Microsoft Fixes Smart App Control Issue Caused by October Windows 11 Update

Microsoft has fixed a known issue that stopped some users from turning on the Smart App Control security feature after they installed the October 2026 KB5127648 Windows 11 security update. The company confirmed on Wednesday that the problem is resolved for users who installed this month's KB5127936 preview update, released on October 28, 2026. Smart App Control relies on Microsoft's code integrity features and app intelligence services, and it works alongside SmartScreen and Microsoft Defender to block potentially harmful applications or binaries. When Microsoft first acknowledged the problem last month, it explained that the Smart App Control option was grayed out and could not be toggled on affected devices running Windows 11 24H2 and later. The option could not be re-enabled if the feature had previously been turned off. "After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in the KB5127648 advisory. "Devices where Smart App Control is already turned on are not affected and remain protected." In a service alert sent to IT administrators, the company recommended installing the latest security update, noting that it contains important improvements and issue resolutions, including the Smart App Control fix. For administrators who do not want to deploy the preview update on enterprise-managed devices and prefer to wait for next month's Patch Tuesday cumulative updates, Microsoft shared a temporary workaround. It involves editing the registry on affected Windows 11 devices to restore the ability to turn on Smart App Control. Admins should open a Command Prompt window by typing cmd in the Search box, enter the commands provided by Microsoft, and then restart the device. Alternatively, admins can work around the issue by installing Group Policies that turn on Smart App Control and enable logging for troubleshooting purposes. The settings are located under Computer Configuration, Administrative Templates, and the relevant Group Policy name, for Windows 11 version 24H2 and 25H2. They must be set to Enabled after installation, and affected devices must be restarted to apply the changes. The KB5127936 preview update also resolves Remote Desktop failures caused by recent Windows updates when the Administrator protection security feature is enabled, and it fixes Always On VPN issues triggered by the September 2026 cumulative updates. Microsoft had previously acknowledged that the October updates did not actually fix the VPN problems as initially reported.