Windows 11 October update can stop Smart App Control turning back on

Windows 11 October update can stop Smart App Control turning back on

16 October 2026: Microsoft has confirmed that KB5127648, the October security update for Windows 11 versions 24H2, 25H2 and 26H2, can leave Smart App Control impossible to switch back on once it has been turned off. Devices where the feature is already on are not affected and stay protected; on affected devices the option in the Windows Security app is greyed out.

Builds affected

• Windows 11, version 26H2: OS build 26300.9711
• Windows 11, version 25H2: OS build 26200.9711
• Windows 11, version 24H2: OS build 26100.9711

Smart App Control blocks untrusted and unsigned applications before they run. The problem matters most on machines where someone turned it off to test or install software and now wants it back on, since those devices stay without it until a workaround is applied.

Two workarounds from Microsoft

For a single device, Microsoft gives two registry values to add from an elevated Command Prompt, followed by a restart. Both go under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides as REG_DWORD entries set to 1, named 2883193997 and 2850574478. Microsoft advises backing up the registry first.

For managed fleets, administrators can instead install two special Group Policy packages tied to KB5074105, named 261015_19222 Feature Preview and 261015_19221 Feature Preview. Both are needed: the first restores the ability to turn Smart App Control on and the second turns on logging for troubleshooting. After installation they appear under Computer Configuration, Administrative Templates, and must both be set to Enabled before a restart. Microsoft says it is working on a resolution for an upcoming release.

A second issue on the same page

The same known-issues list carries a Remote Desktop problem that began with the September non-security preview update KB5124010 and continues in later updates, including this one. Non-admin users may fail to connect to hosts with Administrator protection enabled, with error 0xC000000D, "The token that was passed to the function is invalid." Microsoft notes that Administrator protection is on by default in its Windows 11 24H2, 25H2 and 26H2 security baselines, so organisations that deployed those baselines are the most likely to see it. Its interim mitigation is to turn Administrator protection off temporarily by resetting the User Account Control "Type of Admin Approval Mode" policy in Intune or Group Policy. BleepingComputer, reporting the Smart App Control issue, adds that Microsoft resolved a separate Always On VPN connection problem this week that had followed the September 2026 security updates.

Our patch management software category lists 7 products.

Sources

• Microsoft Support: October 13, 2026, KB5127648 (OS Builds 26300.9711, 26200.9711 and 26100.9711), known issues, 13 October 2026
• BleepingComputer: KB5127648 Windows security update may break Smart App Control, 16 October 2026