KB5127648 Grays Out Smart App Control in Windows 11: Registry and Group Policy Fix

According to Microsoft's official support documentation for the October 13, 2026 security update KB5127648—and as reported by BleepingComputer—installing this month's cumulative patch can prevent users and administrators from turning Smart App Control back on if it was previously disabled. On affected machines, the option inside the Windows Security app simply appears grayed out and refuses to budge.

The good news? If Smart App Control was already switched on before you installed KB5127648, your machine is unaffected and remains protected. Furthermore, Microsoft has published two immediate workarounds—one using Registry FeatureManagement overrides and another using special Group Policy templates—to unfreeze the toggle while engineers work on a permanent fix.

What KB5127648 Breaks—and Who Is Affected​

Released on October 13, 2026, KB5127648 is the monthly cumulative security update covering Windows 11 versions 24H2, 25H2, and 26H2 across all editions, bringing systems to OS Builds 26100.9711, 26200.9711, and 26300.9711, respectively.

In the update's known-issues advisory, Microsoft states that after installing KB5127648, "some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off," noting that the control may appear grayed out.

Let's be crystal clear about the boundaries of this bug based on Microsoft's advisory:

• Already Enabled = Safe: KB5127648 does not turn off Smart App Control on systems where it is currently active, nor does it strip protection from already-enabled PCs.
• Turned Off = Potentially Stuck: The bug specifically hits users and admins who have Smart App Control turned off—for instance, someone who temporarily disabled it to run an unsigned legacy installer or test a tool—and now want to flip it back on inside Windows Security > App & browser control > Smart App Control settings.
• Scope: Microsoft notes that the issue affects "some devices" across the 24H2, 25H2, and 26H2 servicing branches, without specifying a narrower hardware or software trigger.

A Crucial Servicing Note for Windows 11 24H2 Users​

While reviewing the KB5127648 release notes, there is an important lifecycle milestone that every Windows 11 user and IT administrator needs on their radar: Windows 11 version 24H2 (Home and Pro editions) has officially reached its end of updates with this exact October 13, 2026 release. Microsoft notes that KB5127648 is the final monthly security update for 24H2 Home and Pro. While Enterprise and Education editions continue under their respective lifecycles, Home and Pro machines on 24H2 will need to upgrade to version 25H2 or 26H2 to receive future monthly patches—including whatever upcoming cumulative update eventually carries the permanent fix for this Smart App Control bug.

Section Summary:

• Update: KB5127648 (October 13, 2026) for Windows 11 24H2 (Build 26100.9711), 25H2 (Build 26200.9711), and 26H2 (Build 26300.9711).
• Symptom: The radio button/toggle to turn on Smart App Control in Windows Security is grayed out if the feature was previously off.
• Unaffected Systems: PCs with Smart App Control already turned on stay on and remain protected.

Why Smart App Control Matters (And Why the Toggle Exists Now)​

To understand why a grayed-out button is annoying enough to warrant emergency registry overrides, it helps to look at how Smart App Control has evolved since it debuted in Windows 11 version 22H2.

Built on the same underlying architecture as enterprise-grade App Control for Business (formerly Windows Defender Application Control), Smart App Control flips the traditional antivirus model on its head. Instead of assuming every executable, DLL, or MSI installer is innocent until a signature scanner catches it doing something nefarious, SAC blocks untrusted code at the door. When you launch an app, Windows checks two things:

• Does the binary have a valid digital signature?
• If it is unsigned, does Microsoft's cloud-powered Intelligent Security Graph (ISG) predict with high confidence that the file is safe?

If an unsigned binary fails that cloud reputation check, Smart App Control blocks it outright. Additionally, according to Microsoft Learn documentation, when SAC is active on a system that uses a third-party antivirus for real-time protection, Microsoft Defender Antivirus automatically runs in passive or hybrid mode in the background so it can still handle ISG reputation checks without conflicting with your primary AV.

Historically, SAC began in an automatic evaluation mode (which, on enterprise-managed endpoints, automatically switches off within 48 hours unless explicitly enabled). And for years, if SAC switched off—or if a user manually disabled it to run an obscure utility—re-enabling it required a full OS reset. Only recently did Microsoft update Windows 11 so that users could freely re-enable Smart App Control inside the Windows Security app without wiping their drives.

Look closely at the registry workaround Microsoft has issued for KB5127648, and you can see the plumbing behind that change: both registry commands target FeatureManagement\Overrides—the internal Windows servicing mechanism (often known to enthusiasts as Velocity or ViVe feature flags) that controls staged feature rollouts. In essence, Microsoft is having affected users manually force the feature-management flags back on.

How to Fix the Grayed-Out Smart App Control Toggle​

Until Microsoft ships a permanent fix in an upcoming release, the KB5127648 support advisory provides two official methods to restore the Smart App Control setting. You only need to use one of these approaches, and only if your device is actually experiencing the grayed-out toggle.

Option 1: The Registry Workaround (Individual PCs & Power Users)​

If you are managing a standalone PC or prefer a direct command-line fix, Microsoft instructs users to add two REG_DWORD override values to the Windows Registry.

Warning: As Microsoft advises in its support bulletin, always back up your Windows Registry or create a System Restore point before making manual registry modifications so you can easily roll back if needed.

• Click the Windows Search box on your taskbar, type cmd, and select Run as administrator to open an elevated Command Prompt.
• Copy and paste the following two commands, pressing Enter after each one:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

• Close the Command Prompt window and restart your PC.
• Once Windows reboots, open Windows Security, navigate to App & browser control > Smart App Control settings, and verify that you can now turn the feature on.

