Smart App Control won’t turn on: the fix KB5127936 (workaround)

The option to turn on Smart App Control turned gray after Windows updates 11? Microsoft has documented an issue that can prevent protection from being turned back on after it has been disabled. According to the Windows release health advisory provided to the editorial team, the issue is now resolved with KB5127936, in updates released from 27 October 2026.

The important distinction is the feature’s previous state: devices on which Smart App Control was already enabled are unaffected and retain this protection. The issue concerns the ability to turn it back on, not a general deactivation on updated PCs.

What happens on affected devices

The update behind the issue is KB5127648, the cumulative security update of 13 October 2026. After it is installed, on some computers the Windows Security app may show the option to turn on Smart App Control as unavailable.

To identify the case described in the advisory, you therefore need to consider both the symptom and the update history. The mere fact that Smart App Control is disabled is not enough: the feature may also be in that state for reasons related to the device configuration. Microsoft’s FAQs, for example, mention the role of organizational management and developer mode.

This is also not the same issue as an app being blocked by SAC: in that case, protection intervenes when a file is run; here, the command to turn protection back on is unavailable.

Affected versions and the update that fixes the issue

The updated advisory provided to the editorial team lists these associations.

The status shown is Resolved, meaning fixed. The advisory specifies that installing KB5127936 or a later update that includes the fix means you do not need to apply the workarounds listed below.

The temporary policy packages have a stated broader scope and also mention Windows 11 24H2. This does not automatically change the version table shown in the two advisories: package names and the list of affected platforms are details to be read separately.

The preferred solution: update Windows and check SAC

For anyone experiencing this specific issue, the first step is to install the update that fixes it, or a later cumulative update that includes it. Microsoft’s advisory recommends keeping the device up to date so it also receives other available fixes.

On a personal PC:

1. Open Settings > Windows Update and check for available updates.
2. Check that the offered update applies to your version of Windows; complete the installation and restart if prompted.
3. Open Windows Security > App & browser control > Smart App Control settings.
4. Check that the option is available again and, if you want to use SAC, turn it on.

Installing the fix and enabling protection are two separate steps. The command becoming available again should not be taken as confirmation that SAC is already on: check its actual status on the relevant screen.

If the computer is managed by your organization, the update must be deployed through the channels established by the organization. The package not immediately appearing on the Windows Updatescreen, by itself, does not prove that the fix does not exist.

Registry workaround: only for systems that still don’t have the fix

The advisory retains a temporary procedure for affected devices running updates released before 27 October. If you have already installed the fix, this change is not needed for the issue described.

Before making changes, back up the Registry and make sure you know how to restore it. Microsoft documents exporting the affected key via Registry Editor > File > Export. Also save the existing values: the following commands use /f, which lets you overwrite without a confirmation prompt.

To apply the official workaround:

1. Search for cmd in the Start menu.
2. Select Run as administrator.
3. Run the following two commands, one per line.

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

Then restart the computer and return to the Smart App Control settings to check whether the option to turn it on is available. Both commands are part of the procedure specified by Microsoft.

This measure should be limited to the documented issue: it is not a universal procedure for forcing SAC on in any configuration. The recommended solution remains the update that fixes the issue.

Organizational devices: both special policies are required

For managed computers, Microsoft also proposes mitigation using two Group Policy packages. The advisory lists these official downloads:

• KB5074105 261015_19222 Feature Preview — package 1.
• KB5074105 261015_19221 Feature Preview — package 2.

Both must be installed and configured: the first restores the ability to turn on Smart App Control; the second makes event logging available to help diagnose any issues. Installing the MSI files alone does not complete the procedure.

After installation, the policies are available at the path specified in the advisory:

Configurazione computer
  > Modelli amministrativi
  > {nome del criterio di gruppo}
  > Windows 11, version 24H2, 25H2

Set both settings to Enabled and restart the devices to apply them. The references to KB5074105 in the names identify the temporary policy packages: they do not replace KB5127936 as the update that fixes the issue, as listed in the advisories.

Do you need to reinstall Windows to turn Smart App Control back on?

For this issue, the documented solution is the update: reinstalling is not listed as the first step.

The confusion may stem from the rules in the first versions of SAC. Microsoft’s updated FAQs explain that recent updates let you re-enable the feature without a clean install, on devices where it is available. This does not mean it is guaranteed to be possible on every configuration, nor should re-enabling be confused with returning to evaluation mode.

To learn more about how it works and the available states, see our complete guide to Smart App Control.

If the option is still unavailable after the update, note the Windows version, installed updates, and message shown on the screen. These details help distinguish a persistent issue from another device condition before making further changes.