Windows Security can block potentially unwanted applications (PUAs)—such as adware, software bundlers, and evasive installers—by turning on Block apps and Block downloads under Reputation-based protection. This guide applies to Windows 11 and Windows 10 with Microsoft Defender Antivirus available and active. The Windows Security interface path is effectively the same on both versions. Windows 10 reached end of support on October 14, 2025, so keep it enrolled in Extended Security Updates where applicable and plan an upgrade, but the PUA protection steps below still apply.

Prerequisites and compatibility​

  • You must be signed in with an account that can change Windows Security settings. An administrator may be required.
  • Microsoft Defender Antivirus must be your active antivirus provider. If a third-party antivirus is installed and active, Defender may be disabled or its PUA settings may be unavailable.
  • Your device should have an internet connection so Defender can receive current security intelligence updates.
  • A restart is not required. The change takes effect immediately.
  • On work or school PCs, an organization can manage this setting through policy. If Windows says a setting is managed by your organization, do not try to bypass it; contact the IT administrator.
PUA protection is not a replacement for malware protection. A PUA is not always classified as malware, but it can install unwanted extras, inject advertisements, change browser behavior, slow the PC, or make later malware cleanup more difficult.

Turn on PUA blocking in Windows Security​

  1. Open Windows Security.
    Windows 11
    • Select Start.
    • Type Windows Security.
    • Open the Windows Security app.
    Windows 10
    • Select Start.
    • Type Windows Security.
    • Open the Windows Security app.
    Expected result: The Windows Security dashboard opens.
  2. Select App & browser control in the left pane.
    Expected result: You see protections related to app reputation, SmartScreen, exploit protection, and browser-based protection.
  3. Under Reputation-based protection, select Reputation-based protection settings.
    On some Windows builds, the entry may simply appear as Reputation-based protection. Open that section.
  4. Find Potentially unwanted app blocking.
  5. Turn on both available switches:
    • Block apps
    • Block downloads
    Expected result: Both switches show On.
    Block apps helps Microsoft Defender Antivirus identify and block PUA files when they are downloaded, moved, run, or installed.
    Block downloads adds download-related reputation protection, particularly when using Microsoft Edge and Microsoft Defender SmartScreen.
  6. If Windows requests confirmation through User Account Control, select Yes.
  7. Leave Windows Security open long enough for the setting to save. No reboot, sign-out, or manual scan is needed.

Update Defender before relying on the new setting​

PUA classification depends on current security intelligence. Update it now, especially if the setting was previously off or the PC has been offline.
  1. In Windows Security, select Virus & threat protection.
  2. Under Virus & threat protection updates, select Protection updates.
  3. Select Check for updates.
  4. Wait for Windows Security to report that security intelligence is up to date.
Expected result: Defender reports that the latest protection updates are installed, or shows that an update completed successfully.

Verify that PUA blocking is enabled​

Use both the visual check and, if you are comfortable with it, the command-line check.

Check in Windows Security​

  1. Return to App & browser control.
  2. Open Reputation-based protection settings.
  3. Confirm that both Block apps and Block downloads are On.
This confirms the Windows Security switches are enabled. It does not guarantee every unfamiliar installer will be blocked: Defender blocks items that Microsoft identifies as PUA, not every app you might personally dislike or every program from an unknown publisher.

Check the Defender setting with PowerShell​

This check is useful if the Windows Security page is unclear, unavailable, or controlled by another management tool.
  1. Select Start.
  2. Type PowerShell.
  3. Right-click Windows PowerShell or Terminal, then select Run as administrator.
  4. Select Yes if User Account Control appears.
  5. Run:
    Get-MpPreference | Format-Table PUAProtection
  6. Read the value shown under PUAProtection.
    • 1 means PUA protection is enabled in block mode.
    • 2 means audit mode: Defender logs detections but does not block them.
    • 0 means PUA protection is off.
Expected result: For active blocking, the value should be 1.

Optional controlled test​

If you want proof that blocking is working, use the AMTSO potentially unwanted application test page from a personal, non-managed PC. On that page, choose the option to download the PUA test file.
Expected result: Microsoft Defender or the browser should block the test download or prevent it from running. A PUA-related notification may appear, and the detection should be recorded in Windows Security > Virus & threat protection > Protection history.
Do not use random “test virus” downloads or untrusted websites to test security software. Use only recognized security-testing pages designed for this purpose.

Review a blocked app or download​

When Defender blocks a PUA, the item is normally quarantined and Windows Security may show a notification beginning with PUA:.
  1. Open Windows Security.
  2. Select Virus & threat protection.
  3. Under Current threats, select Protection history.
  4. Look for an entry referring to a potentially unwanted app, unwanted software, or a blocked download.
  5. Select the entry to review its detection name, affected item, and available actions.
A block is not automatically proof that a program is malicious. It does mean the software or installer met Microsoft’s criteria for potentially unwanted behavior or reputation.
Warning: Do not select Allow on device merely because you recognize the file name. First confirm that you intentionally downloaded it from the publisher’s official source, that the publisher and digital signature are expected, and that the program is genuinely required. Allowing an item reduces protection against that specific detection.
Click to expand...
If the application is legitimate and you have verified its source, use the action shown in Protection history to allow or restore it. Prefer obtaining a newer installer directly from the software publisher before allowing an older or repackaged download.

