Smart App Control blocked something -- how do I find out what it was???

MatthewDunn-4390 60 Reputation points
2026-09-25T13:34:04.4266667+00:00

Win11.

A pop-up appeared from Smart App Control.

It said a .dll for a program I use had been blocked.

But (as per usual with Windows), it disappeared before I could read what the issue was.

So, I went into Settings: Privacy & Security > Windows Security > App & Browser Control > Reputation-based Protection > Potentially-unwanted app blocking > Protection History. (Is there NO WAY to just copy and paste this stuff?)

Nothing recorded.

Can anyone tell me where I might find this information? Is it buried somewhere else in Windows? Should I use Event Viewer?

Windows for home | Windows 11 | Security and privacy

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Clary-N 16,555 Reputation points Microsoft External Staff Moderator
    2026-09-26T05:48:43.0466667+00:00

    Hi MatthewDunn-4390,

    Thanks for checking that. Since the CodeIntegrity log only goes back to September 25, it’s possible the earlier entry is no longer available.

    Which program were you using when the Smart App Control message appeared and is the program still working normally? If you open it again, does the same warning come back?

    If you can reproduce it, please keep Event Viewer open and check the CodeIntegrity > Operational log immediately afterward. Besides 3077, look for Event ID 3089 around the same time, as that can provide additional signature information about the file that was blocked.

    Once you know the name and location of the DLL, I’d check whether there’s a newer version of the program available directly from its developer rather than turning off Smart App Control.

    If you find a matching 3077 or 3089 event, feel free to share the General details here, with any personal information or user-folder names removed and I will help take a look.

    Was this answer helpful?

  2. AI answer

    2026-09-25T13:34:18.08+00:00

    Yes. Smart App Control block details are typically in Event Viewer, not necessarily in Protection History.

    Use this path:

    1. Open Event Viewer.
    2. Go to Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
    3. Look for these event IDs:
      • 3077 = Smart App Control blocked a file in enforcement mode.
      • 3076 = Smart App Control would have blocked a file in evaluation mode.

    That log records which individual files were blocked or audited. For a blocked .dll, this is the main place to check.

    Important detail: the Code Integrity log records blocked or audited files, but it does not explain an installer failure at the whole-app level. If the blocked item was part of an installer or app launch, review the 3076/3077 events to identify the exact file that was blocked.

    There is also another relevant Event Viewer location for some App Control-related failures:

    • Applications and Services Logs > Microsoft > Windows > AppLocker > MSI and Script

    That second log is used for MSI installers, scripts, and COM objects. For the .dll case described, start with CodeIntegrity > Operational.

    If the goal is only to confirm whether Smart App Control is active and in which mode, check:

    • Settings > Windows Security > App and Browser Control
      • On = enforcement mode
      • Evaluation = evaluation mode
      • Off = not running
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.