Smart App Control Grayed Out After KB5127648? The Fix

The toggle is there. It is just dead. That is how most people are describing the Smart App Control page in Windows Security this week: the option to turn it on is visible but grayed out, and nothing you click changes it.

Microsoft added this to the known-issues list for KB5127648 on October 16 and published two workarounds. Both are short. One takes about ninety seconds. The longer part of this article is making sure the bug is actually what you have, because Smart App Control has been hard to turn back on for years for reasons that have nothing to do with this update.

Contents

• Why is Smart App Control grayed out after the October 2026 update?
• Who is affected by the KB5127648 Smart App Control bug?
• How do you confirm this bug is your problem?
• Fix 1: Two Registry Values That Unlock the Toggle
• Fix 2: The Group Policy Route for Managed PCs
• Should you uninstall KB5127648 instead?
• What else did KB5127648 fix or break?
• Why was Smart App Control so hard to turn on in the first place?
• Tips
• Warnings
• FAQ
• Sources

Why is Smart App Control grayed out after the October 2026 update?

Smart App Control is grayed out on some Windows 11 PCs because the October 13, 2026 security update KB5127648 introduced a known issue in which, in Microsoft’s words, “some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off,” according to the KB5127648 support page.

Microsoft has not said what inside the update caused it. The shape of the workaround gives a strong hint. Both fixes flip two feature-management overrides, which is the mechanism Windows uses to stage features on and off per device. Something in KB5127648 appears to have left the “allow turning Smart App Control on” flag in the off position on affected machines.

The update itself installs OS builds 26300.9711 for version 26H2, 26200.9711 for 25H2 and 26100.9711 for 24H2.

Who is affected by the KB5127648 Smart App Control bug?

The KB5127648 Smart App Control issue affects only Windows 11 devices on versions 24H2, 25H2 or 26H2 where Smart App Control was already turned off before the update was installed, and Microsoft states that “devices where Smart App Control is already turned on are not affected and remain protected.”

So if your PC shows Smart App Control as On today, you can stop reading. Nothing changed for you.

The affected group is people who had it off, installed the October update, and then tried to switch it on. That is a smaller group than the headlines suggest, because for most of the feature’s life you could not switch it on at all after turning it off. More on that below.

When I checked the release-health page for Windows 11 26H2 on October 17, I noticed that the Smart App Control entry appears only on the KB5127648 page itself and not yet in the version’s known-issues table, which still lists the Remote Desktop 0xC000000D failure and the USB audio Code 10 problem. If you are tracking it, the KB page is the place to watch.

How do you confirm this bug is your problem?

You can confirm the KB5127648 Smart App Control bug by checking that your PC is on build 26100.9711, 26200.9711 or 26300.9711 and that the Smart App Control page under Windows Security, App & browser control shows the On option as unavailable while the state reads Off.

Run through this in order. Each line rules out a different cause.

If the first three rows match and the last four are clear, the registry fix below is for you. If any of the last four rows fail, you have one of the older reasons Smart App Control stays off, and KB5127648 is not the cause. Microsoft’s Smart App Control overview lists those reasons: enterprise management, Developer Mode, S mode, a manual turn-off, or optional diagnostic data being disabled.

Fix 1: Two Registry Values That Unlock the Toggle

Microsoft’s first workaround is to add two DWORD values under the FeatureManagement Overrides key and restart. The commands below are copied from the KB5127648 page. Back up the registry first; Microsoft says so and so do I.

1. Type cmd in the Search box, then select Run as administrator on Command Prompt.
2. Paste the first command and press Enter:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f

3. Paste the second command and press Enter:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

4. Each command should reply “The operation completed successfully.” If it says access denied, the prompt is not elevated. Close it and repeat step 1.
5. Restart the PC. Not sign out. Restart.
6. Open Windows Security, go to App & browser control, then Smart App Control settings. The On option should now be selectable.

Microsoft describes the first value as the one that restores the ability to turn Smart App Control on and the second as enabling logging for troubleshooting. Add both. The KB page says both are needed.

This part trips a lot of people up: the values must go under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft, not under HKLM\SOFTWARE\Policies. The two paths look similar and only one works.

To undo the workaround later, once Microsoft ships the real fix, delete the two values you added. That is my note, not Microsoft’s; the KB page does not yet describe a removal step.

Fix 2: The Group Policy Route for Managed PCs

For enterprise-managed devices Microsoft offers two downloadable Group Policy packages named “KB5074105 261015_19222 Feature Preview” and “KB5074105 261015_19221 Feature Preview,” both of which must be installed and set to Enabled before a restart, according to the KB5127648 page.

The download links are on the KB page under the known-issue entry. After installing both, the settings appear in Group Policy Editor under Computer Configuration, then Administrative Templates, then the Group Policy name, then Windows 11, version 24H2, 25H2. Set both to Enabled and restart the affected devices.

Microsoft is explicit that both are required: “The first Group Policy is needed to turn on Smart App Control. The second Group Policy ensures that logging is available to assist with troubleshooting.”

If your PC is managed and you are not the administrator, this is the version to send to IT. Do not run the registry commands on a managed device without asking; policy may simply overwrite them at the next refresh.

