TechTablePro

How to Deactivate Smart App Control in Windows 11: A Comprehensive Guide

How to Deactivate Smart App Control in Windows 11: A Comprehensive Guide

Introduction

Smart App Control (SAC) is a security feature integrated into Windows 11 that works in conjunction with Microsoft Defender to provide enhanced protection against malware, potentially unwanted applications (PUAs), and untrusted software. While this feature offers significant security benefits for most users, there are legitimate scenarios where you may need to deactivate it—such as when legitimate applications are being blocked, or when compatibility issues arise with essential business software.

This comprehensive guide walks you through the process of disabling Smart App Control safely and securely, explaining what happens when you do, and providing alternative options depending on your Windows 11 version and setup. Whether you’re an IT professional managing enterprise systems or an individual user troubleshooting application compatibility issues, this guide provides step-by-step instructions backed by technical expertise.

What Is Smart App Control?

Before proceeding with deactivation, it’s important to understand what Smart App Control does and why Microsoft implemented it.

Smart App Control is a Windows 11 security feature that operates as a gatekeeper for application execution on your system. Rather than scanning applications after they run (like traditional antivirus software), SAC takes a proactive approach by analyzing whether applications are safe before they launch. The feature works through three distinct modes:

  • Evaluation Mode: SAC monitors your system activity and application usage patterns without blocking anything. Windows analyzes whether your device is a good candidate for full enforcement based on your usage habits.
  • Enforcement Mode (On): SAC actively blocks untrusted, unsigned, or potentially harmful applications from executing. There is no override option during this phase.
  • Off: The feature is completely disabled, and no application protection from SAC is applied.

SAC uses Microsoft’s cloud-based application intelligence services combined with signature verification to determine whether an application should be allowed to run. If an application lacks a valid digital signature or is flagged as potentially malicious or unwanted, SAC prevents execution entirely.

Important Prerequisites and System Requirements

Smart App Control has specific system requirements and limitations that you need to understand before attempting to disable it.

RequirementDetails
Windows 11 VersionWindows 11 version 22572 or higher (typically 22H2 and later)
Installation TypeOnly available on clean Windows 11 installations; upgrades from Windows 10 typically have SAC disabled by default
Virtualization SupportVirtualization-Based Security (VBS) and Core Isolation must be enabled
Regional AvailabilitySmart App Control is only available in specific regions (rollout ongoing)
Device Management StatusEnterprise-managed devices or those with developer mode enabled may have restrictions

Critical Note for February 2026: As of Build 26220.7070 (currently in Windows Insider Beta/Dev channels), Microsoft has updated Smart App Control to allow toggling it on and off without requiring a clean Windows installation. However, this feature is still rolling out through the Insider Program and is not yet available in production builds. This guide covers both legacy methods and the new functionality.

Method 1: Disable Smart App Control Through Windows Security (Standard Method)

This is the most straightforward and user-friendly method for deactivating Smart App Control. This approach works for any user with administrator privileges on their device.

Step 1: Open Windows Security

  1. Click the Start button in the Windows taskbar.
  2. Type Windows Security in the search box.
  3. Select Windows Security from the search results (you’ll see a shield icon).

Alternatively, you can press Windows key + I to open Settings, then navigate to Privacy & Security > Windows Security > Open Windows Security.

Step 2: Navigate to App & Browser Control Settings

  1. Once the Windows Security window opens, locate the left sidebar menu.
  2. Click on App & browser control from the navigation panel.
  3. You’ll see various security settings on the right side of the window, including Smart App Control options.

Step 3: Access Smart App Control Settings

  1. Under the “Smart App Control” section, look for the link labeled Smart App Control settings.
  2. Click on this link to open the Smart App Control configuration page.

The page will display your current Smart App Control status (Evaluation, On, or Off) along with a brief explanation of what each mode does.

Step 4: Change Smart App Control to “Off”

  1. On the Smart App Control settings page, you’ll see three options:
    • Evaluation – Monitors without blocking
    • On – Actively blocks untrusted applications
    • Off – Disables the feature completely
  2. Select the radio button next to Off.
  3. You may see a confirmation dialog stating that you won’t be able to re-enable Smart App Control without resetting or reinstalling Windows (on systems prior to Build 26220.7070).

