# SmartScreen and 'unknown publisher': what is actually being blocked

> How reputation and Mark-of-the-Web decide whether a file runs, why your own build is flagged, and what to do before clicking through.

**Tested on**

- Build: 26300.9457 / 26100.33650
- Edition: Pro (26H2) / Server
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Two different mechanisms produce the scary dialogs:

- **Mark-of-the-Web (MotW)** — a flag Windows adds to files downloaded from the internet. It says "this came from outside"; it does not say "this is malware".
- **Reputation** — SmartScreen asks Microsoft whether this file/hash/publisher is known-good or known-bad.

"Unknown publisher" almost always means **the binary is not code-signed**, not that it is malicious. "Windows protected your PC" means the reputation lookup was inconclusive or negative.

## What triggers each warning

| Warning | Cause |
|---|---|
| "Unknown publisher" | no Authenticode signature |
| "Windows protected your PC" | MotW + no/low reputation |
| "This app can't run on your PC" | architecture mismatch (ARM64 vs x64) |
| "Blocked by your administrator" | policy (AppLocker/WDAC/SmartScreen policy) |

```powershell
# does this file carry Mark-of-the-Web?
Get-Item .\setup.exe -Stream * | Select-Object Stream,Length
# and any signature
Get-AuthenticodeSignature .\setup.exe | Select-Object Status,SignerCertificate
```

`Status : NotSigned` explains the publisher warning. `Status : Valid` with a name you do not recognise is a different question — who signed it?

## Why your own build is flagged

You compiled it, so it should be trusted — except:

- it is **unsigned** (most debug builds are);
- it was downloaded or copied from another machine, so it carries MotW;
- SmartScreen has never seen the hash.

Options, in order of correctness:

1. **Sign the binary** (self-signed for private use, code-signing cert for distribution).
2. Remove MotW from a file you produced: `Unblock-File .\app.exe`.
3. Click **More info → Run anyway** — acceptable for a one-off you built.

> **Caution: Do not teach yourself to click through**
>
> The habit of clicking "Run anyway" is exactly what a malicious attachment relies on. Unblock only files whose origin you can state out loud — "I compiled this from my repo at 14:20".

## What SmartScreen is not

- Not an antivirus: it does not scan file contents the way Defender does.
- Not a guarantee: a signed binary from a compromised publisher passes.
- Not a network filter for all traffic — that is Defender's web protection.

## When it blocks something you need

| Situation | Correct action |
|---|---|
| Vendor tool, unsigned | verify the download source and hash on the vendor page, then unblock |
| Internal tool | sign it, or allow it by policy |
| Old installer | prefer the current version; old unsigned installers are a real risk |
| Script from a colleague | read it before unblocking |

```powershell
# unblock a file you produced or verified
Unblock-File .\tool.exe
Get-Item .\tool.exe -Stream * | Select-Object Stream
```

## The reputation side is not configurable per file

You cannot "whitelist" a hash locally in a supported way. Reputation is a cloud service. What you can do:

- **sign** your binaries;
- use **AppLocker/WDAC** to allow by publisher, which bypasses the reputation prompt for trusted publishers;
- for one machine, accept the prompt and move on.

## Related

- [Core isolation and HVCI](https://winbook.fyi/en/windows/hardening/core-isolation/)
- [Controlled folder access](https://winbook.fyi/en/windows/hardening/controlled-folder-access/)
- [Windows Sandbox](https://winbook.fyi/en/windows/customise/sandbox/)
- [BitLocker recovery drill](https://winbook.fyi/en/windows/hardening/bitlocker-recovery-drill/)

## Lab boundary

E1. SmartScreen and MotW behaviour is documented by Microsoft. The lab VMs do not browse to untrusted downloads, so no prompt was reproduced.

## Sources

- [Microsoft Learn — Microsoft Defender SmartScreen](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)
- [Microsoft Learn — Identity protection](https://learn.microsoft.com/en-us/windows/security/identity-protection/)
- [Microsoft Learn — Controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folders)

---

Source: https://winbook.fyi/en/windows/hardening/smartscreen/