Blacklisted drive letter? Executing files gives Security Warning, Do you want to run this file?

Win version 24H2 26100.6901

I switched from Windows 10 to Windows 11 a few months ago and ever since I have been experiencing trouble with one of my internal drives (that has been in use for years on W10 without issue).
It's an encrypted (VeraCrypt) volume from which I am unable to execute files (exe, bat, lnk) without a Security Warning (see attached screenshot for an example).
I have several other VeraCrypt volumes that do not experience this problem, and there is nothing meaningfully different about how they are mounted or set up that I can see.

The most curious thing is, if I mount the drive under a different drive letter, the issue does not appear. Moreover, if I mount a different drive under the "problematic" drive letter (F), I start getting warnings when executing things on that drive. So, it can't have anything to do with the specific executables themselves, it seems. It's only the fact that they are located, sometimes, on a path that starts with F:\... that gives Windows reason to mistrust them.
In short, Windows seems to have "blacklisted" drive letter F on my system.

I also stumbled across another workaround that I don't understand why works, which is to run the following batch file after the drive has been mounted:
So, not only is it blacklisting drive F, it seems to do so (or remember to do so) at the time the drive is mounted, not before.

Any clues as to what part of Windows might do something like that and where one might go to fix this?

I would rather not change drive letter permanently as I've gotten extremely used to it being "the F drive".
I am also aware that I could disable that part of Windows Security entirely, so that no warnings are given for any files at all. But I'd rather not do that, either.

Thanks in advance for any insight...

Right click on an exe file and select properties. If you find a message that says "This file came from another computer and might be blocked..."
Uncheck the box and click apply. Then you should be able to run it. You can do that for all of your files one by one, or just run this command in Powershell to unblock all the files in the folder.

Get-ChildItem -Path "F:/(folder name)" -Recurse | Unblock-File

DJNelson said:

Right click on an exe file and select properties. If you find a message that says "This file came from another computer and might be blocked..."
Uncheck the box and click apply. Then you should be able to run it. You can do that for all of your files one by one, or just run this command in Powershell to unblock all the files in the folder.

Get-ChildItem -Path "F:/(folder name)" -Recurse | Unblock-File

Click to expand...

Thanks for the response! There is no such message, and no box to untick on any of the exe files I checked.

The powershell command does not seem to do anything:

PS F:\> Get-ChildItem -Path "F:\DrawioPortable\DrawioPortable.exe" -Recurse | Unblock-File
Unblock-File: The filename, directory name, or volume label syntax is incorrect. : 'F:\DrawioPortable\DrawioPortable.exe:Zone.Identifier'.

Click to expand...

Slightly different reason for the same kind of problem I've encountered before, apparently. The kind of problem I lack the skills to solve without the machine in hand. Most of the people who have been here a while probably know more.

I'm curious. I wonder what would happen if you used a plain bare drive with no data on it if Windows 11 would still black list it.

This is just a hunch because the problem symptoms are not quite the same as those I've seen before.

Look in the Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
at the bottom of this list are your drive letter assignments \DosDevices\D:, \DosDevices\E:, \DosDevices\F:, etc
and look in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
for mapped network paths.

If you mounted a network path with the same drive letter that you have assigned to a drive then it can cause problems so remove both entries and re-assign the drive letter.


All the best,
Denis

Scannerman said:

I'm curious. I wonder what would happen if you used a plain bare drive with no data on it if Windows 11 would still black list it.

Click to expand...

That's an interesting question. Best I could do right this moment was to create a VeraCrypt file container and mount that as "F" - trying to run things from this caused the same warnings.
Tomorrow maybe I'll see about finding an actual hard drive I can empty out to test this with. It would be good to rule out VeraCrypt if nothing else.

Try3 said:

This is just a hunch because the problem symptoms are not quite the same as those I've seen before.

Look in the Registry Key
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
at the bottom of this list are your drive letter assignments \DosDevices\D:, \DosDevices\E:, \DosDevices\F:, etc
and look in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
for mapped network paths.

If you mounted a network path with the same drive letter that you have assigned to a drive then it can cause problems so remove both entries and re-assign the drive letter.


All the best,
Denis

Click to expand...

