What are these extra /Zone.Identifier files created during Windows Remote Desktop file transfer?

According to Windows: killing the Zone.Identifier NTFS alternate data stream the Zone.Information is:

The Zone.Identifier NTFS alternate data stream (ADS) is appended to Internet downloads by browsers, and inserted by most decompressors when expanding such downloads.

ZoneID=3 means it was downloaded from Internet zone (as opposed to Local Intranet etc) . Different zones are detailed in this Microsoft document About URL Security Zones.

It is not a function of the file type it is metadata indicating the files provenance.

For example on Windows I created a new file Doc1.pdf in Word and downloaded a flight boarding pass Test.pdf from the internet.

PS C:\PDFtest> ls

    Directory: C:\PDFtest

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----       27/12/2019     09:51          25598 Doc1.pdf
-a----       10/11/2019     14:24          21784 Test.pdf

Only the downloaded file contains a Zone.Identifier stream.

PS C:\PDFtest> Get-Item * -Stream zone*

PSPath        : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest\Test.pdf:Zone.Identifier
PSParentPath  : Microsoft.PowerShell.Core\FileSystem::C:\PDFtest
PSChildName   : Test.pdf:Zone.Identifier
PSDrive       : C
PSProvider    : Microsoft.PowerShell.Core\FileSystem
PSIsContainer : False
FileName      : C:\PDFtest\Test.pdf
Stream        : Zone.Identifier
Length        : 151

PS C:\PDFtest>

If you then copy these files to mac the stream data is converted to a file but only in the case that there was some. This is because the filesystem (APFS) does not support streams (and indeed Windows doesn't necessarily know what filesystem it is).

A1398% cd ~/Downloads/PDFTest
A1398% ls -la
total 56
drwxr-xr-x   4 hali  staff    128 Dec 27 09:11 .
drwx------+ 28 hali  staff    896 Dec 27 09:11 ..
-rw-r--r--@  1 hali  staff  25598 Dec 27 09:51 Doc1.pdf
-rw-r--r--@  1 hali  staff  21784 Nov 10 14:24 Test.pdf
-rw-r--r--@  1 hali  staff    151 Nov 10 14:24 Test.pdf:Zone.Identifier

Note that if you check with ls the name is not FileName.pdf/Zone.Identifier it is FileName.pdf:Zone.Identifier - it is just macOS displays : as / in Finder. This is the same name as seen in Windows using Powershell Get-Item -Stream above or as mentioned in the link as seen using Nirsoft AlternateStreamView

The contents are whatever were in this NTFS stream. In my case it also contains the website I downloaded it from - the pdf was a flight ticket and has the airline name.

A1398% cat Test.pdf:Zone.Identifier
[ZoneTransfer]
ZoneId=3
ReferrerUrl=https://booking.nouvelair.com/web/Itinerary.xhtml
HostUrl=https://booking.nouvelair.com/web/generatePDFServlet

If you are not interested in this information you can remove the ADS on Windows as described in the above link:

This batch file kills the Zone.Identifier NTFS alternate data stream using the SysInternals streams tool:

@echo off
  if !%1!==!! goto :end
  :: use caret before pipe to hide the pipe from the outermost command in the batch file
  for /f "usebackq tokens=1" %%d in (`streams.exe %1 ^| find "Zone.Identifier:$DATA"`) do (
    goto :kill
  )
  goto :end
:kill
  streams -d %1
:end

Alternatively you can remove them on macOS after copying using rm (adjusting the directory)

rm ~/Downloads/PDFTest/*:Zone.Identifier