Windows 11 KB5127648 Update Prevents Some Users From Enabling Smart App Control

Microsoft says some users may be unable to enable Smart App Control after installing the October 2026 Windows 11 security update, KB5127648.

Smart App Control option is grayed out after Windows 11 update

Smart App Control is a Windows 11 security feature that uses Microsoft’s app intelligence service and code integrity capabilities. It works with Microsoft Defender and SmartScreen to block potentially harmful applications and binaries.

According to Microsoft, affected devices running Windows 11 version 24H2 or later will show the Smart App Control option as grayed out. Users cannot turn the feature on from the Windows Security app.

“After you install this update, some devices may be unable to turn on Smart App Control if it is turned off in the Windows Security app. The option to turn on Smart App Control may be grayed out on affected devices,” Microsoft said in its KB5127648 advisory.

“Devices that already have Smart App Control turned on are not affected and will continue to be protected.”

Microsoft shares temporary workaround

Microsoft has not yet released a fix for the problem. However, the company shared a temporary workaround for IT administrators managing affected corporate devices. Administrators can modify the Windows Registry or install Group Policy settings to restore the ability to enable Smart App Control.

How to restore Smart App Control using the Registry

To apply the Registry workaround on an affected Windows 11 device:

1. Open a Command Prompt window by typing cmd in the search box.

2. Select Run as administrator.

3. Run the following commands:

   reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
   
   reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

4. Restart the affected device to apply the changes.

Group Policy workaround

IT administrators can also work around the issue by installing and configuring two Group Policy settings to enable Smart App Control and ensure that logging is enabled for troubleshooting.

The two Group Policy settings are located at:

[Computer Configuration] > [Administrative Templates] > [{Group Policy name}] > [Windows 11 version 24H2, 25H2]

After installing the policies, administrators must configure both settings as required and restart the affected devices to apply the Group Policy changes.

Other Windows update issues addressed by Microsoft

This week, Microsoft also confirmed that recent Windows updates caused Remote Desktop errors for non-admin users when the Administrator Protection security feature was enabled. The company also resolved another known issue that caused Always On VPN connectivity problems after installing the September 2026 security update.

On Tuesday, Microsoft addressed a bug that caused black screens, desktop loading problems, and File Explorer crashes after installing Windows 11 updates released since August.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop dramatically.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report