Windows XP SP2 Attachment Execution Service Changes

Windows XP Service Pack 2 (SP2) fundamentally overhauled how downloaded files and email attachments were handled by introducing the Attachment Execution Service (AES). This update replaced inconsistent, easily bypassed download dialogs with a unified, risk-based security prompt system powered by the IAttachmentExecute API. By tagging downloaded content with origin metadata and categorizing files by risk level, SP2 drastically reduced the likelihood of users inadvertently running malicious code.

The Unified Security Warning Dialog

Prior to SP2, different applications such as Internet Explorer and Outlook Express used disparate and inconsistent confirmation prompts when opening files. SP2 introduced a standardized "Open File - Security Warning" dialog across the operating system. This dialog explicitly presents the file name, the file type, the source origin, and the publisher's digital signature status before allowing execution.

Origin Tracking via Mark of the Web

To determine whether an execution prompt was necessary, Windows XP SP2 introduced persistent origin tracking using NTFS Alternate Data Streams (ADS). When a file was saved from an untrusted source—such as the Internet (Zone 3) or Restricted Sites (Zone 4)—AES appended a hidden metadata stream named Zone.Identifier to the file.

Whenever a user attempted to launch the file, the shell checked for this stream. If present, the execution service triggered the security prompt regardless of how much time had passed since the download. Users could permanently dismiss this check on a per-file basis by clicking the newly introduced "Unblock" button in the file's Properties dialog.

Risk-Based Categorization

The behavior of the execution prompt in SP2 depended directly on the file type's risk classification:

  • High-Risk Files: Executable formats such as .exe, .scr, .bat, .cmd, .vbs, and .pif always triggered a warning prompt. For these extensions, the operating system removed or disabled the legacy "Always ask before opening this file" checkbox, preventing users from permanently disabling prompts for dangerous file types.
  • Moderate-Risk Files: Formats that could potentially carry macros or scripts retained the warning prompt, but allowed users to uncheck the confirmation prompt for future launches if desired.
  • Low-Risk Files: Benign formats, such as standard text files (.txt) and common image formats, opened without interruption unless administrative policies dictated otherwise.

Digital Signature Integration

SP2 deeply integrated Authenticode digital signature verification into the attachment prompt. If an executable contained a valid digital signature, the dialog clearly displayed the verified publisher name with a link to inspect the certificate. If the file lacked a valid signature, the prompt prominently displayed an "Unknown Publisher" warning accompanied by a yellow shield icon, alerting users that the authenticity of the file could not be verified.

Centralized Management

The prompts and underlying AES behaviors were centralized under Group Policy. Administrators gained granular control over prompt behaviors via administrative templates, allowing organizations to customize the list of high-risk, moderate-risk, and low-risk extensions, enforce mandatory blocking of untrusted attachments, or disable the ability for end-users to unblock downloaded files.