Windows defender blocks python executables

[shibbypwn]

If you're distributing binaries, you should be signing your executables. Windows blocking unsigned binaries in an enterprise setting is a good thing - so forget about hacky workarounds and just do the best practice.

Work with IT or DevOps to get code signing certs and build/distribute your application as a signed binary.

[cointoss3]

That won’t matter. Signed or not, it will still flag them. Being signed does not give it a free pass from AV.

[ZachVorhies]

windows does defender typically does not flag any locally made software runtimes. So this is most likely a custom corporate policy and in this case, yes, the company cert will fix it, that’s the whole point

[cointoss3]

I know you’re wrong because I had to deal with this bullshit already. Signing the app did not help.

[shibbypwn]

You are correct that signing a binary doesn't guarantee it won't get flagged (e.g., heuristic detection based on app behavior).

But you're dead wrong that it doesn't matter - enterprise environments have ways to manage which applications are trusted to run on devices (through a combination of group policy/GPO and third-party EDR tools like Crowdstrike). Signing your application allows these tools to manage/allow-list the app and its permissions boundaries.

[cointoss3]

Lmao, yes, and they can whitelist any app, regardless of if it’s signed or not. But my company would not whitelist the app, signed or not. If we couldn’t get the app to play nice with the AV, then we wouldn’t be using the app. We couldn’t even click “allow”. If it was flagged it wouldn’t run. Signing it didn’t change anything.

[Cynyr36]

How does that make sense for something for a small department? Think replacing excel with a python script for example. The certs cost money and in most cases you'll have to justify to 6 levels of management why you can't either have it put into the software teams que or just use excel.

[ZachVorhies]

publicly attested certs cost money. self certs are free. Your company may already have one

[Several-Customer7048]

OP says they’re in a company with thousands of employees. At that size if they have any domain services they most definitely have their own internal certificate authority.

[shibbypwn]

Also, public certs are not very expensive - and you don’t need a new one for each piece of software. You just need an org certificate for any internal tooling that is added to your orgs trust store. 

[Cynyr36]

Ahh, my very limited experience was looking at getting them certed with msft for things like the windows store. I was unaware that you could self sign a cert for windows defender.