Set up Smart App Control on a fresh Windows 11 25H2 install

TL;DR

**Smart App Control** only turns on during **evaluation mode** on a clean install. Check its state, let it evaluate, then flip it to **On** in **Windows Security**.

Before you start

Requirements

Windows 11 25H2, clean install (SAC cannot be enabled on an upgraded system)
Microsoft Defender active (no third-party AV replacing it)
VBS and Memory Integrity available and ideally enabled
Admin account

Step by step

Instructions

Check Smart App Control's current state

Open **Windows Security**, go to **App & browser control**, then **Smart App Control settings**. The state is one of **On**, **Evaluation** or **Off**. If it reads **Off**, it cannot be re-enabled without a clean install.

⚠ warningOff is permanent. Do not click Off unless you accept reinstalling Windows to get SAC back.

Confirm the install is eligible via registry

Open **PowerShell** as admin and read the SAC policy value. **0** means off (locked), **1** means on, **2** means evaluation. On a fresh 25H2 install this should be **2**.

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState

Use the PC normally during evaluation

Microsoft watches the apps you install for a few days. If your workload looks compatible, SAC auto-enables. If you run many unsigned or niche tools, it auto-disables itself to avoid breaking you.

tipAvoid installing cracked, pirated or random GitHub binaries during this window - they push SAC toward auto-disable.

Flip Smart App Control to On manually

If you want full enforcement immediately, in **Smart App Control settings** click **On**. This only works while the state is **Evaluation**. Confirm the UAC prompt.

Enable Memory Integrity to harden the base

Still in **Windows Security**, go to **Device security** then **Core isolation details** and toggle **Memory integrity** on. SAC pairs well with VBS-backed protections. Reboot when asked.

⚠ warningIf an old driver blocks Memory Integrity, the UI lists the offending driver - update or remove it, then retry.

Verify enforcement with a test

Download a known-unsigned small utility from a legitimate site and try to run it. SAC blocks execution with a **This app was blocked by Smart App Control** dialog. If the app runs, SAC is not fully On yet - recheck the state.

Troubleshooting

Common issues

Smart App Control settings page shows Off and the toggle is greyed out

SAC was disabled previously and cannot be re-enabled in place. A clean install of Windows 11 is the only way back - see https://learn.microsoft.com/windows/apps/develop/smart-app-control/overview

SAC blocks a legitimate internal tool I need

SAC does not have per-app exceptions by design. Either get the vendor to sign the binary properly, or turn SAC off (one-way) and rely on Defender + Memory Integrity instead.

Evaluation never ends

Keep the PC online with Microsoft account sign-in and normal use for several days. If it stays in evaluation past two weeks, flip it to On manually.

FAQ

Frequently asked

Is Smart App Control the same as SmartScreen?

No. SmartScreen warns, SAC blocks execution of untrusted binaries at the kernel. They work together.

Can I run SAC with a third-party antivirus?

No. SAC requires Microsoft Defender as the active AV.

Does SAC block games?

Signed titles from Steam, Epic, Xbox and GOG run fine. Mods and unsigned trainers get blocked.

How to undo this

Open Windows Security, go to App & browser control then Smart App Control settings and click Off. This is permanent for the current install - the only way to re-enable SAC later is a clean reinstall of Windows 11.

Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress