Windows 11: a fix for the greyed-out Smart App Control switch
On Windows 11 25H2 and 26H2, KB5127936 or a later update fixes blocked re-enabling. The 24H2 case is separate: check your version before applying a registry workaround.
Getting started
Generated image · SecuFocus
At a glance
Key points
Unable to turn Smart App Control back on after the October update? Microsoft confirms a fix for Windows 11 25H2 and 26H2. Check your Windows version and available updates first: on those two branches, KB5127936 or a later update removes the need for the manual workaround in the earlier notice. That resolution does not automatically extend to 24H2.
Blocked re-enabling does not mean active protection was switched off
The KB5127648 notice describes a greyed-out switch on some devices after the update: Smart App Control cannot be turned on if it was previously turned off. Microsoft says devices where the feature is already on are unaffected and remain protected by it.
Smart App Control helps block malicious or untrusted applications. It works alongside other security software; it is not the name of the entire antivirus system. This regression therefore proves neither that your PC is infected nor that all its protections have stopped.
25H2 and 26H2 have a fix; 24H2 follows a different path
The resolution in KB5127648 points to updates released on and after 27 October 2026, including KB5127936, for 25H2 and 26H2. The KB5127936 page itself is titled 28 October and labelled Preview. It explicitly confirms the Smart App Control fix. We retain that date difference between the two pages rather than invent a rollout time.
For those two branches, Microsoft recommends the latest update suitable for the device and says the workaround is no longer needed after this fix. KB5127936 lists build 26200.9818 for 25H2 and 26300.9818 for 26H2.
For 24H2, or an update older than the stated threshold, the earlier notice still offers registry or Group Policy workarounds. It does not declare this issue resolved on 24H2. The policies are intended for administrators and both must be configured; this is not a reason to make speculative registry edits on a personal PC.
| Windows 11 | Fix identified in the notices |
|---|---|
| 25H2 | KB5127936, build 26200.9818, or a suitable later update |
| 26H2 | KB5127936, build 26300.9818, or a suitable later update |
| 24H2 | These two KBs do not announce a resolution for this branch |
Check the setting again after updating
Identify your Windows version, check Windows Update and save your work before any requested restart. Then return to Smart App Control in Windows Security to check its state. On a work PC, let the administrator choose the update route and any policies.
Fixing this regression does not make every device eligible for Smart App Control. The general documentation still describes conditions related to the Windows installation and distinguishes Evaluation, On and Off modes. A greyed-out switch alone is not a reason to reset the PC or disable another protection. If it remains blocked, review the installed version and those conditions with support.
SecuFocus read the notices and documentation. We did not install the fix or change a device’s registry for this article.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.