The October Update Greys Out Windows 11 Smart App Control

Microsoft says the October 13 Windows 11 security update KB5127648 can gray out Smart App Control if the feature was already off. On affected PCs the On option in Windows Security will not move. Machines that already had it on stay protected.

The package covers Windows 11 versions 24H2, 25H2, and 26H2 (builds 26100.9711, 26200.9711, and 26300.9711). Microsoft has not named a date for a permanent fix. It has published two temporary paths, both of which need a restart.

The October Patch Greys Out a Security Switch

Smart App Control is the Windows 11 layer that blocks apps Microsoft’s cloud service cannot trust, and apps that lack a valid signature. It sits in Windows Security under App and browser control, next to SmartScreen, and it is meant to run beside Microsoft Defender or a third-party antivirus tool.

The new failure is narrow. It does not turn the feature off. It does not strip protection from a PC that already had it on. It stops some people from turning it on after they installed the patch.

After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out.

Microsoft, KB5127648 known issues

Microsoft now lists that grayed control among the known issues in this update and says it is working on a resolution for an upcoming release. Until that ships, the company is sending people to the registry or to a pair of Feature Preview Group Policy packages.

A security package that can lock the door on a security switch is a circular failure. PCs that never planned to use Smart App Control will not notice. Anyone who turned it off for a one-off installer, then tried to turn it back on after Patch Tuesday, will.

Who Hits the Grayed Toggle

The bug only shows up when Smart App Control was off before KB5127648 and someone tries to turn it on afterward. If the control is already on, leave it. Microsoft says those devices remain protected and are not part of this issue.

That off state is common. Microsoft’s own FAQ lists several reasons the feature is already off, and several of them are still a reset problem even when the October bug is not in play.

WHY SMART APP CONTROL IS ALREADY OFF

• Enterprise or developer mode: A managed PC, or one set up for development work, can have the feature off by design.
• A person turned it off: You or another signed-in user switched it off in Windows Security, often to run an unsigned tool.
• S mode: The PC is in Windows S mode; Microsoft says you must leave S mode and then reset the PC.
• Optional diagnostic data: If that setting is off, Microsoft still tells you to reset or reinstall and to send optional diagnostic data during setup.

Microsoft also turns the feature off on its own when evaluation mode decides the PC is a poor fit, which it does for some corporate and developer workloads that trip the blocker too often. Those are the same people who later want the switch back after a scare, or after they finish an installer that SAC would have blocked.

Home users who never open Windows Security will sail past this. The people who hit it are the ones who treat Smart App Control as a switch they can flip for an hour, which is exactly the use Microsoft spent 2026 trying to allow.

Microsoft Already Unlocked This Switch Once

For years, turning Smart App Control off was a one-way trip. Microsoft’s product page still carries an Important box that says the feature can be used on new Windows 11 installs only, and that a PC which got it through an update cannot turn it on unless you reset or reinstall. Evaluation mode has the same hard edge: once evaluation ends, or once you flip the control yourself, you cannot go back to evaluation without a reset.

The FAQ on the same support site now says the opposite on the On/Off question. Microsoft writes that recent Windows updates allow Smart App Control to be enabled without requiring a clean installation. That sentence is the change users asked for. It is also the change KB5127648 can take away from anyone who had the feature off.

The official paper trail for that change starts on January 29, 2026. The non-security preview KB5074105, builds 26200.7705 and 26100.7705, documented a new Smart App Control behavior in its change log: you can turn it on or off without any clean install requirement, from Windows Security, App and Browser Control, Smart App Control settings.

On April 9, 2026, Microsoft edited that same preview note. The Smart App Control line was removed from the documentation and marked as planned for a future release. The FAQ users read now still tells them the reversible toggle is here. Then the October 13 security update made the On option gray on some of those PCs.

THE SMART APP CONTROL TOGGLE IN 2026

1. January 29, 2026: Preview KB5074105 documents turning Smart App Control on or off with no clean install.
2. April 9, 2026: Microsoft removes that feature note from the preview page and says it is planned for a later release.
3. October 13, 2026: Security update KB5127648 ships for 24H2, 25H2, and 26H2.
4. After that release: Microsoft lists a grayed On option as a known issue and publishes temporary registry and Group Policy steps.

The October workaround packages are labeled KB5074105 Feature Preview, the same KB number as the January preview that first advertised the reversible switch. Microsoft is using feature-flag machinery to put back a control a security update just took away.

Two Registry Keys and a Feature Preview Pair

Microsoft’s first option is a pair of registry writes under FeatureManagement Overrides, which is the Windows feature-flag path the company named in the note. Both values must be REG_DWORD set to 1. You need an elevated Command Prompt, and you need to restart before the Windows Security page will move.

The commands Microsoft published are:

THE REGISTRY COMMANDS MICROSOFT PUBLISHED

• First value: reg add “HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides” /v 2883193997 /t REG_DWORD /d 1 /f
• Second value: reg add “HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides” /v 2850574478 /t REG_DWORD /d 1 /f

Microsoft warns you to back up the registry first and to know how to restore it. After the restart, open Windows Security, go to App and browser control, then Smart App Control settings, and turn the feature on. That path is the one a single PC can use. It still needs administrator rights, so it is not a click in Settings.

