SCCM Package Deployment issue Files getting Blocked

I have seen an interesting issue on all my SCCM servers.

We have deployed a package to all our SCCM servers and created advertisement for targeted users. However, users are not able to download some particular files from DP. When we checked the DP servers those files are getting blocked by windows Group policy.

The below blog explains the problem in details. Also we can get details from below forum.

“This file came from another computer
and might be blocked to help protect this computer”

http://www.windows-stupidities.com/This_file_came_from_another_computer_and_might_be_blocked_to_help_protect_this_computer.php

http://www.nforcershq.com/forum/solved-this-file-came-from-another-computer-and-migh-t69566.html

In my case the problem was for all the servers and the count of the server is around 400+. The following are the suggestions to avoid these kind of issues.
1) At the packaging level we need to avoid these kind of settings in the files.
2) Apply the below mentioned group policy on the servers (please make sure it is not creating any security breaches in your environment).
3) Remove the package from all the DPs.
4) Distribute the package to the DPs after an hour.

===========================================================================
This file came from another computer
and might be blocked to help protect this computer

This file came from another computer and might be blocked to help protect this computer.

There is no “might be” about it, it is blocked, so the message is wrong.

This is related to the problem described in the section Open File – Security Warning. You downloaded the file or copied it from another computer on your network and now Microsoft says you are not allowed to access it.

You have two choices. Switch to Linux or Mac.

No, actually, you have these two choices: click the Unblock button, and that changes the security setting for that single file. If you happened to have downloaded 137 files, you have to do this 137 times because Microsoft, in its infinite wisdom, did not provide a method to make a mass change to this setting.

To disable this stupidity for future downloads, you have to run the Group Policy Editor, which should be in the Administrative Tools section of Control Panel but isn’t. (Why not? Only Microsoft knows and they ain’t talking.) The only way to invoke it is:

Start
Run
type gpedit.msc
press OK

Then navigate to

User Configuration
Administrative Templates
Windows Components
Attachment Manager

Then right-click on the line Do not preserve zone information in file attachments and choose Properties.

Click on Enabled and then OK. You don’t need to reboot.

Now how do you get rid of the block on all the files you downloaded for the last few months? The only thing I can think of is to copy them to a drive with FAT32 because this security setting is only implemented on drives with NTFS. If you copy them to a FAT32 drive, the security is removed, so when you copy them back to the NTFS drive, they will have no security setting.

But first, you have to identify the blocked files and there is no easy way to do that, except by date.

And by the way, if you have Windows XP Home or Vista Home, they are both crippled versions of Windows and neither has Group Policy Editor, so you are stuck with this problem.

Note ==> Will only take effect on new files.
==========================================================================

Posted in: ConfigMgr (SCCM)

Leave a Comment and Contact Anoop

Visit Us On TwitterVisit Us On FacebookVisit Us On Google PlusVisit Us On YoutubeVisit Us On LinkedinCheck Our Feed