Microsoft Defender Smartscreen doesn´t block via CMD

Hello, by default, SmartScreen mostly kicks in when you launch an executable by double-clicking it (or otherwise through the graphical interface), recognizing that the app is from the Internet or is unknown. When you run the same file from the command line, SmartScreen often behaves differently and may not display the same warning.

If you want to “align” the behavior so that the executable is also blocked or flagged when launched via CMD/PowerShell, you have a couple of main approaches:

Set Group Policy for SmartScreen

Open the Group Policy Editor (gpedit.msc).
Navigate to:
Computer Configuration - Administrative Templates - Windows Components - Windows Defender SmartScreen - Explorer

From there, you can adjust SmartScreen settings so it blocks or warns even when files are launched in different ways, including from the command line.

Use solutions like AppLocker or Windows Defender Application Control

These tools are designed to allow or block execution of specific files (or digital signatures) regardless of how they are launched—GUI, CMD, PowerShell, scripts, etc.
By configuring more restrictive rules (for example, “allow only executables that are signed or come from certain folders”), you can achieve consistent behavior and prevent unauthorized execution from the command line.

SmartScreen is more focused on executions initiated from Explorer or for files that are recognized as downloaded/untrusted. If you want to be certain that all scenarios are covered, setting up Application Control or AppLocker rules is the most robust approach