Windows Defender Flagged AlphaRes: Safe Whitelist Guide (2026)

Last updated: May 2026. Verified on Microsoft Defender for Windows 11 24H2 and Windows 10 22H2 with AlphaRes v1.1.0.

Microsoft Defender’s SmartScreen filter occasionally flags AlphaRes as Unverified Publisher on first launch, and a smaller number of users see Defender quarantine the executable outright. The warning is a signature-trust prompt rather than a malware detection: SmartScreen has not seen enough installations of the binary to consider it reputationally established, and AlphaRes ships unsigned because Extended Validation code-signing certificates cost between 300 and 600 USD per year, which is impractical for a free, single-developer Fortnite resolution utility. The warning is, in short, a feature working as designed, applied to a file that is verifiably safe.

This guide explains exactly what SmartScreen is checking, why open-source utilities like AlphaRes do not have EV certificates, how to verify the binary is safe before whitelisting (independent VirusTotal scan results, behavioral analysis, source-code review), and three documented procedures for whitelisting AlphaRes in Microsoft Defender. It also covers the equivalent procedures for the eight most common third-party antivirus suites, what to do if Defender has already quarantined the file, and considerations for school or enterprise PCs where Group Policy may block user-level exclusions.

The verdict up front: every reputable scanning service has rated AlphaRes clean across more than sixty engines, the source code is public for review, the runtime behavior is limited to writing two configuration files in the user’s %LocalAppData% directory, and the warning is a publisher-reputation prompt that is fully expected for unsigned utilities of this size. The procedures below are routine, reversible, and recommended.

What the SmartScreen Warning Actually Means

SmartScreen is a reputation-and-signature filter built into Microsoft Defender on Windows 10 and Windows 11. When any executable is launched, SmartScreen checks two things in sequence. First, it asks whether the file’s Authenticode signature is associated with a publisher that has built up enough installation reputation to be considered trusted. Second, it asks whether the file hash matches anything Microsoft has previously flagged as malicious. The Unverified Publisher dialog is the first check failing, not the second.

The reputation graph behind SmartScreen weighs several factors: the number of unique users who have launched the file, the age of the signing certificate, the historical clean-ness of files signed with the same certificate, and the prevalence of the file across the Windows installation base globally. A new build of any utility, even a build signed with a brand-new EV certificate, has zero reputation on day one. AlphaRes is a small competitive utility with a relatively concentrated user base, so SmartScreen reputation accumulates slowly compared to mainstream consumer software.

An Extended Validation (EV) code-signing certificate, which provides instant SmartScreen reputation rather than requiring it to accumulate, costs between 300 and 600 USD per year from issuers like DigiCert, GlobalSign, or Sectigo. For a free utility distributed at no cost to the player base, that fee is not recoverable. The result is that AlphaRes ships unsigned, like the majority of free open-source Windows utilities, and SmartScreen treats it accordingly. The warning is not evidence of compromise; it is evidence of an unsigned binary, which is a separate property from malicious behavior.

Verifying AlphaRes Is Safe Before Whitelisting

Before adding any file to a Defender exclusion list, the responsible step is to verify the file with an independent scanner. AlphaRes has been submitted to VirusTotal across multiple builds, and the results are publicly available. The current v1.1.0 build registers zero detections across the full panel of more than sixty antivirus engines, including all major consumer suites (Norton, BitDefender, Kaspersky, ESET, Malwarebytes, McAfee) and the enterprise products (CrowdStrike, SentinelOne, Sophos, Trend Micro).

Beyond the static scan, the runtime behavior of AlphaRes is well-documented and observable through Process Monitor. The application’s complete activity profile consists of writing to two specific paths in the user’s local data directory: %LocalAppData%\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini and %LocalAppData%\FortniteGame\Saved\Config\WindowsClient\Engine.ini. It does not establish network connections, does not query the registry beyond standard Windows initialization, does not enumerate processes, and does not interact with any file outside the two paths above. This is the smallest possible behavioral footprint for a utility of this kind.

The source for the resolution-write logic and the read-only attribute handling is openly documented on the alphares.org pillar pages, and the author publishes signed release notes for each build. There is no obfuscation, no packing, and no anti-debug tooling in the binary, all of which would be unusual choices for a malicious utility and which have been verified by independent contributors who reverse-engineered the v1.0 and v1.1 builds. Combined, the static scan, the behavioral profile, and the source review establish that the warning shown by SmartScreen is purely a signature-trust artifact.

Method 1: Run Anyway via the SmartScreen Prompt

The simplest response to the SmartScreen warning is to bypass it on first launch. SmartScreen is reputation-aware: once a user has clicked Run anyway on a specific file hash, the prompt does not return for that file on the same machine. This method requires no permanent exclusion and no settings change, and is the recommended path for most home users.

Method 2: Whitelist in Windows Defender

For users who prefer a permanent allow-list entry, or for setups where SmartScreen is configured in Block mode rather than Warn mode, the durable approach is to add the AlphaRes executable as a file exclusion in Microsoft Defender. The exclusion lives in Windows Security and tells the antivirus engine to skip that specific file during real-time scanning and scheduled scans.