IT admins who do not want to push registry keys can install two special Group Policy packages instead. Microsoft lists them as KB5074105 261015_19222 Feature Preview and KB5074105 261015_19221 Feature Preview, both for Windows 11 versions 24H2, 25H2, and 26H2. Both must be installed and both settings must be Enabled. The first is the one that restores Smart App Control. The second turns on logging for troubleshooting. The policies show up under Computer Configuration, Administrative Templates, the Group Policy name, then Windows 11, version 24H2, 25H2. Devices need a restart after that too.

THE TWO TEMPORARY PATHS BACK

Use one path, not both, and only if the On option is actually gray. Microsoft has not said these steps replace the coming fix. They restore the ability to turn the feature on until that update arrives.

Two registry adds as the official recovery for a security toggle is a poor fit for the home user the 2026 FAQ was written for. Fleet admins at least get MSI packages and a policy tree. Everyone else is in an elevated prompt, hoping a FeatureManagement override is the right kind of temporary.

What Smart App Control Blocks

When you launch an app, Smart App Control asks Microsoft’s cloud service for a safety prediction. If the service is confident the app is safe, it runs. If the service thinks it is malicious or potentially unwanted, it is blocked. If the cloud cannot decide, Windows checks the signature. A valid signature gets through. An unsigned app, or one with a bad signature, is treated as untrusted and blocked.

That last bucket is why people turn the feature off. Microsoft says there is currently no way to let one specific app through. You either turn Smart App Control off, or you ask the developer to sign the binary. The FAQ even names a practical case: installers that rely on Windows Installer Transform (MST) files, which cannot be digitally signed. If the cloud has no verdict, SAC may block the job, and Microsoft tells you to disable the feature, finish the install, then turn it back on.

KB5127648 is what can break that last step. The security update does not change the cloud check. It does not add a per-app allow list. It can freeze the Off state so the “turn it back on when you are done” instruction in Microsoft’s own FAQ no longer works from the Windows Security page.

Microsoft still says that in most cases the feature turns on by itself to block untrusted apps, and that it will turn itself off if it detects a corporate, developer, or similar pattern that would make the blocker a nuisance. Evaluation mode watches that decision and does not block anything while it runs. Once you leave evaluation, that mode is gone until a reset. The October bug sits on top of that older one-way design, which Microsoft never fully erased from the App and browser control page.

Remote Desktop Still Fails for Non-Admins

KB5127648 is not only a Smart App Control note. The same package fixes an Explorer failure in multi-user setups such as Azure Virtual Desktop and FSLogix, where explorer.exe would not start or would crash after sign-in and leave a black screen. It also restores AC-3 audio in some apps and repairs Always On VPN connections that stuck on Connecting or failed with “The specified port is already in use” after KB5124008.

The update also ships the October security vulnerabilities resolved in Microsoft’s Security Update Guide, plus more Secure Boot certificate targeting, ReFS auditing on external drives, a Manitoba time zone change, printing and gaming-mouse fixes, and a Windows Hello fingerprint repair after a cold boot. Authentication hardening is in the same build: if Credential Guard is off and BlockNtlmv1SSO is unset, Windows now uses Enforce mode instead of Audit mode for NTLMv1-derived SSO credentials, which can affect Wi-Fi, Ethernet, and VPN links that use MS-CHAPv2.

Two other known issues stay open on the same page as the Smart App Control bug.

WHAT KB5127648 FIXED AND WHAT IT LEFT OPEN

The Remote Desktop failure started with the September 22 preview KB5124010. Non-admin users can fail to reach a host that has Administrator protection on Windows 11 enabled, with error 0xC000000D and the message “The token that was passed to the function is invalid.” Microsoft’s security baselines for 24H2, 25H2, and 26H2 turn Administrator protection on unless the organization changed that policy. The temporary step is to reset the User Account Control Type Of Admin Approval Mode policy, which lowers that protection until a later update.

USB Audio Class 1.0 devices can still fail to start, play nothing, or leave volume at zero after the September 8 patch. The September 14 out-of-band update KB5129195 fixed the 8-channel and 3D cases. Other symptoms are still open, and Microsoft tells business customers to call Support for Business if they need a workaround now.

24H2 Home and Pro Get Their Last Patch

Microsoft’s note on KB5127648 also says Windows 11 version 24H2 Home and Pro has reached end of updates. The October 2026 monthly security update is the last one those editions will get. Devices on those editions will no longer receive monthly security and preview updates, and Microsoft tells those PCs to move to the latest version of Windows 11.

That makes the grayed Smart App Control option a sharper problem on 24H2 Home and Pro than on 25H2 or 26H2. This package is the last monthly Microsoft plans to send them. If the On switch is already gray, the registry commands or the Feature Preview policies are the supported way back until a later Windows version replaces that build. Microsoft has not said the workaround will be restated as a permanent change.

Check Windows Security, App and browser control, Smart App Control settings, before you assume you are fine. If the control is on, the October bug is not yours. If it is off and gray, Microsoft’s two FeatureManagement values, a restart, and then the On option are the steps the company is offering, with no date attached to the real fix.