Potentially Unwanted app blocking - How can I Block Downloads

Question

Potentially Unwanted app blocking - How can I Block Downloads

Roger Hendrikse 246

We are using Windows 10 (1909 and 20H2) with SCCM 2010 (and a Cloud Management Gateway for remote machines) and are moving to using Defender and managing it with SCCM. We use SCCM Endpoint Protection Policies to deploy Antimalware policy to machines.

In the Antimalware policy, we enable the option to Block potentially unwanted applications. However, the Windows Security icon is showing an exclamation mark, and if we open Windows Security, under App & browser control, we see a warning that "The setting to block unwanted apps is turned off".

If we click Reputation-based protection settings, we see that Block Apps is enabled, but Block Downloads is not enabled.

The only way to get the exclamation mark warning to go away is to select Block Downloads or click Dismiss, and doing so means having to provide admin credentials (our users do not have local admin rights on their machines). As we are migrating to Defender on over 4000 machines, it is not practical to login to each machine to remove this warning, especially seeing as 90% of our machines are currently working remotely.

The only way I can think of enabling the Block Downloads option on all machines would be to use a group policy (a group policy isn't really a valid option for me, as most of our machines do not have VPN access so I can't reliably use GPOs at the moment), a registry file, or a powershell command. All my research and testing has shown that making changes to PUA (Potentially unwanted Applications) with registry, GPO or powershell only seems to affect the Block Apps setting. I read that the Block Downloads setting is controlled in Edge settings, so how can I enable this setting machine wide using a registry setting or powershell command ?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Anonymous

2021-04-01T09:07:17.69+00:00

Based on my understanding, you want to enable Block Downloads option via registry or PowerShell. Please feel free to let me know if I have any misunderstanding. I am currently performing research on this and will get back to you as soon as possible. I appreciate your patience.
If you have any updates during this process, please feel free to let me know.
Jörg Yannic Brian 6 Reputation points

2021-06-15T13:29:05.673+00:00

How can I change this setting via Intune?
rnd_01 1 Reputation point

2022-03-16T14:40:17.297+00:00

I would also like to make this change to Block Downloads via registry or PowerShell, but could find a solution.
Have you been successful in your research?
mkiss 1 Reputation point

2022-03-17T11:43:24.683+00:00
I have found out the following:

The Block downloads option is controlled by the Edge browser (see screenshot).

To enable blocking, the following registry key needs to be changed:
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled = 1 (REG_DWORD)

There are two ways to do this:

Create a .reg file and execute: Windows Registry Editor Version 5.00
; > Settings > Privacy > General
; Edge: Block potentially unwanted apps
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled]
""=dword:00000001

Edit registry value with PowerShell: $RegKey = "HKCU:\Software\Microsoft\Edge\SmartScreenPuaEnabled"
$RegLeaf = "(Default)"
$RegValue = "1" Set-ItemProperty -Path $RegKey -Name $RegLeaf -Value $RegValue
Roger Hendrikse 246 Reputation points

2022-03-17T12:12:52.67+00:00

Thank you for the response. I see, however that this is a per user settings, which means each user would need to run the command / reg file, or we would need to deploy this to run under user's context. Not the tidiest solution I suppose, but anything is better than nothing.

Thanks again for the detailed info
Roger Hendrikse 246 Reputation points

2022-03-17T12:14:09.883+00:00

How is this an answer to my question ? :-)
mkiss 1 Reputation point

2022-03-17T13:32:50.427+00:00

You're welcome.
Yes, this setting is per user. I suppose the best way would be using a GPO for this setting, although I'm not aware of one.
I'll keep you posted if I find anything.
Ben 0 Reputation points

2023-02-08T03:31:15.08+00:00

There is a respective HKLM version of this key.
Also it is in GPO as "Configure Microsoft Defender SmartScreen to block potentially unwanted apps" in \Microsoft Edge\SmartScreen settings

1 answer

Anonymous

2021-04-01T09:07:17.69+00:00

Based on my understanding, you want to enable Block Downloads option via registry or PowerShell. Please feel free to let me know if I have any misunderstanding. I am currently performing research on this and will get back to you as soon as possible. I appreciate your patience.
If you have any updates during this process, please feel free to let me know.
Jörg Yannic Brian 6 Reputation points

2021-06-15T13:29:05.673+00:00

How can I change this setting via Intune?
rnd_01 1 Reputation point

2022-03-16T14:40:17.297+00:00

I would also like to make this change to Block Downloads via registry or PowerShell, but could find a solution.
Have you been successful in your research?
mkiss 1 Reputation point

2022-03-17T11:43:24.683+00:00

I have found out the following:

The Block downloads option is controlled by the Edge browser (see screenshot).

To enable blocking, the following registry key needs to be changed:
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled = 1 (REG_DWORD)

There are two ways to do this:

Create a .reg file and execute: Windows Registry Editor Version 5.00
; > Settings > Privacy > General
; Edge: Block potentially unwanted apps
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\SmartScreenPuaEnabled]
""=dword:00000001

Edit registry value with PowerShell: $RegKey = "HKCU:\Software\Microsoft\Edge\SmartScreenPuaEnabled"
$RegLeaf = "(Default)"
$RegValue = "1" Set-ItemProperty -Path $RegKey -Name $RegLeaf -Value $RegValue
Roger Hendrikse 246 Reputation points

2022-03-17T12:12:52.67+00:00

Thank you for the response. I see, however that this is a per user settings, which means each user would need to run the command / reg file, or we would need to deploy this to run under user's context. Not the tidiest solution I suppose, but anything is better than nothing.

Thanks again for the detailed info
Roger Hendrikse 246 Reputation points

2022-03-17T12:14:09.883+00:00

How is this an answer to my question ? :-)
mkiss 1 Reputation point

2022-03-17T13:32:50.427+00:00

You're welcome.
Yes, this setting is per user. I suppose the best way would be using a GPO for this setting, although I'm not aware of one.
I'll keep you posted if I find anything.
Ben 0 Reputation points

2023-02-08T03:31:15.08+00:00

There is a respective HKLM version of this key.
Also it is in GPO as "Configure Microsoft Defender SmartScreen to block potentially unwanted apps" in \Microsoft Edge\SmartScreen settings

Answer 1

Dom 0

If only it were this simple...

We manage a tenant which seems to turn this ON in Windows:

User's image

But it is OFF in Edge on the same device, same user profile:
User's image

So these seem to be DIFFERENT settings.

It gets even stranger. For the life of me, I can't identify the Intune policy that turns "Block downloads" ON. No GPOs here, devices are AAD/Intune managed only. So while someone must've solved it in this tenant some time ago - we can't repro that.

Which Intune setting controls "Block Downloads" in the Security App?

Dom 0 Reputation points

2023-08-18T08:44:34.9066667+00:00

OK, found it:
Intune --> Device Profile --> Settings Catalog --> Microsoft Edge. There are a whole bunch of SmartScreen settings in there. Turn them all "on" and you'll be in the green.

It still stays "off" in my Edge Browser, but I use the Dev channel:

There is a bug in it. The release version of Edge follows the setting as expected:
Bram Goedhart 0 Reputation points

2026-07-30T08:24:17.27+00:00

Why do I not get information about what apps are blocked
JuliaMarvin 21,155 Reputation points Volunteer Moderator

2026-07-30T12:06:16.18+00:00

@Bram Goedhart
Please start your own thread/question.
This old thread will be locked now.