Windows blocked the launcher: verify the publisher before adding exceptions

Scope and symptoms

First establish which security feature blocked which file. A familiar filename is not proof that a download is the publisher's original release.

Search fragments; wording and context vary:

Windows protected your PC
This app has been blocked

Source-supported context

Microsoft's Smart App Control guidance applies to Windows 11 and describes its reputation/signature decision; Microsoft's potentially unwanted application guidance describes a separate category and other protections. Neither source makes the two example warning strings a unique identifier for Smart App Control. A blocked application is not automatically malicious, and it is not automatically a false positive either. Smart App Control has no per-app allow option: Microsoft suggests contacting the developer for a validly signed build rather than adding an exception for that one file. V04-SMARTAPP V04-UNWANTED

Distinguish these cases

1. The file does not satisfy a reputation or signing policy; that is different from a specific malware detection.

2. A repackaged mirror or chat attachment cannot be matched to the publisher's release.

3. An organization controls device policy, or a security product quarantined one extracted component rather than the installer itself.

Suggested diagnostic sequence

This sequence is editorial guidance, not a diagnosis of your machine.

1. Record the security product, warning category and affected file. Identify whether the block concerns the installer or a component, and redact personal paths in shared reports.

2. Verify the version, digital signature and any published checksum at the original release source. Stop if identity information is inconsistent or missing in a suspicious way.

3. If Smart App Control is the confirmed blocker, ask the developer for a validly signed build; it has no per-app exception. For a separate Defender, Edge or other product detection, use that product's documented false-positive review process after verifying the file. Refer managed-device decisions to the administrator.

4. Obtain the confirmed release again and recheck the warning with protection still enabled. Preserve the publisher's or security vendor's response with the repair record.

Completion checks

The file has a traceable identity, the warning has been resolved through an appropriate process, and installation no longer loses quarantined components. Clicking an override is not a security audit.

Limits and cautions

This guide does not recommend disabling Defender or permanently excluding entire node or model directories. Custom nodes execute code; a successful launch does not prove they are safe.

Source review: 2026-09-26. No installation, security-product reproduction, GPU inference or user-environment repair was executed.

Original sources

• Microsoft: Smart App Control FAQ · rechecked 2026-09-26
• Microsoft: protect your PC from unwanted software · rechecked 2026-09-26

Related guides

• Model or runtime download failed: separate transport, access, integrity and storage
• Keep a reproducible ComfyUI repair record without exposing secrets