Do I Have to Disable Smart App Control in Windows 11?

If Smart App Control just blocked an install and you're wondering whether you have to disable Smart App Control to get past it, the short answer is: probably not. Windows 11's built-in trust engine blocks a specific file for a specific reason, and in most cases you can find that reason and work around it without switching off protection for the whole system. What's actually changed is what happens if you do end up disabling it: a recent Windows update finally lets you turn Smart App Control back on without wiping the machine, which used to be the real reason people avoided touching the toggle at all (EndpointWeekly; text/plain).

Smart App Control (SAC) arrived with Windows 11 version 22H2. Microsoft's own summary of what it does is blunt: malware, potentially unwanted apps, and unknown or unsigned code get blocked by default (EndpointWeekly). That's a wider net than SmartScreen, which mainly checks the reputation of an entry-point program, usually an .exe arriving from the internet. SAC evaluates trust across DLLs, scripts, and installers that Windows loads, not just the file someone double-clicks (text/plain; Microsoft Learn). There's still no way to whitelist one trusted app and move past the warning: Microsoft's documentation confirms there's currently no bypass for individual apps (EndpointWeekly; XDA Developers).

Answering "should I turn off Smart App Control" comes down to three checks: whether SAC is actually enabled on the device, whether it's really the thing blocking the app, and whether the file is trustworthy enough that disabling protection is worth it. Here's how to work through each one.

Smart App Control turned itself off: what that means

Before touching any toggle, check whether SAC is even running. Microsoft's documentation lists several reasons it ends up off without anyone deliberately switching it, and none of them point to a bug.

SAC starts in Evaluation mode, a self-testing period where Windows watches which apps get installed and used to decide whether its protections fit how the device is actually used (EndpointWeekly; text/plain). If that evaluation decides the device is a poor match, often because it regularly runs unsigned or niche code, Windows switches SAC off on its own to cut down on interruptions (text/plain).

Microsoft lists a few additional documented reasons SAC ends up off: developer mode is configured, the device is running Windows in S mode, or optional diagnostic data has been turned off in Windows settings, since evaluation mode depends on that data (EndpointWeekly).

On an enterprise-managed device, that evaluation moves fast. Microsoft's documentation states SAC switches off within 48 hours unless the user turns it on first, so anyone who wants SAC to stay active on a managed machine needs to opt in before that window closes (EndpointWeekly). What that means for admins and developers gets its own section below.

Do I have to disable Smart App Control?

Signature checks are where SAC causes the most confusion. It verifies every piece of loaded code, DLLs, scripts, and installers, not only the file someone downloads, so a bundled component can trigger a block even when the main app looks fine (text/plain; Microsoft Learn).

A signature alone doesn't guarantee SAC lets an app through, either. One Microsoft Answers user reported SAC blocking installation and updates of an app that carried a proper digital signature, confirmed directly with the developer (Microsoft Answers). Part of the explanation is likely technical: SAC's signature check currently supports RSA-based certificates but not ECC-signed ones, so a legitimately signed app can still get flagged if its certificate uses the wrong algorithm (Microsoft Learn). If the publisher hasn't shipped an RSA-signed build, that mismatch alone can keep an otherwise legitimate app blocked.

SAC also keeps a fixed list of file types it blocks whenever a file's Mark of the Web shows it came from the internet, covering formats like .exe, .dll, .ps1, and MSI-adjacent installers, among others. That list is built into the feature and isn't user-extensible, so it ignores any custom exceptions set through the registry (text/plain).

There's still no allow-list, no "allow once," and no per-app exception path for end users. If SAC misidentifies software that's actually trustworthy, the only lever available to someone without administrative access is the global toggle (XDA Developers). Administrators have more options, covered further down. For everyone else, that combination, broad blocking by design with no fine-grained override, is why disabling SAC should answer a verified, repeated block on software already trusted, not a single warning dialog.

How to check what Smart App Control is blocking before you disable it

1. Check whether SAC is on, off, or in evaluation mode. Open Windows Security, go to App & browser control, and select Smart App Control to see its current state (text/plain). Windows 11 Smart App Control evaluation mode shows up here as "Evaluation," separate from On or Off. Advanced users can also check the registry under VerifiedAndReputablePolicyState in HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy, where 0 is off, 1 is enforcement, and 2 is evaluation, though changes made there don't apply until CiTool.exe -r runs (EndpointWeekly). Stick to the Windows Security app unless troubleshooting specifically requires the registry.

