If you’ve noticed lately that the Preview Pane in File Explorer no longer works for files downloaded from the internet, you’re not imagining it. Microsoft’s update KB5070960 introduces a change where Windows will automatically disable the preview feature for files marked with the “Mark-of-the-Web” (MOTW) attribute (i.e., files downloaded from the Internet). Windows 11 Forum

What is MOTW and why does it matter?

When you download a file from the Internet, Windows flags it with a Mark-of-the-Web (MOTW) attribute. That lets the OS know the file came from outside and may be less trusted. With this update, if a file has that MOTW tag and you attempt to preview it in File Explorer, you’ll instead see a message: “The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents.” Windows 11 Forum
In effect: the preview pane is disabled (or at least suppressed) for files that originate from the internet security zone. Windows 11 Forum

Why did Microsoft make this change?

According to the forum thread discussing the update, Microsoft states that the change “mitigates a vulnerability where NTLM hash leakage might occur if users preview files containing HTML tags (such as <link>, <src>, and so forth) referencing external paths.” Windows 11 Forum
In simpler terms:

• When previewing certain kinds of files, especially those with embedded HTML/resources pointing to external paths, there was a risk that network authentication data (specifically NTLM hashes) could leak. Windows 11 Forum

• By disabling the preview pane for files flagged as downloaded from the internet, Microsoft reduces the attack surface — fewer ways for malicious or cleverly crafted files to exploit built-in file preview functionality.

• The message in the forum makes it clear: “NTLM credential stealing is a serious enough issue to justify this change. Unless you know every website you browse is safe.” Windows 11 Forum

What does this mean for everyday users (and businesses)?

• If you download a file from the internet and try to preview it in File Explorer, you’ll hit that warning message instead of seeing the content in the preview window.

• Workflows relying on quick previews of downloaded files will be disrupted. For example: you download a Word document or PDF from an email or the web, you used to preview it in File Explorer; now you may have to open it directly instead.

• For organizations or IT teams: this is a reminder that even file-preview features can carry risk, especially in a business environment where downloaded files may come from many sources.

• It underscores the importance of controlling what gets downloaded, tracked, scanned and trusted — especially in a small-business environment where resources may be lean but risks are growing.

How This Change Reinforces Good Security Strategy for Small Businesses

At Better IT Now, we work with small businesses that may not have big IT departments or full-time security staff — but still need strong protections. Here are a few lessons and how our services tie in.

1. Recognize that built-in OS features evolve for security

This update is an example of how even core OS features (like File Explorer preview) can be modified due to security concerns. As a small business:

• Expect change: Windows updates may change behaviour you rely on.

• Plan for change: Have an IT partner or plan ready to monitor, test or respond when changes occur.

• Use best practices: Don’t assume default behaviour will remain safe forever; adopt layered security.
  Better IT Now can monitor changes, communicate impacts, and help your team adapt with minimal downtime.

2. Control and monitor downloads and file use

The MOTW/preview scenario drives home how downloads from the internet can introduce risks. For small businesses:

• Enforce policies that limit or scan downloads from the internet or external attachments.

• Use endpoint protection and file scanning before allowing previews or execution.

• Educate users: downloading and previewing untrusted files is a common attack vector.
  Better IT Now’s managed security services include setup of download controls, monitoring user behaviour, and ensuring workstations are configured securely.

3. Have incident response and remediation ready

If a malicious file had been previewed and exploited the NTLM credential scenario, your business could face credential compromise or lateral movement attacks. To defend:

• Ensure you have logging and alerts for suspicious file behaviour.

• Have backups, recovery processes and access controls in place.

• Align your SMB security posture with what larger orgs do (even if scaled down).
  Better IT Now offers incident response planning, disaster recovery readiness, and proactive hardening for small business environments.

4. Simplify security so business doesn’t stall

While this screenshot-friendly change may annoy an office user (who just wanted to preview a file), security often requires small trade-offs for big gains. As a small business:

• Balance usability and security: don’t disable every feature, but control the most risky ones.

• Rely on an IT partner you trust, so you don’t lose productivity chasing updates or confusion.

• Focus on what matters: user credentials, network access, endpoint protection, backups.
  Better IT Now provides managed IT support so that your staff can focus on your business, not on security patch-panic or hidden OS changes.

Final Thoughts

The update KB5070960 in Windows 11 that disables the File Explorer preview pane for internet-downloaded files may feel like a small inconvenience — but it represents a broader trend: attackers continue to exploit even seemingly benign OS features. For small businesses, staying ahead means more than installing updates; it means having a proactive IT & security strategy.

With Better IT Now as your security partner, you get the benefit of monitoring, management, controls, and response designed for your size, your budget, and your risks. When Microsoft tweaks a core feature like file preview to reduce credential-leakage risk, you want an IT team that sees that, explains what it means for you, and ensures your systems stay usable and protected.

If you’d like to talk about how we can help your business with managed IT, endpoint security, backup & disaster recovery, and staying ahead of OS changes — reach out. Don’t let a hidden OS change catch your team off guard.