Fix a Program Blocked by SmartScreen or Mark of the Web

A file downloaded from the internet carries a **Zone.Identifier** alternate data stream. Zone 3 is the internet, and that is what triggers the prompt.

Get-Item 'C:\temp\setup.exe' -Stream * | Select-Object Stream,Length
Get-Content 'C:\temp\setup.exe' -Stream Zone.Identifier -ErrorAction SilentlyContinue
Get-Item 'C:\temp\setup.exe' | Select-Object Name,Length,LastWriteTime

An unsigned installer from an unknown source deserves the warning. The status and the signer are the two fields to read.

Get-AuthenticodeSignature 'C:\temp\setup.exe' | Select-Object Status,StatusMessage,@{n='Signer';e={$_.SignerCertificate.Subject}}
Get-FileHash 'C:\temp\setup.exe' -Algorithm SHA256 | Select-Object Hash
certutil -hashfile 'C:\temp\setup.exe' SHA256

**Unblock-File** deletes the stream, which silences both SmartScreen and the runtime error. The file itself does not change.

Unblock-File -Path 'C:\temp\setup.exe'
Get-Item 'C:\temp\setup.exe' -Stream * | Select-Object Stream,Length
Get-AuthenticodeSignature 'C:\temp\setup.exe' | Select-Object Status

An extracted archive keeps the marker per file. Unblocking before extracting, or unblocking the whole folder recursively, saves a click per file.

Get-ChildItem 'C:\temp\extracted' -Recurse | Unblock-File
Get-ChildItem 'C:\temp\extracted' -Recurse | ForEach-Object { $s = Get-Item $_.FullName -Stream * -ErrorAction SilentlyContinue; if ($s) { $_.FullName } } | Select-Object -First 5

SmartScreen reputation is separate from the marker: an unsigned new file from an unknown publisher is blocked even when unblocked. That block is a reputation decision, not a file attribute.

Get-WinEvent -LogName 'Microsoft-Windows-SmartScreen/Debug' -MaxEvents 10 -ErrorAction SilentlyContinue | Select-Object TimeCreated,Id,Message
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer' | Select-Object SmartScreenEnabled
Start-Process ms-settings:windowsdefender

Run it, then check the Defender history for anything it caught. A file that needed unblocking and then trips Defender is a file to delete, not to trust.

Start-Process 'C:\temp\setup.exe'
Get-MpThreatDetection -ErrorAction SilentlyContinue | Select-Object -Last 3 InitialDetectionTime,ThreatID,Resources
Get-MpComputerStatus | Select-Object AntivirusEnabled,RealTimeProtectionEnabled,LastQuickScanTime