"Windows protected your PC": what the SmartScreen warning means and how to get rid of it

You ship a Setup.exe, a customer downloads it, and Windows shows a blue box: "Windows protected your PC. Microsoft Defender SmartScreen prevented an unrecognised app from starting." The app is fine. The installer is fine. What happened, and what can you do about it?

What SmartScreen is checking

SmartScreen is a reputation service. When a file downloaded from the internet is run, Windows asks Microsoft whether that file, or the certificate it is signed with, is known and trusted. Three things drive the answer:

1. Code signature. Whether the file is signed with a certificate from a certificate authority Windows trusts, and whether that certificate (the "publisher") has a history.
2. Download reputation. How many people have downloaded and run this exact file, and whether anything bad was reported about it.
3. Known threats. Whether the file matches malware. If it does, it is blocked outright, with a red screen rather than a blue one.

A brand-new installer from a small publisher fails the first two checks simply by being new. The warning says "unrecognised", which is literally true, and users can click More info → Run anyway. Many won't.

What makes the warning go away

Reputation builds over time

An unsigned installer gains reputation as more people download and run it without incident. For a popular download this takes days or weeks; for a niche tool it can take a long time, and every new version starts from zero because the file is different.

Code signing, and why it changes the picture

Signing the installer with a code-signing certificate attaches your identity to it. Reputation then accrues to the certificate, not to each file, so a new version inherits the trust of the previous ones. This is the standard fix.

Your options:

• A standard (OV) code-signing certificate from a public CA (DigiCert, Sectigo, GlobalSign and resellers). Since 2023 these are issued on hardware tokens or cloud HSMs. Expect a few hundred dollars a year. Reputation still starts low and grows with downloads, but it carries over between versions.
• An EV code-signing certificate. Stricter identity checks, higher price. These historically got a good SmartScreen reputation faster. Microsoft has reduced that advantage over time, so treat EV as "better identity verification", not a guaranteed instant pass.
• Azure Trusted Signing. Microsoft's own signing service, priced monthly and designed for individuals and small companies in supported regions. It signs with short-lived certificates tied to your verified identity, and SmartScreen treats it well.

Whichever you choose, timestamp the signature so it stays valid after the certificate expires.

Signing an ExeTup installer

ExeTup builds the installer; signing it is your step, because the certificate is yours. After downloading Setup.exe:

On Windows, with the Windows SDK:

signtool sign /fd SHA256 /tr http://timestamp.digicert.com /td SHA256 /a Setup.exe

On macOS or Linux, with osslsigncode:

osslsigncode sign -pkcs12 cert.pfx -pass "..." -t http://timestamp.digicert.com -h sha256 -in Setup.exe -out Setup-signed.exe

NSIS installers accept an Authenticode signature without any special handling. Sign your app's own .exe as well, before zipping it, so the program users launch is signed too. Right-click the signed file → Properties → Digital Signatures to confirm.

What to tell users in the meantime

If you aren't signing yet, a short note on your download page helps: that the warning appears for new software from small publishers, that the installer is safe, and that clicking More info → Run anyway installs it. Publish the file's SHA-256 hash so cautious users can verify the download. ExeTup shows the hash of every build next to its download.

Also host the download on your own domain over HTTPS, and keep the same file for the same version. Re-uploading changed files resets the download reputation.

What doesn't help

• Renaming the file, zipping it, or changing the icon. Reputation is per file hash and per certificate.
• Self-signed certificates. Windows doesn't trust them, so the warning stays and the signature looks worse than none.
• Asking users to turn SmartScreen off. They shouldn't, and most won't.

FAQ

Is my installer being flagged as a virus?

No. The blue "Windows protected your PC" screen means "unknown", not "malicious". A red screen with "This app has been blocked for your protection" is a malware verdict, which is a different problem.

Will every new version show the warning again?

For unsigned installers, yes, because each version is a new file. For signed installers, reputation follows the certificate, so later versions start with the trust the earlier ones earned.

Does ExeTup sign the installers?

Not at the moment. Sign the downloaded Setup.exe with your own certificate using signtool or osslsigncode. The installer accepts the signature like any other Windows executable.

Does the warning also appear for the uninstaller?

The uninstaller is run from the local disk, not downloaded, so SmartScreen does not screen it. Users may see a standard User Account Control prompt instead for all-users installs.