When a Windows 11 security switch suddenly goes grey, most people assume something is broken. With Smart App Control, a feature designed to block untrusted software before it runs, the opposite is often true: the toggle is locked because Windows has determined your PC is not a good match for the tool’s aggressive enforcement.
Unlike conventional antivirus settings that you can flip on or off at any time, Smart App Control follows a strict eligibility dance influenced by how Windows was installed, how you use your machine, and whether an organization manages it. The result? A greyed-out control that can feel like a glitch even when everything is working exactly as Microsoft intended.
What Smart App Control Actually Does and Why It Gets Locked
Smart App Control, tucked inside Windows Security under App & browser control, is Microsoft’s cloud‑backed bouncer for executable files, scripts, and installers. When it’s active, every new application is checked against Microsoft’s cloud‑powered app intelligence service. Two things can earn a “pass”: a high‑confidence safety assessment from those cloud signals, or a valid digital signature from a trusted publisher. Malware, potentially unwanted programs, unsigned tools, and suspicious scripts get blocked—no questions asked, no per‑app exceptions possible.
That no‑exceptions posture is central to why the feature sometimes disappears. Smart App Control operates with three possible states:
- Evaluation: Windows observes your software habits without blocking anything, deciding if enforcement will be too disruptive.
- On: Active blocking of untrusted code.
- Off: The switch is disabled. Once Windows moves from Evaluation to Off, the toggle may become permanently unavailable through the normal interface.
Microsoft originally demanded a clean Windows 11 installation—or at least a “Reset this PC”—because the feature needs a known starting point to gauge whether strict app control will break your workflow. Over time, Windows updates have relaxed that requirement for some devices, but in‑place upgrades from Windows 10 remain a common culprit. Even on PCs that got a fresh start, Evaluation mode can silently conclude that your machine isn’t a good fit and lock Smart App Control into the Off state.
When the Greyed Out Switch Is Actually Normal
Before diving into fixes, it’s crucial to understand that a greyed‑out Smart App Control toggle often signals a legitimate, policy‑driven decision—not a malfunction. These are the most frequent scenarios:
Your PC was upgraded, not cleanly installed
Millions of users took the free upgrade from Windows 10 to 11. That in‑place migration bypasses the clean‑slate evaluation window Smart App Control expects. Microsoft has since improved some devices’ eligibility via update, but there are no guarantees. If your system still shows the feature as unavailable after all current updates, the upgrade path is likely blocking it.
Evaluation mode decided you’re not a candidate
If you frequently run developer tools, unsigned scripts, niche utilities, or older internal business apps, Smart App Control would constantly step in. Rather than bombard you with intrusive blocks, Windows may automatically turn the feature off and lock the control. This is not a security verdict—just a compatibility one.
Your device is managed by work or school
Saying “Some settings are managed by your organization” anywhere in Windows Security or Settings is a clear indicator. Corporate IT often enforces its own app‑control policies through Microsoft Defender Application Control, Group Policy, or mobile device management. Bypassing those controls on a managed PC is not only unsupported but could violate company policy.
Developer Mode is turned on
Smart App Control is inherently incompatible with a mode that exists to simplify testing unsigned code. If you’ve enabled Developer Mode under Settings > System > For developers, the feature will either refuse to enable or will be automatically locked off. Switching Developer Mode off can open the door, but if the Off state is already finalized, a reset may still be needed.
Optional diagnostic data is disabled
Because Smart App Control leans heavily on cloud intelligence, Windows may not be able to complete its evaluation without optional diagnostic data flowing to Microsoft. On privacy‑hardened systems, this data is often turned off—sometimes intentionally, sometimes by third‑party privacy tools. Check the toggle at Settings > Privacy & security > Diagnostics & feedback. Enabling it can help a new evaluation cycle, but it cannot reverse a past decision.
Windows is running in S mode
S mode’s own security model preempts Smart App Control. Leaving S mode is a one‑way street and, by itself, does not unlock the feature; a Windows reset is typically required afterward.
What You Can Check Before Reaching for the Reset Button
A few low‑risk steps can often resolve a stuck toggle—or at least clarify why it’s stuck:
- Restart, don’t shut down. Fast Startup can preserve session state after a normal shutdown. Use Start > Power > Restart to fully refresh Windows services and then reopen Windows Security > App & browser control > Smart App Control settings.