Thank you for this. I have indeed found entries for F (as well as my other VeraCrypt drive, G) under
MountPoints2, but removing them (as well as the ones under MountedDevices) unfortunately did not change the behavior (tested after reboot).

save this as a .bat on your external drive (or drive with other letter) and run it while its there.

dacrone said:

save this as a .bat on your external drive (or drive with other letter) and run it while its there.

Code:

@echo off
for /r %%i in (*) do (
    echo Unblocking: %%i
    streams -d "%%i"
)
pause

Click to expand...

Hi, thank you!
That batch is relying on a command that doesn't come with Windows though:

'streams' is not recognized as an internal or external command,
operable program or batch file.

Click to expand...

Based on the syntax and context I assume it's this: Streams - Sysinternals

However, the volume in question is actually exFAT, not NTFS (as are the ones that work fine), so streams does not apply:

The specified volume does not support streams.

Click to expand...

Scannerman said:

I'm curious. I wonder what would happen if you used a plain bare drive with no data on it if Windows 11 would still black list it.

Click to expand...

FMBz said:

That's an interesting question. Best I could do right this moment was to create a VeraCrypt file container and mount that as "F" - trying to run things from this caused the same warnings.
Tomorrow maybe I'll see about finding an actual hard drive I can empty out to test this with. It would be good to rule out VeraCrypt if nothing else.

Click to expand...

So, I actually didn't end up emptying the drive for this, figured it was not necessary. But I did dig up an older drive that had never been plugged in on this machine before. After I attached it, it was assigned drive letter D by the system, and when I put a program on it for testing, the executable could be run without issue.
This changed when I assigned it the letter F in disk management - same warning as with other volumes.
So, we can probably say that it's not about VeraCrypt, or at least not now.


Incidentally, @dacrone this other drive is NTFS, so I wanted to test what would happen with your batch file.
I downloaded the sysinternals zip straight to F:\Streams.zip. Right-clicking on that gave me a new warning:



This file now had the "unblock" checkbox in its properties as well, but I left that alone and ran the batch file instead. It went through all the files on the drive, but only this zip was modified:

Unblocking: F:\Streams.zip

streams v1.60 - Reveal NTFS alternate streams.
Copyright (C) 2005-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

F:\Streams.zip:
Deleted :Zone.Identifier:$DATA

Click to expand...

Result:
Right-clicking the zip still produces the warning, but the properties no longer have the unblock checkbox. (I also, maybe obviously, still cannot execute programs from that drive without the original warning.)

FMBz said:

I am unable to execute files (exe, bat, lnk) without a Security Warning

Click to expand...

I'm wondering if that warning is being triggered by 'file integrity' issues.
It's almost a decade since I experienced the problem with my IE Favourites folder.
There have been a few reports of it more recently e.g. Why am I suddenly getting this security warning - TenForums

If it is a file integrity issue then I'd expect you to see the same warning if you merely moved a file from F:\ to somewhere else [not from somewhere else to F:\].

Icacls can be used to reset file integrity to Medium e.g.
ICACLS "F:\" /T /SETINTEGRITYLEVEL (OI)(CI)M
which is the cmd I would use. Icacls cmds need to be run as Admin.

You can read about Icacls by entering this command in a Terminal-Cmd prompt window
[Admin is not needed just to see its Help]
icacls /?
or save it to a convenient folder [using a path of your own choosing] with a cmd in the form:-
icacls /? >E:\Wherever\IcaclsHelp.txt
and you can read
Icacls - MSLearn
iCacls - SS64


Denis

are the permissions different?

Try3 said:

If it is a file integrity issue then I'd expect you to see the same warning if you merely moved a file from F:\ to somewhere else [not from somewhere else to F:\].

Click to expand...

I can move files freely from and to F without triggering any warning, including exe or zip files.

Still tried out the command you suggested, limited to just this subfolder:

F:\>ICACLS "F:\DrawioPortable" /T /SETINTEGRITYLEVEL (OI)(CI)M
processed file: F:\DrawioPortable
processed file: F:\DrawioPortable\DrawioPortable.exe
processed file: F:\DrawioPortable\help.html
processed file: F:\DrawioPortable\App
[...]
Successfully processed 186 files; Failed processing 0 files

Click to expand...

Unfortunately, behavior remains unchanged, could not run that exe afterwards without warning.

DTG1 said:

are the permissions different?

Click to expand...

