KB5127648 can prevent enabling Smart App Control on Windows 11

What changed

The 13 October 2026 security update has a documented Smart App Control activation issue: some devices cannot turn the feature on after it has been turned off. This is an activation problem, not evidence that the update slows down all low-spec PCs or disables protection that is already active.

Technical details

• Microsoft offers two temporary mitigation options: two registry overrides, or both special Group Policy packages. A restart is required.
• Registry option, from an elevated Command Prompt after backing up the relevant registry configuration: reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
• Apply the second override as well: reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f. Restart the device.
• Enterprise Group Policy option: install both Microsoft MSI packages named KB5074105 261015_19222 Feature Preview and KB5074105 261015_19221 Feature Preview. Enable both settings and restart. The first restores activation; the second enables troubleshooting logging.

Why it matters

A greyed-out switch can block a planned Smart App Control security rollout or re-enablement. Administrators should distinguish affected devices from those where the protection is already on before deploying a workaround.

Known limitations

• Smart App Control already enabled: Microsoft says these devices are unaffected and remain protected.
• The package names contain KB5074105; Microsoft links these exact mitigation packages from the KB5127648 known-issue section.
• The Administrative Templates path names Windows 11 version 24H2, 25H2; Microsoft explicitly lists the downloads for 24H2, 25H2 and 26H2.
• Microsoft is working on a permanent resolution. Mitigated does not mean resolved.
• This issue is separate from PEAP/802.1X authentication changes and other October update regressions.

Now check

• Inventory Windows 11 24H2, 25H2 and 26H2 devices with KB5127648 and record whether Smart App Control is on, off or unavailable.
• On an affected pilot, verify that the option is greyed out before applying a mitigation; do not disable an already active Smart App Control configuration to reproduce the issue.
• Use the two registry overrides or install and enable both special Group Policies from Microsoft's KB. Back up the registry and use change control.
• Restart the pilot, reopen Windows Security and verify that Smart App Control can be enabled; check application compatibility and logging before broader deployment.
• Monitor the KB for a permanent fix and record any temporary overrides or GPO assignments for later review.