Windows Defender Blocks apps built by Visual Studio

Windows Defender is blocking parts of the apps because SmartScreen and Defender are treating them as potentially unwanted or untrusted, even when real‑time protection is turned off and exclusions are configured. The behavior is controlled from Protection history and from Virus & threat protection settings.

Use these steps to unblock and stabilize the development scenario:

1. Check Protection history and explicitly allow the blocked items
   1. Open Windows Security.
   2. Go to Virus & threat protection → Protection history.
   3. Look for entries that say This app has been blocked or similar for the binaries built by Visual Studio (for example, MSBuild.exe, test executables, or DLLs under the development folders).
   4. Select each relevant entry, choose Actions, then select Allow.
   5. Rebuild or re‑run the project so the files are created again; SmartScreen/Defender should now allow them.
   If an allowed item later needs to be revoked, remove it from the allowed list on the Allowed threats page referenced from Protection history.
2. Prefer targeted exclusions instead of disabling real‑time protection Disabling real‑time protection only works temporarily and can leave the device vulnerable. Instead, keep real‑time protection On and:
   1. In Windows Security → Virus & threat protection → Manage settings.
   2. Under Exclusions, select Add or remove exclusions.
   3. Add exclusions only for the specific build output folders or files that are repeatedly flagged and that are known to be safe.
3. Verify Virus & threat protection settings
   1. In Virus & threat protection → Manage settings, confirm that:
      • Real-time protection is enabled (recommended) so only the explicitly excluded or allowed items are bypassed.
      • If a non‑Microsoft antivirus was installed, ensure it is not conflicting; Defender will turn itself off when a compatible AV is active.
4. If a specific tool in the toolchain is being flagged as a vulnerable driver or similar If any alert mentions a vulnerable driver (for example, VulnerableDriver:WinNT/Winring0) for a development or monitoring tool, either update that tool to a safe version or, if absolutely necessary, add a one‑off exclusion for that file using the same Exclusions workflow as above. This workaround increases risk and should be used only when required.

These steps align Defender’s SmartScreen and antivirus decisions with the development workflow by explicitly allowing the blocked binaries through Protection history and using scoped exclusions, instead of repeatedly turning protection off.

References:

• Protection History
• Microsoft Defender Antivirus alert - VulnerableDriver:WinNT/Winring0
• Virus and Threat Protection in the Windows Security App