Could you be more specific? What permissions do you mean, and different from what?
The only permissions that come to mind are those on NTFS volumes, available through Properties > Security
But I have the same issue if I mount an exFAT volume as "F", so not sure what to do regarding permissions there, or whether that would even apply.

Well I'm out of sensible suggestions.
What I would do is search the Registry for F:\
I use NirSoft RegScanner for such tasks.
I would hope that the results would provide me with sufficient inspiration about the cause of the problem.
I would probably then change the drive letter to G:\ and search the Registry for G:\ in the hope that comparing the two sets of results would yield something useful.


Best of luck,
Denis

FMBz said:

View attachment 151630

Click to expand...

for this one, Internet Options > Security > Trusted Sites > add "file://f" and see if that stops those prompts



also, Internet Options > Security > Local Intranet > Sites > Advanced

Try clearing the Defender protection history. Use this script:

dacrone said:

for this one, Internet Options > Security > Trusted Sites > add "file://f" and see if that stops those prompts

also, Internet Options > Security > Local Intranet > Sites > Advanced

Click to expand...

These had no effect on either of the warning popups.

LesFerch said:

Try clearing the Defender protection history. Use this script:

ClearDefenderHistory

Clear Windows Defender History Files

lesferch.github.io

Click to expand...

The Defender History shown in Windows Security > Protection History appeared to be empty already.
I ran the script anyway, but the behavior did not change.

FMBz said:

This changed when I assigned it the letter F in disk management - same warning as with other volumes.
So, we can probably say that it's not about VeraCrypt, or at least not now.

Click to expand...

Well at least we eliminated one variable. For F sake! This is driving me crazy. I play with drives all the time and I've not seen the likes of it. Could it possibly be that you are running a card with a hidden drive? How many drives in total are you using? (I'm using around 30 on this PC.) What is Disk Management telling you? Can you give us screen shots?

Admittedly, I'm not an IT. I'm a retired PC builder/enthusiast. That said I've had experience with networking and HBA devices (Mostly LSI and Broadcom). If this happened to me I'd be very annoyed. Windows generally won't let you use a drive letter because it "thinks" that letter has already been spoken for. Well, maybe if I keep watching this thread I'll learn something.

Wishing you the best

I replicated the exact same error by running an exe from my "server" (SMB 1 share of a USB drive plugged into my LinkSys router). I resolved the error by adding the server's IP address to the Local Intranet zone (Internet Options > Security > Local Intranet > Sites > Advanced). Adding it to Trusted Sites did not resolve the error. However, it did not work to add the mapped drive letter, so, unless there is an IP address or host name associated with your drive F, I'm not sure if this is any help.

Scannerman said:

Well at least we eliminated one variable. For F sake! This is driving me crazy. I play with drives all the time and I've not seen the likes of it. Could it possibly be that you are running a card with a hidden drive? How many drives in total are you using? (I'm using around 30 on this PC.) What is Disk Management telling you? Can you give us screen shots?

Admittedly, I'm not an IT. I'm a retired PC builder/enthusiast. That said I've had experience with networking and HBA devices (Mostly LSI and Broadcom). If this happened to me I'd be very annoyed. Windows generally won't let you use a drive letter because it "thinks" that letter has already been spoken for. Well, maybe if I keep watching this thread I'll learn something.

Wishing you the best

Click to expand...

There are 3 internal SSDs that are on by default, connected to the on-board sata ports and power supply, completely normal in other words.
I also have a hot swap bay that can take up to three 3.5" SATA HDDs. Each slot has its own off-switch and they are off 99.9% of the time.
-- tl;dr: I don't think it's anything to do with the storage hardware I'm using, it's not that exotic.

On a hunch, I made a new local User account in Windows last night. As it turns out, the problem does not exist there. So, wherever exactly this blacklist might be located or whatever is causing it, it seems to be tied to the Windows user account or at least limited to my main account.

It has occurred to me that I've been modding Windows 11 with several pieces of third-party software, each of which might have unintended consequences. So, I will spend some time slowly and deliberately modding this new windows account to look and feel exactly like the main one, and testing whether the same problem will occur there, and at what stage. Maybe I can narrow it down to some software that way (although I don't see why any of them would have anything to do with any mounted drives or one specific letter, so it's probably a wild goose chase).