SmartScreen Popup When installing All-In-One Package

[slarkins 5]

I created an all in one instal package for latest version of endpoint AV and agent. If i install from server share there is no issues. If i copy the install file to the desktop, i get a smartscreen pop up which blocks the install. While i can bypass the smartscreen and install anyway, why is this happening to begin with? I have never had any issue over the past few years creating install files and installing from a copy of the file from the local desktop (Windows 10)

[Marcos 5,070]

I assume because it's a new file unpopular in cloud. According to the description:

SmartScreen also checks the files that you download against a list of files that are well known and downloaded by many people who use Internet Explorer. If the file that you're downloading isn't on that list, SmartScreen will warn you.

[slarkins 5]

I created the all-in -one installer via ESMC on premise...never had issues in the past with previous AIO installers i created..if i run the AIO instller via the network share i get no Smartscreen popups...only if i copy the same installer to the local desktop will i get the popup...

[itman 1,659]

10 minutes ago, slarkins said:

if i run the AIO instller via the network share i get no Smartscreen popups...only if i copy the same installer to the local desktop will i get the popup...

SmartScreen only monitors files resident on drives locally attached to the device where the execution is attempted as far as I am aware of.

[slarkins 5]

I realize that...but why all of a sudden does the latest endpoint/agent all in one installer that i created on ESMC locally all of a sudden have an issue? I have created at least 5 or 6 AIO installers over the years and have done the exact same thing without issue

[itman 1,659]

1 minute ago, slarkins said:

I realize that...but why all of a sudden does the latest endpoint/agent all in one installer that i created on ESMC locally all of a sudden have an issue?

One possibility is you didn't have SmartSceen enabled or properly configured on the device. I have had past "mysterious" incidents like this.

Also Microsoft added PUA protection in the latest Win 10 version. Besides triggering on either not a Store downloaded app or low reputation; it could be a false positive PUA detection.

Personally I believe SmartScreen alerts are worthless for the most part.