Privacy and Security Enable or Disable Microsoft Defender SmartScreen Phishing Protection Windows 11


Windows_Security_banner.png

This tutorial will show you how to turn on or off Microsoft Defender SmartScreen Phishing protection in Windows 11.

Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files.

Starting with Windows 11 build 22593, Microsoft is introducing two powerful new features that strike against the most common cyberattack techniques: phishing and targeted malware. New in Windows 11 is enhanced phishing detection and protection built into Windows with Microsoft Defender SmartScreen. This new feature will help protect users from phishing attacks by identifying and alerting users when they are entering their Microsoft credentials into a malicious application or hacked website. Smart App Control uses code signing alongside Microsoft’s powerful artificial intelligence models to ensure that only trusted applications are run, blocking one of the largest attack vectors on Windows by-default.

References:

Starting with Windows 11 version 22H2 KB5030310 Build 22621.2361, Enhanced Phishing Protection in Microsoft Defender SmartScreen helps protect Microsoft school or work passwords against phishing and unsafe usage on sites and apps. Microsoft is trying out a change starting with this build where users who have enabled warning options for Windows Security under App & browser control > Reputation-based protection > Phishing protection will see a UI warning on unsafe password copy and paste, just as they currently see when they type in their password.


You must be signed in as an administrator to turn on or off Microsoft Defender SmartScreen Phishing protection.



Contents

  • Option One: Turn On or Off Microsoft Defender SmartScreen Phishing Protection in Settings
  • Option Two: Enable or Disable Microsoft Defender SmartScreen Phishing Protection in Local Group Policy Editor
  • Option Three: Enable or Disable Microsoft Defender SmartScreen Phishing Protection using REG file


EXAMPLE: Phishing protection warning

Microsoft_Defender_SmartScreen_Phising_protection_warning.png
Notify_Password_Reuse.png
Notify_Unsafe_App.png





Option One

Turn On or Off Microsoft Defender SmartScreen Phishing Protection in Settings


1 Open Windows Security.

2 Click/tap on App & browser control. (see screenshot below)

Microsoft_Defender_SmartScreen_Phising_protection-1.png

3 Click/tap on the Reputation-based protection settings link. (see screenshot below)

Microsoft_Defender_SmartScreen_Phising_protection-2.png

4 Turn On (default) or Off Phishing protection for what you want. (see screenshots below step 6)

5 Click/tap on Yes when prompted by UAC to approve.

6 If you turned on Phishing protection, you can check (on) (default) or uncheck (off) the following for the warnings you want: (see screenshots below)

You will need to click/tap on Yes when prompted by UAC to approve each item below.

  • Warn me about malicious applications and websites
  • Warn me about password reuse
  • Warn me about insecure password storage
  • Automatically collect website or app content when additional analysis is needed to help identify security threats
Microsoft_Defender_SmartScreen_Phising_protection-3.png
Microsoft_Defender_SmartScreen_Phising_protection-4.png

7 You can now close Windows Security if you like.




Option Two

Enable or Disable Microsoft Defender SmartScreen Phishing Protection in Local Group Policy Editor


The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.

All editions can use Option Three to configure the same policy.


1 Open the Local Group Policy Editor (gpedit.msc).

2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)

Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Enhanced Phishing Protection

Enhanced_Phishing_Protection_gpedit-1.png

3 Do step 4 (Automatic Data Collection), step 5 (Notify Malicious), step 6 (Notify Password Reuse), step 7 (Notify Unsafe App), and/or step 8 (Service Enabled) below for which policies you want to configure.

4 Enable or Disable "Automatically collect website or app content when additional analysis is needed to help identify security threats"

A) In the right pane of Enhanced Phishing Protection in the Local Group Policy Editor, double click/tap on the Automatic Data Collection policy to edit it. (see screenshot below step 2)​

B) Select (dot) Not Configured (default), Enabled, or Disabled for what you want, and click/tap on OK.​

Enabled or Disabled will override Option One.


C) Go to step 9.​

Automatic_Data_Collection_gpedit.png

5 Enable or Disable "Warn me about malicious apps and sites"

A) In the right pane of Enhanced Phishing Protection in the Local Group Policy Editor, double click/tap on the Notify Malicious policy to edit it. (see screenshot below step 2)​

B) Select (dot) Not Configured (default), Enabled, or Disabled for what you want, and click/tap on OK.​

Enabled or Disabled will override Option One.


