How can I stop my installer from triggering Windows 10's "This app has been blocked for your protection" error?

Question

Windows 10's security features sometimes blocks my application installer as not trusted, saying "This app has been blocked for your protection". (My installer is digitally signed.) There are workarounds available for end users, but this is not a good user experience.

What should I do so Windows 10 trusts my application when downloaded from my company website?

Answer 1

Update: As of 2019, the information in this answer no longer applies. You can still use code-signing to build reputation, but you can no longer use it to gain "initial trust." Quoting Text/Plain:

Notably, as of 2019, using an EV certificate no longer grants your code “initial trust” by SmartScreen Application Reputation.

You can improve your reputation by signing with a trusted code-signing certificate. Established businesses resolve this chicken-and-egg problem by having previously used code-signing (i.e., back when Microsoft was less draconian). The expensive way to resolve this chicken-and-egg problem is to buy an EV code-signing certificate. Assuming [this blog post](https://learn.microsoft.com/en-us/archive/blogs/ie/microsoft-smartscreen-extended-validation-ev-code-signing-certificates) applies to Windows 10:

Programs signed by an EV code signing certificate can immediately establish reputation with SmartScreen reputation services even if no prior reputation exists for that file or publisher. Other factors are considered when generating reputation and determining product experiences and EV-signed programs will be closely monitored over time. We think the improvements in the vetting and security of these certificates are a great development for both users and developers.

...

The presence of an EV code signing certificate is a strong indicator that the file was signed by an entity that has passed a rigorous validation process and was signed with hardware which allows our systems to establish reputation for that entity more quickly than unsigned or non-EV code signed programs.

This is not guaranteed to work.