ransomware sample repository except in an isolated lab with its own procedures.
- Do not roll out Site-to-Zone assignments through GPO broadly without assessing the impact.
- Keep Defender/EDR, NTFS/SMB permissions, SmartScreen and macro policies operating normally.
8. Domain / Group Policy environments
In Active Directory, Site to Zone Assignment List or Internet Explorer/Internet Zone policy may override user settings. Microsoft documents these zone IDs in policy: 1 = Intranet, 2 = Trusted Sites, 3 = Internet, 4 = Restricted Sites.
If a local setting seems to disappear after gpupdate or a new sign-in, check:
gpresult /h gpresult.html
rsop.mscIn a larger organization, the correct fix may be an official policy from the Domain Administrator rather than manually editing Registry on each machine.
9. Responsibility statement
⚠️ Disclaimer / usage guidance
TEKFix / TEKWiki by TUNGTEK provides this content and tool for troubleshooting, system administration and technical support. Users must verify that the SMB Server, NAS, Network Share and relevant files are trusted sources before changing a Security Zone or removing Mark-of-the-Web.
Putting a source in Local Intranet/Trusted Sites can cause Windows to treat its content with a different level of trust than Internet Zone. Do not apply this to unknown sources, malware/ransomware repositories outside a controlled lab or environments where you are not authorized to change security policy.
The tool does not replace Antivirus, EDR, Zero Trust, Access Control, Backup, Patch Management or Security Assessment. The system administrator remains responsible for which hosts and shares enter trusted zones.
Technical feedback: TUNGTEK TEKFix on Zalo — 0963509115.
Conclusion
Remember: an Office Preview failure on a NAS does not always require unblocking individual files. If Windows classifies the SMB source as Internet Zone, fix the source first. Fast Fix follows this principle:
Identify the source → Trust the correct SMB host → Avoid unnecessary data scans → Reload Explorer → Test PreviewTrust only the selected SMB host — do not weaken security across the computer.