Smart App Control Toggle Grayed Out After October Patch
Microsoft has confirmed that this month's Windows 11 security update, KB5127648, released October 13, 2026, can leave Smart App Control stuck in a disabled, grayed-out state. Devices running Windows 11, version 24H2 and later that install the update may find they are unable to turn Smart App Control on if the feature was previously switched off. Microsoft says machines that already had Smart App Control enabled before installing the update are not affected and remain protected — the bug only blocks a fresh attempt to turn the feature on afterward.
The company has not shipped a permanent fix. For now, it has published a registry edit and a Group Policy-based workaround for IT administrators managing affected fleets.
Details
| Attribute | Value |
|---|---|
| Update | KB5127648 (October 2026 cumulative update) |
| Release date | October 13, 2026 |
| Affected OS builds | 26100.9711 (24H2), 26200.9711 (25H2), 26300.9711 (26H2) |
| Affected feature | Smart App Control |
| Symptom | Toggle appears grayed out; cannot be enabled if previously off |
| Unaffected devices | Those with Smart App Control already on before the update |
| Fix status | No permanent fix yet — workarounds only |
| Related issue (same KB) | WPA2-Enterprise 802.1X/PEAP Wi-Fi authentication failures |
What Happened
The update and the feature it affects
Smart App Control is a Windows 11 security feature that layers Microsoft's app intelligence service and code-integrity checks on top of Microsoft Defender and SmartScreen to block potentially malicious or untrusted applications and binaries before they run. It is typically enabled during a clean install of Windows 11 or manually turned on afterward through the Windows Security app. Once disabled, Microsoft has long required a full OS reinstall to turn it back on under normal circumstances — which makes this bug particularly disruptive for anyone who had the feature off and now cannot flip it on through the usual flow either.
KB5127648 shipped as the standard October 2026 cumulative security update for Windows 11, covering builds 26100.9711, 26200.9711, and 26300.9711 across the 24H2, 25H2, and 26H2 servicing branches. Shortly after rollout, Microsoft added a known-issue entry acknowledging that the update can leave the Smart App Control toggle grayed out and unresponsive in the Windows Security app on affected devices.
Who is impacted
The scope is narrower than it first sounds. Only devices where Smart App Control had been turned off prior to installing KB5127648 are affected — these systems lose the ability to re-enable the feature through the normal UI. Devices that already had Smart App Control turned on before the update are explicitly called out by Microsoft as unaffected and remain protected as before. There is no indication the bug disables an already-active Smart App Control session.
The same update has a second, unrelated bug
KB5127648 is also linked to a separate, unrelated problem affecting WPA2-Enterprise (802.1X/PEAP) Wi-Fi authentication on domain-joined and enterprise-managed devices, tied to changes around NTLMv1 deprecation. Microsoft has published a distinct fix for that issue (adjusting the BlockNtlmv1SSO value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0). Administrators troubleshooting KB5127648 fallout should confirm which of the two problems they're actually dealing with before applying either fix, since the symptoms and remediation paths do not overlap.
Current workarounds
Microsoft has published two mitigation paths for IT administrators while a permanent fix is in development:
Option 1 — Registry edit. Run the following commands from an elevated Command Prompt, then restart the device:
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f
Option 2 — Group Policy. Install the KB5074105 Feature Preview packages (the 261015_19222 and 261015_19221 MSI builds) for the affected Windows 11 version, then enable both related Group Policy settings under Computer Configuration → Administrative Templates. Microsoft notes both policies are required: one actually turns Smart App Control on, and the second enables logging that is needed to assist with troubleshooting if problems occur afterward.
Microsoft states it "is working on a resolution and will provide an update in an upcoming release," but has not given a target date for a permanent patch.
Impact Assessment
| Impact Area | Description |
|---|---|
| Endpoint security posture | Devices with Smart App Control off before the update cannot close that gap post-patch, leaving them without an extra layer of app-intelligence/code-integrity protection |
| IT administration overhead | Enterprise fleets need manual registry pushes or Group Policy deployment to work around the bug at scale |
| Already-protected devices | No impact — systems with Smart App Control already on remain covered |
| Troubleshooting complexity | Overlap with the unrelated WPA2-Enterprise/PEAP Wi-Fi bug in the same KB increases risk of misdiagnosis |
| Update hygiene | Another entry in a string of October 2026 Windows servicing issues, which may prompt cautious admins to delay rollout on non-critical rings |
Recommendations
For IT administrators
- Confirm which affected build (26100.9711, 26200.9711, or 26300.9711) is deployed across managed fleets before choosing a workaround path.
- Deploy the registry workaround via existing configuration-management tooling (Intune, Group Policy, SCCM) rather than manually touching individual endpoints.
- If using the Group Policy path, install both KB5074105 Feature Preview MSI packages and enable both policies — a partial deployment leaves logging unavailable for troubleshooting.
- Track Microsoft's Windows release health dashboard for the promised follow-up fix before removing the interim workaround.
For security teams
- Audit which managed devices had Smart App Control disabled prior to October 13, 2026, and prioritize those for remediation, since they are the only systems actually affected.
- Do not assume this bug and the WPA2-Enterprise/PEAP authentication issue share a root cause or fix — verify symptoms against each known-issue entry separately.
- Treat devices stuck unable to enable Smart App Control as a temporary gap and compensate with existing Defender/SmartScreen policy baselines until the toggle is restored.
For end users
- If Smart App Control was already on before installing this month's update, no action is needed.
- If you tried to turn Smart App Control on after installing KB5127648 and the toggle is grayed out, hold off on a full OS reinstall — check for a Microsoft-published fix before resorting to that workaround.
- Home users without IT support should wait for the official patch rather than attempting manual registry edits unless comfortable doing so.
Key Takeaways
- KB5127648, Microsoft's October 13, 2026 Windows 11 cumulative update, can leave Smart App Control permanently grayed out for devices that had it switched off.
- The bug affects builds 26100.9711, 26200.9711, and 26300.9711 across Windows 11 24H2, 25H2, and 26H2.
- Devices with Smart App Control already enabled before the update are unaffected and stay protected.
- No permanent fix exists yet; Microsoft offers only a registry edit or Group Policy workaround for enterprise-managed devices.
- The same update separately breaks WPA2-Enterprise 802.1X/PEAP Wi-Fi authentication — a distinct bug with its own fix, not to be confused with the Smart App Control issue.
- Microsoft says a resolution is in progress but has not committed to a release date.