Smart App Control

Ian Brooke 21 Reputation points
2026-10-16T14:47:51.7933333+00:00

I develop and distribute two Windows desktop applications to volunteers of a charity, both applications are currently unsigned.

Following a recent Windows update, Smart App Control began blocking the exe's and dll's. Disabling Smart App Control immediately resolved the problem.

We are considering purchasing Microsoft's Artifact Signing service to digitally sign both applications.

Before subscribing, we would like to get confirmation of the following:

  1. Will executables and DLLs signed using Microsoft Artifact Signing normally be accepted by Windows 11 Smart App Control without requiring an established application reputation?
  2. Does this apply equally to VB6 and VB.NET applications?
  3. Can we use the same Artifact Signing subscription to sign both applications?
  4. If a signed executable loads unsigned third-party DLLs or ActiveX controls, can Smart App Control still block those components?
  5. Is there a way to test whether Artifact Signing will resolve our particular Smart App Control problem before committing to a subscription? I have actually turned Smart App Control off after having it on and having big problems with the .Net app and there appears to be no way to turn it on again with reinstalling Windows!

Can anyone help with these questions?

Our objective is to distribute software that volunteers can install and run without having to disable Smart App Control. If something else is required to achieve this, what is it?

Many thanks

Windows for home | Windows 11 | Security and privacy
0 comments
Answer accepted by question author

AI answer

2026-10-16T14:48:10.0633333+00:00

Yes. For Windows 11, Smart App Control allows apps and binaries to run if they are recognized as safe by Microsoft app intelligence, or if they are signed with a certificate issued by a certificate authority in the Trusted Root Program. Microsoft Artifact Signing Public Trust is designed to support Smart App Control in Windows 11, and Microsoft recommends Public Trust for artifacts intended to be shared publicly. That means a properly signed executable or DLL does not need an established app reputation to satisfy the signature path described for Smart App Control.

VB6 versus VB.NET is not called out as a difference. The relevant requirement in the available documentation is whether the binaries are trusted and signed appropriately, not which of those two development technologies produced them.

The available documentation does not state any subscription limit that would prevent using one Artifact Signing subscription for both applications.

Yes. Smart App Control can still block components that are unsafe, unknown, or unsigned. Microsoft recommends signing all application code and specifically calls out including all binaries such as exe, dll, temp installer files, scripts, and uninstallers. If a signed executable loads unsigned third-party DLLs or ActiveX controls, those unsigned components can still be a problem.

For testing before broad distribution, the documented approach is to test the app’s signature against Smart App Control before release. Test all code paths, install and uninstall binaries, features, and integrations. Two supported approaches are documented:

  1. Use audit policies so log entries are created without blocking execution.
  2. Test directly against Smart App Control enforcement mode.

Since Smart App Control was already turned off, the available guidance says recent Windows updates allow Smart App Control to be re-enabled within the Windows Security app without requiring a clean installation. Also, Smart App Control can be turned on manually in Windows Security if it is available for the device.

To meet the stated goal, the documented path is:

  1. Sign all distributed code, not just the main EXE.
  2. Include DLLs, installer and uninstaller binaries, scripts, and any other binaries the apps load.
  3. Use a trusted signing certificate path intended for public distribution, such as Artifact Signing Public Trust.
  4. Test all code paths with Smart App Control by using audit policies or enforcement mode before release.
  5. Avoid modifying files after signing, because that can break the signature.

If any third-party dependency remains unsigned or is identified as unsafe, Smart App Control may still block it even if the main application is signed.

AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Ian Brooke 21 Reputation points
    2026-10-16T15:01:44.97+00:00

    I THINK that answers my questions, I am still concerned about some of them but at the moment my main concern is whether the not the small charity is actually able to afford to pay for a signing service!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.