SmartScreen Is Your Free Malware Tripwire - Audit All Four Surfaces

SmartScreen quietly catches downloaded-executable droppers and phishing, but it has four separate on/off switches. Here is how WinSentinel audits every one - free, single-machine, no cloud.

Most Windows security advice tells you to "turn on SmartScreen" as if it were a single toggle. It isn't. SmartScreen is Microsoft's cloud-backed reputation service, and it enforces at four distinct places, each with its own registry policy. Flip the wrong one off - or leave one un-pinned - and you have a gap that never shows up in a single settings screen. WinSentinel's new SmartScreen audit module checks all four, on the local machine, for free.

Why SmartScreen still matters in 2026

SmartScreen is the check that fires when a user double-clicks a downloaded .exe carrying a Mark-of-the-Web (MOTW). It is not an antivirus signature match - it is a reputation call: "have we seen this binary, from this publisher, before?" That single question catches a huge slice of commodity malware and freshly-compiled droppers before they run, because attacker payloads are, by definition, unknown to the reputation graph. It is one of the highest-leverage, zero-cost hardening controls on the platform. The catch: it can be silently weakened in four different spots.

The four surfaces WinSentinel audits

1. App & File (Explorer / shell) SmartScreen

Controlled by EnableSmartScreen and ShellSmartScreenLevel under HKLM\SOFTWARE\Policies\Microsoft\Windows\System. This is the one that guards downloaded executables. There are three effective states:

Block - ShellSmartScreenLevel = Block: unrecognized files are stopped, no click-through. This is the hardened state.
Warn - the user gets a prompt they can dismiss. Better than nothing, weaker than Block.
Disabled - EnableSmartScreen = 0: the check is gone entirely.

WinSentinel flags a disable as a Warning, a Warn-level as Info, and even flags the common "enabled but no policy pins the level" case - because on that machine the behaviour depends on user defaults rather than a guaranteed Block.

2. Microsoft Edge SmartScreen

SmartScreenEnabled under HKLM\SOFTWARE\Policies\Microsoft\Edge. This is the browser-side phishing and malicious-download warning in the default browser. Disabling it re-opens a primary credential-theft and drive-by surface.

3. Edge PUA blocking

SmartScreenPuaEnabled. "Potentially Unwanted Apps" - bundleware, adware installers, browser hijackers, cryptominers - are exactly the low-grade infections that slip past users. PUA blocking is off by default, so WinSentinel surfaces it as an Info-level opportunity with a one-line fix.

4. Store / App Installer web-content evaluation

EnableWebContentEvaluation under the per-user AppHost key. This governs SmartScreen reputation checks for web content evaluated through the App Installer and Store path - relevant now that MSIX web installs are a real distribution channel.

Absence is not a pass

A subtle bug in a lot of homegrown audit scripts: they read a registry value, don't find it, and report "clean." WinSentinel's analyzer maps every missing key to the actual Windows default rather than an assumed-safe value. So an absent ShellSmartScreenLevel becomes "on, but not pinned to Block" - an Info finding - never a false green. A missing key should make you less certain, not more.

Every finding ships a fix

Each non-passing check comes with a plain-English remediation and a copy-paste PowerShell fixCommand. For example, to enforce blocking of low-reputation downloads:

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' `
  -Name EnableSmartScreen -Type DWord -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' `
  -Name ShellSmartScreenLevel -Type String -Value Block

Run it

The SmartScreen module runs as part of a normal audit - no configuration, no account, no cloud call of its own:

dotnet tool install --global WinSentinel.Cli
winsentinel --audit

It's single-machine and fully free, like every audit module in the open-source core. When you need this same posture rolled up across a whole fleet - every laptop reporting its SmartScreen state to one dashboard, with drift alerts when a machine regresses - that's what WinSentinel Pro's fleet control plane adds on top. See pricing for where free ends and fleet begins.