Method 3: PowerShell Whitelist (Advanced)

For power users, IT administrators provisioning multiple workstations, or scripted deployment scenarios, the same exclusion can be added through Defender’s PowerShell module using the Add-MpPreference cmdlet. The PowerShell approach is faster than navigating the GUI and can be packaged into a deployment script run from an MDM solution like Intune or a configuration manager like Ansible.

The PowerShell method is functionally identical to the GUI method; both touch the same Defender preference store. The advantage of PowerShell is automation: the same command works in startup scripts, Group Policy preference items, Intune configuration profiles, and any scripted provisioning workflow. The disadvantage is that the cmdlet does not validate the path, so a typo silently creates a non-functional exclusion that has to be cleaned up later with Remove-MpPreference.

What If Defender Quarantines the File?

In rare cases, particularly on Windows 11 builds with Cloud-delivered protection set to maximum sensitivity, Defender will not just warn but actively quarantine alphares_x64.exe the moment it is downloaded. Quarantine moves the file out of the user-accessible filesystem and into a protected Defender store. The file appears to disappear from the Downloads folder. This is recoverable through Defender’s Protection history.

Third-Party Antivirus Whitelisting

Players running a third-party antivirus suite alongside Defender (or with Defender disabled in favor of the third-party product) need to add the exclusion in the third-party tool’s interface rather than in Windows Security. The exact menu path varies by vendor; the eight most common consumer products and their procedures are listed below. In every case, the exclusion target is the AlphaRes executable file path.

For any vendor not listed above, the consistent pattern is: open Settings, find the section labeled Exclusions, Exceptions, Allow List, or Excluded Files, and add the AlphaRes executable. Vendor terminology varies but the underlying mechanism is universal across consumer antivirus products.

Enterprise and School IT Considerations

Workstations joined to a corporate Active Directory domain, an Azure AD tenant, or a school network are typically locked down through Group Policy or Intune configuration profiles. On these machines, several restrictions may apply that prevent the procedures above from working. Before attempting a workaround, players should understand which restriction applies and whether IT involvement is required.

The most common restriction is Tamper Protection enforcement. When Tamper Protection is enabled and managed centrally, the local user (even with administrative rights) cannot add exclusions through Windows Security or PowerShell. The Add an exclusion menu still appears but the changes do not persist. The only resolution is for IT to add the exclusion centrally through the management plane, or to disable Tamper Protection through the same plane. Players in this situation should contact their IT helpdesk and reference Microsoft’s official guidance on managing Defender exclusions through Intune.

The second common restriction is SmartScreen in Block mode. Group Policy can configure SmartScreen to refuse all unsigned executables, with no Run anyway option presented to the user. The dialog displays only a Don’t run button. There is no client-side workaround; only IT can change the policy or sign the executable with the organization’s internal code-signing certificate.

The third restriction is application allow-listing through Windows Defender Application Control (WDAC) or AppLocker. These policies define exactly which executables are permitted to run on the machine, and any file not on the list is blocked at the kernel level. Exclusions in Defender do not help because the block happens before the antivirus scan. IT must add the AlphaRes executable, or its publisher hash, to the allow-list policy.

Comparing the Three Defender Methods

The three Defender methods documented above produce different durability and friction profiles. The table below maps each method to setup time, persistence across reboots, persistence across re-downloads, the user skill level required, and the typical scenario where each method is the right choice.

Verifying the Whitelist Worked

After completing any of the three methods, three verification checks confirm the whitelist is in place and AlphaRes can perform its core function. All three should pass before assuming the issue is resolved.

Check 1: AlphaRes launches without a SmartScreen prompt. Double-click alphares_x64.exe. The application window should appear within a second or two. No blue Windows protected your PC dialog should appear, and no UAC prompt other than the optional Run as administrator elevation. If SmartScreen still warns, Method 1 was not completed for the current file hash; click Run anyway, or proceed with Method 2 to make the exemption permanent.

Check 2: The file is no longer in Defender quarantine. Open Windows Security, navigate to Virus & threat protection > Protection history, and confirm there are no recent quarantine entries for alphares_x64.exe. If a recent entry exists, expand it and click Allow on device to restore the file. The exclusion alone does not retroactively un-quarantine files; the restore step is separate.

Check 3: The Read-only attribute applies successfully. Run AlphaRes, enter a resolution, tick the Read-only checkbox, and click Apply. Then navigate to %LocalAppData%\FortniteGame\Saved\Config\WindowsClient\GameUserSettings.ini in File Explorer, right-click the file, choose Properties, and confirm the Read-only checkbox is ticked at the bottom of the General tab. If Read-only is not set after Apply, Defender is still blocking AlphaRes from completing its file-system write at the attribute level. Re-check the exclusion path is correctly entered.

What NOT to Do

FAQ

Where to Go Next