Mandatory Integrity Level

What is the file? Windows System files cannot be removed

Some of them are .bat files that I downloaded from Windows 10 Forums. There were also a lot of downloaded drivers and software that I have been copying from drive to drive over the years and never had an issue before. I use RoboCopy to copy with all security permissions. None of the files are Windows System files. I finally beat them by copying to an exFat drive, deleting the originals, and copying back to original location. The first file that I copied back I just overwrote the original, and the High Integrity level was still there. So I deleted the original and copied back from exFat drive again and the issue was fixed. Can anybody explain how the Integrity Level got raised on just a tiny percentage of the files that were all copied to the drive by RoboCopy at the same time with the same settings.

Also, I was not trying to delete or move the files; I was trying to change permissions and ownership.

While very annoying, I think this has something to do with either windows mistaking Local Drives, with Network drives, and/or Dual Boot/Fresh Installs sharing same content on other Drives.
I have an 8TB HDD to store all my GOG Offline Installers (400+ Games), and though this isn't occurring with the entire drive, it seems to be specific to certain folder trees created with amy previous local account. listed now as "Account Unknown" in advanced Security tab..

After a complete PC rebuild, and fresh OS install on a reformatted NVMe, I have come across this issue, specifically with certain GOG offline installers for downloaded with a previous Install.
So I suspect my Local drives have been mistakenly flagged as Networked Drives, somehow, as I have regular issues with MS reinstalling the POS that is "Windows Security", and setting MS decided "Security Settings".
Despite me having my own security software, and removing Defender completely (Many Times).

I've found a workaround though,
Find the actual folder first created when downloading the offline installers files originally, in my experience that is what starts the "Low Mandatory Level" inheritance chain.
That entire chain must be replaced, I've found no way to unset the level once set, so workaround the issue.
That folder name is first copied, then renamed (Deleting, or adding any character works).
I create a new folder with the copied name and the Integrity Level is gone, but just copying/moving the contents over doesn't remove that pesky"Low Mandatory Level" from the subfolders, or contents.
Creating an Archive of the old folders content in that new folder (I use *.7Z made with 7-Zip), does work, as extracting the content inherits the clean security settings of the newly created folder.

It works with the files, and as I write with my second occurrence just found, I'm trying all the folders inside the original culprit, rather than recreating all the subfolders manually, as I did in the first attempt.
It's going to take a while, this is just 2 Games, but files are on a slow HDD, all my SSDs, and NVMe are for my 600+ installed & modded games
Offending Folder
Middle-Earth – Shadow – Series
Archive Contents (Folders in Bold)
1 Middle-Earth – Shadow Of Mordor
Middle-Earth – Shadow Of Mordor – GOTY Edition – Game Installer (GOG)
+ GOG Installer Files = 53.4 GB
2 Middle-Earth – Shadow Of War
Middle-Earth – Shadow Of War – Definitive Edition – Game Installer (GOG)
+ GOG Installer Files =153 GB

So I'll not post this just yet, I'll wait until the 10MB/s Archiving, and 50 MB/s extraction is done, to confirm the entire contents of the "Low Mandatory Level" folder can be archived as I expect.
Well that took a while, about 12 hours due to the 200GB+ size, and to be honest with my 1,130Mbps (141.25 MB/s) Internet, downloading again would have been much faster, but few people have that sort of speed.
It was a test case of the workaround, and I can now confirm it works as expected.

If I want to avoid permissions and ownership I boot with Windows Setup USB and press SHIFT+F10 at first screen to open a Command Prompt with Administrator rights. I can then navigate and copy-paste what I want where I want using DOS commands. Alternatively, you can use a third-party Explorer replacement tool that disregards access rights and ownership such as ERD Explorer. I have borrowed this little tool from the good old Digiwiz MiniPE CD-ROM. For those that don't know it was a Windows XP live CD with many tools for recovery, virus check etc. Much like the Sergei Strelec Boot CD which is a Windows 10/11 live DVD. Both can be converted to a live USB using Rufus or similar tool.

spapakons said:

If I want to avoid permissions and ownership I boot with Windows Setup USB and press SHIFT+F10 at first screen to open a Command Prompt with Administrator rights. I can then navigate and copy-paste what I want where I want using DOS commands. Alternatively, you can use a third-party Explorer replacement tool that disregards access rights and ownership such as ERD Explorer. I have borrowed this little tool from the good old Digiwiz MiniPE CD-ROM. For those that don't know it was a Windows XP live CD with many tools for recovery, virus check etc. Much like the Sergei Strelec Boot CD which is a Windows 10/11 live DVD. Both can be converted to a live USB using Rufus or similar tool.