C) Go to step 9.​

Enhanced_Phishing_Protection_gpedit-3.png

6 Enable or Disable "Warn me about password reuse"

A) In the right pane of Enhanced Phishing Protection in the Local Group Policy Editor, double click/tap on the Notify Password Reuse policy to edit it. (see screenshot below step 2)​

B) Select (dot) Not Configured (default), Enabled, or Disabled for what you want, and click/tap on OK.​

Enabled or Disabled will override Option One.


C) Go to step 9.​

Enhanced_Phishing_Protection_gpedit-4.png

7 Enable or Disable "Warn me about unsafe password storage"

A) In the right pane of Enhanced Phishing Protection in the Local Group Policy Editor, double click/tap on the Notify Unsafe App policy to edit it. (see screenshot below step 2)​

B) Select (dot) Not Configured (default), Enabled, or Disabled for what you want, and click/tap on OK.​

Enabled or Disabled will override Option One.


C) Go to step 9.​

Enhanced_Phishing_Protection_gpedit-5.png

8 Enable or Disable Phishing Protection

A) In the right pane of Enhanced Phishing Protection in the Local Group Policy Editor, double click/tap on the Service Enabled policy to edit it. (see screenshot below step 2)​

B) Select (dot) Not Configured (default), Enabled, or Disabled for what you want, and click/tap on OK.​

Enabled or Disabled will override Option One.


C) Go to step 9.​

Enhanced_Phishing_Protection_gpedit-2.png

9 When finished, you can close the Local Group Policy Editor if you like.




Option Three

Enable or Disable Microsoft Defender SmartScreen Phishing Protection using REG file


1 Do step 2 (Automatic Data Collection), step 3 (Notify Malicious), step 4 (Notify Password Reuse), step 5 (Notify Unsafe App), or step 6 (Service Enabled) below for which policies you want to configure.


 2. Enable or Disable "Automatically collect website or app content when additional analysis is needed to help identify security threats"

Enable or Disable will override Option One.


A) Click/tap on the Download button below to download the .reg file you want below, and go to step 7 below.​

Default_user_choice_Automatic_Data_Collection.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"CaptureThreatWindow"=-

OR​

Force_enable_Automatic_Data_Collection.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"CaptureThreatWindow"=dword:00000001

OR​

Force_disable_Automatic_Data_Collection.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"CaptureThreatWindow"=dword:00000000


 3. Enable or Disable "Warn me about malicious apps and sites"

Enable or Disable will override Option One.


A) Click/tap on the Download button below to download the .reg file you want below, and go to step 7 below.​

Default_user_choice_notify_malicious.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyMalicious"=-

OR​

Force_enable_notify_malicious.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyMalicious"=dword:00000001

OR​

Force_disable_notify_malicious.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyMalicious"=dword:00000000


 4. Enable or Disable "Warn me about password reuse"

Enable or Disable will override Option One.


A) Click/tap on the Download button below to download the .reg file you want below, and go to step 7 below.​

Default_user_choice_notify_password_reuse.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyPasswordReuse"=-

OR​

Force_enable_notify_password_reuse.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyPasswordReuse"=dword:00000001

OR​

Force_disable_notify_password_reuse.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyPasswordReuse"=dword:00000000


 5. Enable or Disable "Warn me about unsafe password storage"

Enable or Disable will override Option One.


A) Click/tap on the Download button below to download the .reg file you want below, and go to step 7 below.​

Default_user_choice_notify_unsafe.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyUnsafeApp"=-

OR​

Force_enable_notify_unsafe.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyUnsafeApp"=dword:00000001

OR​

Force_disable_notify_unsafe.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"NotifyUnsafeApp"=dword:00000000


 6. Enable or Disable "Enable or Disable Phishing Protection"

Enable or Disable will override Option One.


