Microsoft Update Blocks Windows 11 Smart App Control Re-Enablement

Microsoft's October 2026 security update for Windows 11, KB5127648, may prevent users from turning Smart App Control back on if they had previously disabled it, with the option appearing grayed out in the Windows Security app[1][2][3][4][5][6][7]. This issue affects users and administrators who rely on Smart App Control to block untrusted or malicious applications, forcing them to use temporary workarounds until a permanent fix is released[1][2][5][6].

What the records show

The KB5127648 update, issued on October 13, 2026, is the monthly cumulative security update for Windows 11 versions 24H2, 25H2, and 26H2[1][2][4][5]. Microsoft's advisory states that after installing this update, "some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off"[3][6]. On affected devices, the switch to enable Smart App Control is grayed out and cannot be activated[1][2][3][4][5][6][7]. Smart App Control functions with AI and cloud intelligence to block untrusted or potentially harmful software[1][5][6]. Systems with Smart App Control already active before the KB5127648 update are not affected and remain protected[1][2][3][4][5][6][7]. The problem specifically impacts users who had disabled the feature, for example, to run an unsigned program, and now want to re-enable it[2].

Timeline

Microsoft released the Windows 11 security update KB5127648 on October 13, 2026[1][2][4][5]. The company acknowledged the problem in its support documentation and has since offered immediate workarounds[2][3][6][7].

What changed and for whom

Users and administrators who previously turned off Smart App Control cannot re-enable it through the Windows Security app after installing the October 2026 update[2][4][5]. Microsoft had recently made it possible to reactivate the feature within the Windows Security app without a full operating system reinstall, a previous requirement[2]. This update removes that flexibility for some users[2]. Microsoft has provided temporary solutions[2][3][4][5]. Individual users can modify the registry by running specific commands in an administrator Command Prompt and then restarting their device[3][5][6][7]. For IT administrators, Microsoft has published two Group Policy templates[2][3][5][6][7]. Both policies must be installed and enabled: one to restore Smart App Control functionality and another for diagnostic logging[2][3][4][5].

What Microsoft has said publicly

Microsoft's advisory states that "some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off," noting the grayed-out control[2][3][6]. Microsoft confirmed it is working on a fix for a future Windows update[3][5][7]. The company's support pages detail the registry and Group Policy workarounds[3][4][5][7].

What we could not confirm

Microsoft has not disclosed the number of affected devices or the specific cause of the issue[4]. The company has also not provided a date for the permanent fix[4].