Smart App Control Greyed Out After the October 2026 Update? How to Fix It

Smart App Control is a Windows 11 security feature that blocks apps it considers untrusted or malicious. After the 13 October 2026 security update, some people found they could no longer turn it on: the toggle in Windows Security was greyed out.

Microsoft lists this as a known issue on the update’s release notes page. This guide explains who is affected and walks through Microsoft’s fixes. It also covers the older reasons the switch can be grey, which these fixes won’t solve. Everything here comes from Microsoft’s support pages, checked on 27 October 2026 and updated on 31 October 2026 after the fix shipped.

Is this your problem? Three quick checks

The toggle can be greyed out for several reasons. The October bug is only one of them, so check these first:

1. Was Smart App Control off before the update? Microsoft says devices where it was already on “are not affected and remain protected”. The bug only blocks turning it back on.
2. Do you have the October update? Press Win + R, type winver and press Enter. KB5127648 brings Windows 11 to build 26100.9711 (24H2), 26200.9711 (25H2) or 26300.9711 (26H2). You can also look for KB5127648 under Settings → Windows Update → Update history.
3. Is the PC managed by an organisation? On a work or school device, Smart App Control may be controlled by policy. Ask IT rather than changing the registry yourself.

To find the switch, open Windows Security → App & browser control → Smart App Control settings.

Greyed out, or just in Evaluation mode?

Before you touch the registry, look at which option is selected under Smart App Control. There are three: On, Evaluation and Off. (Microsoft’s own pages spell the problem “grayed out”, the US way.)

Evaluation means Smart App Control is still working out whether it suits your PC. According to Microsoft’s Smart App Control documentation, if you look like a developer or another user whose normal work would cause a lot of interruptions, Windows turns it off automatically. If it moves to full protection, you get a notification. So a PC that shows Evaluation isn’t broken, and the October bug isn’t the cause.

The October bug looks different: Smart App Control was Off before the update, and now you can’t choose On.

What Microsoft says about the bug

From the known-issues section of the KB5127648 release notes:

“After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out.”

It applies to Windows 11 versions 24H2, 25H2 and 26H2. The fix came on October 28. The KB5127936 release notes list Smart App Control as a fixed known issue: the update “fixes an issue where you might be unable to turn on Smart App Control in the Windows Security app after it has been turned off.”

Fix 1: Install KB5127936

This is the simplest option if you’re on Windows 11 25H2 or 26H2, since it needs no registry edit. It’s an optional preview update, so Windows won’t necessarily offer it on its own.

1. Open Settings → Windows Update → Advanced options → Optional updates.
2. Under Optional updates available, install KB5127936, then restart.
3. Check Windows Security → App & browser control → Smart App Control settings to see whether you can choose On.

After installing, winver should show build 26200.9818 (25H2) or 26300.9818 (26H2). Microsoft’s notes for this update name only those two versions, so on 24H2, use the registry workaround below or upgrade.

Fix 2: Microsoft’s registry workaround

1. Type cmd in the Start menu search box.
2. Right-click Command Prompt and select Run as administrator.
3. Enter these two commands one at a time, exactly as Microsoft publishes them:

   reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
   reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

   Each one should reply “The operation completed successfully.”

4. Restart the PC.
5. Go back to Windows Security → App & browser control → Smart App Control settings and check whether you can choose On.

These commands don’t turn Smart App Control on by themselves. Microsoft describes them as restoring “the ability to turn on Smart App Control”. You still choose the setting after the restart.

Undoing the change later

The KB5127648 notes we read don’t say whether these values should be removed after the fix. If Microsoft publishes removal steps, follow those. If you made a restore point, it’s there as a fallback.

Fix 3: Group Policy (for IT administrators)

For PCs managed by an organisation, Microsoft offers two special Group Policy downloads on the KB5127648 page. Both must be installed. The first lets Smart App Control be turned on again, and the second keeps logging available for troubleshooting.

After installing them, the settings are under Computer Configuration → Administrative Templates. Set both to Enabled, then restart the devices. The download links and exact policy names are on Microsoft’s KB5127648 page.

Smart App Control greyed out for another reason? What the registry fix won’t solve

Microsoft’s Smart App Control FAQ lists other causes:

The same FAQ says recent Windows updates allow Smart App Control to be turned on again without a clean installation. That’s why the October bug stands out: it removed that ability on some PCs.

Are you unprotected while it’s off?

Not completely. Microsoft says Smart App Control “works alongside your other security software”, such as Microsoft Defender or third-party antivirus. With it off, your antivirus still runs. You lose one extra layer that blocks unsigned or unknown apps before they start.

So the fix isn’t urgent, but if you want that layer back, it’s worth doing. Meanwhile, be careful about running installers from sites you don’t trust.

Other known issues in the October update

Microsoft lists more known issues for KB5127648 and recent updates:

• Remote Desktop: non-admin users may fail to connect to PCs with Administrator protection enabled (error 0xC000000D). This mainly affects managed business devices. KB5127936 fixes it too.
• USB audio: some USB Audio Class 1.0 devices may not start or produce sound. This began with the September 2026 security update and is only partly fixed.

One more change is worth knowing about. Microsoft says the October 2026 update is the last one for Windows 11 version 24H2 Home and Pro, and recommends upgrading to a newer version. If you’re on 24H2, check Settings → Windows Update. If you’re still on Windows 10, our guide to Windows 10 Extended Security Updates explains your options.

Frequently Asked Questions

Sources (checked 27–31 October 2026): Microsoft: KB5127936 release notes, Microsoft Learn: Smart App Control overview, Microsoft: KB5127648 release notes and known issues, Microsoft: Smart App Control FAQ.