Do I Have to Disable Smart App Control in Windows 11?

If Smart App Control just blocked an install and you're wondering whether you have to disable it to get past the warning, the short answer is: probably not.

Windows 11's built-in trust system can block a specific app or one of the files it loads because Microsoft does not recognize it as safe or because its code signature does not meet Smart App Control's requirements. In many cases, the better first step is figuring out what was blocked rather than turning off protection for the entire PC.

One important restriction has changed. For most of Smart App Control's life, turning it off meant you needed to reset or reinstall Windows to turn it back on. Microsoft's current Smart App Control FAQ says recent Windows updates now let supported PCs re-enable it through Windows Security without a clean installation.

Smart App Control, or SAC, arrived with Windows 11 version 22H2. It uses Microsoft's cloud-based app intelligence and Windows code integrity checks to block malware, potentially unwanted apps, and unknown unsigned code.

Unlike Microsoft Defender SmartScreen, which focuses heavily on websites, downloads and file reputation, SAC operates at the Windows process level. That means an executable may appear legitimate while a DLL, script, installer component or other file it loads triggers the block.

There is still no per-app allow list or "allow once" button. If SAC itself is blocking software you have verified as legitimate and the developer cannot provide a compatible build, turning SAC off may ultimately be necessary.

Smart App Control turned itself off: what that means

Before changing anything, check whether SAC is actually active.

Open Windows Security > App & browser control > Smart App Control settings. Depending on the device, the status may show On, Evaluation or Off.

Evaluation mode is a testing period. Windows watches how the PC is used to determine whether Smart App Control is likely to protect the device without interfering too often.

If Windows determines SAC would get in the way regularly, it can turn the feature off automatically.

Microsoft also lists several other reasons SAC may be off, including developer mode being enabled, enterprise management, Windows running in S mode or optional diagnostic data being disabled.

On enterprise-managed PCs, Microsoft says SAC automatically switches off within 48 hours unless the user turns it on first. Microsoft recommends App Control for Business rather than Smart App Control for organizations that need centrally managed application policies.

An Off status therefore does not necessarily mean something is wrong with Windows.

Do I have to disable Smart App Control?

Not necessarily.

SAC first asks Microsoft's app intelligence service whether software is likely to be safe. If Microsoft cannot make a confident prediction, SAC checks the code signature. Software with a valid signature from a certificate authority in Microsoft's Trusted Root Program can still be allowed.

That signature requirement can catch legitimate software.

Microsoft's developer documentation says Smart App Control currently supports RSA-based code-signing certificates but not elliptic-curve cryptography, or ECC, signatures.

That means an app can be digitally signed and still fail SAC's signature check if the developer used an unsupported signing method.

SAC can also evaluate more than the main executable. Microsoft recommends developers sign all code involved in an application, including EXE and DLL files, temporary installer files, scripts and uninstallers.

If a trusted program keeps failing, check whether its developer provides a newer or properly RSA-signed version before disabling SAC.

What you cannot do is create an exception for one application. Microsoft's current FAQ confirms there is no supported way for an end user to tell Smart App Control to allow one specific app while leaving protection enabled for everything else.

How to check what Smart App Control is blocking before you disable it

1. Check whether SAC is on, off or in Evaluation mode. Open Windows Security, select App & browser control, then open Smart App Control settings.

If SAC is Off, it is not responsible for a new block. If it is On, continue checking the Code Integrity logs.

2. Check Code Integrity events if SAC is enforcing. Open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.

Microsoft identifies event ID 3077 as the main block event for an enforced App Control policy. The event can show the exact file that Windows rejected, which is useful when an installer contains several components.

Do not expect event ID 3076 to appear automatically just because SAC is in Evaluation mode. Microsoft says the normal Smart App Control Evaluation policy does not log those audit events by default. Developers and administrators can install a separate audit policy when they need that level of testing.

3. Verify the file before making a security change. Download software from the publisher's official site and confirm the publisher and digital signature where possible.

If the block points to a bundled DLL, updater or installer component rather than the main EXE, check with the developer for a current build instead of assuming the whole package should be allowed.

4. Disable SAC only if the software is already trusted and there is no better fix. Go to Windows Security > App & browser control > Smart App Control settings and turn it off.

Disabling SAC lowers one layer of Windows application protection. Do not do it simply because an unknown installer produces a warning.

If you use a third-party antivirus, you may also notice Microsoft Defender Antivirus operating in passive mode while SAC is active. Microsoft documents this as expected behavior, not necessarily an antivirus configuration problem.

Can you turn Smart App Control back on after disabling it?

On current Windows builds, yes, if the updated control is available on the device.

Microsoft began rolling out the change to Windows 11 versions 24H2 and 25H2 in 2026. It removes the old requirement to reset or reinstall Windows merely because SAC had been switched off.

To check your PC, install current Windows updates, then open Windows Security > App & browser control > Smart App Control settings.

If On is available, SAC can be enabled again from there.

Some older Microsoft documentation still describes the original clean-install and one-way-toggle behavior. Microsoft's newer FAQ and Windows update notes explicitly confirm that recent updates allow SAC to be switched back on without a clean install.

The change does not add a per-app exception system. If you temporarily disable SAC to install trusted software and then turn it back on, that application or one of its components could still be blocked the next time it runs or updates.

Smart App Control on a managed device

Smart App Control is built on the same application-control foundation used by App Control for Business, including Microsoft's Intelligent Security Graph.

For enterprise-managed devices, however, Microsoft recommends App Control for Business rather than relying on consumer-focused SAC.

Microsoft says SAC switches itself off within 48 hours on enterprise-managed devices unless a user explicitly turns it on first. Administrators can also set its state through the VerifiedAndReputablePolicyState registry value, but Microsoft documents that approach primarily as an administrative or testing mechanism rather than a replacement for managed App Control policies.

App Control for Business provides the controls organizations usually need, including custom policies and an audit mode for seeing what would be blocked before enforcement begins.

That makes it a better fit for work PCs that regularly run internal, niche or unsigned applications.

For a personal PC, start with Windows Security rather than immediately turning SAC off. Confirm whether Smart App Control is active, then use the Code Integrity log to identify an actual enforcement block.

If a trusted app is being blocked, check for an updated or correctly signed version first. If no compatible build exists and the software is important enough to justify the tradeoff, current Windows updates make disabling SAC less permanent than it used to be because you can turn the protection back on afterward.