2. Review Code Integrity logs before disabling anything. Open Event Viewer to Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational. Event ID 3076 shows what evaluation mode would have blocked had it been enforced; event ID 3077 shows what enforcement mode actually blocked (EndpointWeekly; XDA Developers). When the event includes a file path, it tells you whether the block hit the main application or some bundled component nobody knew was there. If you can't find a matching event, SAC is less likely to be the cause, so check the installer, Defender, or the app's own error message before disabling protection.

3. Confirm the file's origin and signature before deciding anything. If the flagged file carries the Mark of the Web, meaning Windows recognizes it as an internet download, and it's been independently verified as legitimate, removing that mark may change how Windows evaluates it, but this is not a supported SAC bypass (text/plain).

4. Only disable SAC if the block persists on software already confirmed as legitimate. Go back to Windows Security > App & browser control > Smart App Control and turn the setting off. With no per-app override available, if a signed, trusted app keeps getting blocked and no RSA-signed build exists to fix it, disabling the feature is the only path left (XDA Developers).

One side effect is worth expecting rather than troubleshooting: whenever SAC is active, Microsoft Defender Antivirus shifts into passive or hybrid mode if a third-party antivirus is also installed. Microsoft documents this as expected behavior, not a misconfiguration (EndpointWeekly; text/plain).

Can you turn Smart App Control back on after disabling it?

For most of Smart App Control's existence, switching it off or on outside Evaluation mode was a one-way operation. Microsoft's documentation said the feature could only be enabled on a clean install, and even a full reset counted as one (EndpointWeekly; XDA Developers).

That restriction is gone on current builds. Windows 11 version 25H2 with Windows Security app version 1000.29554 or later lets SAC be re-enabled without reinstalling Windows (text/plain). Microsoft addressed the underlying issue starting with Windows Insider Preview Build 26220.7070 in December 2025, and XDA Developers reports the fix now working across both the 24H2 and 25H2 branches (XDA Developers).

XDA Developers also reports that Microsoft describes the update as incomplete: diagnosing something like a failed installation still means manually searching Code Integrity log entries to find the specific blocked file (XDA Developers).

Don't assume the reversible toggle applies automatically. It depends on running Windows 11 version 25H2 with a current Windows Security app build, so confirm both before relying on it. Anyone still on an older build should treat the original one-way rule as their reality: a "temporary" disable could still turn out to be permanent.

Smart App Control on a managed device

Smart App Control is built entirely on App Control for Business and shares its Intelligent Security Graph reputation engine and Code Integrity logging (EndpointWeekly). That shared foundation explains a lot of what looks confusing on a work laptop.

On a managed device, the 48-hour evaluation window described earlier means SAC often turns itself off before anyone notices it was ever on. None of this runs through Group Policy, Intune, or a CSP setting: Microsoft documents no policy that turns SAC on, and the only administrative lever that exists turns it off, so IT can't remotely flip SAC back on across a fleet of machines (EndpointWeekly).

Organizations that want SAC-style protection with an actual management surface can deploy App Control for Business policies through the Device Guard Group Policy node instead. Those policies support an audit mode that logs would-be blocks under event ID 3076 before anything is enforced, the dry run SAC's consumer-facing evaluation mode doesn't give administrators (EndpointWeekly).

Anyone on a managed or developer machine asking about disabling Smart App Control in Windows 11 is often asking the wrong question, since Windows has usually already made that call automatically. The more useful move is asking IT about App Control for Business policies rather than trying to force SAC back on.

Start with Windows Security, not the toggle. Check whether SAC is on, off, or in evaluation mode, then look at the CodeIntegrity operational log for events 3076 or 3077 tied to the app causing trouble. If nothing turns up there, the block probably isn't SAC's doing, and it's worth checking the installer or the app's own error message instead. If it is blocking software that's already been verified as trustworthy, and no RSA-signed build is available to fix it, disable SAC through Windows Security, then turn it back on once that specific issue is resolved rather than leaving broad protection off indefinitely. On a managed or developer machine, skip the fight with Windows' own evaluation logic and ask IT about App Control for Business instead.