1

On a domain joined Windows 10 computer, the option to turn SmartScreen on is greyed out and is set by the system administrator. I've checked the associated group policy setting and it's not defined.

Computer Configuration > Administrative Templates > Windows Components > File Explorer -> Configure Windows SmartScreen

So Windows 10 is defaulting to off when this policy setting isn't defined. Does anyone know the thinking behind this? Is there some problem with having SmartScreen on when working on a domain?

  • 1
    This question is a primarily opinion-based question. You are asking for the rationale behind something that Microsoft did, and unless you ask Microsoft all you get is a guess or an opinion. – user477799 Feb 9 '17 at 15:16
  • All I'm asking if whether somebody knows Microsoft's rationale which might have been published somewhere but I couldn't find it. It's not opinion - there will be a reason even if "that was the default when the policy was implemented" which is fine, it's then not a problem to turn it on – munrobasher Feb 9 '17 at 17:34
0

On a domain joined Windows 10 computer, the option to turn SmartScreen on is greyed out and is set by the system administrator. I've checked the associated group policy setting and it's not defined.

How things should ordinarily be

According to the official description:

If you disable or do not configure this policy setting, Windows SmartScreen behavior is managed by administrators on the PC by using Windows SmartScreen Settings in Security and Maintenance.

This means if you configure this policy but set it to disabled or if you set the policy to not configured, you are able to log in with an administrative account, go to Control Panel, Security and Maintenance and configure the SmartScreen from there. (Alternatively, if the User Account Control is enabled, you can still go to Security and Maintenance and try to configure SmartScreen; you will be prompted for credentials of an administrator.)

How things actually are

Sometimes, however, Security and Maintenance still does not allow configuring SmartScreen even when the said policy is not configured on the local computer or Active Directory.

In this case do the following:

  1. Log in with an administrative account
  2. Do either of the following:
    1. Start gpedit.msc, go the said policy, set it to Enabled and click OK, then once again set it to Not Configured. (Source)
    2. Save the following script into a file called EnableSmartScreen.reg and import it via Registry Editor.

Script:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"SmartScreenEnabled"="RequireAdmin"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter]
"EnabledV9"=dword:00000001
  • The default GP setting is "not configured" which is subtly different from disabled. The Windows 10 PC is not receiving anything from group policy on this setting and is defaulting to disabled. The question really could be turned around to "What are the problems with enabling SmartScreen?". I guess if we answered that instead we might be able to guess why it defaults to disabled – munrobasher Feb 9 '17 at 17:38
  • Alright. Let's sum it up: Your answer has a flaw. While you contend that in absence of any policy, Windows grants the control to Security and Maintenance Center, both I and OP have discovered that sometimes Windows denies this control to Security and Maintenance. Plus, you have linked to another question in which the same is true. So that makes three of us. I want you permission to modify your answer and introduce a solution to mitigate this. – user477799 Feb 10 '17 at 18:21
  • @FleetCommand - You don't need my permission to propose an edit. The community or I will have to approve the edit. – Ramhound Feb 10 '17 at 18:24
  • Obviously. But I'd like to know if you approve of such a change before I undertake the labor. Do you at least agree with the concept? – user477799 Feb 10 '17 at 18:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.