Microsoft warns October Windows update may block Smart App Control

No fix yet, but registry and group policy workarounds offered for IT administrators

By LineZotpaper

Published16 October 2026

Read Time2 min

Microsoft has warned that this month's Windows 11 security update, KB5127648, may prevent some users from turning on Smart App Control, a built-in security feature that blocks potentially harmful applications. On affected devices, the option to enable the feature is grayed out, and no permanent fix is available yet.

Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update.

Smart App Control uses Microsoft's app intelligence services and code integrity features, and works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries.

On affected devices running Windows 11 version 24H2 and later, the Smart App Control option is grayed out and cannot be toggled if it has been turned off.

"After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to the KB5127648 advisory.

"Devices where Smart App Control is already turned on are not affected and remain protected."

While a fix is not yet available, Microsoft has shared temporary workarounds for IT administrators on enterprise-managed devices. The company recommends either adding two registry entries, with specific commands provided in the advisory, or installing and configuring two group policies to turn on Smart App Control and enable logging for troubleshooting. Both group policy settings must be set to Enabled and affected devices restarted.

The company also confirmed this week that recent Windows updates may trigger Remote Desktop failures for non-admin users when the "Administrator protection" security feature is enabled, and said it had resolved another known issue involving VPN connections.

Analysis

Why This Matters

Users who had Smart App Control switched off cannot re-enable it after the update, leaving affected devices without an extra layer of protection.
IT administrators managing fleets of Windows 11 machines must apply registry or group policy workarounds while waiting for an official fix.
The issue adds to a growing list of known problems in recent Windows updates, including Remote Desktop failures.

Background

Smart App Control is a Windows 11 security feature designed to block untrusted or potentially harmful applications. It relies on Microsoft's app intelligence services and code integrity checks, complementing Defender and SmartScreen. Microsoft releases cumulative security updates monthly, and occasionally documents known issues in the advisory for each update while developing permanent fixes.

Key Perspectives

Microsoft: Acknowledges the problem and stresses that devices with Smart App Control already enabled remain protected. For affected machines, it points administrators to registry edits and group policy configurations as interim measures. IT administrators: Face the immediate task of deciding whether to apply the workarounds across managed devices or wait for a permanent fix, weighing configuration effort against leaving machines with reduced protection. Critics and affected users: Those who had turned Smart App Control off, such as for testing or software compatibility, may find themselves unable to restore the protection until Microsoft ships a resolution.

What to Watch

Updates to the KB5127648 advisory that announce a permanent fix or replacement workaround.
The next round of Windows preview updates, which often carry fixes for known issues.
Any expansion of the list of affected configurations beyond Windows 11 24H2 and later.

Sources

Microsoft: October Windows update may break Smart App Control — BleepingComputer