ZoneId Property

Get and set the default security zone ID for downloaded files.

Syntax

object.ZoneId = ZoneId

Remarks

The ZoneId property returns the default security zone identifier used when downloading a file. This property may be one of the following values:

Value Description

httpZoneNone
(-1) The file does not have a zone identifier associated with it. This typically indicates that the file was created locally or has not been marked by Windows as originating from another zone. This is the default behavior if the application does not explicitly set a default security zone.

httpZoneLocal
(0) The file is considered to be part of the Local Machine zone, which includes files stored on the user's local system or removable media. This zone has the least restrictive security settings, and files are typically allowed to run without prompting or limitation. This zone should not be assigned to downloaded files, as doing so can bypass security mechanisms designed to protect against potentially harmful content. Only use this setting for files that are created locally by the application itself and are known to be safe. Misuse of this setting can result in a significant security risk, especially if the file contains scripts, executables, or other active content.

httpZoneIntranet
(1) The file originates from the Local Intranet zone, which includes content served from internal network resources, such as shared drives, file servers, and internal web applications. This zone typically has fewer security restrictions than the Internet zone but more than the Local Machine zone. It is commonly used in enterprise environments where network resources are managed and considered relatively safe. This zone should not be used for files downloaded from the public Internet, as doing so may incorrectly signal that the file is trusted within the organization. Assign this zone only to files that are retrieved from authenticated internal sources or known secure locations on the local network.

httpZoneTrusted
(2) The file is from a site or source explicitly added to the Trusted Sites zone in Internet Explorer or Windows security settings. This zone is intended for domains or locations that the user or system administrator considers to be safe, such as internal applications hosted on the public Internet or third-party services with a strong reputation for safety. Files marked with this zone typically bypass certain security checks, and applications may allow active content (such as scripts or macros) to run without prompting. Use caution when assigning this zone to downloaded files, as it may override protections that would otherwise apply to untrusted content.

httpZoneInternet
(3) The file was downloaded from the Internet zone, which represents untrusted or unknown sources outside the local network. This is the standard zone identifier automatically applied by web browsers, email clients, and many applications when a file is downloaded from a public website or external server. Windows uses this zone to enforce security restrictions, such as prompting the user before executing scripts, blocking active content, or displaying a warning when the file is opened. This is typically the appropriate zone to assign for any file obtained over HTTP from an external site. Assigning this zone helps ensure that users are notified before opening potentially unsafe content, in accordance with Windows Attachment Manager and Group Policy settings.

httpZoneRestricted
(4) The file is associated with the Restricted Sites zone, which enforces the strictest security policies. This zone is used for content that is explicitly marked as untrusted or potentially harmful. Files tagged with this zone may be blocked from execution, prevent active content from running, or trigger warnings when accessed. Assigning this zone can be useful for sandboxing unverified downloads or limiting the risk from files obtained from questionable sources. However, it may also cause legitimate files to fail to open or operate with reduced functionality depending on system policy and application behavior.

Zone identifiers are part of a Windows security feature called Mark of the Web (MOTW) which helps identify files that originate from untrusted sources, such as the Internet. When a file is downloaded using a web browser, email client, or another application that supports zone awareness, Windows attaches metadata indicating the file's origin. This metadata allows Windows and other applications to enforce security policies based on the file's zone classification. For example, the user may be warned before opening the file, active content like macros or scripts may be disabled, or the file may be opened in a sandboxed environment.

This feature is implemented using NTFS alternate data streams (ADS), specifically a stream named Zone.Identifier. The stream contains a small block of metadata which includes the numeric zone ID, and optionally some other information such as the original URL used to download the file. This metadata is used by Windows features like Attachment Manager and supported by many Microsoft applications including Office, Windows Explorer, and Microsoft Defender SmartScreen. For example, Office may open a file originating from the Internet zone in Protected View, and Windows Explorer may show an "Unblock" checkbox in the file's properties dialog.

When your application sets the ZoneId property, the control will attach this metadata to downloaded files. This ensures that the file is properly flagged as external content, allowing Windows to apply consistent security policies. If this property is not explicitly set the by your application, or is assigned the value httpZoneNone, the control will not set a default security zone for the file. This maintains backwards compatibility with previous versions of the control which would not create the security zone metadata for downloaded files.

Assigning httpZoneLocal as the default security zone identifier for downloaded files is strongly discouraged. This zone disables key Windows security features and can expose users to significant risk. This security zone should only be used with files that are generated locally by the application and are guaranteed to be safe. Never assign this zone to content obtained from the Internet or other untrusted sources.

Because zone identifiers depend on alternate data streams, this feature is only supported with files stored on NTFS volumes. It cannot be used with files on shared network volumes (e.g., SMB shares or mapped drives) or FAT32-formatted storage devices because those filesystems do not support ADS. Files copied to a network share will lose any existing zone metadata, along with any other streams associated with the file.

If your application sets the ZoneId property to mark downloaded files with a specific security zone, it is recommended that you note this behavior in your own product documentation. This helps ensure that end users understand why they may see warning prompts or restricted functionality when opening those files, similar to files downloaded through a web browser. In managed environments, system administrators may configure Group Policy settings that prevent files from being marked with a zone identifier or suppress associated security warnings. This control adheres to those system policies, and if zone tagging is disabled by policy, the metadata will not be written even if a zone is specified.

Data Type

Integer (Int32)

Syntax

Remarks

Data Type

See Also