How to Exempt a Known Tool From Reputation-Based Protection on Windows 11

Windows 11 includes Microsoft Defender SmartScreen, a security feature that checks files and apps against a reputation database. When you run a tool that SmartScreen has not seen before, it may block execution or display a warning. This happens even if the tool is safe and comes from a trusted source. The feature uses cloud-based reputation scoring to decide if an app is trustworthy. This article explains how to add a known tool to the exclusion list so SmartScreen stops flagging it.

What Reputation-Based Protection Does in Windows 11

Reputation-based protection is part of Microsoft Defender SmartScreen. It checks every downloaded file, app, or script against a cloud database that tracks known safe and unsafe software. If a file has low reputation — meaning few users have run it or it is new — SmartScreen blocks it or shows a warning. This reduces the chance that malware can infect your system.

The feature works in the background. When you try to run a file, SmartScreen sends a hash to Microsoft’s cloud service. The service returns a reputation score. If the score is below a threshold, Windows 11 blocks the file or shows a prompt asking you to confirm. This process takes less than a second but can interfere with legitimate tools that are not widely distributed.

Exclusions let you bypass this check for specific files or folders. After you add an exclusion, SmartScreen does not query the cloud for that file. The tool runs without any warning. Exclusions apply only to the current user account unless configured via Group Policy for all users.

Steps to Add a File or Folder Exclusion in Windows Security

The easiest method uses the Windows Security app. You can exempt a single executable file or an entire folder. Exempting a folder is better if the tool updates itself and creates new files in the same directory.

1. Open Windows Security
   Click Start, type Windows Security, and press Enter. The app opens to the Dashboard tab.
2. Go to App and browser control
   In the left sidebar, click App and browser control. The main pane shows SmartScreen settings.
3. Open Reputation-based protection settings
   Under Reputation-based protection, click Reputation-based protection settings. A new page opens with checkboxes and links.
4. Scroll to Exclusions
   Scroll down to the Exclusions section. Click Add or remove exclusions. If prompted by User Account Control, click Yes.
5. Add an exclusion
   Click Add an exclusion and choose File or Folder. Browse to the tool’s executable file or its installation folder. Select it and click Open. The path appears in the exclusion list.
6. Confirm the exclusion is active
   Close Windows Security. Run the tool. It should start without a SmartScreen warning.

To remove an exclusion later, return to the same Exclusions page. Click the path, then click Remove. Confirm the removal.

Using Group Policy or Registry to Deploy Exclusions

IT administrators can configure exclusions for multiple devices using Group Policy or the Registry. This method prevents users from seeing the warning at all and ensures consistent settings across the organization.

Group Policy Method for Windows 11 Pro, Enterprise, or Education

1. Open Group Policy Management Console
   Press Windows + R, type gpedit.msc, and press Enter.
2. Navigate to SmartScreen policy
   Go to Computer Configuration > Administrative Templates > Windows Components > File Explorer. Double-click Configure Windows Defender SmartScreen.
3. Enable the policy and set exclusion paths
   Select Enabled. In the Options box, enter the full file path or folder path for each tool you want to exempt. Separate multiple paths with semicolons. Click OK.
4. Apply the policy
   Run gpupdate /force in an elevated command prompt. Restart the computer.

Registry Method for Any Windows 11 Edition

1. Open Registry Editor
   Press Windows + R, type regedit, and press Enter. Click Yes in the UAC prompt.
2. Navigate to the SmartScreen key
   Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System. If the System key does not exist, right-click Windows, select New > Key, and name it System.
3. Create or modify the Exclusions value
   Right-click in the right pane. Select New > String Value. Name it SmartScreenExclusions. Double-click it and enter the full path to the file or folder. For multiple exclusions, separate paths with semicolons.
4. Restart the computer
   Close Registry Editor and restart the device for the change to take effect.

Common Mistakes and Limitations When Exempting Tools

Exclusion Does Not Work for All File Types

Reputation-based protection exclusions apply only to executable files such as .exe, .msi, .scr, and .dll. Script files like .ps1 or .vbs are not covered. For scripts, use Windows Defender Antivirus exclusions instead by going to Virus and threat protection > Manage settings > Exclusions.

Wrong Path or Mismatched Case

Windows 11 paths are case-insensitive, but a typo in the path causes the exclusion to fail. Always copy the exact path from File Explorer. For folder exclusions, include the trailing backslash. For file exclusions, include the full file name and extension.

Exclusion Only Applies to the Current User

When you add an exclusion through Windows Security, it applies only to the user account that added it. If another user on the same computer runs the same tool, SmartScreen still checks it. Use Group Policy or Registry to apply exclusions to all users.

Tool Still Blocked After Exclusion

If the tool is blocked by Windows Defender Antivirus real-time protection rather than SmartScreen, the exclusion does not help. Check the Windows Security notification history. If the block reason is Trojan or Behavior:Win32, add the file to Antivirus exclusions under Virus and threat protection > Manage settings > Exclusions.

Item	Windows Security Exclusion	Group Policy Exclusion
Scope	Single user account	All users on the device
Configuration method	GUI in Windows Security app	Group Policy Editor or Registry
Supported file types	.exe, .msi, .scr, .dll	Same as Windows Security
Requires reboot	No	Yes after Registry change
Best for	Individual users with one tool	IT admins managing many devices

You can now add a known tool to the SmartScreen exclusion list using Windows Security or Group Policy. For a single tool on your own computer, the Windows Security method takes less than two minutes. If you manage multiple computers, use Group Policy to deploy the exclusion silently. Always verify that the tool still receives updates from its vendor; an exclusion does not block updates but may cause SmartScreen to skip scanning update files.