Handle Mark of the Web on downloaded files.

[R Fowkes (rayfo)]

The Short Story

Depending on how MSO-Scripts is downloaded and unzipped, the files may get the "Mark of the Web."
This causes PowerShell (depending on the execution policy) to either refuse to execute the script, or it requests approval for each script loaded: TraceCPU.ps1, INCLUDE.ps1, INCLUDE.WPA.ps1 (See Issue #39 for details.)

This pull request takes a two-pronged approach to neutralizing the Mark of the Web (MotW), based on the notion that PowerShell may be extra careful, but running the batch file wrapper will get the job done:

1. All of the batch files that launch a PowerShell script detect and neutralize the MotW on that script. If needed, they also neutralize MotW on: INCLUDE*.ps1 or: ..\INCLUDE*.ps1
2. When INCLUDE.ps1 loads, it detects MotW on itself (even if neutralized), and it runs Unblock-File on *.ps1 on its own folder and sub-folders, removing all trace of MotW.

In both cases, a warning is emitted.

Another option would be to avoid adding this bit of code to all *.bat files, and instead create a "fix-it" script that you run after downloading/unzipping. However, that requires extra steps and documentation, and perhaps user frustration.

The Long Story

Windows implements MotW as a NTFS Alternate Stream named :Zone.Identifier , and containing specific text:

[ZoneTransfer]
ZoneId=3

Each batch script is able to detect this alternate stream and null it out, but not remove it completely (without invoking PowerShell).

REM Detect, warn, and remove Mark of the Web.
(more < "%~dpn0.ps1:Zone.Identifier") >nul 2>nul && (
	echo Unblocking downloaded PowerShell script: %~n0.ps1
	echo https://github.com/microsoft/MSO-Scripts/wiki/Frequently-Asked-Questions#policy
	echo:>"%~dpn0.ps1:Zone.Identifier"
	powershell unblock-file '%~dpn0.ps1' 2>nul
	echo:
)

OR:

REM Detect, warn, and remove Mark of the Web.
set TraceThis=%~n0.ps1
set Include=INCLUDE*.ps1 & REM or: ..\INCLUDE*.ps1
(more < "%~dp0%TraceThis%:Zone.Identifier") >nul 2>nul && (
	echo Unblocking downloaded PowerShell scripts: %TraceThis%, %Include%
	echo https://github.com/microsoft/MSO-Scripts/wiki/Frequently-Asked-Questions#policy
	for %%f in ("%~dp0%TraceThis%","%~dp0%Include%") do echo %%~nxf & echo:>"%%~f:Zone.Identifier"
	echo:
)

This executes when INCLUDE.ps1 loads:

if ($Path -and (Get-Item -Path $Path -Stream 'Zone.Identifier' -ErrorAction:SilentlyContinue))
{
	Write-Warn 'Unblocking all downloaded PowerShell scripts in this folder: *.ps1'
	$Path = Split-Path -Parent -Path $Path
	Get-ChildItem -Path $Path -Recurse -Filter '*.ps1' | Unblock-File -ErrorAction:SilentlyContinue -Verbose:(DoVerbose)
	Write-Warn
}