Click to expand...

Not sure if that would even matter, you can copy, and/or move the files just fine on the installed OS, that's not the issue at all.

The issue is running the files with the Current User on an installed W11, because it's NOT the same user account that was used when "Low Mandatory Level" was set.
I had no issues running the installers when I created them, the original user account wasn't blocked, and all permissions, can be changed with the current user account, that is not blocked.
It made no difference what permissions were changed, nothing has been able to remove the "Low Mandatory Level", and I don't think it's even set with File/folder security permissions.
Seems more like the zoning security levels from the Internet Options Control Panel, but issue seems to only occur when the account that it was set for no longer exists.

I'm not saying their is no other way, as that's rarely the case.
I'm saying this method will fix this specific, and rare issue, because I've tested it, and know it does work.

Uhuru said:

Seems more like the zoning security levels from the Internet Options Control Panel, but issue seems to only occur when the account that it was set for no longer exists.

Click to expand...

From the OP's description and solution.....

Some of them are .bat files that I downloaded from Windows 10 Forums. There were also a lot of downloaded drivers and software that I have been copying from drive to drive over the years and never had an issue before...... I finally beat them by copying to an exFat drive, deleting the originals, and copying back to original location.

Click to expand...

It was almost certainly that the files were being blocked as having come from another machine. Fat32 or ExFat do not support NTFS's alternate data stream for files, which holds this info. So copying them to ExFat and back would have removed it. There are easier ways to unblock files.

Bree said:

From the OP's description and solution.....



It was almost certainly that the files were being blocked as having come from another machine. Fat32 or ExFat do not support NTFS's alternate data stream for files, which holds this info. So copying them to ExFat and back would have removed it. There are easier ways to unblock files.

Unblock File Downloaded from Internet in Windows 11

This tutorial will show you different ways on how to unblock files downloaded from the Internet depending on how they were blocked in Windows 11. When you download files from the Internet, Windows 11 shows you a security warning every time you try to open it by default. Some file types are...

www.elevenforum.com

Click to expand...

Aware of that awful "Feature", and it's long been disabled system wide on my PC, and though I can't speak for the OP directly, do you seriously think that that they would have not unticked that box before going to the security tab.
That doesn't set the Integrity level either, and as I said, it is set on folders as well, and they were definately created on my computer with a Local account, not just the file as your example pic shows.
Just found another one, so here's the pics showing on the folder

I have no exFAT Drives, only NTFS, and had already found my workaround, using Archives before this thread even existed, and you cut off the part that lead to me posting my experience with same issue.

IndieArchive said:

Can anybody explain how the Integrity Level got raised on just a tiny percentage of the files that were all copied to the drive by RoboCopy at the same time with the same settings.

Click to expand...

Lucky for me this ones a much older game series, only 300 MB in total, so an easy & quick test, and copying to another Physical NTFS Drive also removes the Integrity Level, maybe another partition on the same drive might, but my GOG installer Drive has just one partition so can't test it.
I stand by my hypothesis that these are set by The Internet options security levels, because I know I downloaded my GOG Installers, but that was to folders I created locally, and that "Low Mandatory Level" is inherited by EVERYTHING inside the root folder shown above.
Like the OP, I'm not seeing this on every folder on the drive, so I think for me, it occurs when a Windows Update re-installs Defender, and/or resets things behind my back.

NTLite (Paid version only) has a feature to auto remove, the parts of Bundled updates, the user removed on creating a custom install, and as I own that, and make my custom ISO with it, I've now disabled Windows Update.
On my next Fresh Install, I will use NTLite as my Windows Update tool, a I learn to use it's features better, this is mainly to stop Defender making decisions behind my back, even though I use other Security, I have total manual control over, and obeys my Ask me every time, on first use security setup.
Far to many mods, get false flagged as "Suspicious" for having the exact behavior I need, and use them for, not to mention the cracks I use on OWNED games to remove DRM, and/or Store Clients.
I can't expect others to know my setup, so tend to fix my own issues, by RTFM, rather than asking others for help, there are times like this when I can help others though, because I must rely on myself to fix my own problems.

I you want to modify file attributes (read only, system, hidden), there are some utilities that do that. I have one that even allows you to set a custom date, but I am not on my computer now and don't remember how it is called. Another way is to use the attrib command from an elevated Command Prompt. I haven't understood exactly what are you trying to do, sorry not enough time to read all the posts again.