Windows 11 Smart App Control blocks my Installation although it is signed

[ChrisGue]

I use AI 14.1.1 Enterprise

I digital signed all my exes/dlls/oxcs
And AI signs the installation with my Signature.

But on Windows 11 systems with Smart App Control activated, the installation (exe with msi inside) is blocked by it:
"Smart App Control app has blocked this app:
AIED914.tmp was blocked because we can't confirm who published it and it's not an app we're familiar with.

AIED914.tmp has been digital signed by the AI build process with my signature, but is it not detected as valid!:


The installation with that problem can be downloaded here:
https://www.jumpingbytes.com/down/PureSyncInst.exe

When I sign my exe its signature is valid:


Why is that?
And how to fix that?

Thank you,
Chris

[Catalin]

Hello Chris,

Thank you for the provided setup!

I'm afraid I can't quite reproduce the issue on my end here, despite having the Smart App Control enabled.

Screenshot_11.png (333.98 KiB) Viewed 2245 times

Are you able to reproduce this on multiple machines, or it happens on one machine only?

Best regards,
Catalin

[ChrisGue]

Yes.
I have 3 windows 11 24h2 (Pro and Home) were this occurs.
On all other windows I have here Smart App Control cannot be activated.

[Catalin]

Hello Chris,

In your first screenshot from the post, is that for the TMP file that gets blocked?

I'm asking because I can not quite tell from the ss alone.

If possible, during the installation, could you please run, on the TMP file that gets blocked, the following command:

Code: Select all

sigcheck.exe AIED914.tmp

and forward me the results?

I've tested this again and it seems to be working just fine on my end.

The only scenario I can think of is if the certificate is not EV. Could you please check with your team to see if this is the case?

Best regards,
Catalin

[ChrisGue]

yes the 1s t screenshot is of the tmp file.

I used the sigcheck.exe from the sysiternals suite:
Sigcheck v2.90 - File version and signature viewer
Copyright (C) 2004-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\users\chris\appdata\local\temp\AIEAA68.tmp:
Verified: The digital signature of the object did not verify.
Signing date: 8:53 PM 3/26/2025
Publisher: Jumping Bytes (Christoph Guentner)
Company: n/a
Description: n/a
Product: n/a
Prod version: n/a
File version: n/a
MachineType: n/a

When I copy that tmp file to my work station (smart app control off), it is the same: the digital signature is not valid

[Catalin]

Hello Chris,

Are you reproducing this with the exact setup you provided in your first thread?

I once again tested this on 3 machines and forwarded the setup to the QA team as well and 2 of the members tested this on their machines and we could not reproduce this at all.

Without being able to reproduce the issue, I'm afraid there isn't much that I can do, as I can not investigate this any further.

Also, did you receive any complaints about this from your clients? If not, I think that this might be something happening only locally on your end.

If you are not testing with the setup you first provided, please forward me the setup that you are testing this and reproducing this with.

Best regards,
Catalin

[ChrisGue]

yes I tested with exact that file.
I the meantime the download is a new version. But with this it is the same.

I am Testing in a virtual machine (VMWare). Could that be a problem?
Or that it is a german windows? (one of them switched later to english)

[ChrisGue]

Can you please download this file:
https://www.jumpingbytes.com/down/AIEAA68.tmp
and check its signature

Here it is shown as invaslid:

(ungültig = invalid)
(checked on several machines)

[Catalin]

Hello Chris,

Thank you for the sent file.

I've had a look over it and it indeed looks like the signature is invalid.

It's quite hard for me to grasp why this is happening right now, considering I can not reproduce this at all (neither me or my colleagues that I've asked to far to help with the testing).

Please allow me some more time to investigate this and I will followup here as soon as I will have more information.

I am Testing in a virtual machine (VMWare). Could that be a problem?

Shouldn't be a problem, as I have also tested this on a VM (Hyper-V).

Or that it is a german windows? (one of them switched later to english)

This I can't say for sure, as I've only tested on English systems. I will try to give this a go tomorrow and see whether this reproduces over there (although I doubt).

By the way, did you receive any complaints from the customers so far regarding this? Or you reproduce this only locally?

Have you tried testing this outside of your network (perhaps on your personal PC from home)? I'm thinking that this might have to do with some GPO set in place in your company that causes this - but can't say for sure just yet.

Best regards,
Catalin

[ChrisGue]

I tested now

[Catalin]

Hello Chris,

How did the test go? Did it work locally on your personal computer?

Best regards,
Catalin

[ChrisGue]

I tested now with a fresh installed windows 11 24H2 english-us
And it is the same.

I had one complaint for a customer so far.


With an installation of another product (creating an exe Installer on the same machine ther same way) the problem does not ocurr. Installation runs fine. but with this I do not see the AI...tmp file in the temp folder.
What is that file for? For any custom action or searches?

[Catalin]

Hello Chris,

It looks like the temporary file that you have provided is signed at a different date compared to your setup.

Screenshot_17.png (349.26 KiB) Viewed 679 times

That being said, please rebuild your project, retest this and, if this still reproduces, forward me the latest TMP file that is blocked, together with the setup file and the Advanced Installer project.

If you want, you can forward the download link for these via email at support at advancedinstaller dot com (for more privacy).

Best regards,
Catalin

[ChrisGue]

I now started removing custom actions, then files and finally languages from the AI project.
Finally it turns out the german language causes that issue!
(My project build one exe with all languages inside it.)

Any idea what might be the issue here?

[ChrisGue]

I have unchecked all languages and the checked them again.
Now the installation is working fine