Advanced Plus Security Devjit’s Gaming PC 2026

[devjitdutta2025]

@Andy Ful does SAC get its info from SmartScreen like WDAC? If WDAC blocks a file and I use runbysmartscreen and if it thinks the file to be safe WDAC allows the file to run. Is it the same with SAC? Suppose a file is blocked by SAC but if I run the file using RunbySmartscreen and if it deems the file to be safe will SAC still block the file? You’re the best person here who can answer this for me.

 

[Andy Ful]

@Andy Ful does SAC get its info from SmartScreen like WDAC?

Yes and No.
Yes, for unsigned files and files with a bad reputation.
However, when the file is signed with an unknown reputation, SAC will allow it.

If WDAC blocks a file and I use runbysmartscreen and if it thinks the file to be safe WDAC allows the file to run.

Yes, that is right. For WDAC + ISG , RunBySmartScreen forces SmartScreen for files with no MotW to decrease the number of false positives. The ISG alone is a very restrictive AI-based file reputation system.

Is it the same with SAC?

No. With SAC, RunBySmartScreen extends protection only for non-EXE files such as scripts, shortcuts, scriptlets, documents, etc.

Suppose a file is blocked by SAC but if I run the file using RunbySmartscreen and if it deems the file to be safe will SAC still block the file?

That cannot happen (as far as I know).
For WDAC + ISG, RunBySmartScreen slightly decreases aggressive blocking of EXE/MSI files.
For SAC, RunBySmartScreen slightly increases protection for non-EXE/MSI files.

 

[Parkinsond]

That cannot happen (as far as I know).

I have had the experience before; unfortunately, it still will be blocked by SAC; RunbySmartScreen will not help to bypass block as in the case with WDAC.
I have no explanation for the mechanism.

 

[Divergent]

In a standard SAC environment, RunBySmartScreen cannot "force" an override. If the kernel-level Code Integrity (CI) driver says "No," the application dies.

 

[devjitdutta2025]

Yes and No.
Yes, for unsigned files and files with a bad reputation.
However, when the file is signed with an unknown reputation, SAC will allow it.



Yes, that is right. For WDAC + ISG , RunBySmartScreen forces SmartScreen for files with no MotW to decrease the number of false positives. The ISG alone is a very restrictive AI-based file reputation system.



No. With SAC, RunBySmartScreen extends protection only for non-EXE files such as scripts, shortcuts, scriptlets, documents, etc.



That cannot happen (as far as I know).
For WDAC + ISG, RunBySmartScreen slightly decreases aggressive blocking of EXE/MSI files.
For SAC, RunBySmartScreen slightly increases protection for non-EXE/MSI files.

Beautifully explained….thank you.