Alvise C.Updated on 14 October 2026.
Have you downloaded a program only for Windows to prevent it from starting, saying that Smart App Control blocked an untrusted app? The message can also appear with legitimate software. .
Smart App Control, abbreviated SAC and also called Smart App Control, is a feature of Windows 11 that controls code execution by combining Microsoft assessment services with code integrity. So it doesn’t just ask whether you want to open a file: it can prevent it from running.
In this guide, we look at how it works, where to configure it, what the three available states mean, and how to investigate a block. There’s also an important new development: recent updates let you turn it back on without reinstalling Windows on devices where the feature is available.
What is Smart App Control and what is it for?
The goal is to reduce the execution of untrusted code before it can carry out its activities on the computer. Microsoft describes SAC as a combination of application intelligence services and Windows code integrity features.
The term “app” shouldn’t make you think only of a program with an icon on the desktop. An installation may involve executables, DLL libraries, scripts, temporary components, and uninstallers. Microsoft recommends that developers consider and sign the entire software chain.
This explains a frequent diagnostic scenario: the main installer opens, but a component it tries to launch is blocked. To understand the problem, you need to identify the file involved rather than assume that the entire package is necessarily harmful.
How it decides which programs can run
The general logic described in Microsoft’s FAQ is as follows:
- The cloud-based security service assesses the app.
- If it considers the app safe, SAC allows it to run.
- If it considers it harmful or potentially unwanted, it blocks it.
- If the assessment isn’t sufficiently certain, it checks the digital signature; a valid signature may allow the app to start, while unknown code without a valid signature is blocked.
A digital signature makes it possible to verify the file’s publisher and integrity. It doesn’t mean that any signed software should be considered harmless: signing, reputation, and security classification are different things. The application control documentation specifies that code determined to be unsafe is blocked.
The absence of a signature must also be interpreted correctly. A small program written by an independent developer may be legitimate and unsigned. The block alone doesn’t prove that there’s a virus; it indicates that the code didn’t meet the required checks.
For example, a newly compiled utility distributed to only a few users may not yet have sufficient reputation. Before changing your PC’s protections, it’s worth verifying its source, version, and signature with its distributor.
Smart App Control, SmartScreen, and antivirus: the differences
The names are similar, but the functions aren’t interchangeable.
| Protection | Main purpose | How to interpret its action |
|---|---|---|
| Smart App Control | Control code execution based on trustworthiness and policies | Can prevent an app from starting without offering an exception for that individual app |
| Microsoft Defender SmartScreen | Assess websites, downloads, and apps based on reputation | Can show warnings about dangerous content or content with insufficient reputation |
| Antivirus | Detect and manage malware using its own engines and checks | It should remain active even when using application control |
| App Control for Business | Apply execution policies defined by the organization | Allows business software management |
SmartScreen includes protection against phishing and dangerous websites, as well as checks on downloaded files and their signatures. SAC, by contrast, is an execution control based on App Control technologies.
SAC doesn’t replace antivirus. Its presence is no reason to disable Microsoft Defender or a third-party antivirus.
When reporting a problem, give the exact name of the protection in the message. “Windows blocked the file” isn’t enough to choose the right procedure. A SmartScreen warning and a SAC block should be diagnosed separately.
Availability and requirements: what to check today
Smart App Control was introduced for consumer users starting with Windows 11 version 22H2. It isn’t available on Windows 10.
Don’t confuse general availability with the status on an individual computer: a feature present in Windows may be disabled, unavailable, or managed differently depending on the configuration.
Is a clean installation still required?
In the first versions, SAC required a fresh Windows installation; turning it off prevented it from being turned back on normally without a reset or reinstallation.
This rule should no longer be presented as universal. The update notes dated 26 March 2026, KB5079391, for Windows 11 24H2 and 25H2, document the start of the rollout of the ability to turn SAC on and off without a clean installation. The current Microsoft FAQ confirms this is possible on devices where the feature is available.
The rollout was described as gradual: citing the KB doesn’t guarantee the same behavior on every configuration. Some Microsoft pages still list the previous requirement. For this new feature, the updated FAQ and release notes are the reference, along with the options actually shown on the PC.
Before considering a reinstallation:
- install available Windows updates;
- check the version and build with Win+R > winver;
- reopen the SAC settings;
- read any message that prevents activation.
Don’t try to force-install an old KB on a system that’s already updated: the number documents the introduction of the feature.
Where to find it and check its status
Open Start, search for Security in Windows and select:
App & browser control > Smart App Control settings.
Here you can check the status and available options.
| Status | Meaning |
|---|---|
| On | SAC applies its checks and may block untrusted code |
| Evaluation | Windows observes whether the protection suits your usage; SAC doesn’t block apps during this phase |
| Off | SAC protection isn’t active |
The evaluation may end with SAC being turned on or off. Microsoft also distinguishes returning to evaluation mode, which its relevant page continues to associate with resetting or reinstalling, from the new option to turn SAC back on. The two operations shouldn’t be confused. [4]
Why Smart App Control is turned off
The FAQ lists possible causes such as organizational management, developer mode, manual deactivation, S mode, and optional diagnostic data settings.
This list can help guide your investigation, but it isn’t a reason to change everything indiscriminately. If the device is managed by your organization, check with IT about which application protection has been chosen. If you develop software, check whether the block involves code generated during compilation and testing.
The section on diagnostic data retains guidance tied to the initial configuration alongside the new activation options. It’s therefore not correct to guarantee that turning on a single diagnostic option today will solve every case.
Avoid registry changes to force a state that the interface doesn’t allow: they may hide the cause and don’t replace a supported configuration.
What to do when SAC blocks a program
The first useful question is: which file was blocked, and where did it come from?
