SmartScreen and Phishing Protection¶
SmartScreen checks downloaded files and visited sites against Microsoft's reputation service. A file nobody has seen before, or from a site known for malware, gets a warning before it runs. It's the layer that catches what a user clicks on.
Where it is¶
Windows Security → App & browser control → Reputation-based protection settings.
| Setting | Set to |
|---|---|
| Check apps and files | On |
| SmartScreen for Microsoft Edge | On |
| Phishing protection | On |
| Potentially unwanted app blocking | On (see previous page) |
| SmartScreen for Microsoft Store apps | On |
Enhanced Phishing Protection¶
Windows 11 watches for the user typing their Windows password into a website or an app and warns them. It also warns about password reuse and unsafe apps. gpedit.msc → Administrative Templates → Windows Components → Windows Defender SmartScreen → Enhanced Phishing Protection:
| CIS | Setting | Set to |
|---|---|---|
| 18.10.77.1.5 | Service Enabled | Enabled |
| 18.10.77.1.2 | Notify Malicious | Enabled |
| 18.10.77.1.3 | Notify Password Reuse | Enabled |
| 18.10.77.1.4 | Notify Unsafe App | Enabled |
| 18.10.77.1.1 | Automatic Data Collection | Enabled |
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components" /v ServiceEnabled /t REG_DWORD /d 1 /f
One worked example; the rest are in the table. Type each reg add yourself (the syntax is on The Command Line) and read it back with reg query "<key>" /v <name> before moving on:
| Key | Value | Type | Data |
|---|---|---|---|
HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components |
ServiceEnabled |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components |
NotifyMalicious |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components |
NotifyPasswordReuse |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components |
NotifyUnsafeApp |
REG_DWORD | 1 |
HKLM\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components |
CaptureThreatWindow |
REG_DWORD | 1 |
Enforce it with policy¶
So users can't turn it off: gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → File Explorer → Configure Windows Defender SmartScreen (18.10.77.2.1): Enabled, Warn and prevent bypass.
Verify¶
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer" /v SmartScreenEnabled
Should be Warn or Block. If the policy is set:
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen
Returns 1.
Example¶
SmartScreenEnabled returns Off. A user downloading a renamed .exe from a phishing link would get no warning. Switch Check apps and files back on and confirm the value reads Warn.
Try it¶
- Set SmartScreen to Warn and prevent bypass, then try to run an unsigned download.
- Find each value in the table with
reg query.
Build it¶
Put the SmartScreen reg add lines in protections.bat and add the key to your verify list.