Recently, Microsoft changed the security feature Smart App Control on Windows so that it could be enabled on existing installations. Previously, the feature could only be activated on new systems. Even worse, once turned off, it could not be enabled again without setting up the system anew.
Clearly, this meant that many Windows users never came into contact with the feature in first place. Microsoft changed the behavior so that Smart App Control could be enabled on all Windows devices.
This week, the company had to admit that the most recent Windows updates could cause problems with enabling the security feature on Windows devices.
After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out.
Devices where Smart App Control is already turned on are not affected and remain protected.
Good news is that the issue does not affect systems with Smart App Control enabled. However, it may affect Windows users who want to enable the feature, as they may not be able to do so.
Even better, there is a Registry workaround that should enable the toggle functionality again.
Option #1: Modify the registry
You can modify the registry to restore the ability to turn on Smart App Control by following these steps:
Open a Command Prompt window by typing cmd in the Search box.
Select Run as administrator.
At the command prompt, enter the following commands. Then restart the device.
reg add “HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides” /v 2883193997 /t REG_DWORD /d 1 /f
reg add “HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides” /v 2850574478 /t REG_DWORD /d 1 /f
Option #2: Install a Group Policy
IT administrators can instead choose to mitigate this issue for enterprise-managed devices managed by IT departments by installing and configuring the special Group Policies listed below.
Group Policy downloads with Group Policy name:
- Download #1 for Windows 11, versions 24H2, 25H2, and 26H2 — KB5074105 261015_19222 Feature Preview
- Download #2 for Windows 11, versions 24H2, 25H2, and 26H2 — KB5074105 261015_19221 Feature Preview
Important: You should install and configure both Group Policies to resolve this issue. The first Group Policy is needed to turn on Smart App Control. The second Group Policy ensures that logging is available to assist with troubleshooting in case any problems arise.
The special Group Policies can be found in Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2. After installing the Group Policies, configure the value for both settings to Enabled and restart your device(s) to apply the Group Policy settings.
Should you use it?
While Smart App Control may sound good on paper with its threat blocking happening before actual execution, its lack of exceptions makes it highly problematic. Furthermore, since it relies on online checks, it may also be problematic from a privacy point of view.