Smart App Control Grayed Out After KB5127648: Fix (Oct 2026)

If Smart App Control suddenly shows a grayed-out toggle after the October 2026 Patch Tuesday update, you are not alone. Microsoft has confirmed it as a known issue in KB5127648 (OS Builds 26100.9711, 26200.9711 and 26300.9711), and it is still listed as open in the October 26 out-of-band update KB5134133. The good news: Microsoft has published an official workaround, and it takes about two minutes.

This guide explains what is happening, who is affected, and how to get the Smart App Control switch working again on Windows 11 24H2, 25H2 and 26H2, both on a home PC and on enterprise-managed devices.

A Common Scenario in IT Support

A typical ticket looks like this: a user turned Smart App Control off months ago because it blocked an older in-house tool or an unsigned installer. After the October update, the security team asks for it to be turned back on. The user opens Windows Security > App & browser control > Smart App Control settings, and the On option is grayed out. Restarting does not help, and running Windows Update again shows no new fix.

Helpdesk teams often waste time here by resetting Windows Security, running SFC, or even planning a reinstall. None of that is needed. This is a known bug with a documented fix.

Symptoms

• The Smart App Control option in the Windows Security app is grayed out and cannot be selected.
• It happens only on devices where Smart App Control had been turned off before the update.
• Devices where Smart App Control was already on are not affected and, per Microsoft, remain protected.
• There is no error code or pop-up. The control is simply disabled.

Affected versions

• Windows 11, version 24H2 (build 26100.9711 and later)
• Windows 11, version 25H2 (build 26200.9711 and later)
• Windows 11, version 26H2 (build 26300.9711 and later)

Windows 10 is not affected because Smart App Control is a Windows 11 feature.

What Causes It

Microsoft has not shared the root cause in detail. The workaround it published turns on two Windows feature-management overrides, which suggests that a feature flag shipped with the October cumulative update is blocking the re-enable path for Smart App Control. Microsoft says it is working on a resolution and will provide an update in an upcoming release.

How to Fix Smart App Control Grayed Out (Step by Step)

First, check your build. Press Win + R, type winver, and press Enter. If you are on build x.9711 or later (from the October 13, 2026 update), the steps below apply.

Option 1: Registry fix (home users and single PCs)

This is Microsoft's own workaround. Back up the registry first (or create a restore point) before you change anything.

1. Type cmd in the Start menu search box.
2. Right-click Command Prompt and select Run as administrator.
3. Run these two commands exactly as shown:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

4. Restart the PC.
5. Open Windows Security > App & browser control > Smart App Control settings and choose On (or Evaluation).

To confirm the values were written, run:

reg query "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides"

You should see both 2883193997 and 2850574478 with a value of 0x1.

Option 2: Group Policy fix (enterprise-managed devices)

For domain-joined or managed fleets, Microsoft provides two special Group Policy packages instead of the registry edit. You need both:

• KB5074105 261015_19222 Feature Preview — turns on the ability to enable Smart App Control.
• KB5074105 261015_19221 Feature Preview — adds logging to help with troubleshooting if problems arise.

1. Download both packages from the links in the "Known issues" section of Microsoft's KB5134133 support page.
2. Install the .msi files on a management machine so the ADMX templates are available (copy them to your Central Store if you use one).
3. In Group Policy Management, open your policy and go to Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2.
4. Set both settings to Enabled.
5. Link the GPO to the right OU, run gpupdate /force on a test device, and restart it.

Pilot on a few devices first. Remember that Smart App Control in On mode can block unsigned or low-reputation line-of-business apps, so check with app owners before you turn it on at scale.

Check the Smart App Control state with PowerShell

On current Microsoft Defender platform versions you can read the state from an elevated PowerShell window:

Get-MpComputerStatus | Select-Object SmartAppControlState

Typical values are On, Off or Eval. If you are new to running scripts, see our guide on fixing "running scripts is disabled" safely.

What NOT to Do

• Do not uninstall KB5127648. It is the October security update. Removing it to get a toggle back trades a minor bug for real security gaps.
• Do not reset or reinstall Windows just for this. The registry or Group Policy workaround is enough.
• Do not copy registry commands from random forums. Use the exact value names above, which match Microsoft's KB page, or copy them straight from Microsoft.
• Do not turn off Microsoft Defender or other protections while troubleshooting. They are unrelated to this issue.
• Do not push Smart App Control On to every device blindly in an enterprise. Use Evaluation mode or a pilot group first.

Related October 2026 Update Issues

The same KB pages list other known issues worth checking if users report problems after Patch Tuesday:

• Remote Desktop error 0xC000000D for non-admin users on hosts with Administrator protection. See our RDP 0xC000000D fix guide.
• USB Audio Class 1.0 devices failing with "This device cannot start (Code 10)", partially resolved by the September 14 out-of-band update KB5129195.
• Windows 11 24H2 Home and Pro reached end of updates, and October 2026 was their last monthly security update. Read how to upgrade to 25H2 or 26H2.

If an update itself refuses to install, our Windows Update stuck fixes cover the usual causes.

FAQ

Is my PC unprotected if Smart App Control is grayed out?

Only Smart App Control is affected, and only if it was already off. Microsoft Defender Antivirus, SmartScreen and your other protections keep working. If Smart App Control was on before the update, it stays on.

Will Microsoft fix this automatically?

Microsoft says it is working on a resolution for an upcoming release. Until then, the registry or Group Policy workaround is the official route.

Does the October 26 out-of-band update KB5134133 fix it?

No. KB5134133 is a cumulative update for devices that do not receive current certificate trust list (CTL) updates, related to the eMudhra certificate distrust. It still lists the Smart App Control issue as a known issue. Read more in our eMudhra certificate compromise explainer.

Is it safe to leave those registry values in place?

They are Microsoft's documented workaround. Keep a note of them in your change log so you can remove them once Microsoft ships the permanent fix, if Microsoft advises doing so.

Does this affect Windows 10?

No. Smart App Control is available only on Windows 11.

Want to test your Windows troubleshooting knowledge? Try our free IT skill tests.

Sources: Microsoft Support KB5127648 (October 13, 2026) and KB5134133 (October 26, 2026) release notes, and Windows release health.