A) Click/tap on the Download button below to download the .reg file you want below, and go to step 7 below.​

Default_user_choice_enhanced_phishing_protection.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"ServiceEnabled"=-

OR​

Force_enable_enhanced_phishing_protection.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"ServiceEnabled"=dword:00000001

OR​

Force_disable_enhanced_phishing_protection.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WTDS\Components]
"ServiceEnabled"=dword:00000000

7 Save the .reg file to your desktop.

8 Double click/tap on the downloaded .reg file to merge it.

9 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

10 You can now delete the downloaded .reg file(s) if you like.


That's it,
Shawn Brink


 

Attachments

Last edited:
Yes, I do. In fact I already turned it on several times, first time as I saw it turned off again I thought "wtf, didn't I turned it on recently? I am pretty sure I did..." Then I turned it on the second time and restarted. And after that I became aware that Windows 11 just keeps turning it back off all over again and then I went to the forum looking for advice...
Well, it's not an elevation issue then.

If you like, you could test doing a repair install of Windows 11 below to see if it may fix this for you without losing anything.

 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    CyberPower CP1500PFCLCD
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Surface Laptop 7 Copilot+ PC
    CPU
    Snapdragon X Elite (12 core) 3.42 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Monitor(s) Displays
    15" HDR
    Screen Resolution
    2496 x 1664
    Hard Drives
    1 TB SSD
    Internet Speed
    Wi-Fi 7 and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender
Thanks, but I'll keep it as it is until Microsoft provides an update. It seems more unlikely than likely that phishing protection feature is going to work with the build I have and I don't see ways to upgrade to the build you have for example. As of Windows Update I am already running the most recent official build. We still don't know what forces the system to turn it back off. It may be a feature, not a bug.

So, from my perspective trying to repair my installation would be waste of time and effort, chances are very very low it will change anything on my system because I think there is just nothing to repair. :-)
 

My Computer

System One

  • OS
    Windows 11 Home 23H2
    Computer type
    Laptop
    Manufacturer/Model
    Dell Alienware M17xR3 (2011)
    CPU
    i7-2960XM
    Motherboard
    Alienware HM67 SandyBridge
    Memory
    16 GB Kingston DDR3 1866
    Graphics Card(s)
    Nvidia GeForce GTX 880M
    Sound Card
    NVIDIA HD Audio
    Monitor(s) Displays
    native 17" 120Hz
    Screen Resolution
    1920x1080
    Hard Drives
    2xSSD Kingston SHSS37A 240GB at SATA-6
    PSU
    330W
    Case
    Alienware Notebook
    Cooling
    Air cooling: SilverStone Shark Force Lüfter, 140
    Keyboard
    Speedlink LEVIA
    Mouse
    Logitech MX Master 2S
    Internet Speed
    50 Mb/s
    Browser
    Chrome
    Antivirus
    Windows Defender
Thanks, but I'll keep it as it is until Microsoft provides an update. It seems more unlikely than likely that phishing protection feature is going to work with the build I have and I don't see ways to upgrade to the build you have for example. As of Windows Update I am already running the most recent official build. We still don't know what forces the system to turn it back off. It may be a feature, not a bug.

So, from my perspective trying to repair my installation would be waste of time and effort, chances are very very low it will change anything on my system because I think there is just nothing to repair. :-)

Hopefully, it'll be fixed in the next update for you.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    CyberPower CP1500PFCLCD
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    Surface Laptop 7 Copilot+ PC
    CPU
    Snapdragon X Elite (12 core) 3.42 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Monitor(s) Displays
    15" HDR
    Screen Resolution
    2496 x 1664
    Hard Drives
    1 TB SSD
    Internet Speed
    Wi-Fi 7 and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender
No it isn't fixed with the latest updates! we are at Aug 8 2024 and it doesn't work - turned all the Phishing protection on, restarted - all switches are turned off back again. You can do it over and over, nothing changes.
I have an oposite effect....I try to turn it off and it instantly turns back on.
 

My Computer

System One

  • OS
    Windows 11 24H2 Version 10.0.26100.2605
    Computer type
    PC/Desktop
    CPU
    Core I5 6600
    Motherboard
    Gigabyte Z170x Gaming 5
    Memory
    2 x 8 HeperX Fury DDR4 2666 HZ
    Graphics Card(s)
    Nvidia GTX 1070 ti
    Monitor(s) Displays
    165 HZ Gigabyte GS32QC
    Screen Resolution
    1440p
    Hard Drives
    1TB NVME M.2 Samsung 990 Pro
Just wondering, what are your considerations to turn it off? It's beyond my imagination. :think: By the way - I mean, it's turned off by default, so you must have turned it on, why do you want to turn it off now?
 

