Quick answer: This User Account Control (UAC) message means Windows refused to give the program administrator rights. On a home PC the usual reason is that the program’s digital signature is no longer trusted, most often because its signing certificate was revoked. On a work or school PC it usually means an IT policy blocks the app. The safe fix is to download the current version from the developer’s own site, or on a managed PC to ask IT to allow it. Turning off UAC makes the message go away, but it also removes a protection designed to stop exactly this kind of file.
In this guide
Why Windows shows this message
The dialog appears when you open a program that asks for administrator rights. Users report it reading This app has been blocked for your protection, followed by An administrator has blocked you from running this app. For more information, contact the administrator. It usually lists the file name, Publisher: Unknown and where the file is stored.
Despite the wording, nobody has to have blocked you personally. Microsoft documents that, starting with Windows 10, UAC will not elevate a program whose files are signed with a revoked certificate. Certificates get revoked when, for example, they were stolen, so Windows treats the file as untrustworthy even if it looks like a normal installer. Old software is the most common victim: the developer’s certificate from years ago may since have been revoked.
Two other things can block an app in a similar way. On managed PCs, administrators can use AppLocker or App Control for Business to allow only approved apps. On some new Windows 11 installs, Smart App Control blocks apps that are unsigned or have an invalid signature when Microsoft’s cloud service can’t vouch for them. Those blocks can use different wording, so check the exact text on your screen.
Work out which case you are in
| What you see | Likely cause | Where to start |
|---|---|---|
| A PC from your employer or school | An app-control policy set by IT | Ask IT to allow the app |
| An old installer or program, Publisher: Unknown | Revoked or invalid signature | Fix 1 and Fix 2 |
| A file you just downloaded | Bad or tampered download, or an untrusted signature | Fix 1, then Fix 3 |
| mmc.exe or a built-in tool such as Computer Management | A damaged or replaced system file, or a policy | The mmc.exe section |
| A new Windows 11 PC, Smart App Control turned on | Smart App Control | Fix 4 |
Safe fixes, in order
Fix 1: Check the file’s digital signature
Right-click the program, select Properties and look for a Digital Signatures tab. Select the signature, then Details. If Windows says the certificate was revoked or the signature isn’t valid, that matches the cause above, and you should not try to force the file to run. If there’s no Digital Signatures tab at all, the file is unsigned.
Also check that the publisher name, when one is shown, is the company you expected. A file that claims to be from a well-known vendor but isn’t signed by it is a red flag.
Fix 2: Get the current version from the developer
Microsoft’s own fix for the revoked-certificate case is simple: the program has to be signed with a valid certificate. In practice that means downloading the latest version from the developer’s official website rather than reusing an old installer, a copy from a file-sharing site or a CD. Developers re-sign their software with new certificates, so a current build normally installs without the message. If the program is discontinued, contact the developer or look for a maintained alternative.
Fix 3: Unblock a downloaded file you trust
Windows marks files that came from the internet. In Properties > General, some downloaded files show This file came from another computer and might be blocked to help protect this computer with an Unblock checkbox. If the file came from the developer’s site and the signature checks out, tick Unblock, select OK and try again. This clears the download mark only. It won’t fix a revoked signature, so if the message returns, go back to Fix 2.
Fix 4: Smart App Control on Windows 11
Microsoft says there’s currently no way to let a single app past Smart App Control. Your choices are to use a signed version of the app, ask the developer to sign it, or turn Smart App Control off in Windows Security > App & browser control > Smart App Control settings. Think before turning it off: on many PCs it can’t be switched back on without resetting or reinstalling Windows, although Microsoft says recent updates relax this. If Windows Security won’t open, see how to fix Windows Security not opening.
Fix 5: On a work or school PC, contact IT
If the PC is managed by an organization, the block comes from a policy you can’t and shouldn’t change yourself. Send IT the program name and the exact message. They can add an allow rule or install an approved version for you. Admins who manage the policies centrally may find the Group Policy Management Console useful.
If the blocked app is mmc.exe or another Windows tool
Built-in consoles such as Computer Management, Device Manager and Services run through mmc.exe. A genuine Windows copy of that file is signed by Microsoft, so Publisher: Unknown on a Windows tool is unusual. Check that the program location points to C:\Windows\System32. If it does, repair system files: open Command Prompt as administrator, run the two commands below, then restart.
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannowIf SFC reports that it couldn’t do its job, see Windows Resource Protection could not perform the requested operation. If the file is somewhere other than System32, don’t run it, and scan the PC with Microsoft Defender. On a work PC, IT may also restrict which consoles you can open, so ask them first.
Workarounds to avoid (or undo afterwards)
Many guides suggest the following. They often make the message disappear, but they do it by removing the check rather than fixing the file. Microsoft advises against the first three, and the fourth carries the same risk:
- Setting the UAC slider to Never notify. Microsoft says this option isn’t recommended due to security concerns.
- Disabling “User Account Control: Run all administrators in Admin Approval Mode”. This turns off UAC as a whole, and Windows Security will warn that the security of the system is reduced.
- Enabling the hidden built-in Administrator account. It runs everything with full rights, and Microsoft recommends keeping it disabled and not signing in with it unless it’s necessary.
- Running the file from an elevated Command Prompt. This is widely reported to get around the dialog for old installers, but Microsoft doesn’t document it, and it hands full control to a file Windows has flagged. Only consider it for a file you are certain is genuine, such as an old installer you have kept since you first bought the software, and never for a download you aren’t sure about.
If you already used one of these, put it back: return the UAC slider to its default, re-enable Admin Approval Mode, and disable the built-in Administrator with net user administrator /active:no from an elevated Command Prompt.
FAQ
I’m the only user and I am an administrator. Why does Windows say an administrator blocked me?
The wording is generic. In the revoked-certificate case the block comes from Windows itself, not from another person or a setting you changed, which is why being an administrator doesn’t help.
Is this the same as the SmartScreen warning?
No. SmartScreen shows a blue Windows protected your PC screen for unrecognized downloads, usually with a way to run the app anyway. If SmartScreen itself is failing, see SmartScreen can’t be reached right now.
Related guides
- How to open Command Prompt as administrator in Windows 11 and 10
- SmartScreen can’t be reached right now: how to fix it
- Windows Security not opening in Windows 11? 7 fixes that work
- Windows Resource Protection Could Not Perform the Requested Operation: 7 Fixes
Official sources:
Leave a Reply