Microsoft: October Windows update may break Smart App Control
Microsoft says Windows 11 update KB5127648 can gray out Smart App Control so it cannot be turned on.
Microsoft warned that after installing the October 2026 KB5127648 security update, some Windows 11 version 24H2 and later devices cannot turn Smart App Control back on if it is already off; the option is grayed out. Devices where the feature is already enabled remain protected. No fix is available yet. Administrators can apply published registry overrides or two KB5074105 Group Policy feature previews and restart.
- KB5127648 can block re-enabling Smart App Control on Windows 11.
- Devices that already have the feature enabled stay protected.
- Workarounds use registry overrides or two Group Policies.
- Microsoft has not yet released a permanent fix.
Full article469 words · extracted from bleepingcomputer.com · click to collapse
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update.
Smart App Control is a Windows 11 security feature that uses Microsoft's app intelligence services and code integrity features and works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries.
According to the company, on affected devices running Windows 11, version 24H2 and later, the Smart App Control option is grayed out and cannot be toggled.
"After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to the KB5127648 advisory.
"Devices where Smart App Control is already turned on are not affected and remain protected."
While a fix isn't available yet, Microsoft shared temporary workarounds to help IT administrators mitigate the issue on enterprise-managed devices by modifying the registry or installing a group policy.
To restore the ability to turn on Smart App Control on affected Windows 11 devices by editing the registry, you have to follow these steps:
-
Open a Command Prompt window by typing cmd in the Search box.
-
Select Run as Administrator.
-
At the command prompt, enter the following commands and then restart the device:
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f
IT admins can also work around the issue by installing and configuring the two Group Policies below to turn on Smart App Control and ensure that logging is enabled for troubleshooting:
- Windows 11, versions 24H2, 25H2, and 26H2 - KB5074105 261015_19222 Feature Preview
- Windows 11, versions 24H2, 25H2, and 26H2 - KB5074105 261015_19221 Feature Preview
The two Group Policies can be found under Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2.
After installing them, admins must set both settings to Enabled and restart the affected device(s) to apply the Group Policy settings.
This week, Microsoft also confirmed that recent Windows updates cause Remote Desktop failures for non-admin users if the "Administrator protection" security feature is enabled, and resolved another known issue that triggered Always On VPN connection problems after installing the September 2026 security updates.
On Tuesday, it also addressed a bug that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.