Microsoft’s October 13 Windows 11 security update can lock some PCs out of Smart App Control, and the company has not set a date for a permanent fix. On affected machines, the toggle in Windows Security is grayed out. Anyone who switched the protection off before installing KB5127648 cannot turn it back on.

Microsoft has confirmed the problem. KB5127648 is the regular Patch Tuesday release, so it reaches a broad base of Windows 11 devices. Microsoft’s known-issue entry was reviewed on October 16, and gHacks reported the confirmation on October 17.

What the update breaks in Smart App Control

Smart App Control is a Windows 11 feature that works with Microsoft Defender and SmartScreen to block apps and binaries that may be harmful. It is designed to run quietly in the background, and most people never open its settings. The bug hits a narrower case: devices where the feature was already switched off before the update landed.

After installing KB5127648, those devices show the Smart App Control toggle as grayed out, so the user cannot switch it back on. HelpDeskGeek breaks down the known issue in detail, and Windows Report covers the workarounds Microsoft has shared.

Microsoft draws a clear line between the two groups. As TechAiWire quoted the advisory, citing BleepingComputer, “Devices where Smart App Control is already turned on are not affected and remain protected.” For anyone who left the feature on, that sentence is the most important line in the notice.

Which Windows 11 versions and PCs are affected

The issue applies to Windows 11 versions 24H2, 25H2 and 26H2. The builds that result from the update are:

  • Windows 11 24H2: build 26100.9711
  • Windows 11 25H2: build 26200.9711
  • Windows 11 26H2: build 26300.9711

The bug is limited to devices where the feature was turned off before updating. That narrows the group, but it does not make it small. Home users who disabled the feature are locked out of a setting they chose to change, and IT administrators who manage fleets of these machines must decide how to handle the gap across many devices at once.

No source gives a count of affected devices. Because the update went to a wide installed base, the scope could be large, but the reporting does not quantify it. Readers should not assume their machine is affected just because the update is installed. The toggle state is the test that matters.

Why this is a regression and not a security breach

The sources describe a regression in the feature itself. They do not describe a breach, an exploit or an attack, and none has been reported. A greyed-out toggle is a functional failure, not evidence that a PC has been compromised.

The history makes the bug sting more. Windows Digitals reports that Smart App Control could be switched on without a clean install since the April 2026 security update. Before that change, turning the feature off was a one-way door, and the only way back was to reset or reinstall Windows. That recent flexibility is what makes the new block a regression.

Neowin points out the irony directly: the feature broke almost as soon as Microsoft dropped its mandatory clean-install requirement for turning it on. The trade-off is easy to see. Smart App Control protects people who would never think to check what they are running. A stuck toggle hurts a different group, often people who turned the feature off for a reason and now have no simple way to reverse that choice.

Smart App Control grayed out: how to check your PC

Start by confirming the symptom. Open Windows Security, select App & browser control, and look at the Smart App Control setting. If the toggle is grayed out and you cannot change it, your device falls into the reported group. If the feature is already on, Microsoft says your device is not affected.

  • Open Windows Security and select App & browser control.
  • Check whether the Smart App Control toggle is grayed out.
  • If it is, leave the setting alone unless you specifically need the protection back.
  • Watch the KB5127648 release notes for the permanent fix.
  • Do not treat the gap as a sign of compromise.

Forcing changes to a greyed-out setting is the step most likely to create new problems. Leave the feature as it is until you have a reason to act, and only use a workaround when you need the protection back.

Microsoft’s temporary workarounds and who should use them

Microsoft has published two temporary workarounds. One uses registry values and the other uses Group Policy. Both are aimed mainly at IT administrators managing enterprise devices, according to gHacks, Windows Report and BastionZero.

Administrators should use the Group Policy route and test it first on a small set of devices before rolling it out. Home users with a single PC should weigh whether they need the protection enough to edit registry values. Neither workaround is a permanent fix, and Microsoft has not said whether they will survive the next update.

Enterprises face a second problem. Neowin reports a separate network-authentication break from the same update, which Microsoft has acknowledged with its own temporary workaround. That combination makes October’s update a heavier job for IT teams than the Smart App Control toggle alone.

Other fixes and problems in the October update

The update also fixes several bugs. According to TechAiWire, it addresses Explorer crashes, black screens in multi-user Azure Virtual Desktop setups, and Windows Hello fingerprint sign-in failures after a cold boot. Those fixes matter to many users, but they do not change the Smart App Control problem.

Neowin also reports Xbox sign-in problems on home PCs. Neither Microsoft nor the Xbox team has confirmed those reports, so readers should treat them as unverified for now.

For broader context on Microsoft’s staffing, see USA 24’s report on how Microsoft layoffs spread to Nairobi, Israel and Vietnam after the July cuts.

What to watch next

Four questions remain open. The first is timing. Microsoft has said only that a permanent fix is coming in an upcoming release, and it has not published a date. Watch the KB5127648 release notes and Microsoft’s known-issue entries for changes.

The second is scale, since no source gives a count of affected devices. The third is durability. Because the workarounds are registry and policy changes that Microsoft calls temporary, administrators should recheck them after each monthly update. The fourth is the Xbox reports, which need confirmation before anyone acts on them.

The next regular Patch Tuesday will show whether Microsoft moves from workarounds to a fix. Home users can wait for that release without losing anything they do not already lack, while administrators should keep their test groups ready. Until then, the toggle is the thing to check.