Windows · Windows Server · medium · Applications & Microsoft 365

A legitimate application is being blocked or quarantined

Defender, SmartScreen or controlled folder access has stopped something. Each has a different exclusion mechanism and a different risk.

What you see

A file disappears after download, an installer fails with 0x800700E1, or an application cannot save to Documents. Sometimes with no message at all.

What is actually wrong

Real-time protection quarantining a detection, SmartScreen blocking an unsigned or uncommon executable, or controlled folder access refusing a write from an unrecognised application.

Codes and articles

Operation did not complete successfully because the file contains a virus0x800700E1Controlled folder accessSmartScreen0x80070005 defender

Fixes (3)

Check the detection before restoring anything

Elevated PowerShell20 minuteshigh riskreversible

A file has been quarantined. Find out what it was detected as first — the detection is right more often than not.

List the detections with their names.

PowerShell

Get-MpThreatDetection | Sort-Object InitialDetectionTime -Descending | Select-Object -First 10 ThreatID,InitialDetectionTime,Resources | Format-ListGet-MpThreat | Format-Table ThreatName,SeverityID,Resources -Wrap

Look the threat name up. A detection of a genuine trojan family is a very different thing from a heuristic like Wacatac or a PUA classification of a system tool.
"It is a false positive" is the most common assumption and it is wrong about half the time. Two minutes reading the detection name tells you whether you are restoring a working file or reinfecting the machine.

If you are confident it is legitimate, submit it to Microsoft for analysis and restore it.

PowerShell

Get-MpThreat | Format-List ThreatName,Resources& "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" -Restore -Name 'Threat:Win32/Example'

Add a targeted exclusion — the specific file path, not the whole drive.
PowerShell
```
Add-MpPreference -ExclusionPath 'C:\Program Files\LineOfBusiness\app.exe'
```
Review the exclusions periodically. An exclusion list nobody has looked at in three years is a standing hole.
PowerShell
```
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
```

Confirm it workedThe application runs and the exclusion list contains only what you intended.

PowerShell

Get-MpPreference | Format-List ExclusionPath,ExclusionProcess,ExclusionExtension

If you need to undo itRemove-MpPreference -ExclusionPath removes the exclusion again.

Allow the application through controlled folder access

Elevated PowerShell15 minutesmedium riskreversible

The application runs but cannot save to Documents, Desktop or Pictures.

Confirm the feature is on and read what it has blocked.
PowerShell
```
Get-MpPreference | Format-List EnableControlledFolderAccess,ControlledFolderAccessAllowedApplicationsGet-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 50 | Where-Object Id -in 1123,1124 | Format-List TimeCreated,Message
```
Event 1123 names the exact executable that was blocked and the folder it tried to write to. Without it, this fault presents as an application that silently cannot save, with nothing in its own logs.

Allow that specific executable.

PowerShell

Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Program Files\App\app.exe'

Do not turn the feature off wholesale — it is one of the more effective defences against ransomware and the allow list is per-application for a reason.

Confirm it workedThe application saves normally and no further 1123 events appear.

If you need to undo itRemove-MpPreference -ControlledFolderAccessAllowedApplications with the same path.

Deal with a SmartScreen block on an unsigned application

The download itself10 minutesmedium riskreversible

"Windows protected your PC" on an installer you obtained deliberately.

Verify the download before bypassing anything — check it came from the vendor's own site over HTTPS, and compare its hash against the one the vendor publishes.
PowerShell
```
Get-FileHash "$env:USERPROFILE\Downloads\setup.exe" -Algorithm SHA256
```
Check who signed it. An unsigned installer from a small vendor is normal; an unsigned installer claiming to be from a large one is not.
PowerShell
```
Get-AuthenticodeSignature "$env:USERPROFILE\Downloads\setup.exe" | Format-List Status,SignerCertificate,StatusMessage
```
SmartScreen warns on files it has not seen often, which includes every genuinely new release from a small developer. The signature and the hash are what separate that from something that has been tampered with.
If it checks out, choose More info → Run anyway, or clear the mark of the web on the file.
PowerShell
```
Unblock-File "$env:USERPROFILE\Downloads\setup.exe"
```
Do not disable SmartScreen to install one application.

Confirm it workedThe installer runs, and SmartScreen remains enabled.

PowerShell

Get-MpPreference | Format-List EnableNetworkProtection

If you need to undo itNothing system-wide was changed.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.