Microsoft has confirmed a known issue in which Windows 11 devices that install the October 2026 security update, KB5127648, might be unable to turn Smart App Control back on once it has been switched off. The update shipped on October 13. Microsoft has not yet released a fix, though it has published two workarounds, one for individual computers and one for administrators.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
KB5127648 and the builds it installs
The update is cumulative and covers three Windows 11 releases, each with its own build number. Version 24H2 moves to build 26100.9711, version 25H2 to build 26200.9711, and version 26H2 to build 26300.9711. Microsoft dated the release October 13, 2026, which is the second Tuesday of the month and the company’s usual day for security updates. The Smart App Control problem was reported on October 16, three days after release, so a device patched on the release day could already be carrying the flaw.
Microsoft’s support page for KB5127648 carries the build numbers for all three versions. BleepingComputer says it affects Windows 11 version 24H2 and later and that no fix is available yet; the outlet’s report on the known issue is the source for the advisory language quoted below, as is a second write-up by BetaNews, which adds that Microsoft is working on a fix expected in the near future.
What Smart App Control does and why being off matters
Smart App Control is a Windows 11 security feature built on Microsoft’s app intelligence services and on code integrity features in the operating system. It works alongside Microsoft Defender and SmartScreen to block apps and binaries that could be harmful. That design makes it a gatekeeper on what is allowed to run, a different layer of defense from a scanner that looks for known malware after a program is already on the machine.
For a device where the feature is off, the practical effect is the absence of that layer. A user whose device has the feature off, for whatever reason, cannot restore it from the Windows Security app after this update, and the device continues relying on Defender and SmartScreen alone. That is the gap Microsoft is describing, and it is why a security update that interferes with a security setting draws attention.
Microsoft’s own wording on the grayed-out option
Microsoft’s advisory, as quoted by BleepingComputer, says that some devices “might be unable to turn on Smart App Control” after the update is installed and that “the option to turn on Smart App Control might be grayed out.” The company is equally direct about who is safe, stating that “devices where Smart App Control is already turned on are not affected and remain protected.” BetaNews quotes the release note as saying the problem applies if the feature “has been turned off,” which fits the pattern: a device that left it on is untouched, and a device that had it off is stuck there. Microsoft’s wording is hedged with “might,” so not every affected installation will necessarily show the problem, but the company has confirmed it as a known issue rather than a rumor.
The scope is limited to the toggle. The coverage reviewed describes the problem as confined to a switch that will not flip, with no reported file damage or boot failure attached to this particular issue. Administrators who track known issues will want to note that no fix date has been reported, only that Microsoft is working on one, so the registry and Group Policy methods below are the only remedies on offer until a corrected update arrives. Devices where the feature is already running need no action under Microsoft’s guidance, and an earlier Microsoft fix for other recent update problems, such as the black screens and Explorer crashes BleepingComputer mentions, shows that corrections do arrive through later updates, and BleepingComputer’s report does not suggest uninstalling KB5127648 to keep it that way.
Two workarounds, one registry edit and one Group Policy route
For an individual computer, Microsoft’s workaround is to open Command Prompt as an administrator, add two registry values under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides, named 2883193997 and 2850574478, set each to a DWORD value of 1, and restart. Microsoft advises backing up the registry first, and the company’s guide to backing up and restoring the registry explains how. Editing the registry on the wrong key can break a system, so the backup is not optional.
Administrators of managed devices have a second route: install two Group Policy packages, build 261015_19222 and build 261015_19221, set both policies to Enabled under Computer Configuration and Administrative Templates, and restart. The first turns Smart App Control on and the second enables logging for troubleshooting. Both packages are labeled KB5074105 rather than KB5127648, a naming quirk BetaNews flags, so administrators should check them against Microsoft’s release notes before deploying.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
