Microsoft Defender SmartScreen warning for my unsigned game installer – how can I establish file reputation?

Sign every public release with the same trusted Authenticode identity and timestamp it; an unsigned installer starts with no transferable publisher reputation, so each changed installer must establish reputation again from zero.^1^

Recommended long-term approach

1. Obtain a publicly trusted code-signing identity.
   • Microsoft recommends Azure Artifact Signing for eligible developers distributing outside the Store.
   • Otherwise, obtain an OV code-signing certificate from a certificate authority participating in the Microsoft Trusted Root Program.
   • Do not use a self-signed certificate for public distribution; SmartScreen treats it like an unsigned file.
   • Do not pay extra for EV solely to bypass SmartScreen. Since 2024, EV and OV certificates follow the same reputation-building process.^2^
2. Sign the final installer and executable files. Sign after Inno Setup has produced the final installer. Also sign the game executable and other executable components included in the package. Do not modify an artifact after signing, because that can invalidate its signature.^1^
3. Use SHA-256 and an RFC 3161 timestamp. Substitute the certificate selector and timestamp service supplied by your signing provider:

      signtool sign ^
        /fd SHA256 ^
        /tr <RFC3161_TIMESTAMP_URL> ^
        /td SHA256 ^
        /a ^
        "Shadow_Protocol_Dead_Drop_0.9.0_Setup.exe"
   
      signtool verify /pa /v ^
        "Shadow_Protocol_Dead_Drop_0.9.0_Setup.exe"
   

   Timestamping keeps the signature verifiable after the signing certificate expires; without it, Windows eventually treats the binary as unsigned.^3^ SignTool is included with the Windows SDK and supports signing, verification, and timestamping.^4^
4. Verify the published download itself. Download the file from the production Cloudflare location, then check:
   • signtool verify /pa /v succeeds.
   • Properties → Digital Signatures displays the expected publisher.
   • Its hash matches the final signed build.
   • No CDN or packaging step changes the file after signing.
5. Keep the signing identity consistent across releases. A new signed installer may still produce an “unrecognized app” warning initially, but consistent signing allows publisher reputation to accumulate across versions. Microsoft does not publish a guaranteed number of downloads or days required.^1^

SmartScreen review and the 1.5-GB installer

The ordinary “Windows protected your PC” warning for a new unsigned installer is a reputation warning, not by itself an incorrect malware detection. Microsoft documents no manual consumer-endpoint mechanism for granting SmartScreen reputation; reputation develops from the file hash and, for signed files, the publisher identity.^1^

Use the Microsoft Security Intelligence submission portal only if Defender identifies the installer as malware or potentially unwanted software and that classification is incorrect. Developers can submit the disputed file, track the determination, and use the developer contact form after a final determination.^5^

Microsoft’s public instructions do not document direct-download-URL submission as a replacement for uploading an oversized SmartScreen sample. The Defender for Endpoint unified submission system supports either files or hashes, but its file uploads have a 500-MB total limit and the feature requires an applicable Defender subscription and permissions.^6^ A hash submission can support enterprise analysis, but it is not a way to assign consumer SmartScreen reputation to an unsigned release.

Option that avoids SmartScreen download warnings

Publishing through the Microsoft Store is the most reliable way to avoid these warnings. Store-distributed MSIX packages are re-signed by Microsoft. If submitting the existing Win32 EXE installer through the Store instead, the installer and applicable PE files must already be signed with a certificate chaining to a trusted CA.^2^

Do not instruct users to disable SmartScreen. During the initial signed-release reputation period, clearly identify the expected publisher and provide a SHA-256 hash so users can verify that they received the authentic installer.

References

1. SmartScreen reputation for Windows app developers
2. Code signing options for Windows app developers
3. Time Stamping Authenticode Signatures
4. Use SignTool to sign a file
5. Submit files for analysis
6. Submit files in Microsoft Defender for Endpoint