Microsoft just broke some custom folder icons, and it's deliberate

At a glance:

• Microsoft’s June 2026 Windows 11 update now treats custom folder icons from untrusted sources as a security risk.
• Icons defined via desktop.ini are silently reverted to defaults when the file originates from Mark‑of‑the‑Web, WebDAV/HTTP locations, or untrusted network paths.
• Users can restore icons by adding the source to Trusted Sites, enabling the "Allow the use of remote paths in file shortcut icons" policy, or stripping the Mark‑of‑the‑Web tag.

What changed and why

The June 2026 update to Windows 11 introduced stricter validation for desktop.ini files that define custom folder icons. If the operating system cannot verify that the file came from a trusted source, it silently discards the custom icon setting and falls back to the default folder appearance. Microsoft confirmed on its blog that this behavior is intentional, not a bug, and is part of a broader security hardening effort.

Untrusted sources are specifically defined as files that carry a Mark‑of‑the‑Web (MOTW) tag, files copied from certain WebDAV or HTTP‑based locations, and files residing on network paths that are not classified as intranet or trusted by the current zone policy. The MOTW marker is attached by browsers and other download mechanisms to indicate that a file originated from the Internet and should be treated with caution.

Microsoft’s rationale is to prevent potential icon‑spoofing attacks where a malicious actor could replace a benign folder icon with a deceptive one to trick users into opening harmful content. By requiring that desktop.ini files come from trusted locations, the OS reduces the attack surface for social engineering that relies on visual cues.

How to fix it and what to watch

To restore missing custom icons, administrators and end users have three options. First, they can add the source location (e.g., a web server or network share) to the Trusted Sites zone in Internet Options, signalling to Windows that files from there are safe. Second, they can enable the Group Policy setting "Allow the use of remote paths in file shortcut icons," which tells the shell to accept icons from remote paths even if they are not in Trusted Sites. Third, they can remove the Mark‑of‑the‑Web tag from the desktop.ini file using PowerShell (Unblock‑File) or the file’s Properties dialog.

The change affects anyone who personalizes folder appearance via desktop.ini, including home users who organize projects with visual cues, enterprises that deploy standardized icons via logon scripts, and software vendors that ship template folders over the web. Without adjusting trust settings, those icons will revert after each feature update that enforces the new validation.

Looking forward, Microsoft may extend similar trust checks to other shell extensions such as custom context menus or property sheets. Users should keep desktop.ini files on trusted internal shares, monitor the Windows release notes for further hardening, and consider signing scripts or using internal package distribution methods to avoid the MOTW flag.