Should you uninstall KB5127648 instead?

Uninstalling KB5127648 to recover the Smart App Control toggle is a poor trade, because the update is the October 2026 security release and removing it strips every security fix it contains in exchange for a toggle that two registry values restore in under two minutes.

There is a second problem with the uninstall route. Windows 11 version 24H2 Home and Pro reached the end of their update support with this release, as covered in our earlier piece on Windows 11 24H2 support ending October 13, 2026. On a 24H2 PC, KB5127648 is the last security update you will get. Removing it leaves nothing newer to replace it.

Most people skip this and regret it.

Apply the workaround, keep the update, and let Microsoft’s “resolution in an upcoming release” land on its own.

What else did KB5127648 fix or break?

KB5127648 resolved the Explorer black-screen problem on Azure Virtual Desktop hosts, the Always On VPN connection failures and the AC-3 audio crash that arrived with September’s KB5124010, while leaving the Remote Desktop 0xC000000D error and the USB Audio Class 1.0 Code 10 issue open, according to Microsoft’s KB page and its Windows 11 26H2 release-health page.

If the Remote Desktop line is your problem rather than Smart App Control, we walked through that one separately in Remote Desktop Error 0xC000000D After a Windows 11 Update?. The workaround there is a policy change, not a registry edit.

Why was Smart App Control so hard to turn on in the first place?

Smart App Control was designed to be enabled only on a fresh Windows 11 installation, and for most of its existence Microsoft’s own guidance was that a PC which had the feature turned off needed to be reset or have Windows reinstalled, with optional diagnostic data switched on during setup, before it could be turned on again.

That history is why this bug is confusing. Microsoft’s Smart App Control overview now says that “recent Windows updates allow Smart App Control to be enabled within the Windows Security App without requiring a clean installation.” The ability to just flip it back on is new. KB5127648 broke the new ability on some PCs, which to a user looks identical to the old restriction.

If you have never seen the On option available on your PC, you may be in the old situation rather than the new bug. The registry fix will not help a machine where Smart App Control is unavailable because optional diagnostic data is off, and Microsoft’s page still says a reset with diagnostic data enabled is the route in that case.

What the feature does, for anyone deciding whether it is worth the trouble: when you run an app, Smart App Control asks Microsoft’s cloud service whether it “can make a confident prediction about its safety.” Safe apps run. Known-bad or unwanted apps are blocked. If the service cannot decide, the app must carry a valid signature or it is blocked too. That last rule is why developers and people who run unsigned tools tend to turn it off, and why Microsoft turns it off automatically when Developer Mode is enabled.

Tips

• ✅ Export the registry key before you add anything. In Registry Editor, right-click the Overrides key and choose Export. It takes ten seconds and gives you a clean rollback.
• ✅ After the restart, if the On option is still gray, confirm both reg add commands actually wrote by running reg query “HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides” and checking that both value names appear with data 0x1.
• ✅ Turn Smart App Control on before installing anything unsigned. Once it is on it will block unsigned installers, so sequence your software setup accordingly.
• ✅ Check the KB5127648 page again in November. Microsoft typically updates the known-issue entry with the resolving KB number, and that is your signal to remove the override values.
• ✅ On a 24H2 Home or Pro PC, plan the move to 25H2 or 26H2 now. KB5127648 was the last security update for 24H2 consumer editions.

Warnings

• Registry edits made incorrectly can prevent Windows from starting. Use the exact key path and value names from the KB page, and back up first.
• Do not run the registry commands on a company-managed PC without IT approval. Group Policy may override them, and the organization may have disabled Smart App Control deliberately.
• The workaround restores the ability to turn Smart App Control on. It does not turn it on. You still have to select On in Windows Security afterward.
• Smart App Control, once on, blocks unsigned apps without a per-app allow option. If you depend on unsigned software, turning it on will stop that software from running.

FAQ

Does the KB5127648 bug turn Smart App Control off on PCs that had it on?

No. Microsoft states that devices where Smart App Control is already turned on are not affected and remain protected. The bug only prevents turning the feature on when it was already off before the update was installed.

Will the registry workaround be undone by the next Windows update?

Microsoft has not said. The values sit under a policy override key that updates do not normally clear, so expect them to persist until you remove them. Once the KB page lists a resolving update, delete the two values and confirm the toggle still works.

Can I use the registry fix on Windows 11 23H2?

The known issue and its workaround apply to versions 24H2, 25H2 and 26H2, which received KB5127648. Windows 11 23H2 got a different October update, KB5126653, and Microsoft has not listed the Smart App Control issue for it.

Sources

• Microsoft Support — October 13, 2026, KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711), known issues and workarounds
• Microsoft Support — What is Smart App Control?
• Microsoft Learn — Windows 11, version 26H2 known issues and notifications
• Help Desk Geek — KB5127648 Smart App Control bug explained (October 2026)

Fact-checked against Microsoft’s KB5127648 support page, the Smart App Control overview and the Windows 11 26H2 release-health page as of October 17, 2026. Registry commands are reproduced from Microsoft’s page; apply them at your own risk and back up first.