- Install all pending updates. Go to Settings > Windows Update, click Check for updates, and apply everything, including optional driver and quality updates. Some users have reported that a specific update (KB5007651) caused Smart App Control to grey out, but Microsoft has not confirmed a widespread regression. More often, cumulative fixes expand eligibility. After updating, revisit the Smart App Control page.
- Update Microsoft Defender security intelligence. Open Windows Security > Virus & threat protection > Protection updates > Check for updates. While Smart App Control isn’t antivirus, it shares the same cloud‑based reputation infrastructure.
- Verify the Smart App Control page directly. Avoid third‑party shortcuts; navigate manually. If the page is missing entirely, your device may not support the feature at all. If it’s present but locked, note any message explaining why (e.g., “managed by your organization” or “evaluation mode” status).
- Check for management policies. Look for a “managed by your organization” banner in Settings > Accounts > Access work or school. If present, contact your IT administrator.
- Disable Developer Mode (if enabled) under Settings > System > For developers. Restart afterward.
- Enable optional diagnostic data at Settings > Privacy & security > Diagnostics & feedback. Make sure “Send optional diagnostic data” is on, then allow some time for the system to reassess.
The Registry Path: Powerful but Unpredictable
Many online guides point to a Registry value at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\VerifiedAndReputablePolicyState. The settings map to Smart App Control states (0 = Off, 1 = On, 2 = Evaluation), and they’re real. But editing that value does not magically override Windows’ eligibility check.
- Windows may ignore or revert the change after a restart if the underlying device state isn’t eligible.
- Incomplete changes can weaken code‑integrity protections, causing boot problems or silent security gaps.
- Microsoft treats Registry‑driven Smart App Control configuration as a testing scenario, not a consumer repair path.
If you still want to inspect the key, create a System Restore point first, export the Policy key, and change only that one value. If Windows resets it to Off, take that as confirmation that your device is not accepting the instruction normally—stop forcing it.
The Last Resort: When Only a Fresh Windows Install Helps
When you’ve ruled out management, Developer Mode, diagnostic data, and pending updates, and the toggle remains stubbornly greyed out, a Windows reset is the cleanest supported way to give Smart App Control a new evaluation. A reset counts as a fresh installation, triggering the feature’s initial observation period.
Before resetting, back up everything:
- Personal documents, photos, and project files
- Browser bookmarks and saved passwords
- BitLocker recovery keys
- License keys for paid software
- Specialized drivers or installers
- Local email archives and game saves not stored in the cloud
Then go to Settings > System > Recovery > Reset this PC. Choose Keep my files if you want to preserve personal data (desktop apps and settings are still removed). Select Cloud download for a fresh Windows image if your internet connection is reliable, then follow the prompts. During initial setup, ensure optional diagnostic data is enabled. After installation, run Windows Update, let the system settle, and revisit the Smart App Control page. The switch should now be in Evaluation mode.
For machines with deep corruption, persistent policy remnants, or years of accumulated configuration changes, a fully clean installation using official Windows 11 media is more thorough. But the built‑in reset often suffices.
Keeping Your PC Secure Without Smart App Control
A greyed‑out control is not a security disaster. For many users, Smart App Control is overkill—or outright incompatible—and the rest of Windows 11’s defenses provide strong protection when properly configured:
- Microsoft Defender Antivirus with real‑time protection and cloud‑delivered intelligence
- SmartScreen for apps, files, websites, and downloads
- Reputation‑based protection against potentially unwanted apps
- Controlled folder access (ransomware shield)
- Regular Windows and browser updates
- Standard user accounts for daily work
- BitLocker device encryption
- Separate backups
If your daily workflow depends on unsigned tools, internal business apps, community‑built utilities, or custom scripts, leaving Smart App Control off is often the pragmatic choice. Microsoft Defender and SmartScreen still provide layered defense, and their exception mechanisms let you fine‑tune what’s blocked without a nuclear reset.
Outlook
Microsoft’s gradual expansion of Smart App Control eligibility suggests the company wants more users to benefit from the feature. Windows 11 build updates have already relaxed the clean‑install requirement for some systems, and future changes may further broaden compatibility. But the core design—a binary decision with no per‑app exceptions—means the feature will always be a high‑discipline tool. For users who regularly run software that doesn’t come from the Microsoft Store or signed publishers, Smart App Control will remain a rocky road. Until Microsoft offers granular overrides, a greyed‑out toggle is often a sign the feature is simply not meant for your machine—and that’s okay.