www.it-connect.fr
Windows 11 KB5127648 Breaks Smart App Control in October 2026 Update
Smart App Control and Windows 11 still don't play nicely together. Since installing the October 2026 update, also known as KB5127648, the option remains grayed out. Microsoft has confirmed the issue and offers two workarounds. Here's what you need to know.
As a reminder, Smart App Control is a security feature built into the Windows Security app. It relies on code signing and a Microsoft cloud-based reputation service to block untrusted apps, drivers, and files, or those with invalid signatures. It is a security feature that complements Microsoft Defender and SmartScreen.
For a long time, this feature came with an annoying limitation: once disabled, it could not be re-enabled without reinstalling Windows 11. It was even impossible to turn it on if the machine did not meet certain configuration prerequisites set from the start. In November 2025, I published an article about Microsoft's simplified Smart App Control management, tested with members of the Windows Insider program. Since then, that flexibility has made its way to stable versions of Windows 11: thanks to recent updates, Smart App Control can be re-enabled without starting from a clean installation.
The problem is that the October 2026 cumulative update is now disrupting all of that... Microsoft has added a new known issue to the KB5127648 release notes, published on October 13, 2026, for Patch Tuesday.
Smart App Control grayed out: which devices are affected?
The bug affects Windows 11 24H2, 25H2, and 26H2, which are the three versions receiving KB5127648. The symptom is easy to spot: in the Windows Security app, the toggle used to enable Smart App Control is grayed out and does not respond. After installing the update, "some devices might not be able to enable Smart App Control", Microsoft says. A real step backward...
Only systems where the feature had previously been disabled are affected. According to the Redmond company, machines where Smart App Control is already enabled are not impacted and remain protected. In other words, the bug does not break anything if it was already in place. That's something, at least.
On the other hand, if you plan to temporarily disable Smart App Control to finish installing a legitimate application, before re-enabling it, that is where you will run into trouble.
No fix is available at this time. Microsoft says it is working on a resolution that will be delivered in a future update. Note that this is not the only known issue with this KB: Remote Desktop connections can also fail with error 0xC000000D for non-administrator users when Administrator protection is enabled on the remote machine.
Two ways to re-enable Smart App Control
In the meantime, Microsoft is suggesting two workarounds. Here is what is recommended.
- Edit the Registry: open Command Prompt as administrator, run the two commands below, then restart the machine.
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f- Deploy Group Policy: for managed endpoints and to patch a fleet of machines, Microsoft provides something similar to KIR fixes through two MSI packages named KB5074105 261015_19222 Feature Preview and KB5074105 261015_19221 Feature Preview. What makes this unusual is that both must be installed and configured: the first re-enables Smart App Control, while the second enables logging for troubleshooting. The settings can then be found under Computer Configuration > Administrative Templates > (policy name) > Windows 11, version 24H2, 25H2. Set both to Enabled, then restart the machines.
The two values are written to the FeatureManagement\Overrides key, which is also used by Known Issue Rollback (KIR) to roll back a problematic change. Here, it is the opposite: you are forcing the activation of two features identified by their number. The Feature Preview policies appear to work on the same principle. Still, this whole situation looks pretty bad...
