Windows 11 Smart App Control no longer needs a clean wipe: why your PC still has it switched off
- windows-11
- security
- malware
- audits
Open the Windows Security app on almost any Windows 11 laptop in London today, click App & browser control, and look at the Smart App Control setting at the top. Nine times out of ten, it is switched off. For the last three years, once that switch flipped off, the grey text underneath told you that the only way to turn it back on was to wipe the hard drive and reinstall Windows from scratch.
Microsoft quietly changed that rule in its 2026 updates for Windows 11 25H2 and the new 26H2 release. You can now switch Smart App Control back on without formatting your computer. When I inspect a PC on my £10 a month Home Device Security Plan or carry out a Windows security audit for a small business, this single setting is one of the easiest ways to stop fake PDF converters and unsigned infostealers dead in their tracks.
What Smart App Control does that normal antivirus misses
Traditional antivirus software works by looking for known bad behaviour. When you download a file, Microsoft Defender checks whether the file matches a known virus signature or starts doing something suspicious in memory. The problem, as I wrote last week about infostealers lifting saved passwords out of Chrome and Edge, is that a newly compiled script only needs three seconds of head start before Defender flags it.
Smart App Control works the other way around. Instead of asking whether a program is known to be bad, it asks whether the program is known to be trustworthy. Every time you double-click an `.exe`, `.msi`, or script downloaded from the internet, Windows checks two things: whether Microsoft’s cloud intelligence service already recognises the file, and whether the developer signed the code with a valid digital certificate from a trusted authority. If the file is both unfamiliar and unsigned, Windows refuses to run it at all.
Why it was turned off on your PC in the first place
If Smart App Control is built into Windows 11, why is it switched off on almost every computer I audit? Until spring 2026, Microsoft made three design choices that guaranteed almost nobody ended up using it.
First, if your computer was upgraded from Windows 10 to Windows 11 rather than wiped clean, Microsoft disabled Smart App Control permanently during the upgrade so it would not block your existing programs.
Second, on brand-new laptops, Smart App Control started in a silent “Evaluation” mode. If you barely installed anything during your first few weeks, or if you turned off optional diagnostic telemetry in your privacy settings, Windows decided your machine was not a good candidate and flipped the switch to Off forever.
Third, if you ever turned it off yourself for five minutes just to install an older label printer driver or an unsigned utility, Windows locked the button in the Off position and demanded a full factory reset to re-enable it. Beginning with update KB5079391 and baked straight into Windows 11 25H2 and 26H2, that one-way lock is gone. Provided your machine is up to date on a supported build, the On and Off radio buttons in Windows Security work like a normal switch.
Defender alone vs Smart App Control vs App Control for Business
Before flipping the switch across twenty office laptops, it helps to see where Smart App Control fits alongside standard antivirus and enterprise allow-listing:
| Protection Layer | How it decides what can run | What happens to an unsigned, unknown `.exe` | Can you whitelist one custom internal app? |
|---|---|---|---|
| Microsoft Defender Antivirus alone | Blocks known malware signatures and suspicious runtime behaviour | Allowed to start unless it matches a threat signature or triggers behavioural heuristics | Yes, via folder, file, or hash exclusions |
| Smart App Control (Windows 11 25H2 / 26H2) | Cloud reputation check + valid developer code-signing certificate | Blocked immediately before execution | No per-app exclusion list; requires a signed binary or toggling SAC off |
| App Control for Business (WDAC / Intune) | Custom cryptographic policy defined by your IT administrator | Blocked unless permitted by your company’s policy rules | Yes, by signing internal tools or adding publisher/hash rules in Intune |
The catch for small businesses: there is no exception list
Look at the last column of that table. That is the trade-off you need to know before turning Smart App Control on inside a working office.
For a home user on my £10 a month Home Device Security Plan, or an office worker who only uses Microsoft 365, Chrome, Adobe Reader, Sage, Xero, and Zoom, having no exception list is a blessing. Every legitimate program they use is digitally signed by its publisher, and every fake “Invoice_Copy.exe” or trojanised “FreePDFMerger.msi” they accidentally click gets blocked before it can touch their files. Even better, a clumsy user cannot click an “Run anyway” button on the popup to bypass it.
In a workshop, engineering firm, or accountancy practice that relies on a fifteen-year-old unsigned payroll converter or a bespoke USB dongle program written by a contractor in 2014, Smart App Control will block that unsigned `.exe` every morning. Because Microsoft provides zero per-file exclusions in Smart App Control, you have three choices: ask the developer to sign their executable properly, sign the internal tool yourself, or leave Smart App Control off on that specific machine and enforce strict Standard User account permissions alongside Microsoft Defender.
How to check and enable it on your PC today
To check your own computer right now, open the Start menu, type Windows Security, and open the app. Click App & browser control on the left, then click Smart App Control settings at the top.
If the radio button is sitting on Off and the On button is clickable, you can turn it on immediately. If the On button is still greyed out even though you are running Windows 11 25H2 or 26H2, check two places: first, make sure the latest monthly cumulative update is installed and actually applied with a real Restart; second, check Settings → Privacy & security → Diagnostics & feedback, because Smart App Control relies on Microsoft’s cloud reputation lookup and refuses to activate if optional diagnostic data is switched off or blocked by an old registry script.
Common questions
Does Smart App Control replace Microsoft Defender or my antivirus?
No. Smart App Control runs alongside Microsoft Defender. Smart App Control checks whether an application is signed and trusted at the moment it launches, while Defender handles real-time file scanning, malicious website blocking, and memory protection.
Why did Smart App Control block a legitimate tool I downloaded?
Because the developer who wrote that tool did not pay for a code-signing certificate and the file has not been seen by enough Windows machines to build a reputation score in Microsoft’s cloud service. If you trust the tool completely and only need to run its installer once, the 2026 update lets you toggle Smart App Control off, run the installer, and switch Smart App Control straight back on afterwards.
Does Smart App Control help with Cyber Essentials v3.3?
Yes. Section A8 of the NCSC Cyber Essentials v3.3 (Danzell) requirements covers Malware Protection through active anti-malware software and application allow-listing. Combining Microsoft Defender with Smart App Control on staff laptops ensures unsigned, untrusted executables downloaded from emails or web browsers cannot run.
If you want your office laptops audited and hardened properly against ransomware and infostealers, take a look at my Windows Security Audits. If it is your own computer at home, have a look at my £10 a month Home Device Security Plan or send me a message and I will check your setup.
