{"id":10449,"date":"2019-07-24T03:56:33","date_gmt":"2019-07-24T03:56:33","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=10449"},"modified":"2019-07-24T04:01:26","modified_gmt":"2019-07-24T04:01:26","slug":"bypass-smartscreen-even-if-its-enabled-through-group-policy","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/bypass-smartscreen-even-if-its-enabled-through-group-policy\/","title":{"rendered":"Bypass SmartScreen even if its Enabled through Group Policy"},"content":{"rendered":"

When you download a file you downloaded from the internet, Windows adds the zone identifier or Mark of the Web as NTFS stream to the file. So, when you run the file, Windows SmartScreen checks if there is a zone identifier<\/a> alternate data stream attached to the file. If the ZoneId=3<\/code> data ADS is present, Windows identifies that the file was downloaded from the internet, and the SmartScreen does a reputation check when you run the file.<\/p>\n

If the file has a bad reputation according to the Microsoft SmartScreen server, you’re adviced not to run the file, with an option to run the file anyway despite the warning. The warning reads Windows protected your PC. Windows SmartScreen prevented an unrecognized app from starting. Running this app might put your PC at risk<\/strong>.<\/em><\/p>\n

\"batch<\/p>\n

Zone ID 3<\/code> represents the “Internet Zone”. If you downloaded the file using Chrome or Chrome-based browsers, you’ll also see the ReferrerUrl and HostUrl data in the NTFS stream.<\/p>\n

\"bypass<\/p>\n

To prevent the SmartScreen, you usually right-click on the file, click Properties, select the Unblock checkbox and click OK.<\/p>\n

\"batch<\/p>\n

But if you have the Hide mechanisms to remove zone information<\/strong> policy located under the node User Configuration<\/strong> \u2192 Windows Components<\/strong> \u2192 Attachment Manager<\/strong> in the Group Policy Editor enforced, the Unblock<\/strong> option would be missing in the file’s properties tab.<\/p>\n

Also, the SmartScreen group policy can be configured such that you don’t get the Run anyway option, and the users can’t turn off SmartScreen via Windows 10 Settings UI.<\/p>\n

\"bypass<\/p>\n

The relevant policy setting is Configure Windows Defender SmartScreen<\/strong>\u00a0under Computer Configuration<\/strong> \u2192 Windows Components<\/strong> \u2192 File Explorer<\/strong>.<\/p>\n

Setting it to Warn and prevent bypass<\/strong> removes the Run anyway<\/strong> option.<\/p>\n

