If Smart App Control is grayed out on your Windows 11 PC, the October security update, KB5127648, is the likely cause. Microsoft says the bug is fixed in updates released October 28, 2026 and later, and there is also a short registry workaround you can use right now.
Here is the short version before the details:
- The trigger is KB5127648, the October 2026 security update released on October 13.
- It hits Windows 11 24H2, 25H2 and 26H2, but only PCs where the feature was already switched off.
- PCs that had it on keep it on and stay protected.
- Microsoft says the fix arrived in updates released October 28 or later, including the KB5127936 preview.
- Until then, two registry values bring the toggle back.
Those five lines cover most readers. The rest of this post shows you how to check your PC and fix it.
Why Smart App Control is grayed out after the October update
After installing KB5127648, some PCs show the Smart App Control switch in the Windows Security app as grayed out. You can look at it, but you can’t turn it on. Microsoft added the problem to the update’s known issues, with the wording “You might be unable to turn on Smart App Control.”
Who is affected comes down to one detail. According to BleepingComputer, only devices where the feature was already off are hit. If it was on before the update, it stays on.
There is one more catch. PCWorld reports that if you turn the feature off after installing the update, you can’t switch it back on. So don’t toggle it off to “test” anything.
Why bother? With it off, Windows has no automatic layer that blocks unknown or risky apps. Regular Microsoft Defender protection still runs, but PCWorld notes that malicious apps can slip through more easily.
Fix 1: Install the update that carries the fix
The cleanest route is to let Windows install the fix. Microsoft says the issue was resolved in updates released October 28, 2026 and later, and it confirmed this for the KB5127936 preview update.
Follow these steps:
- Open Settings and go to Windows Update.
- Select Check for updates and install whatever Windows offers.
- If KB5127936 appears as an optional preview update, install it, then restart.
- Open the Windows Security app and check the Smart App Control switch.
Preview updates are optional, so they can carry rough edges of their own. Our KB5127936 breakdown covers what else that build changes, so you can decide if it suits your PC. Admins who skip previews are waiting for the next Patch Tuesday, according to BleepingComputer.
Fix 2: Microsoft’s registry workaround for Smart App Control
If you don’t want a preview update, Microsoft shares a temporary workaround. It adds two DWORD values that switch the feature’s control back on. Back up your registry first, since you are editing system settings.
Open Command Prompt as administrator and run these two commands:
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /fRestart your PC afterward. The two numbers are feature IDs from Microsoft’s own advisory, so copy them exactly. A typo creates a useless value instead of an error.
Managed work PCs use a different route. Microsoft points administrators to the KB5074105 Feature Preview packages and a Group Policy setting. Your IT team should handle that one.
How to check that Smart App Control is back on
Open Settings, then Privacy & security, then Windows Security, and choose App & browser control. Select Smart App Control settings and make sure it is set to On.
If the option is still grayed out after a restart, recheck that the update installed or that both registry values exist. This table shows which fix fits which situation:
| Your situation | What to do |
|---|---|
| Smart App Control was already on | Nothing. Microsoft says these devices remain protected. |
| Off and grayed out, home PC | Install the latest updates, or run the registry workaround and restart. |
| Off and grayed out, work PC | Ask your IT team. They can use the Group Policy method. |
| Want to avoid preview updates | Use the registry workaround, or wait for the next Patch Tuesday. |
While you are in the Windows Security area, it’s a good time to run other checks too. Our guide to the Secure Boot certificate expiry shows another one worth five minutes.
Frequently Asked Questions
Is my PC unsafe if Smart App Control is off?
Not defenseless. Microsoft Defender still works. But you lose the extra layer that blocks unknown apps, so be careful about what you download and run.
Do I need to do anything if it was already on?
No. The bug only blocks turning the feature on, and devices with it on remain protected. Just avoid switching it off.
Is the registry workaround safe?
It comes from Microsoft’s own advisory, so it is the official stopgap. Back up the registry first and enter the values exactly as shown.
Which Windows 11 versions are affected?
Versions 24H2, 25H2 and 26H2, after installing KB5127648. Older Windows 11 releases are not named in the advisory.
Start with the update. If you want to stay off previews, the registry route takes about two minutes. Either way, check the toggle afterward and don’t leave it off. A grayed-out security switch is easy to ignore, and that is exactly why it deserves a quick look today.
Leave a Reply