Windows 11 Smart App Control Grayed Out KB5127648 Fix Guide

Microsoft confirmed this week that KB5127648, the October 2026 Windows 11 security update, can leave the Smart App Control toggle grayed out on some PCs, according to BleepingComputer, which reported the issue three days ago. The known issue applies to devices running Windows 11 24H2 and later, and it only shows up on machines where Smart App Control had already been switched off before the update installed.

The reported mitigations are aimed at IT administrators managing enterprise devices; the research does not identify a separate consumer one-click fix. Here's how to check whether a given PC shows the symptom, what it means for security if you can't turn on Smart App Control on Windows 11 right now, and what to do depending on whether the machine is personal or managed by a workplace.

Windows 11 24H2 Smart App Control issue: how to check if KB5127648 affected you

Start by confirming the update is actually installed. Open Settings > Windows Update > Update history and look for KB5127648. This specific KB5127648 issue would not explain the symptom yet if the update isn't listed there.

Next, go to Settings > Windows Security > App & Browser Control > Smart App Control settings, the same path Microsoft documented in an April 2026 preview update when it added toggle flexibility to SAC (Microsoft Support, earlier this year). You can use this check to identify whether your PC shows the described symptom.

If Smart App Control already shows as on, that device remains protected, per Microsoft's advisory, as reported by BleepingComputer. If SAC is off and the toggle still responds normally, the symptom Microsoft described doesn't currently appear on that PC.

The third outcome is when the Smart App Control option is grayed out after installing the update. "After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to its KB5127648 advisory, according to BleepingComputer. The advisory says "some devices" but gives no affected-device count, so checking the setting directly is the clearest way to see where a specific machine stands.

What a grayed-out Smart App Control toggle means for security

Smart App Control draws on Microsoft's app-intelligence and code-integrity services. It works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries, according to BleepingComputer's description of the feature.

Microsoft's advisory confirms two specific points and nothing beyond them: devices that already had SAC enabled remain protected, and some devices where SAC was off before the update may not be able to turn it on now, per BleepingComputer. Anyone who wanted that extra layer of app vetting and can't switch it on is missing that specific protection until a fix ships.

What's still missing from the advisory matters too. Microsoft hasn't disclosed why KB5127648 causes the toggle to stop working, and the supplied reporting does not provide a fix timeline. The available research does not identify the cause.

KB5127648 Smart App Control bug: Microsoft's workaround, and who it's for

Microsoft said in an update to its KB5127648 advisory, according to BleepingComputer, that it shared two mitigation paths for the stuck toggle: a registry edit and two Group Policies. Both are described as temporary workarounds for IT admins managing enterprise devices, not a routine consumer fix.

The registry method requires an elevated Command Prompt. Microsoft's advisory, as documented by BleepingComputer, lists these two commands, followed by a restart:

These add override values under FeatureManagement\Overrides and require a restart to apply. They're system-level policy flags, not an app setting, so running them is a bigger step than flipping a setting in the Windows Security app.

The Group Policy route uses two feature-preview policies, listed as KB5074105 261015_19222 and 261015_19221, set under Computer Configuration > Administrative Templates > the relevant policy name > Windows 11 version 24H2, 25H2, per the advisory. The policy names reference Windows 11 versions 24H2, 25H2, and 26H2, while the known-issue description lists affected devices only as 24H2 and later. Both policies need to be set to Enabled, followed by a restart.

The bug arrives months after an April 2026 preview update let users toggle SAC on or off without a clean install for the first time, through that same Settings path (Microsoft Support, earlier this year). The reported bug can prevent some users from using that newer toggle.

Can't turn on Smart App Control on Windows 11? What to check and do next

Confirm KB5127648 is installed at Settings > Windows Update > Update history, then check Settings > Windows Security > App & Browser Control > Smart App Control settings. If SAC already shows as on, Microsoft's advisory says the device remains protected, according to BleepingComputer, and there's no toggle issue to chase.

If the toggle is grayed out on a work or school PC, contact the IT administrator rather than applying the registry or Group Policy changes directly. Because Microsoft frames those mitigations for IT admins managing enterprise devices, running them outside a managed rollout can create inconsistencies the administrator then has to untangle.

If the toggle is grayed out on a personal PC, Microsoft's advisory does not say whether users should uninstall the update or how much risk the missing feature creates. Anyone who doesn't need SAC turned on right away can skip the registry changes and keep an eye on Microsoft's advisory instead. Anyone who needs the feature active now can consider the published registry mitigation, provided they're comfortable making system-level changes on their own.

Watch the KB5127648 advisory page, as tracked by BleepingComputer, for word of a standard fix before deciding whether to run the enterprise-oriented steps yourself.