SmartScreen Registry Key for Download Validation

Windows Defender SmartScreen protects systems by scanning downloaded files and blocking recognized threats. In environments where Group Policy is unavailable or when automated configuration is required, administrators can manage SmartScreen download validation behavior directly through the Windows Registry. This guide details the specific registry keys and values that control SmartScreen functionality across the operating system and web browsers.

Primary System Registry Key

The primary registry key governing Windows Defender SmartScreen behavior at the system and file validation level is:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System

Key Values and Configurations

Within this key, two main values manage validation checks:

• EnableSmartScreen (DWORD)
  • 1 = Enables Windows Defender SmartScreen.
  • 0 = Disables Windows Defender SmartScreen completely.
• ShellSmartScreenLevel (String / REG_SZ)
  • Block = Prevents users from running unrecognized or malicious downloaded files (removes the “Run anyway” bypass option).
  • Warn = Displays a warning when an unrecognized file is opened, but allows users with administrative rights to bypass the warning.
  • Off = Turns off file verification warnings.

Microsoft Edge Download Validation Key

To control SmartScreen specifically for downloads within Microsoft Edge, the following policy key is used:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge

• SmartScreenEnabled (DWORD)
  • 1 = Enforces SmartScreen protection for browsing and downloads in Edge.
  • 0 = Disables SmartScreen protection in Edge.
• SmartScreenPProtectionEnabled (DWORD)
  • 1 = Enables Potentially Unwanted Application (PUA) blocking for downloads.
  • 0 = Disables PUA download blocking.

Standard Explorer Fallback Key

On standalone systems where policies have not been applied, File Explorer references the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer

• SmartScreenEnabled (String / REG_SZ)
  • RequireAdmin = Requires administrator approval before running an unrecognized downloaded app.
  • Prompt = Prompts standard users with a warning before running.
  • Off = Completely disables download verification.

Applying the Changes

After adding or modifying these keys in regedit.exe:

1. Close the Registry Editor.
2. Restart the Windows Explorer process (explorer.exe) via Task Manager, or run gpupdate /force in an elevated Command Prompt.
3. Restart the computer if system-wide policy enforcement does not apply immediately.