How to Completely Disable ‘Windows Defender SmartScreen’ via Group Policy in Windows 11

Windows Defender SmartScreen is a cloud-based security feature baked into Windows 11 that intercepts executable files and websites before they load, checking their cryptographic hashes against Microsoft’s servers to determine if they are known malware. While highly effective for consumer protection, it is often a severe bottleneck in software development environments or isolated corporate networks. If developers are constantly compiling and executing their own unsigned binaries, SmartScreen will aggressively flag and block them, requiring constant manual overrides. Furthermore, in air-gapped environments, the inability to reach Microsoft’s servers causes significant timeouts.

This guide explains how to completely disable Windows Defender SmartScreen system-wide using the Group Policy Editor in Windows 11.

Disable SmartScreen via Group Policy

To enforce a strict, permanent block on the telemetry checks that cannot be bypassed by standard users, we must use an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, navigate precisely to this path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer

5. In the right-hand pane, locate the policy named Configure Windows Defender SmartScreen.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled.
8. Click Apply, then click OK.

Verify the Local Execution Lockdown

To enforce the change immediately without requiring a reboot, open an elevated Command Prompt and execute gpupdate /force.

To verify the restriction is active, open the native Windows Security app (Windows Defender). Click on App & browser control, then click on Reputation-based protection settings. You will immediately notice a banner at the top stating, “This setting is managed by your administrator.” The toggle switch for “Check apps and files” will be entirely greyed out and permanently locked in the Off position. You can now execute custom, unsigned binaries instantly without enduring cloud-based reputation checks or timeouts.