Fix Windows Defender SmartScreen Blocks Trusted Internal Apps

Quick fix: For one-off blocks, right-click the file → Properties → Unblock. For folder-level whitelisting, use Windows Security → Virus & threat protection → Manage settings → Add or remove exclusions. For app reputation issues, run from Command Prompt to bypass the SmartScreen prompt.

You download an internal company tool or a small-vendor utility and Microsoft Defender SmartScreen blocks it: Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognized app from starting. The file is trusted, signed by your company, or a well-known niche tool — SmartScreen just hasn’t seen enough downloads to consider it “known.” The fix is to whitelist either the specific file, a containing folder, or your trusted signing certificate.

What causes this

SmartScreen reputation works on download count, age, and digital signature. Files seen by Microsoft millions of times pass automatically. Files from a newly-released app or an unsigned binary trigger the block — even if you know exactly what they are. SmartScreen also marks downloaded files with the Mark-of-the-Web (MOTW) attribute, which keeps the warning on every launch until you explicitly unblock.

Method 1: Unblock a single file via Properties

The right approach for a one-off trusted download.

1. Locate the downloaded file (typically in C:\Users\you\Downloads).
2. Right-click the file → Properties.
3. At the bottom of the General tab, look for: This file came from another computer and might be blocked to help protect this computer.
4. Tick the Unblock checkbox next to it.
5. Click Apply → OK.
6. Now run the file. SmartScreen may show one more warning “Windows protected your PC” — click More info → Run anyway.
7. The app runs and SmartScreen learns over time that this file is trusted.

For bulk-unblocking a folder of files, PowerShell:

Get-ChildItem -Path "C:\path\to\folder" -Recurse | Unblock-File

Method 2: Add the app or folder to Defender exclusions

Use when you trust an entire folder or app — typically development tools or your company’s internal apps.

1. Open Windows Security → Virus & threat protection.
2. Under Virus & threat protection settings, click Manage settings.
3. Scroll to Exclusions. Click Add or remove exclusions.
4. Click Add an exclusion, choose:
   • File — exclude a single .exe.
   • Folder — exclude a folder and its contents.
   • File type — exclude by extension (.exe, .dll, etc.).
   • Process — exclude by process name.
5. Pick the path or pattern. Confirm.
6. The exclusion is now active. SmartScreen and real-time scanning skip the path.
7. Reboot for the exclusion to fully apply.

Use cautiously — exclusions reduce protection. Limit to specific trusted folders, not broad ones like Downloads.

Method 3: Use Microsoft Defender PowerShell for granular control

Use for scripted whitelisting, certificate-based trust, or to validate that exclusions actually applied.

1. Open Terminal (Admin).
2. Add a path exclusion:

   Add-MpPreference -ExclusionPath "C:\dev\internal-tool"

3. Add a process exclusion:

   Add-MpPreference -ExclusionProcess "my-app.exe"

4. View current exclusions:

   Get-MpPreference | Select-Object ExclusionPath, ExclusionProcess, ExclusionExtension

5. Remove an exclusion that’s no longer needed:

   Remove-MpPreference -ExclusionPath "C:\dev\internal-tool"

6. For corporate trust of code-signed apps from your company: deploy your company’s code-signing certificate to Trusted Publishers store via Group Policy. SmartScreen treats apps signed by trusted publishers as trusted regardless of reputation.

PowerShell exclusions can be scripted into onboarding tools and deploy-at-scale solutions.

How to verify the fix worked

• Launch the previously-blocked app. SmartScreen does not appear.
• Run Get-MpPreference | Select ExclusionPath in PowerShell. The path you excluded appears in the list.
• The file’s Properties dialog no longer shows the “blocked from another computer” warning.

If none of these work

If SmartScreen continues blocking despite exclusions and unblock, three deeper causes apply. SmartScreen App Reputation at the Edge level: separate from Defender SmartScreen. Open Windows Security → App & browser control → Reputation-based protection settings, set Check apps and files and SmartScreen for Microsoft Edge to Off temporarily, retry. Group Policy enforcement: on corporate-managed PCs, IT may have configured SmartScreen to block-without-prompt (no “Run anyway” option). Contact IT to add the trusted app to their approval list. Mark of the Web persistence: even after unblock, some apps re-read MOTW on each launch. Use the PowerShell command Get-Item file.exe | Remove-Item -Stream Zone.Identifier to strip the zone identifier entirely. For chronic blocks, ensure the app is digitally signed — unsigned apps are inherently suspect to SmartScreen and there’s no full bypass without signing.

Bottom line: SmartScreen blocks trusted apps when reputation is low or files are marked as “from another computer” — unblock individual files, exclude trusted folders, or sign your internal apps to bypass the friction.