This tutorial will show you how to turn on or off Microsoft Defender SmartScreen Phishing protection in Windows 11.
Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.
Starting with Windows 11 build 22593, Microsoft is introducing two powerful new features that strike against the most common cyberattack techniques: phishing and targeted malware. New in Windows 11 is enhanced phishing detection and protection built into Windows with Microsoft Defender SmartScreen. This new feature will help protect users from phishing attacks by identifying and alerting users when they are entering their Microsoft credentials into a malicious application or hacked website. Smart App Control uses code signing alongside Microsoft’s powerful artificial intelligence models to ensure that only trusted applications are run, blocking one of the largest attack vectors on Windows by-default.
References:

Enhanced Phishing Protection in Microsoft Defender SmartScreen
App & Browser Control in the Windows Security App - Microsoft Support


Windows powers the future of hybrid work


New security features for Windows 11 will help protect hybrid work | Microsoft Security Blog
Windows 11, version 22H2 Security baseline | Microsoft Community Hub

Protect passwords with enhanced phishing protection | Windows IT Pro Blog

Starting with Windows 11 version 22H2 KB5030310 Build 22621.2361, Enhanced Phishing Protection in Microsoft Defender SmartScreen helps protect Microsoft school or work passwords against phishing and unsafe usage on sites and apps. Microsoft is trying out a change starting with this build where users who have enabled warning options for Windows Security under App & browser control > Reputation-based protection > Phishing protection will see a UI warning on unsafe password copy and paste, just as they currently see when they type in their password.
You must be signed in as an administrator to turn on or off Microsoft Defender SmartScreen Phishing protection.
- Option One: Turn On or Off Microsoft Defender SmartScreen Phishing Protection in Settings
- Option Two: Enable or Disable Microsoft Defender SmartScreen Phishing Protection in Local Group Policy Editor
- Option Three: Enable or Disable Microsoft Defender SmartScreen Phishing Protection using REG file
EXAMPLE: Phishing protection warning
1 Open Windows Security.
2 Click/tap on App & browser control. (see screenshot below)
3 Click/tap on the Reputation-based protection settings link. (see screenshot below)
4 Turn On (default) or Off Phishing protection for what you want. (see screenshots below step 6)
5 Click/tap on Yes when prompted by UAC to approve.
6 If you turned on Phishing protection, you can check (on) (default) or uncheck (off) the following for the warnings you want: (see screenshots below)
You will need to click/tap on Yes when prompted by UAC to approve each item below.
- Warn me about malicious applications and websites
- Warn me about password reuse
- Warn me about insecure password storage
- Automatically collect website or app content when additional analysis is needed to help identify security threats
7 You can now close Windows Security if you like.
Enable or Disable Microsoft Defender SmartScreen Phishing Protection in Local Group Policy Editor
The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.
All editions can use Option Three to configure the same policy.
1 Open the Local Group Policy Editor (gpedit.msc).
2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)
3 Do step 4 (Automatic Data Collection), step 5 (Notify Malicious), step 6 (Notify Password Reuse), step 7 (Notify Unsafe App), and/or step 8 (Service Enabled) below for which policies you want to configure.
Enabled or Disabled will override Option One.
Enabled or Disabled will override Option One.
Enabled or Disabled will override Option One.
Enabled or Disabled will override Option One.
Enabled or Disabled will override Option One.
9 When finished, you can close the Local Group Policy Editor if you like.
1 Do step 2 (Automatic Data Collection), step 3 (Notify Malicious), step 4 (Notify Password Reuse), step 5 (Notify Unsafe App), or step 6 (Service Enabled) below for which policies you want to configure.
Enable or Disable will override Option One.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"CaptureThreatWindow"=-
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"CaptureThreatWindow"=dword:00000001
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"CaptureThreatWindow"=dword:00000000
Enable or Disable will override Option One.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyMalicious"=-
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyMalicious"=dword:00000001
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyMalicious"=dword:00000000
Enable or Disable will override Option One.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyPasswordReuse"=-
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyPasswordReuse"=dword:00000001
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyPasswordReuse"=dword:00000000
Enable or Disable will override Option One.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyUnsafeApp"=-
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyUnsafeApp"=dword:00000001
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyUnsafeApp"=dword:00000000
Enable or Disable will override Option One.
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"ServiceEnabled"=-
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"ServiceEnabled"=dword:00000001
(Contents of REG file for reference)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"ServiceEnabled"=dword:00000000
7 Save the .reg file to your desktop.
8 Double click/tap on the downloaded .reg file to merge it.
9 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
10 You can now delete the downloaded .reg file(s) if you like.
That's it,
Shawn Brink
Attachments
-
Default_user_choice_notify_malicious.reg662 bytes · Views: 339
-
Force_disable_notify_malicious.reg688 bytes · Views: 429
-
Force_enable_notify_malicious.reg688 bytes · Views: 306
-
Default_user_choice_notify_password_reuse.reg670 bytes · Views: 285
-
Force_disable_notify_password_reuse.reg696 bytes · Views: 408
-
Force_enable_notify_password_reuse.reg696 bytes · Views: 275
-
Default_user_choice_notify_unsafe.reg666 bytes · Views: 250
-
Force_disable_notify_unsafe.reg692 bytes · Views: 357
-
Force_enable_notify_unsafe.reg692 bytes · Views: 256
-
Default_user_choice_enhanced_phishing_protection.reg664 bytes · Views: 326
-
Force_disable_enhanced_phishing_protection.reg690 bytes · Views: 492
-
Force_enable_enhanced_phishing_protection.reg690 bytes · Views: 346
-
Default_user_choice_Automatic_Data_Collection.reg660 bytes · Views: 194
-
Force_disable_Automatic_Data_Collection.reg686 bytes · Views: 262
-
Force_enable_Automatic_Data_Collection.reg686 bytes · Views: 118