1. Keep the message details
Note the file name, path, publisher, version, and when the block occurred. If the problem happens during installation, indicate at which stage it occurs.
This information is useful for comparing the file with the one distributed by the publisher and for finding the corresponding event.
2. Verify the package with the publisher
Check that the download comes from the official website and that an updated version is available. If the publisher provides a package hash, compare it with the hash of the downloaded file.
This check establishes whether you’re examining the expected package; on its own, it doesn’t certify that the software is safe.
3. Check the digital signature
For a technical check, you can use PowerShell:
Get-AuthenticodeSignature -LiteralPath 'C:\Percorso\programma.exe' |
Format-List Status, StatusMessage, SignerCertificateReplace the path with the actual one. The command reads the signature information and doesn’t run the program. [9]
A result of Valid indicates that the signature passes the check performed by the cmdlet; NotSigned indicates that no signature was detected. The result isn’t an antivirus verdict and doesn’t reproduce all of SAC’s decisions.
4. Find the component that was actually blocked
If the setup file is signed, check whether the event instead concerns a DLL or a temporary executable. Send the details to the publisher: signing only the initial file may leave other components outside the intended chain of trust. [6]
5. Consider turning it off only after diagnosis
Microsoft doesn’t currently provide a command to allow an individual app through SAC. [2]
Turning it off removes this layer of control for the system, not just for the program you’re interested in. Before proceeding, consider an updated, signed version or an equivalent alternative.
How to turn it off and back on
On the Smart App Control settingspage, select Off and confirm any prompts.
To turn it back on, return to the same page and select On, if available. Recent updates allow it to be turned back on without a clean installation on eligible devices.
However, read your system’s message before confirming: on configurations that retain the previous behavior, turning it back on may require different steps.
The practical rule is simple: don’t habitually turn off a protection that is working, and don’t promise that it can be turned back on immediately without checking the PC’s interface.
Advanced diagnostics: Event Viewer and CiTool
For administrators and developers, Microsoft documents the logs:
Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
Events 3077 relate to blocks in enforcement mode; events 3076 are associated with auditing. However, SAC’s standard evaluation mode doesn’t normally record these audit events: specific policies are intended for testing. [10]
You can also list the policies with:
citool.exe -lpMicrosoft associates VerifiedAndReputableDesktop with active mode and VerifiedAndReputableDesktopEvaluation with evaluation mode, when the policy is applied.
Check the policy name, file, and time: a CodeIntegrity event may also belong to other App Control configurations. The log identifies blocked files, but it doesn’t necessarily explain the entire failure of an installer.
Collect evidence on the affected PC before changing policies. For audit testing, use a dedicated environment and the Microsoft procedure linked in the sources.
What developers need to know
Signing should be integrated into product distribution: executables, DLLs, setup components, scripts, and uninstallers should all be included in testing.
The English documentation, updated on 28 September 2026 indicates support for signing certificates using RSA and ECC issued by trusted providers. Some translations still list the old limitation concerning ECC. This is another detail for which you should consult updated documentation and check the target systems.
Microsoft lists Artifact Signing among the tools for signing apps and also documents the use of SignTool. A self-signed signature shouldn’t automatically be considered equivalent to one issued by a trusted provider.
Include installation, updating, startup, features that load add-ons, and uninstallation in the test plan. An application starting correctly doesn’t prove that all its operations are compatible.
Smart App Control in the workplace
SAC offers a setting aimed at consumer users and environments with a relatively simple set of applications. An organization with in-house software and specific requirements should evaluate App Control for Business.
This technology lets you build policies that include business applications. Microsoft provides the SAC policy as a starting point, but documents necessary adaptations: copying it without changes isn’t the same as designing a complete business solution.
In practice, an IT department should inventory the software, test policies in audit mode, manage necessary exceptions, and prepare recovery before deployment. The advantage is retaining control over execution without relying on turning off protection on every PC.
Limitations and frequently asked questions
Does a blocked app definitely contain a virus?
No. It could be harmful, but it may also lack sufficient evidence to be considered trustworthy. The message means the file needs to be checked.
Is it enough if the antivirus finds nothing?
A negative scan result is useful information, not an absolute guarantee. Antivirus and application control assess different things.
Does it work only with apps from the Microsoft Store?
The feature assesses code and applications based on reputation and signature, not just on the store they came from.
Do you need a Copilot+ PC or an AI subscription?
SAC is a security feature of Windows 11. The cited sources don’t present it as a service that requires a Copilot subscription or a Copilot+ PC.
Can I trust the same decisions when I’m offline?
The assessment described by Microsoft includes cloud services and signature checks. It isn’t correct to promise that every file will receive the same verdict under all connectivity conditions. For software that’s needed offline, verify the actual workflows in a representative environment before deployment.
Does it slow down the PC?
The sources used here don’t provide a universal impact percentage. If you notice slowdowns, measure startup, installation, and the operations of the program in question; don’t automatically attribute every slowdown to SAC.
Does it protect against all online scams?
It doesn’t replace evaluating links, payment requests, or credentials. The fact that a program can run doesn’t guarantee the trustworthiness of every operation performed inside it.
Is it best to leave it on?
For a personal PC running compatible applications, SAC adds a useful check before execution. If it doesn’t interfere with your work, turning it off preemptively offers little benefit.
For people who develop or use specialist software, the choice requires more care: identify the components involved and check their signatures and compatibility. In a business environment, an App Control policy designed for the required applications may provide more suitable management.
When a block appears, start with the name of the protection and the affected file. This diagnosis makes it possible to request a fix from the publisher or make an informed decision, avoiding turning every startup error into a blanket disabling of security.
