Philterd Developers

New: Philter One, a redaction box for your office, is coming soon. Learn more →

Contact Us

Tell us about your stack and the privacy problems you're trying to solve. We typically respond within one business day.

Prefer email? support@philterd.ai

Please do not enter PII or PHI in this form. If you need to share an example, use a sanitized one.

Knowledge base Troubleshooting

Philter Desktop Blocked by Smart App Control or App Control for Business

Fix "An application control policy has blocked this file" when starting Philter Desktop. Update to 1.3.1, which signs every file Smart App Control checks.

For Philter Desktop

Applies to Philter Desktop 1.3.0 and earlier. Fixed in Philter Desktop 1.3.1.

On some Windows PCs, Philter Desktop 1.3.0 and earlier fails to start with this error:

An application control policy has blocked this file.

It happens on PCs that run Smart App Control, which is built into Windows 11, or App Control for Business (formerly Windows Defender Application Control, or WDAC), which IT departments use on managed PCs. The fix is to install Philter Desktop 1.3.1 or later.

Why it happens

Both features check every program file Windows loads, not just the program you double-click. A Windows application is one .exe plus a folder of .dll libraries, and each of those is checked on its own as it loads.

Up to version 1.3.0, the Philter Desktop installer and the main PhilterDesktop.exe were digitally signed, but some of the libraries that ship with it were not, including the redaction engine itself. A signed program is not enough when one of its libraries is unsigned, so Windows blocked the library and Philter Desktop could not start.

From version 1.3.1, every library in the installer is signed by Philterd LLC. The build now checks that nothing unsigned is left before it packages the installer, so this should not come back in a later version.

Update to 1.3.1

  1. Download the current installer from the download page.
  2. Run it. It upgrades the existing installation in place, and your policies and settings are kept.
  3. Start Philter Desktop.

To see which version you have, open the About dialog in Philter Desktop. If the app will not start, look at the version shown for Philter Desktop under Settings > Apps > Installed apps.

Do not turn off Smart App Control to get an older version running. Updating fixes the cause, and turning it off lowers the protection on the whole PC for the sake of one app.

If your organization uses App Control for Business

Smart App Control has no allow list. It decides from the signature and from Microsoft’s reputation data, so on a personal PC updating is the whole fix.

App Control for Business is configured by your IT department, and a strict policy may still block a signed app it has never seen. If 1.3.1 is blocked on a managed PC, send this to whoever manages the policy:

  • Every .exe and .dll that Philter Desktop installs is Authenticode-signed. The signer is Philterd LLC, through Microsoft’s Trusted Signing service.
  • A publisher (signer) rule for Philterd LLC covers the app and its future updates. A file hash rule would also work, but it breaks on every update.
  • Libraries from Microsoft, such as the .NET runtime files, keep their Microsoft signatures.

Check the signatures (optional)

This section is for information only. To confirm that nothing in the installation is unsigned, run this in PowerShell:

Get-ChildItem "C:\Program Files\Philter Desktop" -Recurse -Include *.dll, *.exe |
    Get-AuthenticodeSignature |
    Where-Object Status -ne 'Valid'

On 1.3.1 and later the command prints nothing. On 1.3.0 and earlier it lists the unsigned libraries with a status of NotSigned. If you installed Philter Desktop for your user account only, change the path to match.

If Philter Desktop 1.3.1 is still blocked, open an issue on GitHub with the exact error and the output of the command above.

Related reading