KB5127648 Update Disables Smart App Control on Windows 11 24H2 and Later

What happened

Microsoft’s KB5127648 security update for Windows 11 inadvertently disables the Smart App Control toggle on systems running version 24H2 and later. The feature, which works with Microsoft Defender and SmartScreen to block potentially harmful applications, becomes grayed out and cannot be turned on if it was previously disabled.

Impact

Only devices that had Smart App Control turned off before installing the update are affected. Devices that already had the feature enabled continue to operate normally and remain protected. The issue does not affect Windows 10 or earlier Windows 11 releases.

Workarounds

Microsoft has issued temporary mitigations for enterprise‑managed machines. Administrators can either modify the registry or apply a Group Policy setting to re‑enable the feature.

"After installing this update, some devices might be unable to turn on Smart App Control in the Windows Security app if it has been turned off. On affected devices, the option to turn on Smart App Control might be grayed out," Microsoft said.

• Registry: Add the DWORD SmartAppControlEnabled with value 1 to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\SmartAppControl.
• Group Policy: Enable the policy “Turn on Smart App Control” under Computer Configuration → Administrative Templates → Windows Components → Windows Security.

What to do

• Verify whether Smart App Control is currently enabled on your endpoints.
• If disabled, apply the registry or Group Policy workaround on affected devices.
• Monitor Microsoft’s advisory channel for a permanent fix in a future cumulative update.
• Keep Defender and SmartScreen up to date to maintain baseline protection.