Kb5127648 Smart App Control Known Issue Windows 11

KB5127648 is a Windows 11 cumulative update that has been reported to disable Smart App Control (SAC) for some users after installation, leaving the feature turned off and unable to be re-enabled without a reset. This article explains what the issue is, why it happens, and the steps you can take to restore Smart App Control on your system.

What Is Smart App Control?

Smart App Control is a security feature introduced in Windows 11 22H2 that blocks untrusted or potentially malicious apps from running. It works by evaluating an app’s reputation, publisher, and behavior against Microsoft’s cloud-based intelligence. When enabled, SAC only allows apps that are known to be safe or signed by a reputable publisher. It is designed to complement, not replace, antivirus software. Unlike a traditional antivirus, SAC focuses on preventing execution of unknown or unsigned code, which can stop many types of malware before they even start.

What Is KB5127648 and Why Does It Affect SAC?

KB5127648 is a monthly cumulative update for Windows 11 that includes security fixes and improvements. Cumulative updates are meant to be all-in-one packages, but occasionally they introduce regressions. In this case, some users have reported that after installing KB5127648, Smart App Control is automatically turned off and the toggle in Windows Security is greyed out. The exact cause is not officially documented, but it appears to be related to how the update interacts with the SAC evaluation service. When SAC is disabled, Windows may also show a warning in the Windows Security app, and the feature cannot be re-enabled without a full reset of the system.

How to Check If Your System Is Affected

To see if your Windows 11 PC is affected by this issue, follow these steps:

Open the Windows Security app (search for “Windows Security” in the Start menu).
Click on App & browser control in the left sidebar.
Look for the Smart App Control section. If it says “Off” and the toggle is greyed out, your system is affected.
You can also check the Security intelligence section to see if the update was recently installed.

If the toggle is greyed out, it means SAC cannot be manually re-enabled. The only way to turn it back on is to reset Windows, which is a drastic step. However, before doing that, you can try a few workarounds.

Workarounds to Re-enable Smart App Control

There is no official fix from Microsoft yet, but the following methods have been reported to work for some users. Try them in order, as they become more invasive.

Method 1: Uninstall the Update

If you are comfortable rolling back the update, you can uninstall KB5127648 and then pause updates until a fix is released. Here’s how:

Go to Settings > Windows Update > Update history.
Click Uninstall updates.
Find KB5127648 in the list, select it, and click Uninstall.
Restart your PC. After the restart, check if Smart App Control is available again.

If it is, you can re-enable it from Windows Security. Then go to Settings > Windows Update and pause updates for a week or two to avoid re-installing the problematic update.

Method 2: Use System Restore

If you have a restore point from before the update, you can roll back your system to that point. This will undo the update and any changes it made, but it may also undo other changes you made after that point.

Search for “Create a restore point” and open it.
Click System Restore and follow the wizard to choose a restore point from before the update.
Complete the restore and check if SAC is back.

Method 3: Reset Windows (Last Resort)

If you cannot re-enable SAC and you absolutely need it, you can reset Windows. This will reinstall the OS and should re-enable SAC by default. You can choose to keep your files, but apps and settings will be removed. Make sure to back up important data first.

Go to Settings > System > Recovery.
Under Reset this PC, click Reset PC.
Choose Keep my files if you want to keep personal files, or Remove everything for a clean slate.
Follow the on-screen instructions to complete the reset.

Why Smart App Control Cannot Be Re-enabled Normally

Smart App Control is designed to be a one-way gate. Once you turn it off, you cannot turn it back on without resetting Windows. This is intentional: if an attacker could disable SAC, they could also re-enable it with the same privileges. By making it irreversible, Microsoft ensures that a compromised system cannot silently re-enable the protection. The KB5127648 issue appears to trigger this same irreversible state, even though the user did not manually disable it. This is why the toggle is greyed out and why the only official path is a reset.

Is It Safe to Continue Using Windows Without SAC?

If you are affected, your PC is still protected by Windows Defender antivirus and other security features. Smart App Control is an additional layer, not a replacement. However, you should be more cautious about running unknown apps, especially those downloaded from the internet. Make sure your antivirus definitions are up to date, and consider using a standard (non-admin) account for daily use. If you rely heavily on SAC to block untrusted apps, you may want to uninstall the update or reset Windows to restore it.

Frequently Asked Questions

Can I re-enable Smart App Control after KB5127648 without resetting?

In most cases, no. The toggle is greyed out because the update has triggered the same state as a manual disable. Uninstalling the update may restore the ability to re-enable it, but if that doesn’t work, a reset is the only option.

Will Microsoft release a fix for this issue?

Microsoft has not officially acknowledged this specific issue as of now, but they typically address widespread problems in subsequent cumulative updates. Keep Windows Update enabled to receive any future fixes. In the meantime, you can use the workarounds above.

Is Smart App Control the same as Windows Defender?

No. Windows Defender (Microsoft Defender Antivirus) is the built-in antivirus that scans for and removes malware. Smart App Control is a separate feature that blocks untrusted apps from running in the first place. They work together, but they are distinct.

If I reset Windows, will Smart App Control be on by default?

Yes, on a fresh install of Windows 11 22H2 or later, Smart App Control is enabled by default. After a reset, it should be on unless you choose to turn it off during the initial setup.

Does this issue affect Windows 10?

No, Smart App Control is only available on Windows 11. Windows 10 has a similar feature called “App & browser control” but it is not the same and is not affected by this update.

Should I uninstall KB5127648 to avoid the issue?

If you have not installed it yet and you use Smart App Control, you may want to pause updates for a few days to see if a fix is released. If you already installed it and are not affected, there is no need to uninstall. If you are affected, uninstalling is a reasonable first step.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →