Skip to main content

Desktop installer signing and SmartScreen

The Siter desktop installer (Siter-win-Setup.exe) and the executables it installs are code-signed with a publicly trusted certificate issued to The Schreifer Group, LLC through Microsoft's Azure Artifact Signing service. This page explains what that means for users, how to verify a download, and what an IT department can do to deploy Siter without SmartScreen prompts in a managed environment.

What users see​

Windows shows the publisher name wherever it reports on the file: the SmartScreen dialog, the User Account Control prompt, and the Digital Signatures tab in the file's properties. An unsigned or tampered installer shows "Unknown Publisher" instead — treat that as a reason to stop and contact the Siter team.

Signing does not by itself remove the blue Windows protected your PC screen. Microsoft Defender SmartScreen shows that screen for any download that has not yet built enough reputation, and reputation accrues through download volume over time. When it appears, click More info and confirm the line reads Publisher: The Schreifer Group, LLC before clicking Run anyway.

Browsers apply their own checks at download time. Microsoft Edge uses SmartScreen; Google Chrome and Firefox use Google Safe Browsing, which may report that the file "isn't commonly downloaded" for a new release. These prompts also fade with download volume.

How to verify the installer​

Verify the signature before deploying the installer or adding it to an allow list.

  1. Open PowerShell in the folder containing the downloaded file.

  2. Run:

    Get-AuthenticodeSignature .\Siter-win-Setup.exe | Format-List Status, SignerCertificate, TimeStamperCertificate

  3. Confirm the output shows Status : Valid and a signer subject of CN=The Schreifer Group, LLC, O=The Schreifer Group, LLC, L=Washington, S=District of Columbia, C=US.

If you prefer the Windows SDK tooling, signtool verify /pa /v .\Siter-win-Setup.exe reports the same chain. The Digital Signatures tab in the file's Properties dialog shows it without any tooling.

If your organization records file hashes, Get-FileHash .\Siter-win-Setup.exe produces the SHA-256, and the Siter team can confirm the value for any release on request.

Signing identity reference​

Use these values when writing allow-list rules. They come from the certificate chain embedded in every signed Siter release.

AttributeValue
SubjectCN=The Schreifer Group, LLC, O=The Schreifer Group, LLC, L=Washington, S=District of Columbia, C=US
Issuing CACN=Microsoft ID Verified CS EOC CA 03, O=Microsoft Corporation, C=US
Intermediate CACN=Microsoft ID Verified Code Signing PCA 2021, O=Microsoft Corporation, C=US
Root CACN=Microsoft Identity Verification Root Certificate Authority 2020, O=Microsoft Corporation, C=US
Durable identity EKU1.3.6.1.4.1.311.97.956579665.126334261.828326623.830726269
Artifact Signing Public Trust EKU1.3.6.1.4.1.311.97.1.0
Timestamp authorityMicrosoft Public RSA Time Stamping Authority (http://timestamp.acs.microsoft.com)
Certificate lifetime72 hours, renewed daily by the service
Install location%LOCALAPPDATA%\Siter\ (per-user install; no administrator rights required)
warning

Do not pin rules to the certificate thumbprint, serial number, or public key. Artifact Signing issues a fresh certificate every day, so any rule tied to one certificate stops matching within 72 hours. Pin to the publisher subject or, in App Control for Business, to the durable identity EKU — both stay constant across renewals.

Signatures remain valid after the signing certificate expires because each one carries an RFC 3161 timestamp countersignature. A release signed today still verifies as Valid years from now.

Options for managed environments​

SmartScreen only evaluates files that carry the "Mark of the Web" applied to internet downloads. Any of the following approaches avoids the prompt for your users. They are not mutually exclusive.

