Microsoft has confirmed that this month’s KB5127648 security update for Windows 11 can leave some PCs unable to turn Smart App Control on. On affected devices running Windows 11 version 24H2 or later, the Smart App Control option in the Windows Security app is greyed out and cannot be toggled. Smart App Control is the Windows 11 feature that uses Microsoft’s app intelligence and code-integrity checks, alongside Microsoft Defender and SmartScreen, to block potentially harmful apps and binaries.
The scope is narrow. Microsoft says devices where Smart App Control is already turned on are not affected and remain protected; the problem only bites when the feature was off and someone tries to switch it on after installing the update. No fix is available yet. For enterprise-managed devices, Microsoft has published temporary workarounds: two registry values under the FeatureManagement Overrides key, or two Group Policy templates (KB5074105 261015 Feature Preview) that admins set to Enabled and then restart the device.
How to check if you’re affected
Affected devices are Windows 11 PCs on version 24H2, 25H2 or 26H2 that have installed KB5127648 and have Smart App Control turned off.
- Open Settings > Windows Update > Update history and look for KB5127648.
- Open the Windows Security app and find the Smart App Control setting. If the option to turn it on is greyed out, you have the issue.
- If Smart App Control already shows as on, nothing changes for you.
- Microsoft’s published workarounds are aimed at enterprise-managed devices and IT administrators; watch the KB5127648 advisory for a fix.