Microsoft recently confirmed that KB5127648, the October 2026 Windows 11 security update, can leave the Smart App Control toggle grayed out on some PCs. The known issue applies to devices running Windows 11 24H2 and later, and it only shows up on machines where Smart App Control had already been switched off before the update installed.
Microsoft documents two workarounds: a registry modification and special Group Policies for IT administrators managing enterprise devices. Neither is a one-click consumer fix.
Here's how to check whether a given PC shows the symptom, what it means for security if you can't turn on Smart App Control on Windows 11 right now, and what to do depending on whether the machine is personal or managed by a workplace.
Windows 11 24H2 Smart App Control issue: How to check if KB5127648 affected you
Start by confirming the update is actually installed. Open Settings > Windows Update > Update history and look for KB5127648. This specific KB5127648 issue would not explain the symptom if the update isn't listed there.
Next, go to Settings > Windows Security > App & Browser Control > Smart App Control settings, the same path Microsoft documented in an April 2026 preview update when it added toggle flexibility to SAC. You can use this check to identify whether your PC shows the described symptom.
If Smart App Control already shows as on, that device remains protected, per Microsoft's advisory, as reported by BleepingComputer. If SAC is off and the toggle still responds normally, the symptom Microsoft described doesn't currently appear on that PC.
The third outcome is when the Smart App Control option is grayed out after installing the update. "After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to its KB5127648 advisory. The advisory says "some devices" but gives no affected-device count, so checking the setting directly is the clearest way to see where a specific machine stands.
What a grayed-out Smart App Control toggle means for security
Smart App Control draws on Microsoft's app-intelligence and code-integrity services. It works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries.
Microsoft's advisory confirms two specific points and nothing beyond them: devices that already had SAC enabled remain protected, and some devices where SAC was off before the update may not be able to turn it on now. Anyone who wanted that extra layer of app vetting and can't switch it on is missing that specific protection until a fix ships.
What's still missing from the advisory matters too. Microsoft hasn't disclosed why KB5127648 causes the toggle to stop working, and the supplied reporting does not provide a fix timeline. The available research does not identify the cause.
KB5127648 Smart App Control bug: Microsoft's workaround, and who it's for
Microsoft said in an update to its KB5127648 advisory that it shared two mitigation paths for the stuck toggle: a registry edit and two Group Policies. Both are described as temporary workarounds for IT admins managing enterprise devices, not a routine consumer fix.
The registry method requires an elevated Command Prompt. Microsoft's advisory lists the two commands below, followed by a restart.
Microsoft recommends backing up the registry and knowing how to restore it before making changes. Run each command separately in an elevated Command Prompt, then restart the device.
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f
These add override values under FeatureManagement\Overrides and require a restart to apply. They're system-level policy flags, not an app setting, so running them is a bigger step than flipping a setting in the Windows Security app.
The Group Policy workaround requires IT administrators to download and install two special policies: KB5074105 261015_19222 Feature Preview, which restores the ability to turn on Smart App Control, and KB5074105 261015_19221 Feature Preview, which enables logging for troubleshooting. Both policies cover Windows 11 versions 24H2, 25H2, and 26H2. After installing them, administrators must set both policies to Enabled and restart the affected devices.
Microsoft began gradually rolling out the ability to toggle SAC without a clean install in its April 30, 2026 preview update, after first disclosing the feature in January. The reported bug can prevent some users from using that newer toggle.
Can't turn on Smart App Control on Windows 11? What to check and do next
Confirm KB5127648 is installed at Settings > Windows Update > Update history, then check Settings > Windows Security > App & Browser Control > Smart App Control settings. If SAC already shows as on, Microsoft's advisory says the device remains protected, and there's no toggle issue to chase.
If the toggle is grayed out on a work or school PC, contact the IT administrator rather than applying the registry or Group Policy changes directly. Because Microsoft frames those mitigations for IT admins managing enterprise devices, running them outside a managed rollout can create inconsistencies the administrator then has to untangle.
If the toggle is grayed out on a personal PC, Microsoft's advisory does not say whether users should uninstall the update or how much risk the missing feature creates. Anyone who doesn't need SAC turned on right away can skip the registry changes and keep an eye on Microsoft's advisory instead. Anyone who needs the feature active now can consider the published registry mitigation, provided they're comfortable making system-level changes on their own.
Watch the KB5127648 advisory page for word of a standard fix before deciding whether to run the enterprise-oriented steps yourself.
Comments
Be the first, drop a comment!