Step 5: Confirm the Change

  1. Read the warning message carefully. This is critical information about the irreversibility of the action on pre-26220.7070 builds.
  2. Click Yes or Confirm when prompted to finalize the change.
  3. Windows Security should display a confirmation message indicating that Smart App Control is now off.

Visual Workflow:
Start > Search “Windows Security” > Windows Security Opens > Click “App & browser control” > Click “Smart App Control settings” > Select “Off” > Confirm

Method 2: Disable Smart App Control Using Registry Editor (Advanced Method)

This method is useful for IT administrators managing multiple systems or when the graphical interface method fails. Modifying the Windows Registry requires administrative privileges and should be approached carefully.

Safety Precautions

Before proceeding with registry modifications, create a system restore point:

  1. Press Windows key + R to open the Run dialog.
  2. Type rstrui.exe and press Enter.
  3. Click Create a restore point in the System Protection tab.
  4. Enter a descriptive name (e.g., “Before Smart App Control Deactivation”) and click Create.

This ensures you can revert changes if needed.

Step 1: Open Registry Editor

  1. Press Windows key + R to open the Run dialog.
  2. Type regedit and press Enter.
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

The Registry Editor window will open, displaying the Windows Registry structure.

Step 2: Navigate to the Smart App Control Registry Key

  1. In the Registry Editor, navigate to the following path:
textHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy

You can paste this path directly into the Registry Editor’s address bar for faster navigation:

  • Click on the address bar at the top of the Registry Editor
  • Clear it and paste the full path
  • Press Enter

Alternatively, expand the folders manually by clicking the arrow icons:

  1. Double-click HKEY_LOCAL_MACHINE to expand it
  2. Navigate to SYSTEM > CurrentControlSet > Control > CI > Policy

Step 3: Locate and Modify the VerifiedAndReputablePolicyState Value

  1. In the right pane of the Registry Editor, look for the value named VerifiedAndReputablePolicyState.
  2. If this value doesn’t exist, you’ll need to create it:
    • Right-click in the empty space of the right pane
    • Select New > DWORD (32-bit) Value
    • Name it VerifiedAndReputablePolicyState
  3. Double-click on VerifiedAndReputablePolicyState to open the Edit DWORD dialog.

Step 4: Set the Appropriate Value

In the “Value data” field, enter one of the following values depending on your desired outcome:

ValueResult
0Smart App Control is turned OFF
1Smart App Control is turned ON (Enforcement Mode)
2Smart App Control is in EVALUATION Mode

To disable Smart App Control, enter 0 and click OK.

Step 5: Close Registry Editor and Restart

  1. Close the Registry Editor window.
  2. Restart your computer to apply the changes:
    • Press Windows key + X
    • Select Restart
    • Or use the Power button in the Start menu

After your system reboots, Smart App Control will be disabled according to the value you set in the registry.

Method 3: Using a REG File for Batch Deployment (Enterprise Method)

For IT administrators managing multiple Windows 11 devices, creating and deploying a .reg file allows you to disable Smart App Control across multiple systems efficiently.

Creating the Disable REG File

  1. Open Notepad (press Windows key, type Notepad, press Enter).
  2. Copy and paste the following content:
textWindows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy]
"VerifiedAndReputablePolicyState"=dword:00000000
  1. Press Ctrl + S to save the file.
  2. In the Save dialog:
    • Name the file: DisableSAC.reg (the .reg extension is essential)
    • Change “Save as type” to All Files
    • Choose a location (e.g., Desktop or a network share)
    • Click Save

Deploying the REG File

For single systems:

  1. Right-click the DisableSAC.reg file
  2. Select Open or Merge
  3. Click Yes in the confirmation dialog
  4. Click OK when the merge completes
  5. Restart your computer

For enterprise deployment:

  • Deploy via Group Policy
  • Use Systems Management Configuration Manager (ConfigMgr)
  • Use Intune for cloud-managed devices
  • Execute via PowerShell scripts using reg import command

Understanding What Happens When You Disable Smart App Control

Disabling Smart App Control has immediate security and functional implications that you should understand before proceeding.

Security Implications

When Smart App Control is turned off, you lose the following protections:

  • Application Whitelisting: Previously, SAC maintained a whitelist of known safe applications. When disabled, this protection layer is removed.
  • Zero-Day Protection: SAC provided protection against emerging threats by analyzing application behavior. Without it, your system relies solely on traditional antivirus scanning.
  • PUA Blocking: Potentially unwanted applications are no longer automatically blocked before execution.
  • Unsigned Code Execution: Applications without valid digital signatures can now run, which increases risk if the application is malicious.