My Computer

System One

  • OS
    Windows 11 Home 23H2
    Computer type
    Laptop
    Manufacturer/Model
    Dell Alienware M17xR3 (2011)
    CPU
    i7-2960XM
    Motherboard
    Alienware HM67 SandyBridge
    Memory
    16 GB Kingston DDR3 1866
    Graphics Card(s)
    Nvidia GeForce GTX 880M
    Sound Card
    NVIDIA HD Audio
    Monitor(s) Displays
    native 17" 120Hz
    Screen Resolution
    1920x1080
    Hard Drives
    2xSSD Kingston SHSS37A 240GB at SATA-6
    PSU
    330W
    Case
    Alienware Notebook
    Cooling
    Air cooling: SilverStone Shark Force Lüfter, 140
    Keyboard
    Speedlink LEVIA
    Mouse
    Logitech MX Master 2S
    Internet Speed
    50 Mb/s
    Browser
    Chrome
    Antivirus
    Windows Defender
Just wondering, what are your considerations to turn it off?
Privacy and security. Sending your browsing history to MS, while it can also leak.
People can just use DNS, it does not slow down browsing and it works way better.

capture_08242024_174002.jpg
 

My Computer

System One

  • OS
    Windows 11 Home
    Computer type
    PC/Desktop
    CPU
    AMD Ryzen 5 8600G (07/24)
    Motherboard
    ASROCK B650M-HDV/M.2 3.18 (07/24)
    Memory
    2x32GB Kingston FURY DDR5 5600 MHz CL36 @4800 CL40 (07/24)
    Graphics Card(s)
    ASROCK Radeon RX 6600 Challenger D 8G @60FPS (08/24)
    Sound Card
    Creative Sound BlasterX AE-5 Plus (05/24)
    Monitor(s) Displays
    24" Philips 24M1N3200ZS/00 (05/24)
    Screen Resolution
    1920×1080@165Hz via DP1.4
    Hard Drives
    Kingston KC3000 NVMe 2TB (05/24)
    ADATA XPG GAMMIX S11 Pro 512GB (07/19)
    PSU
    Seasonic Core GM 550 Gold (04/24)
    Case
    Fractal Design Define 7 Mini with 3x Noctua NF-P14s/12@555rpm (04/24)
    Cooling
    Noctua NH-U12S with Noctua NF-P12 (04/24)
    Keyboard
    HP Pavilion Wired Keyboard 300 (07/24) + Rabalux 76017 Parker (01/24)
    Mouse
    Logitech M330 Silent Plus (04/23)
    Internet Speed
    500/100 Mbps via RouterOS (05/21) & TCP Optimizer
    Browser
    Edge & Brave for YouTube & LibreWolf for FB
    Antivirus
    NextDNS blocking 99% TLDs
    Other Info
    Backup: Hasleo Backup Suite (PreOS)
    Headphones: Sennheiser RS170 (09/10)
    Phone: Samsung Galaxy Xcover 7 (02/24)
    Chair: Huzaro Force 4.4 Grey Mesh (05/24)
    Notifier: Xiaomi Mi Band 9 Milanese (10/24)
    2nd Monitor: AOC G2460VQ6 @75Hz (02/19)
At least that would be your reasons. Fair enough, as long as everyone understand what you are talking about and how to use it. The fact that I can make use of a keyboard doesn't automatically mean I am in the game. :-)
 

My Computer

System One

  • OS
    Windows 11 Home 23H2
    Computer type
    Laptop
    Manufacturer/Model
    Dell Alienware M17xR3 (2011)
    CPU
    i7-2960XM
    Motherboard
    Alienware HM67 SandyBridge
    Memory
    16 GB Kingston DDR3 1866
    Graphics Card(s)
    Nvidia GeForce GTX 880M
    Sound Card
    NVIDIA HD Audio
    Monitor(s) Displays
    native 17" 120Hz
    Screen Resolution
    1920x1080
    Hard Drives
    2xSSD Kingston SHSS37A 240GB at SATA-6
    PSU
    330W
    Case
    Alienware Notebook
    Cooling
    Air cooling: SilverStone Shark Force Lüfter, 140
    Keyboard
    Speedlink LEVIA
    Mouse
    Logitech MX Master 2S
    Internet Speed
    50 Mb/s
    Browser
    Chrome
    Antivirus
    Windows Defender

Latest Support Threads

Back
Top Bottom