Potentially Unwanted Apps in 2026: Blocking Explained

Potentially unwanted apps in 2026: the short answer

A potentially unwanted app is software that can slow your PC, show unexpected ads or install other software that is more harmful or annoying.[1] It is not classic malware, which is why security tools label it as potentially unwanted rather than dangerous.

Windows can block these apps through reputation-based protection in Windows Security, and Microsoft Edge can block their downloads.[1][4] One point needs care in 2026. Microsoft's current support page says the blocking is turned off by default for enterprise and consumer customers, so you should check the switch yourself.[1]

Timeline: how Microsoft added PUA blocking

What changed since 2021

In 2021 we reported Microsoft's plan to turn PUA blocking on by default from August. The current Microsoft support page tells a more careful story. It says the feature is off by default for enterprise and consumer customers, and it recommends that you turn on both Block apps and Block downloads.[1] We found no Microsoft page that explains the difference.

The tools also spread out. Microsoft Edge blocks PUA downloads and the URLs linked to them through Microsoft Defender SmartScreen.[4] Companies can switch on PUA protection in Microsoft Defender Antivirus through Intune, Configuration Manager, Group Policy or PowerShell. An audit mode detects such apps without blocking them.[4]

The basic definition did not change. Microsoft still describes PUA as software that slows the machine, shows unexpected ads or installs more harmful software.[1] Its published criteria still sort these apps into categories such as advertising, bundling and cryptomining.[2]

Risks around potentially unwanted apps

This is our analysis of how PUA reaches people in 2026, based on the categories Microsoft uses.[2]

• Bundled installers. Free tools from download portals add extra offers that are pre-ticked during setup.
• Fake update and push notification sites. Unknown pages, often on cheap domains, ask you to allow notifications and then push ads or fake virus alerts.
• PUA APKs on Android. Apps from outside official stores can show aggressive ads or track you, and a changed APK can hide real malware.
• Fake cleaners and optimizers. Programs that report hundreds of problems and ask you to pay to fix them.
• Browser modifications. A new search engine, home page or extension that you did not choose and that comes back after you remove it.

How to block and remove potentially unwanted apps

1. Check the setting. Open Windows Security, then App and browser control, then Reputation-based protection settings. Microsoft says the blocking is off by default, so do not assume it is on.[1]

2. Block apps and downloads. Turn on both options. Block apps finds PUA you already have, and Block downloads checks files as they arrive in Edge.[1]

3. Turn on Edge blocking. In Edge settings, open Privacy, search, and services and turn on Block potentially unwanted apps.[4][5]

4. Act on alerts. When Windows flags an app, open Virus and threat protection, choose an action and select Start actions. Until then the app is only blocked, not removed.[1]

5. Clean the browser. Remove extensions you do not recognise and reset the search engine and home page. Our virus and malware removal guides cover common adware by name.

6. Install with care. Pick custom or advanced setup, read each screen and untick extra offers. Avoid download portals that wrap installers in their own setup files.

What is still unknown

• Why Microsoft's current support page says PUA blocking is off by default after the 2021 plan to enable it. We found no explanation.
• How many Windows PCs run with the feature on. Microsoft does not publish a figure that we could find.
• Whether Microsoft will extend download blocking beyond Edge. Its page says Block downloads works only with Edge.[1]

Our original 2021 report

The text below is our report as first published in 2021. We keep it unchanged for the record; the sections above bring it up to date.

Microsoft has announced that the PUP (potentially unwanted program) blocking feature they released last year will now be enabled by default starting in August. Every device with the 2020 update installed will automatically block unwanted programs without the user having to do anything. Previously this setting had to be manually enabled. This will make it easier for users to keep their systems performing at their best. But if needed, you will still be able to turn it off or back on manually in your settings.

Automatic PUP blocking will be achieved with the help of Microsoft Defender[1], which is a Windows Security program. It provides virus protection along with other advanced security features. It is not required to download this program as it is part of the Windows security suite. Potentially unwanted app blocking was first introduced in the Windows 10 May 2020 update, but it was turned off by default for consumers.

Microsoft provides this protection from potential threats by identifying and analyzing software and online content. When people download, install, and run software, they check the reputation of downloaded programs and ensure consumers are protected against known threats. Windows also has a function that warns about software that is unknown to them.

Users who would like to turn off the feature will be able to do so by heading to the "Windows Security" setting, selecting the "App & browser control" option, clicking the "Reputation-based protection settings". Users are also now able to choose if they want to keep blocking downloads or apps, or both.

Potentially unwanted applications pose a high risk to user privacy

PUA isn't malware, but it is the software you often do not need and probably do not want. Potentially unwanted applications are normally created by reputable sources who walk a thin line between what is considered "legitimate" software and carry out unwanted behavior on users' devices. These programs usually do not fully disclose their purpose or functions. In some cases, the user might find the application useful enough to keep it on their system and continue to endure its effects. That is why they are defined as potentially unwanted.

Blocking these PUPs by default can be very useful for people who want to keep their devices protected from these unwanted third-party programs. These applications can critically threaten user's security or privacy, and this is probably the reason why Microsoft is changing its protection settings and making it enabled by default on Windows 10.

A PUP will sometimes function as a form of adware. These apps might cause your device to slow down, clogging up your system with advertising materials and change browser or system settings. Antivirus companies say potentially unwanted programs track the user's internet usage to sell information to advertisers, inject their own advertising into web pages that a user then sees.

Another reason why these programs aren't considered desired is because of software bundling. These types of applications install other applications that users may not want. The primary application that installed the additional applications often tricks users in the installation process, which allows the installation of the bundled software.

How Microsoft classifies software as a PUA

Microsoft Defender helps deliver more productive and performant Windows experiences for its users by having specific potentially unwanted application categories. These are advertising, torrent, cryptomining, bundling, marketing, evasion, and poor industry reputation software[2].

Advertising software includes software that inserts advertisements to web pages, displays advertisements, or prompts users to complete surveys for other products or services. These ads can be malicious and link users to shady websites.

Torrent software is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies. Using these types of programs puts people at risk of downloading dangerous or infected torrents from unknown sources.

Cryptomining software uses your device resources to mine cryptocurrencies. Also known as cryptojacking, these possibly malicious cryptomining programs let cybercriminals hack into computers, laptops, and mobile devices to install software. It uses the victim's computer's power to mine for cryptocurrencies or even steal cryptocurrency from wallets.

Bundleware is a term used to describe software that offers to install other software which is not developed by the same entity or not required for the software to run. These unnecessary programs usually come with free version programs from third-party vendors. Users should be careful not to skip through the installation process if they want to get any apps from non-official sites.

Marketing software keeps track and transmits the activities of users to applications or services other than itself for marketing research. It is important to check the privacy policies of programs you download as they can overstep the boundaries of user privacy.

Evasion software actively tries to evade detection by security products, like antiviruses by detecting user behavior such as moving the mouse, by taking action at certain times, and laying still on others. It can also change its code and use encryption or use a technique called code compression[3]

Poor industry reputation software is detected with security products. This is achieved on Microsoft and other organizations constantly exchanging knowledge about analyzed files to provide users with the best possible protection.

Related guides on 2-Spyware

• Virus and malware removal guides
• Check whether your email appeared in a leak
• Recent data breaches
• How to report phishing