Advantages of Disabling

  • Compatibility: Legacy or specialized software that doesn’t have valid signatures can now execute.
  • Developer Testing: Developers and testers can run development builds and unsigned binaries.
  • Power User Flexibility: Advanced users and system administrators gain more control over what runs on their systems.

Recommended Practices After Disabling

Even with Smart App Control disabled, maintain security:

  1. Keep Windows Defender Active: Your traditional antivirus protection through Microsoft Defender remains essential.
  2. Enable Windows Firewall: Maintain inbound and outbound firewall rules.
  3. Regular Scanning: Perform regular system scans with Windows Defender.
  4. Keep Software Updated: Regularly update Windows, drivers, and applications with security patches.
  5. Use SmartScreen: Continue using Microsoft Defender SmartScreen for browser-based protection.
  6. Monitor Application Behavior: Be vigilant about unusual system behavior or performance changes after disabling SAC.

Monitoring Smart App Control Status with PowerShell

You can verify Smart App Control’s current status using PowerShell, which is useful for confirming whether your changes took effect.

Step 1: Open PowerShell as Administrator

  1. Press Windows key, type PowerShell, right-click the application.
  2. Select Run as administrator.
  3. Click Yes if prompted by User Account Control.

Step 2: Execute the Status Command

Copy and paste the following command, then press Enter:

powershellGet-MpComputerStatus | Select-Object SmartAppControlState

Understanding the Output

  • Off: Smart App Control is disabled
  • On: Smart App Control is in enforcement mode
  • Evaluation: Smart App Control is monitoring usage patterns
  • (No output): Your device may not support Smart App Control or it’s restricted

This command is valuable for IT administrators who need to verify configurations across multiple systems.

Re-enabling Smart App Control

Once you disable Smart App Control, your options for re-enabling it depend on your Windows 11 build version.

For Windows 11 Builds Prior to 26220.7070

Unfortunately, if you’ve disabled Smart App Control on pre-26220.7070 builds, you cannot simply re-enable it through the Settings interface. Your options are:

Option 1: Reset Windows (Recommended)

  1. Press Windows key + I to open Settings
  2. Click System in the left sidebar
  3. Scroll down and click Recovery
  4. Click Reset this PC
  5. Choose between:
    • Keep my files: Resets Windows while preserving your personal files
    • Remove everything: Performs a complete system wipe
  6. Follow the on-screen prompts

After resetting, Smart App Control will be in Evaluation mode. You can then manually enable it through Windows Security.

Option 2: Reinstall Windows 11

  1. Create Windows 11 installation media using Microsoft’s Media Creation Tool
  2. Boot from the installation media
  3. Follow the Windows 11 installation wizard to perform a clean installation
  4. After installation, Smart App Control will be available

For Windows 11 Build 26220.7070 and Later (February 2026+)

With the latest updates available in the Insider Program, re-enabling Smart App Control is now possible without a complete system reset:

  1. Open Windows Security
  2. Navigate to App & browser control > Smart App Control settings
  3. Select On or Evaluation
  4. Confirm your selection

This change significantly improves user experience and flexibility compared to previous versions.

Troubleshooting Common Issues

Issue 1: Smart App Control Option Is Grayed Out

Cause: Your device may not support Smart App Control or it’s restricted by enterprise policies.

Solutions:

  • Verify you’re running Windows 11 version 22572 or higher
  • Check if your device was upgraded from Windows 10 (clean installs only have SAC enabled)
  • If enterprise-managed, contact your IT administrator
  • Verify Virtualization-Based Security (VBS) is enabled in Windows Security > Device security > Core isolation

Issue 2: “Cannot Turn Off Smart App Control” Message

Cause: Windows 11 version or build restrictions, or device configuration issues.

Solutions:

  • Update Windows to the latest version (use Windows Update)
  • If on a corporate device, it may be managed through Group Policy—contact your IT department
  • Try the Registry Editor method (Method 2) if the Windows Security interface fails
  • Check event logs for more detailed error information

Issue 3: Registry Modification Not Taking Effect

Cause: Registry Editor permissions issue or incorrect path.

