Smart app control and smart screen are not blocking unsigned apps.

Johnny Graterol Guevara 0 Reputation points
2026-11-06T15:48:22.04+00:00

After the update KB5127648, I began to have issues with both Smart app control and Smart screen. The fix added in update KB5127936 has only enabled the activation option in the Smart app control screen. However, I am noticing that neither Smart app control nor Smartscreen are blocking unsigned apps on my system. The usual behavior when I tried to either run or install and unsigned app was blocking, with option of ignore (in the case of the Smart screen). This is no longer the case, despite confirmation (on a Powershell script) that both apps are running. Captura de pantalla 2026-11-06 104418 What is exactly going on here? Is this an update issue, or should I be concerned about a malware issue (or even worse)?

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-11-06T15:48:46.3866667+00:00

    Smart App Control being On does not mean it will block every unsigned app immediately.

    Smart App Control first uses Microsoft’s cloud-powered security service to decide whether an app is safe. If that service can make a confident safe prediction, the app is allowed to run. If it cannot make a confident prediction, Smart App Control then checks whether the app has a valid signature. If the app is unsigned or has an invalid signature, it is considered untrusted and blocked.

    That means an unsigned app is not the only factor in the decision path described in the product behavior.

    For the KB5127648 issue specifically, Microsoft documented a known problem where some devices could not turn Smart App Control back on after that update. Microsoft states this was resolved by updates released on and after October 27, 2026, including KB5127936. That fix addresses the ability to turn Smart App Control on when the option was grayed out.

    To verify whether Smart App Control is actually auditing or blocking files on the device, check the Code Integrity log:

    1. Open Event Viewer.
    2. Go to Application and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
    3. Look for:
      • Event ID 3076 for evaluation mode events
      • Event ID 3077 for enforcement mode events

    Important: this log records blocked or audited files, not full installer-level diagnostics. If an installer fails, the useful detail is which individual file inside it was blocked.

    Also verify the Smart App Control mode in Windows Security > App & browser control > Smart App Control settings:

    • Evaluation mode does not block anything.
    • On notifies when apps are untrusted.
    • Off does not notify.

    Based on the documented behavior, the KB5127936 fix explains why the toggle became available again, but the context does not show any documented issue saying that KB5127936 causes Smart App Control or SmartScreen to stop blocking unsigned apps in general. The supported next step is to confirm actual Smart App Control decisions in the CodeIntegrity\Operational log rather than relying only on service status output.

    If the log shows no 3077 enforcement events for the tested files, that indicates Smart App Control is not treating those files as block candidates under its current decision process, not necessarily malware on the device.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.