Microsoft has resolved a known issue that prevented some users from activating the Smart App Control security feature after installing the October 2026 KB5127648 Windows 11 security update.
Smart App Control uses Microsoft's code integrity features and app intelligence services, and it works alongside SmartScreen and Microsoft Defender to block potentially harmful apps or binaries.
As the company explained when it acknowledged the issue last month, the Smart App Control option is grayed out and cannot be toggled on affected devices running Windows 11 24H2 and later.
"After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in the KB5127648 advisory. "Devices where Smart App Control is already turned on are not affected and remain protected."
On Wednesday, the company confirmed that the issue has been fixed for users who installed this month's KB5127936 preview update.
"This issue was resolved by Windows updates released October 28, 2026 [..] and later. We recommend you install the latest security update for your device as it contains important improvements and issue resolutions, including this one," it noted in a service alert sent to IT administrators.
Workaround available
Microsoft also shared a temporary fix for admins who don't want to deploy the preview update on enterprise-managed devices and want to wait for next month's Patch Tuesday cumulative updates.
This requires them to edit the registry on affected Windows 11 devices to restore the ability to turn on Smart App Control by going through the following steps:
-
Open a Command Prompt window by typing cmd in the Search box.
-
Select Run as Administrator.
-
At the command prompt, enter the following commands and then restart the device:
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f
They can also work around the issue by installing the Group Policies below, which turn on Smart App Control and enable logging for troubleshooting:
- Windows 11, versions 24H2, 25H2, and 26H2 - KB5074105 261015_19222 Feature Preview
- Windows 11, versions 24H2, 25H2, and 26H2 - KB5074105 261015_19221 Feature Preview
The Group Policy settings are under Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2, and must be set to Enabled after installation. Admins must also restart affected devices to apply the Group Policy settings.
Last month's KB5127936 preview update also resolves Remote Desktop failures caused by recent Windows updates when the "Administrator protection" security feature is enabled and finally fixes Always On VPN issues triggered by the September 2026 cumulative updates.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.