Microsoft Update Disrupts Smart App Control Feature in Windows 11

"After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said in an update to the KB5127648 advisory.

What Microsoft says about KB5127648

Microsoft updated its advisory for KB5127648 — the October 2026 Windows 11 security update — to warn that some devices running Windows 11, version 24H2 and later may be unable to re-enable Smart App Control after the update. The company said devices where Smart App Control is already turned on are not affected and "remain protected." Microsoft also said a permanent fix is not yet available and provided temporary workarounds for enterprise administrators.

How Smart App Control functions

Smart App Control is a Windows 11 security feature that "uses Microsoft's app intelligence services and code integrity features and works alongside Microsoft Defender and SmartScreen to block potentially harmful apps or binaries." The problem described in the advisory only affects the ability to toggle the feature back on through the Windows Security app when it has previously been turned off.

Temporary workarounds for IT administrators

Microsoft offered two mitigation paths for administrators managing enterprise devices: a registry change and Group Policy installation.

• To restore the ability to turn on Smart App Control by editing the registry, Microsoft instructs admins to open an elevated Command Prompt and run the following commands, then restart the device:

  reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f

  reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

• Alternatively, admins can install and configure two Group Policies identified by Microsoft as:
  • Windows 11, versions 24H2, 25H2, and 26H2 - KB5074105 261015_19222 Feature Preview
  • Windows 11, versions 24H2, 25H2, and 26H2 - KB5074105 261015_19221 Feature Preview
  These Group Policies are located under Computer Configuration > Administrative Templates > {{Group Policy name}} > Windows 11, version 24H2, 25H2. After installing them, Microsoft says administrators must set both settings to Enabled and restart the affected device(s) to apply the Group Policy settings. Microsoft characterized these as temporary workarounds while a fix is not available.

Other Windows update problems Microsoft confirmed this week

Microsoft also confirmed additional, distinct update-related issues during the same period. The company said recent Windows updates caused Remote Desktop failures for non-admin users if the "Administrator protection" security feature is enabled. Separately, Microsoft resolved a known issue that had triggered Always On VPN connection problems after installing the September 2026 security updates. On Tuesday, Microsoft addressed a bug that had been causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August.

How technologists, enterprises, and end users are likely to respond

• Technologists and security teams: Expect immediate use of the registry commands or the two KB5074105 Feature Preview Group Policies to restore Smart App Control functionality on managed devices where the option is grayed out, followed by monitoring for a permanent fix from Microsoft.
• Affected enterprises and procurement leaders: Will need to weigh deploying Microsoft’s temporary Group Policy packages and rolling restarts against change-control windows, ensuring logging is enabled for troubleshooting as Microsoft recommended.
• End users and general IT staff: Should note that devices with Smart App Control already enabled remain protected; users who had previously turned the feature off may have to wait for IT to apply the provided workarounds or for Microsoft’s forthcoming fix.

Microsoft’s advisory leaves a clear operational path for administrators but no immediate permanent resolution. For defenders and operators, the episode underscores how configuration-state regressions after security updates can temporarily limit access to protective features — a point Microsoft itself emphasized elsewhere in the source material by noting how prevention metrics can change after initial access. The Blue Report 2026, cited in the same source, "measures defenses technique by technique across 338 million simulations run in customer production environments."

Read the original Microsoft advisory and full reporting here: https://www.bleepingcomputer.com/news/microsoft/kb5127648-windows-security-update-may-break-smart-app-control/