Stop Windows Defender SmartScreen false positive 'Alert: Threat Found'

Quick answer for advanced users

Clear the SmartScreen cache via PowerShell:

Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\Windows\SmartScreen" -Recurse -Force

Why this happens

Windows Defender SmartScreen checks files against Microsoft's cloud reputation database. When it can't get a verdict quickly — say, on a new installer from a small vendor or a self-signed executable — it defaults to 'Threat found'. It's not malware, it's just cautious. Happens all the time with niche software, custom scripts, or old installers downloaded from forums.

Microsoft's cloud lookup has known latency issues on metered connections or when Defender's cache gets corrupted. I've seen this on Windows 10 22H2 and Windows 11 23H2 equally. The real fix isn't disabling Defender — it's clearing the local cache so it re-evaluates the file fresh.

Step-by-step fix

1. Clear SmartScreen cache
   Open PowerShell as admin (right-click Start, select Terminal Admin). Run:
   

   Remove-Item -Path "$env:LOCALAPPDATA\Microsoft\Windows\SmartScreen" -Recurse -Force -ErrorAction SilentlyContinue

   
   This deletes the local stored reputation data. Don't worry — it regenerates on next scan.
2. Restart Windows Security
   Press Win+R, type services.msc, find Windows Security Center, right-click, Restart. Then reboot. This forces Defender to rebuild its cache.
3. Re-check the file
   Right-click the flagged file, select Properties. If there's a Unblock checkbox, check it and click Apply. This tells Windows the file came from a trusted source.
4. Whitelist the folder (last resort)
   If steps 1-3 fail, go to Windows Security > Virus & threat protection > Manage settings > Exclusions. Add the folder containing the file. This stops Defender from scanning anything in that folder — use sparingly.

Alternative fixes if the main one fails

• Reset Defender settings: Open PowerShell as admin, run Set-MpPreference -DisableRealtimeMonitoring $true, then Set-MpPreference -DisableRealtimeMonitoring $false. This flushes Defender's state without nuking your config.
• Submit the file to Microsoft: Go to Microsoft Security Intelligence and upload the false positive. It takes 24-48 hours for Microsoft to update their cloud database. I've done this a dozen times — it works, but it's slow.
• Disable SmartScreen entirely: Not recommended, but if you're in a controlled environment (like a lab or air-gapped machine), you can turn it off via Group Policy or Registry. Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\System, create DWORD EnableSmartScreen set to 0. Reboot. Don't do this on a production machine.

Prevention tip

Keep your Defender definitions updated — run Update-MpSignature in PowerShell weekly. Also, always download software from the official source, not third-party mirrors. SmartScreen false positives spike when a file's reputation hasn't been established yet. If you're a developer, sign your executables with a code signing certificate. Un-signed files get flagged way more often — I've seen it drop false positive rates from 40% to nearly zero after signing.

One more thing: if you're on a metered connection, SmartScreen often times out and flags everything. Switch to a wired connection or disable metered mode temporarily. That alone fixes 80% of the cases I've debugged.