Steps to Reproduce

  1. Installs Windows Remote Desktop client for mac
  2. Connect to a Windows 10 server, mounting a local folder over the connection
  3. On the remote server, copy a pdf (e.g. my_file.pdf from a remote folder to the mounted Mac folder
  4. Look at the mounted Mac folder locally on the Mac

Observed behavior

The pdf I copied is there.

A second file with the same name plus /Zone.Identifier is there. (i.e. my_file.pdf/Zone.Identifier (despite the slash, that's one file name.)

The contents when viewed in a text editor is:



One Drive cannot sync files with slashes in their file name, so I get lots of errors whenever I do this, and I have to manually delete each one.


  • What is this file?
  • What put it there? Was it the remote desktop client?
  • Why doesn't it go away when I close the connection?
  • Why doesn't it happen for .txt files?
  • How do I avoid creating such a file?

1 Answer 1


According to Windows: killing the Zone.Identifier NTFS alternate data stream the Zone.Information is:

The Zone.Identifier NTFS alternate data stream (ADS) is appended to Internet downloads by browsers, and inserted by most decompressors when expanding such downloads.

ZoneID=3 means it was downloaded from Internet zone (as opposed to Local Intranet etc) . Different zones are detailed in this Microsoft document About URL Security Zones.

It is not a function of the file type it is metadata indicating the files provenance.

For example on Windows I created a new file Doc1.pdf in Word and downloaded a flight boarding pass Test.pdf from the internet.

PS C:\PDFtest> ls

    Directory: C:\PDFtest

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       27/12/2019     09:51          25598 Doc1.pdf
-a----       10/11/2019     14:24          21784 Test.pdf

Only the downloaded file contains a Zone.Identifier stream.

PS C:\PDFtest> Get-Item * -Stream zone*

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest\Test.pdf:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest
PSChildName   : Test.pdf:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\PDFtest\Test.pdf
Stream        : Zone.Identifier
Length        : 151

PS C:\PDFtest>

If you then copy these files to mac the stream data is converted to a file but only in the case that there was some. This is because the filesystem (APFS) does not support streams (and indeed Windows doesn't necessarily know what filesystem it is).

A1398% cd ~/Downloads/PDFTest
A1398% ls -la
total 56
drwxr-xr-x   4 hali  staff    128 Dec 27 09:11 .
drwx------+ 28 hali  staff    896 Dec 27 09:11 ..
-rw-r--r--@  1 hali  staff  25598 Dec 27 09:51 Doc1.pdf
-rw-r--r--@  1 hali  staff  21784 Nov 10 14:24 Test.pdf
-rw-r--r--@  1 hali  staff    151 Nov 10 14:24 Test.pdf:Zone.Identifier

Note that if you check with ls the name is not FileName.pdf/Zone.Identifier it is FileName.pdf:Zone.Identifier - it is just macOS displays : as / in Finder. This is the same name as seen in Windows using Powershell Get-Item -Stream above or as mentioned in the link as seen using Nirsoft AlternateStreamView


The contents are whatever were in this NTFS stream. In my case it also contains the website I downloaded it from - the pdf was a flight ticket and has the airline name.

A1398% cat Test.pdf:Zone.Identifier

If you are not interested in this information you can remove the ADS on Windows as described in the above link:

This batch file kills the Zone.Identifier NTFS alternate data stream using the SysInternals streams tool:

@echo off
  if !%1!==!! goto :end
  :: use caret before pipe to hide the pipe from the outermost command in the batch file
  for /f "usebackq tokens=1" %%d in (`streams.exe %1 ^| find "Zone.Identifier:$DATA"`) do (
    goto :kill
  goto :end
  streams -d %1

Alternatively you can remove them on macOS after copying using rm (adjusting the directory)

rm ~/Downloads/PDFTest/*:Zone.Identifier
  • That script looks like it should work, but it doesn't. I saved it to a .bat file, and downloaded the streams64.exe file, then renamed it to streams.exe in the same directory. When I ran ./fix.bat in powershell the process exits without printing anything, looking like success. But the same behavior remains. Is there any way to just tell Firefox not to create the file in the first place? (e.g. about:config) Commented Dec 30, 2019 at 4:13
  • @falsePockets - You could try powershell dir * | Unblock-File to remove them from specific directory (see How to Remove Zone.Identifier from Multiple Files Quickly in Windows or turn off creation in gpedit.msc option Do not preserve zone information in file attachments (see this ask ubuntu question - option is the same in Windows 10).
    – lx07
    Commented Dec 31, 2019 at 15:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .