Allowing the presentaid Installer through SmartScreen

This article is for IT administrators whose users download and install presentaid themselves. It explains what Microsoft Defender SmartScreen checks and how to let the installer through without turning SmartScreen off.

If you deploy presentaid centrally, you don't need any of this. See Organization Wide Roll-out / Installation Parameters.

How the Installer Works

The download button on the download page gives users presentaid-setup.exe, a small installer. When it runs, it:

1. Downloads the current presentaid.msi from https://presentaid.com/downloads/presentaid.msi over HTTPS
2. Checks that the MSI is digitally signed by bkt solutions GmbH and hasn't been modified. If the check fails, the MSI isn't started.
3. Starts the normal MSI installation. presentaid installs for the current user and needs no admin rights.

Both files are signed with an Extended Validation (EV) code signing certificate issued to bkt solutions GmbH.

Why SmartScreen Can Warn

SmartScreen judges downloaded programs by their reputation, which builds up as many people download and run the same file. A new file has little reputation at first, even when it's correctly signed. Users may then see:

• In Microsoft Edge: a message that presentaid-setup.exe isn't commonly downloaded
• When starting the file: "Windows protected your PC"

By default, users can continue (Keep in Edge, More info > Run anyway in Windows). If your policies don't allow users to bypass these warnings, use one of the options below.

Option 1: Deploy presentaid Centrally (Recommended)

Install the MSI with Intune, Configuration Manager or a logon script. Nothing is downloaded in the browser, so SmartScreen isn't involved and users don't need to do anything. See Organization Wide Roll-out / Installation Parameters.

Option 2: Provide the Installer Internally

SmartScreen only checks files that carry the Windows "downloaded from the internet" mark. A copy of the installer without that mark, started from your own file share, isn't checked.

1. Download presentaid-setup.exe from the download page.
2. Check its signature in PowerShell. Status must be Valid, and the subject must start with CN=bkt solutions GmbH.

3. Remove the download mark, because it stays on the file when you copy it:

4. Put the file on a file share your users can reach, and tell them to start it from there.

The installer always downloads the latest MSI, so you don't need to replace the file on the share when a new presentaid version comes out.

Option 3: Allow presentaid.com in SmartScreen

With this option, users download from the website and Microsoft Edge doesn't warn about the download. Which setting applies depends on whether your organization uses Microsoft Defender for Endpoint.

Without Microsoft Defender for Endpoint

Set the Microsoft Edge policy Configure the list of domains for which Microsoft Defender SmartScreen won't trigger warnings (SmartScreenAllowListDomains) and add presentaid.com.

• Group Policy: Administrative Templates > Microsoft Edge > SmartScreen settings (from MSEdge.admx)
• Intune: Settings catalog > Microsoft Edge > SmartScreen settings
• Registry:

Microsoft applies this policy only on PCs that are joined to an Active Directory domain, or on Windows Pro or Enterprise PCs enrolled in device management. If Defender for Endpoint is enabled, Edge ignores it.

With Microsoft Defender for Endpoint

Create an allow indicator for the domain:

1. In the Microsoft Defender portal, go to Settings > Endpoints > General > Advanced features and make sure Custom network indicators is turned on.
2. Go to Settings > Endpoints > Indicators > IP addresses or URLs/Domains and select Add item.
3. Enter presentaid.com, choose the action Allow, and select the device groups.

Microsoft says the indicator usually takes effect within two hours, and at most within 48 hours.

If users still see "Windows protected your PC" without a way to continue when they start the downloaded file, use option 1 or 2.

Application Control (AppLocker, App Control for Business)

If your PCs only run approved programs, add publisher rules for bkt solutions GmbH:

• Executable rules: presentaid-setup.exe
• Windows Installer rules: presentaid.msi (the default AppLocker rules already allow all digitally signed MSI files)

Create the rules from the signed files and set them to the publisher level, so they also cover future versions. Don't use path rules: the installer saves the MSI in a new folder under the user's temp folder each time.

Network

The installer connects to presentaid.com over HTTPS (port 443). It uses the Windows proxy settings and signs in to the proxy with the user's Windows account.

Troubleshooting

If the installer can't download the MSI, it shows a link to the download page, where users can download presentaid.msi directly.