Mark-of-the-web and pinning installers to sites
The article discusses how the Mark-of-the-Web (MoTW) security feature in Windows can be used to pin executable installers to specific websites, improving download security. It explains how administrators can leverage Group Policy to require that certain installer files originate from trusted domains, ensuring that files downloaded from other sources are flagged and handled appropriately.
Background
Mark-of-the-Web (MotW) is a Windows security feature that tags files downloaded from the internet (e.g., via browsers, email, or chat apps). When a user opens such a file, Windows checks for the MotW identifier (an NTFS alternate data stream named `Zone.Identifier`) and may apply extra restrictions — for example, blocking macros in Office documents or prompting the user to confirm they really want to run an executable. The core idea is that a file downloaded from the web is less trusted than one created locally.
This post proposes "pinning installers to sites" as a way to add provenance information to installers (`.exe`, `.msi`, etc.) by storing the download URL alongside the file. The author argues that the current MotW system is too blunt — it treats all web downloads the same, even though users might trust installers from known sources (e.g., official software publishers) more than random files. By tying an installer to a specific site, tools like PowerShell or antivirus software could make smarter trust decisions. The post assumes familiarity with Windows file system internals, code signing, and enterprise software deployment workflows.