Deploy with your management tooling​

Installs pushed by Microsoft Intune, Configuration Manager, or Group Policy software installation do not carry the Mark of the Web, so SmartScreen does not evaluate them. Siter installs per-user into %LOCALAPPDATA%\Siter\, so configure the deployment to run in the user context rather than as SYSTEM. For a silent install, run:

Siter-win-Setup.exe --silent

Republish the installer on an internal location​

Files opened from a location in the Local intranet or Trusted sites zone do not receive the Mark of the Web. Download the installer once, verify it as described above, and host it on an internal file share or intranet site for your users.

Allow-list the publisher​

If your organization runs an application allow-list, add a rule for the Siter publisher. This is required, not optional, where AppLocker or App Control for Business is enforced: the default rules only permit executables under Program Files and Windows, and Siter runs from the user's profile.

AppLocker

  1. Open the Group Policy editor and navigate to Computer Configuration › Windows Settings › Security Settings › Application Control Policies › AppLocker › Executable Rules.
  2. Right-click and select Create New Rule.
  3. Select Allow, then Publisher as the condition type.
  4. Browse to the verified Siter-win-Setup.exe as the reference file.
  5. Move the slider to the Publisher level so the rule reads O=THE SCHREIFER GROUP, LLC, L=WASHINGTON, S=DISTRICT OF COLUMBIA, C=US and applies to any product, file, and version from that publisher.
  6. Deploy the rule in Audit only mode first and review the AppLocker event log before switching to Enforce rules.

App Control for Business (WDAC)

Use the App Control Policy Wizard to create a signer rule from the verified installer. Set the rule to trust the issuing CA and add an EKU condition with the durable identity value 1.3.6.1.4.1.311.97.956579665.126334261.828326623.830726269. This scopes the rule to Siter's validated identity without depending on any individual certificate.

note

Every executable and DLL shipped in the installer — including bundled components such as PostgreSQL — is signed with the same Schreifer Group identity during packaging, so a single publisher rule covers Siter and its dependencies. Run new rules in audit mode against a real install before enforcing.

About Microsoft's file submission portal​

Microsoft's Security Intelligence portal lets enterprise administrators submit files for review, but it accepts files up to 50 MB. The Siter installer is roughly 400 MB, so it cannot be submitted that way. Use one of the options above instead.

Troubleshooting​

"Windows protected your PC" appears when running the installer​

Cause: SmartScreen has not yet accumulated reputation for this release. Every new Siter version is a new file, so a recently published release can prompt even though the previous one did not.

Solution: Click More info, confirm Publisher: The Schreifer Group, LLC, and click Run anyway. For a fleet, use one of the managed environment options so users never see the prompt.

The "Run anyway" button is missing​

Cause: Group Policy has set SmartScreen to Warn and prevent bypass, which removes the option for standard users.

Solution: An administrator must deploy Siter through management tooling, an internal location, or an allow-list rule as described above. The prompt cannot be dismissed by the user under this policy.

Get-AuthenticodeSignature reports UnknownError or "A certificate chain could not be built"​

Cause: The machine does not trust the Microsoft Identity Verification Root Certificate Authority 2020. Windows distributes this root through the automatic certificate trust list update (added in July 2021). Machines that are air-gapped or blocked from Windows Update may not have it.

Solution: Apply the current certificate trust list update through your offline servicing process, or import the root certificate into the Trusted Root Certification Authorities store on affected machines. Both the root and the intermediate certificates are published in the Microsoft PKI repository.

Siter installs but will not start under AppLocker​

Cause: The default AppLocker executable rules do not allow programs under %LOCALAPPDATA%, where Siter installs.

Solution: Add a publisher rule for The Schreifer Group, LLC as described in Allow-list the publisher, then confirm in the AppLocker event log that nothing else is being blocked.

Edge or Chrome says the file "isn't commonly downloaded"​

Cause: The browser's download reputation service has not yet seen enough downloads of this release.

Solution: Choose Keep (Edge) or Keep anyway (Chrome), then verify the signature before running the installer. Republishing the installer internally avoids the prompt for your users.