Smart App Control blocked an app: what it means and what to do

Why Smart App Control blocked it

Smart App Control is a Windows 11 feature that stops untrusted apps from running at all, rather than just warning you. According to Microsoft’s Smart App Control FAQ, each time you run an app Windows first asks Microsoft’s cloud security service whether it can confidently predict the app is safe. If the answer is yes, it runs; if the app is known malware or a potentially unwanted app, it’s blocked. When the service can’t make a confident prediction, Smart App Control checks the signature: a validly signed app runs, while an unsigned app or one with a bad signature is blocked.

That’s why small tools, older freeware, game mods and in-house scripts get blocked even when they’re harmless. Microsoft also says Smart App Control blocks unknown scripts and macros from the web, not only .exe files. You’ll see one of these messages:

• Smart App Control blocked an app that may be unsafe or blocked a file that may be unsafe: the program or installer itself didn’t run.
• Smart App Control has blocked part of this app: the main app is trusted, but it tried to load an unsigned file such as a DLL or plugin. Microsoft’s page on this message says the rest of the app usually works, but the feature that needs that file won’t.

Microsoft is clear that there’s currently no way to bypass Smart App Control for individual apps. Guides that suggest launching from the .exe instead of a shortcut, or other tricks, don’t change how it decides.

It’s different from SmartScreen, which shows a warning you can click past with Run anyway. If you’re seeing SmartScreen messages instead, see SmartScreen can’t be reached right now.

Find out exactly what was blocked

1. Select Learn more in the pop-up to see the file name.
2. If the pop-up has gone, open Windows Security > Virus & threat protection > Protection history and look for the Smart App Control entry.
3. For installers that fail partway through, open Event Viewer and go to Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational. Microsoft’s developer docs list Event ID 3077 for files Smart App Control blocked (3076 is used while it’s still in evaluation mode).

Then right-click the blocked file, choose Properties and open the Digital Signatures tab. No tab means the file isn’t signed.

What to do, in order

1. Check the source. Only continue if you downloaded the file from the publisher’s own site or a store you trust. If you’re not sure, delete it and run a scan; see how to scan for malware.
2. Get the latest version. Download the current release from the official site; a newer release may be signed even if the one you have isn’t.
3. Update Windows. Run Settings > Windows Update and install everything, since Microsoft keeps updating how the feature behaves.
4. Report a false block. Upload the file at Microsoft’s file submission page, choosing Smart App Control as the product and Incorrectly detected. You can also send feedback through Feedback Hub (Win + F) under Security and Privacy > Smart App Control, and ask the developer to sign the app.
5. Turn Smart App Control off only if you still need the app, as described below.

Turning Smart App Control off (and back on)

Open Windows Security > App & browser control > Smart App Control settings and choose Off. This removes the protection for every app on the PC, not just the one you wanted, so keep Microsoft Defender or your antivirus running.

For a long time this was one-way: turning it off meant resetting or reinstalling Windows to get it back. Microsoft’s FAQ now says recent updates let you turn it on again without a clean installation, and press reports put the change in the March 2026 preview update and the April 2026 monthly update for Windows 11 24H2 and 25H2. On a fully updated PC, return to the same page and choose On once you’re done with the app. If the option isn’t offered, your build may not have the change yet.

Avoid registry edits that switch the feature’s policy state directly. Microsoft documents those only for test machines, run from the recovery environment with BitLocker suspended.

If the setting is greyed out or Off

Microsoft lists several reasons Smart App Control stays off or can’t be turned on:

• The PC is managed by an organization, or developer mode is turned on. Smart App Control turns itself off for corporate users and developers, and businesses use App Control for Business instead. If an administrator policy is blocking apps, see “An administrator has blocked you from running this app”.
• The PC is in S mode. You need to switch out of S mode and then reset the PC.
• Optional diagnostic data is off. Microsoft says you need to reset or reinstall Windows and choose to send optional diagnostic data during setup.
• It’s still in evaluation mode, where Windows watches how you use the PC before deciding whether to enforce it.

Some users report the toggle greyed out after the October 2026 update on PCs where the feature was already off. Microsoft’s release notes didn’t list this when we checked, so check Windows release health before trying workarounds.

If you make the app

Microsoft’s advice to developers is to sign everything you ship, including the .exe, DLLs, scripts, installers and uninstallers, with a certificate from a trusted provider. Self-signed certificates don’t count. Microsoft’s signing guide names Artifact Signing (formerly Trusted Signing) as the preferred option. Related Windows Security features, such as memory integrity, apply similar rules to drivers.

Related guides

• SmartScreen can’t be reached right now: how to fix it
• An administrator has blocked you from running this app: what it means and safe fixes
• How to Scan for Malware on Windows 11 and 10 (Free, Built-In Tools)
• Memory integrity is off because of incompatible drivers: how to fix it

Official sources

• Smart App Control frequently asked questions (Microsoft Support)
• Smart App Control has blocked part of this app (Microsoft Support)
• Submit a file for malware analysis (Microsoft Security Intelligence)