If the command is being done from an Intranet site then set the domain in the trusted zone like

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mydomain.com]

"*"=dword:00000002

(the above can just be copied to a REG file and and run with Local Administrator permissions). Files in the Intranet zone will get the MOTW on them if download from the web site (intranet). This prevents code execution via a Protocol Handler from a website.