[Win10 Pro] Single-clicking ANY file on my Desktop triggers a "These files might be harmful" warning, and Defender blocks VSCode/scripts. Only happens on the Desktop; D drive is completely fine. Please help!

💻 1. System Environment

OS: Windows 10 Pro 22H2 (OS Build 19045.6466)

Account: Local Administrator account. NOT linked to a Microsoft account (No OneDrive sync/redirection).

Security Software: Windows Defender only (No third-party AV).

Affected Path: C:\Users\Administrator\Desktop

Working Path: D drive and other non-user folders on C drive work perfectly.

🐛 2. Symptoms

Trigger: I used Microsoft Edge to open a folder on my Desktop. Since then, the system seems to have locked down the Desktop folder with maximum security restrictions.

Single-click Warning: Now, just single-clicking (selecting) any file on the Desktop triggers the "Windows Security - These files might be harmful to your computer" popup (stating "Internet security settings indicated that one or more files might be harmful").

Dev Tool Blocking: Dragging files into VSCode, or running .ps1 / .bat scripts triggers a Windows Defender warning and blocks execution.

ZIP Extraction Blocked: Zipping a file on the Desktop and extracting it back also triggers the "might be harmful" warning.

Abnormal Permissions & Sharing:

Desktop Properties -> Security -> Group or user names contains an "Unknown Account (S-1-4-1039366120-933337351)".

  The Desktop folder shows a **"Shared"** status (even though `Get-SmbShare` only shows the default `C$`, `D$`, `ADMIN$`, `IPC$`).

  
  **Comparison**: D drive files are entirely unaffected. No popups, no blocks.
```### 🛠️ 3. Troubleshooting Attempted (All Failed)

*Please do not suggest these again:*

**Internet Options**: Lowered all zone security levels to minimum, reset to default, enabled "Launching applications and unsafe files". No fix.

**Registry Tweaks**: Added `SaveZoneInformation=1` under `Attachments`; Added `AutoShareWks=0` under `LanmanServer\Parameters` (This caused Error 2114; fixed by restarting LanmanServer). No fix.

**PowerShell**: Ran `Unblock-File`, and force-removed `Zone.Identifier` data streams. Reported success, but the issue persists.

**Defender Exclusions**: Added exclusions for VSCode and Desktop in Windows Security. Added `AttackSurfaceReductionOnlyExclusions` via PowerShell. Disabled Controlled Folder Access. No fix.

**Tamper Protection**: Turned off Tamper Protection and temporarily disabled Real-time protection. No fix.

**Removing Orphaned SID**: Used `takeown` and `icacls` to remove the Unknown Account (`S-1-4-...`), but got "Successfully processed 0 files; Failed processing 0 files".

**ZIP Trick**: Compressed, deleted, and re-extracted. Extracted files still trigger the warning.

**VSCode Settings**: Disabled `security.workspace.trust.enabled` in VSCode. No fix.

**UAC**: Set to lowest ("Never notify"). No fix.

### 🎯 4. Questions

Why is this *only* happening to the Desktop? Is it related to that "Unknown Account" or the "Shared" status?

How can I completely remove the Internet mark and abnormal permissions **without reinstalling Windows and without abandoning the Desktop**?

How do I stop Defender from blocking VSCode and scripts?

### 📎 5. Attachments

- [Attach screenshots: The Security popup, the Unknown Account in permissions, and the "Shared" status]

  ### 💻 1. System Environment

  - **OS**: Windows 10 Pro 22H2 (OS Build 19045.6466)
  
  - **Account**: Local Administrator account. **NOT** linked to a Microsoft account (No OneDrive sync/redirection).
  
  - **Security Software**: Windows Defender only (No third-party AV).
  
  - **Affected Path**: `C:\Users\Administrator\Desktop`
  
  - **Working Path**: D drive and other non-user folders on C drive work perfectly.
  
  ### 🐛 2. Symptoms

  1. **Trigger**: I used Microsoft Edge to open a folder on my Desktop. Since then, the system seems to have locked down the Desktop folder with maximum security restrictions.
  
  1. **Single-click Warning**: Now, just **single-clicking (selecting)** *any* file on the Desktop triggers the "Windows Security - These files might be harmful to your computer" popup (stating "Internet security settings indicated that one or more files might be harmful").
  
  1. **Dev Tool Blocking**: Dragging files into VSCode, or running `.ps1` / `.bat` scripts triggers a Windows Defender warning and blocks execution.
  
  1. **ZIP Extraction Blocked**: Zipping a file on the Desktop and extracting it back also triggers the "might be harmful" warning.
  
  1. **Abnormal Permissions & Sharing**:
  
      - Desktop Properties -> Security -> Group or user names contains an **"Unknown Account (S-1-4-1039366120-933337351)"**.
      
      - The Desktop folder shows a **"Shared"** status (even though `Get-SmbShare` only shows the default `C$`, `D$`, `ADMIN$`, `IPC$`).
      
  1. **Comparison**: D drive files are entirely unaffected. No popups, no blocks.
  
  ### 🛠️ 3. Troubleshooting Attempted (All Failed)

  *Please do not suggest these again:*
  
  1. **Internet Options**: Lowered all zone security levels to minimum, reset to default, enabled "Launching applications and unsafe files". No fix.
  
  1. **Registry Tweaks**: Added `SaveZoneInformation=1` under `Attachments`; Added `AutoShareWks=0` under `LanmanServer\Parameters` (This caused Error 2114; fixed by restarting LanmanServer). No fix.
  
  1. **PowerShell**: Ran `Unblock-File`, and force-removed `Zone.Identifier` data streams. Reported success, but the issue persists.
  
  1. **Defender Exclusions**: Added exclusions for VSCode and Desktop in Windows Security. Added `AttackSurfaceReductionOnlyExclusions` via PowerShell. Disabled Controlled Folder Access. No fix.
  
  1. **Tamper Protection**: Turned off Tamper Protection and temporarily disabled Real-time protection. No fix.
  
  1. **Removing Orphaned SID**: Used `takeown` and `icacls` to remove the Unknown Account (`S-1-4-...`), but got "Successfully processed 0 files; Failed processing 0 files".
  
  1. **ZIP Trick**: Compressed, deleted, and re-extracted. Extracted files still trigger the warning.
  
  1. **VSCode Settings**: Disabled `security.workspace.trust.enabled` in VSCode. No fix.
  
  1. **UAC**: Set to lowest ("Never notify"). No fix.
  
  ### 🎯 4. Questions

  1. Why is this *only* happening to the Desktop? Is it related to that "Unknown Account" or the "Shared" status?
  
  1. How can I completely remove the Internet mark and abnormal permissions **without reinstalling Windows and without abandoning the Desktop**?
  
  1. How do I stop Defender from blocking VSCode and scripts?
  
  ### 📎 5. Attachments

- ![User's image](/api/attachments/335ff606-b6c5-4c23-8706-1e183ba4e92e?platform=QnA)

![User's image](/api/attachments/8de37257-d68e-464b-9784-510cb28a745a?platform=QnA)