Option 2: The Group Policy Workaround (Enterprise IT Admins)​

For IT administrators managing enterprise fleets, Microsoft has published a pair of Known Issue Rollback (KIR) / Feature Preview Group Policy templates in the KB5127648 support bulletin.

Unlike typical single-policy rollbacks, Microsoft stresses that administrators must install and enable both Group Policy packages:

• Policy 1 (KB5074105 261015_19222 Feature Preview): Restores the ability to turn on Smart App Control.
• Policy 2 (KB5074105 261015_19221 Feature Preview): Enables diagnostic logging to assist with troubleshooting in case any issues crop up.

Both MSI packages are labeled by Microsoft as applying to Windows 11, versions 24H2, 25H2, and 26H2. After downloading and installing both policy definitions onto your domain controller or management workstation:

• Open the Group Policy Management Editor.
• Navigate to:
  Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2
  (Admin Note: Even though the download packages explicitly cover 26H2 as well, Microsoft's advisory text displays the folder path as "Windows 11, version 24H2, 25H2". Be sure to check under that node for both installed policy names.)
• Open each of the two policy settings and set both of them to Enabled.
• Restart the affected client devices once the Group Policy updates have applied so the changes take effect.

The Bigger Picture: What Else Is Inside KB5127648?​

Should you uninstall KB5127648 to avoid the Smart App Control glitch? Absolutely not. Beyond mandatory October security patches, this cumulative update fixes several painful regressions from the August and September 2026 update cycles, while introducing a few other changes that system administrators need to watch closely.

Major Fixes Included in KB5127648​

• Black Screens and Explorer.exe Crashes Resolved: Multi-user environments—specifically Azure Virtual Desktop (AVD) and FSLogix deployments—were recently plagued by a bug where Explorer.exe would repeatedly crash or fail to start after sign-in, leaving users staring at a black screen. KB5127648 officially fixes this.
• Always On VPN Connection Failures Fixed: Following the September 2026 update (KB5124008), Always On VPN profiles using automatic protocol selection or fallback could get stuck in a "Connecting" state or throw the error "The specified port is already in use." That bug is squashed in this release.
• Storage Spaces Direct (S2D) & Printing Repairs: The update resolves an issue where tiered Storage Spaces Direct virtual disks could fail to come online in clustered workloads, and fixes a printing failure affecting RAW or Generic Text Only printer drivers that started back in August 2026.
• Gaming, Audio, and Windows Hello Fixes: Gamers get a fix for mouse-input stuttering in certain titles, AC-3 audio playback issues in affected apps are resolved, and a bug causing fingerprint sign-in to fail after a cold boot has been patched.

Other Active Known Issues and Hardening Changes to Watch​

While KB5127648 cleans up last month's mess, Microsoft's support page flags two other active known issues and an authentication hardening shift:

• Remote Desktop Failures (0xC000000D) with Administrator Protection: If your organization uses Windows 11 security baselines (which enable the newer "Administrator protection" feature by default on 24H2, 25H2, and 26H2), non-admin users attempting to establish Remote Desktop connections to those hosts may fail with error 0xC000000D ("The token that was passed to the function is invalid"). This issue actually originated in the September preview update KB5124010 and carries over into October. Until patched, admins must temporarily disable Administrator protection via Intune or Group Policy (User Account Control: Type of Admin Approval Mode) on affected RDP hosts.
• NTLMv1 SSO Now Blocked by Default: On October 15, Microsoft updated the KB5127648 release notes to highlight a security hardening change: when Credential Guard is disabled and the BlockNtlmv1SSO registry value is not explicitly configured, Windows 11 now defaults to Enforce mode (1) instead of Audit mode (0). This blocks NTLMv1-derived credentials for Single Sign-On and can impact legacy Wi-Fi, Ethernet (802.1X), and VPN connections still relying on MS-CHAPv2 authentication.
• USB Audio Class 1.0 Glitches: A leftover issue from September continues to affect some older USB Audio Class 1.0 peripherals (Code 10 in Device Manager or unresponsive volume controls). While a September out-of-band patch (KB5129195) fixed multichannel/3D audio modes, remaining stereo symptoms are still under investigation.

Final Thoughts for Windows Users and Admins​

At the end of the day, the KB5127648 Smart App Control bug is a classic example of modern Windows servicing: a localized feature-flag hiccup rather than a catastrophic security failure. Because systems that already had Smart App Control enabled remain protected, most everyday users will never even notice the bug exists.

However, if you are a power user who toggles SAC off to test software, or an enterprise sysadmin piloting application control across Windows 11 24H2, 25H2, or 26H2 endpoints, having those two FeatureManagement\Overrides registry commands or the dual Group Policy templates in your back pocket will save you plenty of head-scratching. And if you are still running Windows 11 24H2 Home or Pro, take Microsoft's end-of-servicing notice seriously—now is the time to plan your jump to 25H2 or 26H2 so your machine doesn't get left behind when November's Patch Tuesday rolls around.

Have you run into the grayed-out Smart App Control toggle or the Remote Desktop 0xC000000D token error after installing KB5127648? Drop your build numbers and experiences in the WindowsForum community threads!

Update: KB5127936 fixes Smart App Control toggle (November 2, 2026)​

According to Windows Report, Microsoft has marked the Smart App Control issue as fixed in the KB5127936 release preview changelog. Affected Windows 11 25H2 and 26H2 users who install KB5127936 or a later update reportedly no longer need the registry or Group Policy workaround.

Windows 11 24H2 does not receive the fix through KB5127936, Windows Report says. Affected 24H2 users should continue to use Microsoft’s published workaround. The update also reportedly fixes the Remote Desktop error 0xC000000D described above.