Microsoft's October Patch Tuesday release has brought a familiar kind of headache. A Windows update bug is stopping some Windows 11 users from switching on Smart App Control, a security feature that blocks suspicious and potentially malicious apps. The problem was first reported by ZDNET, which also walked through a temporary fix.
It isn't a catastrophic flaw, and it doesn't switch off protection that's already running. Still, it quietly removes a safeguard for anyone who hadn't turned it on yet, and many people won't notice.
What the Windows update bug actually does
The update in question rolled out on October 13 as part of Microsoft's regular monthly cycle for Windows 11. After you install it, the control for enabling Smart App Control can appear grayed out. If the setting is currently off, you can't click your way back to on.
Smart App Control arrived in Windows 11 in 2022. It's stricter than several of the operating system's other built-in protections, and it's aimed at newer and emerging threats rather than only well-known ones.
There's an important distinction here. People who already had the feature enabled are still covered, so the Windows update bug doesn't strip protection from them. The people who lose out are those who left it off, either on purpose or by default, and now find the option locked.
The ZDNET writer tested the behavior on four Windows 11 machines. On the three that had installed the October update, the On option was grayed out. On the one that hadn't been updated, it was still available. That's a small sample, but it's consistent with the update being the trigger.
How to check if the Windows update bug hit your PC
Checking takes under a minute. You're looking for a specific combination: the feature is set to Off, and the On choice can't be selected.
- Open Settings and choose Privacy & security, then Windows Security.
- Under Protection areas, select App & browser control.
- Click the link for Smart App Control settings.
- Look at the options. If Off is selected and On is grayed out, the bug has affected your machine.
If On is selectable, or the feature is already running, there's nothing to fix. Admins who manage fleets of PCs may want to spot-check a few updated machines rather than assume every one behaves the same way.
The Registry workaround, step by step
Microsoft says it's working on a proper fix for the Windows update bug and will ship it in a future release. It hasn't given a date. Until then, the company has published a manual workaround that involves adding two keys to the Windows Registry.
In outline, you open a command prompt with administrator rights, since without elevation you can't change the Registry. You then run two reg add commands that create two DWORD values, each set to 1, under the FeatureManagement Overrides path in the system policies hive. Each command should report that it completed successfully. After that, you close the prompt and restart the PC.
When you sign back in and revisit the Smart App Control settings, the On option should be available again. You can then enable the feature normally.
Because Registry edits can cause trouble if they're mistyped, copy the exact commands from Microsoft's own instructions instead of retyping them from memory or from a summary like this one. Anyone who isn't comfortable at a command prompt may be better off waiting for the official patch.
Why this Windows update bug matters beyond one toggle
On its face, a grayed-out switch sounds minor. But security features only help if people can use them, and a Windows update bug that blocks activation creates a gap that's easy to miss. Nothing alerts you that the setting has become unavailable. You'd only find out by going looking.
It also fits a pattern the ZDNET writer pointed out: monthly Windows updates often arrive with some new problem affecting a feature or setting. That's worth keeping in mind for anyone responsible for rollout decisions. Many IT teams stage updates to a pilot group first, and this Windows update bug is a reasonable argument for including security-setting checks in that pilot, not only app compatibility and performance.
For small businesses without dedicated IT staff, the practical lesson is simpler. After a major monthly update, take a few minutes to confirm that your protections are still in the state you expect. A Windows update bug like this one won't announce itself.
Should you turn Smart App Control on at all?
The ZDNET writer's view is that it's a good idea for most people. It defends against potentially malicious apps and files, including unknown malware that might otherwise slip onto a system.
There is a trade-off. If you regularly download or install files from unfamiliar sources, Smart App Control can get in your way. In that case you can switch it off again. The suggestion is to give it a trial period and see whether it fits how you work before deciding.
That advice carries extra weight for businesses with a mix of standard office software and more unusual tools, such as niche utilities or in-house apps. Those are the situations where a strict blocker is most likely to cause friction, so it's worth testing before you roll the setting out widely.
What to watch next
The main thing to watch is Microsoft's promised fix. When it arrives, the Registry entries should no longer be needed, though Microsoft hasn't said whether they need to be removed afterward. Check its guidance once the patch ships, particularly if you applied the workaround across multiple machines.
Until then, the situation is manageable. Verify the setting, apply Microsoft's documented workaround if you need the protection now, and hold off if you'd rather wait for the official correction. Either way, this Windows update bug is a reminder to check your security settings after every Patch Tuesday, not just the ones you expect to change.
Source: news – ZDNET
