Windows blocks all GCC-compiled C programs when connected to the internet

Question

Hello Microsoft Community,

I'm facing a strange issue on my personal Acer Aspire 3 laptop running Windows 11.

I use Visual Studio Code with GCC (MSYS2 UCRT64) to compile and run C programs.

The compilation works successfully, and the .exe files are generated. However, when I try to execute them, Windows displays this error:

"An Application Control policy has blocked this file."

Here are the details I've found while troubleshooting:

1. GCC compiles my C programs successfully.

All GCC-generated executable files are affected, not just one file.

When I disconnect from the internet, the executables run successfully.

When I reconnect to the internet, Windows blocks them again.

Event Viewer shows Event ID 3033 with the message: "did not meet the Enterprise signing level requirements."

The CiTool.exe -lp command shows that the VerifiedAndReputableDesktop policy is currently enforced.

Smart App Control is enabled on my system.

This is my personal laptop, not a work or school-managed device.

My questions:

Why are GCC-generated executables blocked only when the internet is connected?

Which Windows security policy is responsible for this behaviour?

How can I fix this issue without compromising Windows security or unnecessarily disabling Smart App Control?

I would really appreciate a safe and permanent solution.

Thank you!

Answer 1

Hi paras jain,

Thanks for including Event 3033 and the policy name. They point clearly to Smart App Control (SAC).

SAC uses a cloud reputation service and allows only apps that are known to be safe or signed by a trusted publisher. Programs you've just compiled yourself are unsigned and new, so they have no reputation yet, and SAC blocks them by design. (Overview: Smart App Control)

At this point, your options are:

1, Turn SAC off on your development PC. Go to Windows Security > App & browser control > Smart App Control settings > Off. SAC can't exclude individual apps, so this is the supported way to run your own builds.

• On recent Windows builds, you can turn SAC back on later without reinstalling Windows.
• FAQ: Smart App Control Frequently Asked Questions

2, Sign the programs you share with others. Use a code-signing certificate from a certificate authority in the Microsoft Trusted Root Program, so the programs run on PCs that have SAC turned on.

3, Ask for per-app exceptions. If you'd like SAC to support exclusions, send feedback through Feedback Hub (Windows + F) > Security and Privacy > Smart App Control.

Hope this clears things up so you can get back to coding without interruptions!