Skip to content
Windows.HomesUnofficial

SmartScreen and 'unknown publisher': what is actually being blocked

Verified 2 min read

How reputation and Mark-of-the-Web decide whether a file runs, why your own build is flagged, and what to do before clicking through.

Tested onPro (26H2) / Server · Build 26300.9457 / 26100.33650 · x64
E1
Build
26300.9457 / 26100.33650
Edition
Pro (26H2) / Server
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Concept

The short answer

Section titled “The short answer”

Two different mechanisms produce the scary dialogs:

  • Mark-of-the-Web (MotW) — a flag Windows adds to files downloaded from the internet. It says “this came from outside”; it does not say “this is malware”.
  • Reputation — SmartScreen asks Microsoft whether this file/hash/publisher is known-good or known-bad.

“Unknown publisher” almost always means the binary is not code-signed, not that it is malicious. “Windows protected your PC” means the reputation lookup was inconclusive or negative.

What triggers each warning

Section titled “What triggers each warning”
Warning Cause
“Unknown publisher” no Authenticode signature
“Windows protected your PC” MotW + no/low reputation
“This app can’t run on your PC” architecture mismatch (ARM64 vs x64)
“Blocked by your administrator” policy (AppLocker/WDAC/SmartScreen policy)
Terminal window
# does this file carry Mark-of-the-Web?
Get-Item .\setup.exe -Stream * | Select-Object Stream,Length
# and any signature
Get-AuthenticodeSignature .\setup.exe | Select-Object Status,SignerCertificate

Status : NotSigned explains the publisher warning. Status : Valid with a name you do not recognise is a different question — who signed it?

Why your own build is flagged

Section titled “Why your own build is flagged”

You compiled it, so it should be trusted — except:

  • it is unsigned (most debug builds are);
  • it was downloaded or copied from another machine, so it carries MotW;
  • SmartScreen has never seen the hash.

Options, in order of correctness:

  1. Sign the binary (self-signed for private use, code-signing cert for distribution).
  2. Remove MotW from a file you produced: Unblock-File .\app.exe.
  3. Click More info → Run anyway — acceptable for a one-off you built.

What SmartScreen is not

Section titled “What SmartScreen is not”
  • Not an antivirus: it does not scan file contents the way Defender does.
  • Not a guarantee: a signed binary from a compromised publisher passes.
  • Not a network filter for all traffic — that is Defender’s web protection.

When it blocks something you need

Section titled “When it blocks something you need”
Situation Correct action
Vendor tool, unsigned verify the download source and hash on the vendor page, then unblock
Internal tool sign it, or allow it by policy
Old installer prefer the current version; old unsigned installers are a real risk
Script from a colleague read it before unblocking
Terminal window
# unblock a file you produced or verified
Unblock-File .\tool.exe
Get-Item .\tool.exe -Stream * | Select-Object Stream

The reputation side is not configurable per file

Section titled “The reputation side is not configurable per file”

You cannot “whitelist” a hash locally in a supported way. Reputation is a cloud service. What you can do:

  • sign your binaries;
  • use AppLocker/WDAC to allow by publisher, which bypasses the reputation prompt for trusted publishers;
  • for one machine, accept the prompt and move on.
Section titled “Related”

Lab boundary

Section titled “Lab boundary”

E1. SmartScreen and MotW behaviour is documented by Microsoft. The lab VMs do not browse to untrusted downloads, so no prompt was reproduced.

Sources