SmartScreen and Phishing Protection¶
SmartScreen checks downloaded files and visited sites against Microsoft's reputation service. A file nobody has seen before, or from a site known for malware, gets a warning before it runs. It's the layer that catches what a user clicks on.
Where it is¶
Windows Security → App & browser control → Reputation-based protection settings.
| Setting | Set to |
|---|---|
| Check apps and files | On |
| SmartScreen for Microsoft Edge | On |
| Phishing protection | On |
| Potentially unwanted app blocking | On (see previous page) |
| SmartScreen for Microsoft Store apps | On |
Enhanced Phishing Protection¶
Windows 11 watches for the user typing their Windows password into a website or an app and warns them. It also warns about password reuse and unsafe apps. gpedit.msc → Administrative Templates → Windows Components → Windows Defender SmartScreen → Enhanced Phishing Protection:
| CIS | Setting | Set to |
|---|---|---|
| 18.10.77.1.5 | Service Enabled | Enabled |
| 18.10.77.1.2 | Notify Malicious | Enabled |
| 18.10.77.1.3 | Notify Password Reuse | Enabled |
| 18.10.77.1.4 | Notify Unsafe App | Enabled |
| 18.10.77.1.1 | Automatic Data Collection | Enabled |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components" /v ServiceEnabled /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components" /v NotifyMalicious /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components" /v NotifyPasswordReuse /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components" /v NotifyUnsafeApp /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components" /v CaptureThreatWindow /t REG_DWORD /d 1 /f
Enforce it with policy¶
So users can't turn it off: gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → File Explorer → Configure Windows Defender SmartScreen (18.10.77.2.1): Enabled, Warn and prevent bypass.
Verify¶
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled
Should be Warn or Block. If the policy is set:
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen
Returns 1.
Example¶
SmartScreenEnabled returns Off. A user downloading a renamed .exe from a phishing link would get no warning. Switch Check apps and files back on and confirm the value reads Warn.