Solutions:

  • Ensure you’re running Registry Editor with administrator privileges
  • Verify the exact registry path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy
  • Confirm the value name is exactly VerifiedAndReputablePolicyState
  • Restart your computer after making registry changes
  • Check your antivirus software isn’t blocking registry modifications

Issue 4: Applications Still Blocked After Disabling SAC

Cause: Other security features (SmartScreen, Defender, Exploit Protection) may still be blocking the application.

Solutions:

  1. Check Windows Defender:
    • Open Windows Security
    • Click Manage settings under Virus & threat protection
    • Verify Defender is functioning correctly
  2. Check SmartScreen:
    • Windows Security > App & browser control
    • Under “Reputation-based protection”, verify SmartScreen settings
  3. Check Exploit Protection:
    • Windows Security > App & browser control
    • Click Exploit protection settings
    • Ensure settings are appropriate for your applications
  4. Consult with application vendor for digital signature requirements

Frequently Asked Questions

Q: Will disabling Smart App Control affect my antivirus protection?
A: No, Microsoft Defender and other antivirus software will continue to function normally. Smart App Control is an additional layer specifically for application whitelisting, not traditional antivirus scanning.

Q: Can I disable Smart App Control for specific applications only?
A: No, Smart App Control is an all-or-nothing feature. There is no option to create per-application exceptions. You must disable it entirely if a legitimate application is being blocked.

Q: Is it safe to disable Smart App Control?
A: Yes, if you maintain other security practices. However, you lose an important security layer. Only disable it when necessary for application compatibility.

Q: How will I know if Smart App Control was successfully disabled?
A: Check Windows Security > App & browser control > Smart App Control settings, which should show “Off”. Alternatively, use the PowerShell command mentioned earlier.

Q: If I disable Smart App Control, can I re-enable it later?
A: On pre-26220.7070 builds, you must reset or reinstall Windows. On Build 26220.7070 and later (currently in Insider Program), you can simply toggle it back on through Windows Security.

Q: Does disabling Smart App Control slow down my computer?
A: No, disabling Smart App Control will not improve or degrade system performance noticeably. SAC runs in the background and has minimal performance impact.

Expert Recommendations

As an Information Technology Specialist with over five years of enterprise experience, I recommend the following best practices:

  1. Evaluate Before Disabling: Use Evaluation mode for at least a week to ensure Smart App Control isn’t blocking legitimate applications you use regularly.
  2. Document Your Decision: If you’re disabling SAC in an enterprise environment, document the business justification and affected systems.
  3. Maintain Compensating Controls: When disabling application whitelisting, strengthen other defenses:
    • Enable Group Policy restrictions on executable locations
    • Implement application allowlisting through alternative solutions
    • Use Microsoft Intune for centralized device management
  4. For Enterprise Environments: Deploy this change using Group Policy Objects (GPOs) or Intune for consistency and auditability across all managed devices.
  5. Monitor After Changes: Implement security monitoring to detect unusual application execution patterns once SAC is disabled.
  6. Stay Updated: Monitor Microsoft’s announcements regarding Smart App Control improvements, particularly as new builds like 26220.7070 roll out to stable releases.

Conclusion

Deactivating Smart App Control in Windows 11 is a straightforward process that can be accomplished through three distinct methods depending on your technical comfort level and organizational requirements. Whether you choose the user-friendly Windows Security interface, the command-line Registry Editor approach, or enterprise-scale REG file deployment, understanding the security implications and maintaining compensating controls is essential.

While Smart App Control provides valuable security benefits by preventing untrusted applications from executing, legitimate scenarios exist where disabling this feature becomes necessary for application compatibility and operational flexibility. The emergence of Build 26220.7070 with its improved Smart App Control flexibility demonstrates Microsoft’s commitment to balancing security with user control.

Remember that disabling Smart App Control doesn’t compromise your entire security posture if you maintain other protective measures: keep Windows Defender active, enable SmartScreen, maintain Windows updates, and implement additional controls appropriate for your security requirements.

About the Author

Javed Ahmad is an Information Technology Specialist at Accenture with a postgraduate degree in IT and over 5 years of enterprise-level experience. He specializes in creating hands-on guides for B2B platforms, software tools, and FinTech, helping users solve complex technical problems with professional-grade accuracy. LinkedIn.