The “your current security settings do not allow this file to be downloaded” error on Windows Server 2025 usually comes from an Internet Explorer security zone or Enhanced Security Configuration rule. In about ten minutes, you can allow a trusted download without turning off Windows Defender Firewall, SmartScreen, or the server’s general browser protections.
Prerequisites
- A Windows Server 2025 VPS; the same Internet Options screens are also present on Windows Server 2016, 2019, and 2022.
- An active RDP session with a local administrator account, or permission to open Server Manager and Internet Options.
- The HTTPS domain that hosts the file, such as
downloads.example.com, and confidence that the file is from a legitimate vendor. - A working network connection and enough free disk space for the download. No firewall port needs to be opened for a normal outbound HTTPS download.
- If you need a Windows environment for this task, VPSLake Windows RDP hosting provides a server with administrator access.
Step 1: Identify the browser that shows the message
The exact wording is an Internet Explorer security-zone message, including when a legacy site is opened in Microsoft Edge’s Internet Explorer mode; it is not the usual Edge download warning.
Try the download once and note where it opens. If the page is in Internet Explorer or an Edge tab running in IE mode, continue with Step 2. If a normal Edge tab shows a different warning such as “Blocked by Microsoft Defender SmartScreen,” do not change Internet Options; inspect the download warning, verify the source, and use a trusted vendor URL instead.
On current Windows Server releases, Internet Explorer may not be available as a normal desktop application. For a legacy site, open Microsoft Edge and go to edge://settings/defaultBrowser, then enable the option that allows sites to be reloaded in Internet Explorer mode if your administrator permits it. Microsoft explains this workflow in its IE mode documentation. Reload the site in IE mode and reproduce the error.
Step 2: Open the legacy Internet Options security settings
Internet Options stores the file-download permission separately for each security zone, so changing a general Windows privacy setting will not fix this message.
Press Windows key + R, enter the following control-panel command, and select OK:
control.exe inetcpl.cplSelect Security. The four zones are Internet, Local intranet, Trusted sites, and Restricted sites. The site’s zone determines which File download rule is applied.
Step 3: Allow the download for the correct zone
Use the narrowest zone that solves the problem; allowing downloads only for a known HTTPS vendor is safer than lowering settings for every internet site.
Recommended: allow one trusted download domain
- Select Trusted sites, then select Sites.
- Enter the exact HTTPS origin that serves the file, such as
https://downloads.example.com, and select Add → Close. Keep Require server verification (https:) for all sites in this zone checked. - With Trusted sites still selected, choose Custom level….
- Scroll to Downloads → File download, select Enable, then select OK → Yes → Apply → OK.
Use the actual download host if the link redirects. Do not add an entire domain family, an IP address, or an unknown mirror just to make the warning disappear.
If the file must be downloaded from ordinary internet sites
Repeat the same setting for the Internet zone: select Internet → Custom level…, find Downloads → File download, choose Enable, and select OK → Yes → Apply → OK. This is broader because it permits file downloads initiated from any site assigned to the Internet zone, so return to the targeted Trusted sites method after the one-time download if possible.
Close every Internet Explorer or IE-mode window after saving the change. Reopen the browser so it reads the updated zone policy instead of the settings cached by the existing tab.
Step 4: Check Internet Explorer Enhanced Security Configuration
IE Enhanced Security Configuration hardens server browser zones and can still affect legacy web pages after File download is enabled.
Open Server Manager → Local Server. Find IE Enhanced Security Configuration and read whether it is enabled for administrators or users. Microsoft describes this feature in its Windows Server local server documentation.
Leave the protection enabled when possible. Instead, add only the vendor’s verified HTTPS site to Trusted sites as shown in Step 3. If a legacy application genuinely requires IE ESC to be disabled, select the current setting, choose Configure, change only Administrators to Off, select OK, and reconnect the browser. Do not turn it off for all users unless your security administrator has approved that broader change.
Verify the setting and download
First confirm that the Internet zone’s file-download value is enabled for the current Windows user. Open PowerShell in the same RDP session and run:
$InternetZone = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
Get-ItemPropertyValue -Path $InternetZone -Name 1803An output of 0 means File download is enabled for the Internet zone:
0If you changed only Trusted sites, verify that zone instead:
$TrustedSitesZone = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
Get-ItemPropertyValue -Path $TrustedSitesZone -Name 1803The result should also be 0. These registry checks read the setting; they do not bypass a Group Policy or a download reputation block.
Return to the same browser mode, open the verified download URL, and select Save. The file should begin downloading without the security alert. If it is an installer, scan it with the server’s active security product and verify its publisher or checksum before running it.
Troubleshooting
The File download option is greyed out or changes back
An administrator policy, domain Group Policy, or device-management policy is controlling the Internet zone. Generate a policy report with gpresult /h "$env:TEMP\policy.html", open the resulting HTML file, and look for Internet Explorer or security-zone settings. Ask the policy owner to allow the specific trusted site or change the rule; do not repeatedly lower local settings that policy will overwrite.
The setting is enabled, but the same alert appears
The page may be running in a different zone than the one you edited, or the download may redirect to another host. Check the zone indicator in Internet Options, add the final HTTPS download host to Trusted sites, and reopen the browser. Also confirm that the link is being opened in IE mode if the application requires Internet Explorer behavior.
Edge still blocks the file after the Internet Options change
Internet Options controls Internet Explorer and IE mode, not every normal Edge download. For a regular Edge warning, select the download panel’s details, confirm the publisher and URL, and obtain a clean copy from the vendor. Do not disable SmartScreen or Defender simply to force an unknown executable to download.
The browser cannot reach the download site
This is a connectivity or DNS problem rather than a File download permission problem. Check the hostname and proxy configuration, then test name resolution from PowerShell:
Resolve-DnsName downloads.example.com
Test-NetConnection downloads.example.com -Port 443Expected output includes a resolved address and a successful TCP test:
Name Type TTL Section IPAddress
---- ---- --- ------- ---------
downloads.example.com A 300 Answer 203.0.113.20
TcpTestSucceeded : TrueReplace downloads.example.com with the real host. If port 443 fails, check the server’s outbound proxy, DNS resolver, and provider network policy instead of changing browser security zones.
Hardening
- Remove the temporary entry from Internet Options → Security → Trusted sites → Sites after the download if the server no longer needs that vendor.
- Keep IE Enhanced Security Configuration and SmartScreen enabled for routine administration.
- Prefer signed installers and HTTPS sources; verify a vendor-provided checksum before executing a downloaded program.
- Use a separate workstation for general web browsing. A production server should not become a daily browsing environment.
FAQ
Why is this error common on Windows Server?
Windows Server applies stronger browser restrictions because administrators often use servers to host services rather than browse the web. Internet Explorer Enhanced Security Configuration can disable or restrict actions in the Internet zone, including file downloads.
Does enabling File download change Microsoft Edge?
Only when the page is using Internet Explorer mode or a legacy Internet Explorer component. A normal Edge download is controlled by Edge’s own download and reputation protections, so the Internet Options change will not override a SmartScreen warning.
Should I disable Internet Explorer Enhanced Security Configuration?
Usually no. Add the verified HTTPS vendor host to Trusted sites and permit File download for that zone first. If a legacy application cannot work otherwise, disable IE ESC only for the administrator scope and restore it when the task is finished.
Can I allow downloads for one website only?
Yes. Add the site’s exact HTTPS origin to Trusted sites, enable File download for that zone, and leave the broader Internet-zone setting unchanged. Remove the site afterward if it was needed for a one-time installer.