The corresponding registry settings for the above two Policies are below:<\/p>\n

HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Attachments\r\nValue: HideZoneInfoOnProperties<\/strong>\r\nType: REG_DWORD, Data: 1<\/strong>\r\n\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\r\nValue: EnableSmartScreen<\/strong>\r\nType: REG_DWORD, Data: 1<\/strong>\r\n\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\r\nValue: ShellSmartScreenLevel<\/strong>\r\nType: REG_SZ, Data: Block<\/strong><\/pre>\n
Bypass SmartScreen even if it is Enabled through Group Policy<\/h2>\n
However, even with the above policies configured, there is a loophole method to bypass SmartScreen using a registry value which can be configured per-user — i.e., under HKEY_CURRENT_USER.<\/p>\n
Let’s say you get this screen when running a downloaded installer in your Windows 10 computer.<\/p>\n
\"bypass<\/p>\n
To bypass the SmartScreen, create a DWORD (32-bit) value named NoSmartScreen<\/strong><\/code> under the following registry key:<\/p>\n
HKEY_CURRENT_USER\\Software\\Classes\\exefile\\shell\\open<\/pre>\n
\"bypass<\/p>\n
Now, the file runs without going through the SmartScreen check!<\/p>\n
\"bypass<\/p>\n
Another way to prevent the SmartScreen is to remove the zone information using PowerShell (as the Unblock option in file properties is now hidden using Policy). If the user has access to PowerShell, he can run the Unblock-file<\/a> cmdlet to easily remove the zone identifier information from the file.<\/em><\/p>\n
The above bypass works only if the user is able to create the NoSmartScreen<\/code> registry value using one of the methods, such as Registry Editor, PowerShell, console reg.exe tool, WScript.exe, CScript.exe, or any other tool already present in the computer.<\/p>\n
The SmartScreen is an extra layer of defense which can be useful in addition to your Windows Defender real-time and cloud protection<\/a> features. Microsoft should ensure that the above loophole is plugged in the future Windows releases.<\/p>\n","protected":false},"excerpt":{"rendered":"
When you download a file you downloaded from the internet, Windows adds the zone identifier or Mark of the Web as NTFS stream to the file. So, when you run the file, Windows SmartScreen checks if there is a zone identifier alternate data stream attached to the file. If the ZoneId=3 data ADS is present, … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[8],"tags":[441],"class_list":["post-10449","post","type-post","status-publish","format-standard","hentry","category-windows-10","tag-registry"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":3410,"url":"https:\/\/www.winhelponline.com\/blog\/bulk-unblock-files-downloaded-internet\/","url_meta":{"origin":10449,"position":0},"title":"How to Bulk Unblock Files Downloaded from Internet","author":"Ramesh","date":"July 5, 2016","format":false,"excerpt":"Files downloaded from the internet are marked with the Zone identifier (\"Mark of the Web\" stored as Alternate Data Streams) to trigger the application reputation check by Windows SmartScreen in Windows 8 and higher. This article explains how to bulk unblock multiple files downloaded from the internet. Zone Identification tagging\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"zoneid and hosturl - ntfs alternate data streams","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/07\/zoneid-hosturl-streams.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5072,"url":"https:\/\/www.winhelponline.com\/blog\/edge-unsafe-files-blocked-smartscreen\/","url_meta":{"origin":10449,"position":1},"title":"Microsoft Edge – Prevent Download of Unsafe Files Blocked by SmartScreen Filter","author":"Ramesh","date":"January 7, 2017","format":false,"excerpt":"The SmartScreen Filter warns the user when running unrecognized programs or files downloaded from the internet. When you download files using Microsoft Edge, the file download is blocked if the source URL is blacklisted or the downloaded program fails the application reputation check by Microsoft SmartScreen filter. However, Edge Chromium\u2026","rel":"","context":"In "Microsoft Edge"","block_context":{"text":"Microsoft Edge","link":"https:\/\/www.winhelponline.com\/blog\/category\/edge\/"},"img":{"alt_text":"prevent unsafe files from being downloaded - edge policies","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/prevent-unsafe-files-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":76710,"url":"https:\/\/www.winhelponline.com\/blog\/error-not-a-microsoft-verified-app\/","url_meta":{"origin":10449,"position":2},"title":"The app you’re trying to install isn’t a Microsoft-verified app","author":"Ramesh","date":"October 10, 2024","format":false,"excerpt":"When you run a setup file downloaded from the internet (i.e., non-Store app), the setup doesn't run, and the following message may appear: The app you're trying to install isn't a Microsoft-verified app Installing apps from the Store helps protect your PC and keep it running smoothly. Cause This can\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"unblock exe downloaded from internet","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/10\/unblock-downloaded-exe.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":75762,"url":"https:\/\/www.winhelponline.com\/blog\/find-where-file-downloaded-from\/","url_meta":{"origin":10449,"position":3},"title":"How to Determine where a File was Downloaded from","author":"Ramesh","date":"July 1, 2024","format":false,"excerpt":"You may have downloaded a file weeks ago and want to find out where it was downloaded from. You may determine that by reading the alternate data streams for that file. When you download a file and save the file in an NTFS volume, the zone information for the file\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"zone identifier open in notepad","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/where-as-a-file-downloaded-from-notepad.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/where-as-a-file-downloaded-from-notepad.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/where-as-a-file-downloaded-from-notepad.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2024\/07\/where-as-a-file-downloaded-from-notepad.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":79925,"url":"https:\/\/www.winhelponline.com\/blog\/file-explorer-previews-blocked-harm-your-computer\/","url_meta":{"origin":10449,"position":4},"title":"File Explorer: The file you are attempting to preview could harm your computer","author":"Ramesh","date":"December 5, 2025","format":false,"excerpt":"After installing the October 15 (2025), cumulative update for Windows 11, File Explorer turns off the preview feature for files downloaded from the internet. After the October 2025 or a later Windows security update is installed, the File Explorer preview pane will display the following message: The file you are\u2026","rel":"","context":"In "Windows 11"","block_context":{"text":"Windows 11","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-11\/"},"img":{"alt_text":"Internet Explorer options - Trusted sites zone","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2025\/12\/ie-trusted-zone-sites.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":5571,"url":"https:\/\/www.winhelponline.com\/blog\/remove-3d-objects-folder-pc-windows-10\/","url_meta":{"origin":10449,"position":5},"title":"Remove 3D Objects Folder from This PC in Windows 10","author":"Ramesh","date":"October 18, 2017","format":false,"excerpt":"Windows 8 and Windows 10 come with a set of folders (6) shown in This PC view. With Windows 10 Fall Creators Update, a new folder has been added to list of folders in This PC; it's the 3D Objects folder where the Paint 3D app saves files by default.\u2026","rel":"","context":"In "Windows 10"","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"3d objects replace custom folder","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/3d-objects-replace.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/3d-objects-replace.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/3d-objects-replace.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/10449","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=10449"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/10449\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=10449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=10449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=10449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}