Alternate method: enable block mode with PowerShell​

Use this method only when the Windows Security switches are unavailable but Microsoft Defender Antivirus is active. It is also useful for a device where you need to set the exact Defender mode.
  1. Open Windows PowerShell or Terminal as administrator.
  2. Run:
    Set-MpPreference -PUAProtection Enabled
  3. Confirm the result:
    Get-MpPreference | Format-Table PUAProtection
Expected result: PUAProtection returns 1.
No restart is required.
For a cautious trial on a PC with specialized or legacy software, audit mode records potential PUA detections without blocking them:
Set-MpPreference -PUAProtection AuditMode
Audit mode is not equivalent to protection. Review the results before moving to block mode:
Set-MpPreference -PUAProtection Enabled

Troubleshooting and rollback​

The Potentially unwanted app blocking section is missing​

First, check whether another antivirus product is active.
  1. Open Windows Security.
  2. Select Virus & threat protection.
  3. Look for the active security provider or select Manage providers if shown.
When another antivirus is active, Microsoft Defender Antivirus may enter passive or disabled mode. Its PUA controls can be unavailable, and the other product’s reputation or unwanted-software settings may be the relevant protection instead.
If Defender is the active provider but the section is still absent, install pending Windows updates and Defender protection updates, then restart once and check again.

The switches are gray, revert to Off, or Windows says the setting is managed​

The PC is likely managed through Group Policy, Microsoft Intune, Configuration Manager, or another security-management service. A local user setting cannot reliably override an enforced organization policy.
For IT-managed devices, the policy setting is:
  • Computer Configuration
  • Administrative Templates
  • Windows Components
  • Microsoft Defender Antivirus
  • Configure detection for potentially unwanted applications
The policy must be set to Enabled, with Block selected in its options. If you are not the administrator, provide IT with the fact that the setting is controlled and ask whether PUA protection is intentionally configured for audit mode or block mode.

PowerShell reports PUAProtection as 2​

The device is in audit mode. Defender can detect and log a PUA but will not prevent it from running or installing.
To change to blocking mode, open an elevated PowerShell window and run:
Set-MpPreference -PUAProtection Enabled
If the command fails or the setting returns to 2, a policy is overriding the local command. Contact the organization’s administrator.

PowerShell returns access denied or the command is not recognized​

Make sure PowerShell or Terminal was started with Run as administrator. Set-MpPreference requires elevation.
If Get-MpPreference or Set-MpPreference is unavailable, Microsoft Defender Antivirus may not be active, required Defender components may be damaged, or the device may be using a nonstandard Windows security configuration. Check Windows Security > Virus & threat protection > Manage providers before making further changes.

A download was not blocked even though both switches are On​

PUA protection is reputation- and classification-based. It does not block every installer, every ad-supported program, or every suspicious-looking download. A file must be identified as a PUA for Defender to take action.
Also check these points:
  • Update Defender security intelligence, then try again only with a legitimate test method.
  • Microsoft Edge has its own SmartScreen-related download protection. Other browsers may use their own download reputation systems and extensions.
  • A file already downloaded before protection was enabled may not trigger a new download block. Right-click it and select Scan with Microsoft Defender if that option is available.
  • Review Protection history after a few minutes; a block may have occurred without an obvious notification.

A legitimate program was blocked​

Do not disable PUA protection globally as the first response.
  1. Open Windows Security > Virus & threat protection > Protection history.
  2. Select the PUA detection.
  3. Verify the program came directly from its legitimate publisher and is appropriate for the device.
  4. If justified, use the available Allow on device or restore action.
  5. Install the current version from the publisher’s official download source, then scan it again.
If you believe the detection is wrong, submit the file to Microsoft for analysis through the Microsoft security file-submission process rather than relying on an unverified mirror or altered installer.

Temporary rollback is required​

Warning: Disabling PUA protection removes Defender’s ability to block software identified as potentially unwanted. Use this only for brief troubleshooting after confirming that the affected program is legitimate.
Click to expand...
To turn it off through Windows Security:
  1. Open Windows Security > App & browser control > Reputation-based protection settings.
  2. Turn off Block apps and Block downloads.
  3. Complete only the required test or installation.
  4. Immediately turn both switches back On.
To disable it temporarily through an elevated PowerShell window:
Set-MpPreference -PUAProtection Disabled
Re-enable protection as soon as the test is complete:
Set-MpPreference -PUAProtection Enabled
Confirm the final state:
Get-MpPreference | Format-Table PUAProtection
The final value should be 1; then confirm that Block apps and Block downloads remain enabled in Windows Security.
 

Click to expand...
You must log in or register to reply here.