 |
| Three ways to install Windows software, and one safety check that applies to all of them. |
The safest way to install software on Windows is to prefer the Microsoft Store when the app is there, and otherwise to download an EXE or MSI file from the publisher's official site, verify it, and read every prompt before you approve it. This guide compares the three methods, shows how to check a download before you run it, and explains the warnings Windows may show.
Which method should you use?
| Method | Best for | Main safety check |
|---|---|---|
| Microsoft Store | Apps that are listed in the Store | Check the publisher name on the listing |
| MSI package | Software distributed as a Windows Installer package | Verify the download and the publisher before running it |
| EXE installer | Most downloads from developer websites | Verify the download, then read each wizard screen |
Step 1: Verify the download before you run it
These checks apply to EXE and MSI files, and they take a minute.
- Download from the official source. Go to the developer's own website rather than clicking the first search result or an unfamiliar download site, and make sure the publisher name matches the company that makes the software.
- Check the digital signature (if the file has one). Right-click the file, select Properties, and look for a Digital Signatures tab. The signer's name should match the publisher. An unsigned file isn't proof of malware, but expect a Windows warning.
- Compare the file hash (when the developer publishes one). Open PowerShell and run:
Get-FileHash "$env:USERPROFILE\Downloads\Setup.exe"Microsoft's documentation says Get-FileHash uses the SHA256 algorithm by default. If the result differs from the hash printed on the developer's official download page, delete the file and download it again from the official site. A hash is only useful if the developer publishes one on a page you trust.
Method 1: Install from the Microsoft Store
- Select Start, then Microsoft Store.
- Choose Apps (or Gaming), or search for the app by name.
- Check that the publisher on the listing is the one you expect, then select the install button.
Microsoft's guide to getting trusted apps and games says an app installed from the Store follows you to your other devices and is updated automatically. For developers, Microsoft states that apps published through the Store are signed by a Microsoft certificate and aren't subject to SmartScreen download warnings, which is why the Store is the simplest route when the app is available there. That removes the warning step, but it doesn't replace a quick look at the publisher name.
To update manually, open the Store and select Get updates or Check for updates (the label differs by version). Microsoft also says automatic updates are being rolled out and that you can pause them. See Get updates for apps and games in Microsoft Store.
Method 2: Install an EXE file
An EXE is a standalone installer that runs its own setup process, so each program's wizard looks a little different.
- Double-click the file you verified in Step 1.
- If a User Account Control (UAC) prompt asks whether to allow the app to make changes to your device, read the app name and publisher before you select Yes.
- If you see a SmartScreen warning, read the section on warnings below.
- In the wizard, read the license terms, choose the install location, and untick any optional toolbars, extensions or bundled programs you don't want.
- Finish the installation and restart if the installer asks you to.
Method 3: Install an MSI package
An MSI is a Windows Installer package. Microsoft describes msiexec.exe as the app that interprets these packages and installs the products. For most people, double-clicking the MSI file is enough, and the steps are the same as for an EXE: verify the file, read the UAC prompt, and follow the wizard.
Command-line options are useful when you want more control. Based on Microsoft's msiexec command-line options:
| Option | What it does |
|---|---|
/package | Installs the package |
/passive | Shows only a progress bar, with no prompts |
/quiet | No interface at all, and you can't cancel |
/norestart | Never restarts the PC after installing |
/log | Writes a log file to a folder that already exists |
/uninstall | Removes the product, using the package or its product code |
A typical command looks like this (create the C:\Temp folder first, because the installer doesn't create it):
msiexec /package "C:\Users\YourName\Downloads\Application.msi" /passive /norestart /log "C:\Temp\install.log"Be careful with /quiet. Microsoft says that if you don't add a restart option, the installer restarts the computer whenever necessary without any prompt or warning. Adding /norestart avoids a surprise reboot. To remove a program later, the simplest route is Settings, Apps, Installed apps. Our guide to uninstalling programs on Windows 11 shows how.
What the Windows warnings mean
"Windows protected your PC" (SmartScreen)
Microsoft says SmartScreen checks two signals when you run a downloaded file: the publisher's reputation (is the file signed by a trusted certificate?) and the reputation of that specific file. A new or little-downloaded file can trigger a warning even when it is legitimate, and unsigned or self-signed files do trigger it. Microsoft's guidance in its SmartScreen reputation documentation is to proceed only after verifying the source and publisher.
So if you have completed Step 1 and trust the developer, select More info and then Run anyway. If you have any doubt, don't run it.
Smart App Control (Windows 11)
Microsoft says Smart App Control, where it is turned on, can take over from SmartScreen's reputation check and blocks unsigned files unless they have a positive reputation. You can see its status in Windows Security, under App & browser control.
Don't switch protection off to get the installer working
Microsoft warns that turning off the block and warn options in App & browser control may leave your device vulnerable. If an installer only works with protection disabled, that is a reason to look for a different source.
Red flags before you install
These are general safety signs, not Microsoft rules:
- The download comes from an ad or a site that isn't the developer's.
- The installer name doesn't match the program you wanted.
- The wizard pre-selects extra programs or browser changes you didn't ask for.
- The publisher in the UAC prompt is "Unknown" or doesn't match the developer.
- The site tells you to turn off antivirus or SmartScreen first.
Example (illustrative): You search for a PDF tool and a third-party site offers a download. The file isn't signed, SmartScreen warns you, and the wizard pre-ticks a "free browser add-on". You close it, go to the developer's own site, and install from there instead.
After installing
- Open Settings, Apps, Installed apps and confirm the program appears with the right publisher and version.
- For Store apps, check Library in the Store.
- Keep the app updated through its own updater or the Store.
- Remove programs you no longer use.
If the installation fails or freezes, our guide to diagnosing and fixing a failed installation covers the usual causes. If you are short on disk space, see how to free up storage on Windows 11.
Conclusion
Choose the Microsoft Store when the app is there, and verify the file when it isn't. Treat prompts and SmartScreen warnings as checkpoints rather than obstacles, and never disable protection just to finish an install. If you want ideas on what to install, read our roundup of the best free software for Windows 11, or the complete guide to fixing common software problems. If Windows Security shows a confusing alert after an install, see our article on the Defender "turned off" false alert.
Frequently asked questions
Is the Microsoft Store safer than downloading an EXE?
Microsoft says Store apps are signed by a Microsoft certificate and aren't subject to SmartScreen download warnings, which makes the Store the simplest option. You should still check the publisher name on the listing.
What is the difference between EXE and MSI installers?
An MSI is a Windows Installer package interpreted by msiexec.exe, which supports options for quiet installs, logging and uninstalling. An EXE is a standalone installer that runs its own process.
Is it safe to click "Run anyway"?
Only after you have verified the source and the publisher. Microsoft's guidance is to proceed only after verifying the source and confirming you trust the download.
How can I check that a download wasn't altered?
Run Get-FileHash in PowerShell and compare the result with the hash the developer publishes on its official download page. If they differ, delete the file and download it again.
Do I need to turn off SmartScreen to install a program?
No. Microsoft warns that turning off the block and warn options may leave your device vulnerable. If an installer only runs with protection disabled, look for a different source.
Post a Comment