Can I mark an external exe as “safe to run (Unknown publisher)” programmatically?

Question

So I have my own application, \"main.exe\". In some computers where the security level is higher it will display a warning because of the \"unknown publisher\".

Answer 1

After a lot of trying I got to a very good workaround!

I found this Visual Studio 2015 Installer Projects here: https://visualstudiogallery.msdn.microsoft.com/f1cc3f3e-c300-40a7-8797-c509fb8933b9

Witch gives you the option to create and installer to your project.

After downloading and installing this addons you will be able to add an installer project to your main project.

Then you need to select what project will the installer install:

Then you can build this installer project and you get 2 installation files:

And then you are done!

Now you can run the setup.exe without any warning msg about the "unknown publisher", important to note that you must start the Setup.exe and not Setup.msi and when starting the Setup.exe you must have the Setup.msi in the same folder. While it installs your app it will request admin privileges but it will not give you a scary warning msg about "this is an un-safe application".

After your app is installed you will be able to run it (from the location you set the installing to), and by running it I mean that in the installation directory you will have your app exe file and you can run it without any warning msgs.

So basically what is happening is you only must give admin privileges when the installer starts the installation but after that you app will be trusted and will run without any msgs.

About the Setup.exe and Setup.msi you can join them two a 1 exe using IExpress.

Answer 2

The only right answer to this problem can be found here at the Microsoft blog.

It is all about reputation. This means, you need to properly sign your executable with an official cerificate signed by a CA like Comodo or Verisign. This is needed so that your reputation as a publisher can be tracked. After that you need to build reputation. That simply takes time, the more your software is installed, the higher the chance that you get trusted by the smart screen filter.

If you need a trusted executable as soon as possible, in other words, now... Buy yourself an Extended Validation or EV Code Signing certificate. As said in the Microsoft blog post, building reputation isn't necessary then:

"...Programs signed by an EV code signing certificate can immediately establish reputation..."