This guide is for small business owners, office IT staff and home users running Windows 11 who want an extra layer of protection against malicious downloads. Smart App Control is a free Windows 11 feature that can stop many harmful programs before they run. An October 2026 update stopped some people from switching it back on, and Microsoft has now fixed that. Below, you will learn what the feature does, how to turn it on, and how to get past the bug.

Key takeaways

• Smart App Control checks apps against Microsoft’s cloud intelligence and blocks untrusted or potentially harmful ones.
• Since the April 2026 security update for Windows 11 version 25H2, you can turn it on without reinstalling Windows.
• The October 2026 update KB5127648 greyed out the setting on some PCs where it had been turned off.
• Updates released on or after 28 October 2026 fix the problem, so update first, then switch it on.

What Smart App Control does

Smart App Control uses Windows code integrity features and Microsoft’s app intelligence service to decide whether an app is safe to run. It works alongside Microsoft Defender and SmartScreen. Where Defender mainly looks for known malware, Smart App Control blocks apps that are unknown, untrusted or unsigned, which helps against new malware that antivirus tools have not seen yet.

The three settings

• On: actively blocks untrusted or malicious apps.
• Evaluation: new or freshly installed PCs may start here. Windows watches how you use your apps to decide whether the feature can run without getting in your way.
• Off: no Smart App Control protection.

Who can use it

Smart App Control has been part of Windows 11 since version 22H2. It is not available on Windows 10. Until 2026 it could only be turned on after a clean installation, but that changed with the April 2026 security update for version 25H2.

Before you start

1. Check your Windows version. Open Settings, go to System, then About, and look under Windows specifications for the version (for example 24H2, 25H2 or 26H2).
2. Install the latest updates. Open Settings, select Windows Update, then click Check for updates. Install everything offered and restart.
3. List your business apps. Smart App Control can block older or less common programs, such as some accounting tools or printer utilities, and it has no per-app unblock option. Know which apps you rely on so you can test them.

How to turn on Smart App Control: step by step

1. Click Start, type Windows Security and open the app.
2. Select App & browser control in the left menu.
3. Under Smart App Control, click Smart App Control settings.
4. Choose On. If you prefer a gentler start on a new PC, leave it in Evaluation and let Windows decide.
5. Confirm any User Account Control prompt, then restart the PC if asked.
6. Open your everyday apps to check they still work.

Fixing the greyed-out setting after KB5127648

What went wrong

KB5127648, the October 2026 security update released on 13 October for Windows 11 versions 24H2, 25H2 and 26H2, caused a known issue. On some PCs where Smart App Control had been turned off, the option became greyed out and could not be switched back on. Microsoft said PCs that already had it turned on were not affected and stayed protected.

The fix

Microsoft says Windows updates released on 28 October 2026 and later include the fix, starting with the optional preview update KB5127936. You can either install that preview update now, or wait for the next regular monthly cumulative update, which will also include it.

1. Open Settings and select Windows Update.
2. Click Check for updates. If KB5127936 or a newer update is listed as optional, download and install it.
3. Restart the PC, then follow the step-by-step instructions above.

Workaround for IT administrators

Microsoft also published a temporary workaround in the KB5127648 release notes under known issues. It adds two values (2883193997 and 2850574478, each set to 1) under the FeatureManagement Overrides policy key in the registry, followed by a restart. Managed environments can use a Group Policy method with the KB5074105 Feature Preview package instead. Back up the registry first, and follow Microsoft’s official release notes exactly rather than copying commands from unofficial sites.

Troubleshooting

• A trusted app is blocked: there is no per-app exception. Contact the software vendor about a signed version, or turn the feature off on that PC and rely on Defender and careful downloading.
• The option is still greyed out: confirm the October 28 or later update installed under Update history, then restart. Also check whether your organisation manages the PC with policies that control the setting.
• You are on Windows 10: Smart App Control is not available. Plan an upgrade to a supported Windows 11 PC.

Checklist

• Windows 11 updated with the latest cumulative or preview update.
• Smart App Control set to On or Evaluation in Windows Security.
• Business-critical apps tested after switching it on.
• Microsoft Defender and SmartScreen also left on.
• Staff reminded to download software only from official sources.

Next steps

Pick one PC this week, update it and switch on Smart App Control. If your key apps still run, roll it out to the rest of your office computers. It costs nothing and adds a strong barrier against the fake installers and cracked software that often carry malware.

Sources

• BleepingComputer: Microsoft fixes Smart App Control broken by October Windows update
• PCWorld: Windows 11’s October update blocks Smart App Control. Here’s the fix
• Pureinfotech: How to enable Smart App Control on Windows 11

Featured image: Photo: “computer laptop keyboard HP Pavilion Entertainment PC” by GoodNCrazy, CC BY 2.0, via Openverse — source

Read and share the original on Mosravo Endless Solutions Publications