Smart App Control (SAC) is a Windows Security feature that helps protect you against malicious apps. While it’s available on all devices running Windows 11 22H2 or above, you might find you can’t turn it on—and for a good reason.

Let’s explore how Smart App Control works, why it’s turned off on some systems, and how to enable it.

What Is Smart App Control and How Does It Work?

Smart App Control is a feature within Windows Security that provides protection against untrustworthy apps. When you try to run an app, SAC analyzes its credibility using Microsoft’s Intelligent Security Graph, a cloud-based security service. If the service is unable to make a confident prediction, it then checks the app for a valid signature (which identifies where the file originates from and if it’s a trusted source).

Apps from known publishers or with valid signatures will run as expected. If not, the program is blocked. There’s no manual override option, nor can you add an app to an exemption list.

Microsoft intends that SAC is only useable on a clean Windows installation. By doing so, Windows can ensure that all the apps installed on your computer are vetted by SAC, thus ensuring the devices’ safety. If you received SAC as a part of a Windows 11 update, you’ll need to perform a factory reset or clean install Windows 11 before you can use it (unless you perform a registry tweak, explained below).

Windows doesn’t automatically enable SAC completely. By default, it starts in Evaluation mode. During the evaluation period, Windows monitors your application usage pattern to determine if you are a suitable candidate to have SAC enabled full-time.

Once the evaluation is complete, if Windows thinks SAC can work without too many interruptions on your system, it’s automatically turned on. If not, it’s disabled.

How to Turn On Smart App Control

Assuming you meet the conditions explained above, you can skip Evaluation mode and turn on Smart App Control in Windows Security settings.

First, press Win+i to open the Settings app. Select the “Privacy & Security” tab in the left pane, then click “Windows Security” on the right.

Click “Open Windows Security” to launch the Windows Security app.

In Windows Security, select the “App & Browser Control” tab. Then, beneath “Smart App Control”, click “Smart App Control Settings”.

Select “On” to enable Smart App Control on your Windows device. Once enabled, SAC starts monitoring and blocks any suspicious app execution on your computer.

How to Force Enable Smart App Control Using the Registry Editor

If SAC is turned off on your Windows computer for any reason, you can force enable it using a registry tweak.

Press Win+i to open Run. Type “regedit” and click “OK” to open the Registry Editor.

In the Registry Editor, navigate to the following location:

Computer > HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > CI > Policy

In the right pane, locate and double-click the “VerifiedAndReputablePolicyState” value.

In the “Value Data” field, type 1 to enable Smart App Control and click “OK” to save the changes. Alternatively, type 2 to put SAC in Evaluation mode, or 0 to turn it off. You need to relaunch the Windows Security app to apply the changes.

How to Turn Off Smart App Control

If you find SAC to be too intrusive, you can turn it off manually in Windows Security settings. Disabling SAC is permanent, and you can’t enable it again without reinstalling Windows or altering the registry (as explained above).

Open the Start menu, search for “Smart App Control”, and select the matching result.

Within the Smart App Control window, select “Off.”

Read the confirmation prompt, then click “Yes, I’m Sure” to disable Smart App Control.

Smart App Control should work without issue for you. However, if you’re unsure whether to use SAC, leave it in Evaluation mode and let Windows decide what’s best for you. If you find it too intrusive, you can always turn it off in Windows Security settings.