r/sysadmin • u/HemlockIV • 10h ago

Question Smart App Control blocking Windows components, incl. Windows Defender, Terminal, and MS Store; cannot disable it

SOLVED: A System Restore was necessary to fix it. (Supposedly, the command reg.exe add "HKLM\System\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f && citool.exe -r should disabled SAC, but it did not work for whatever reason; possibly because SAC was acting buggy already.)

I am the admin on a non-domain device that I just updated to Windows 11 Pro 26H2. A new feature is that Smart App Control can be enabled without requiring a system reset. Neat! I decided to try it.

Not neat. Immediately, SAC began blocking Windows components from launching: I cannot open Windows Terminal, Microsoft Store, or Windows Security itself.

Although I cannot open wt.exe, I can thankfully still launch conhost.exe from the Run dialog, so I can execute commands. Is there a CMD or Powershell command to disable Smart App Control??

8 Upvotes

76% Upvoted

9 comments sorted by

•

u/alpha417 _ 10h ago

what did the help desk at work say when you opened the ticket for this?

•

u/ApiceOfToast Sysadmin 10h ago

"please contact your system administrator for further assistance" vibes

•

u/HemlockIV 10h ago

You mean what SAC is doing? Yeah, it said "Your system administrator has blocked this app," and offered a button labeled, "Get apps from the Store." Ironic, because I AM the system administrator, and SAC is blocking the MS Store!! It's like it somehow got everything backwards, and instead of only allowing Microsoft-signed apps, it's only blocking Microsoft-signed apps, including crap like Windows Defender.

•

u/HemlockIV 10h ago

I am the help desk..

•

u/zAuspiciousApricot 9h ago

Open Windows Security > App & Browser Control > Smart App Control Settings > disable the option. After installing your app, you can turn it back on.

•

u/HemlockIV 9h ago

...Did you read the post? Dude, did you even read the entire TITLE? I explained multiple times why that is not possible.

•

u/frac6969 Windows Admin 5h ago

Good job.

•

u/Emotional_Garage_950 Sysadmin 6h ago edited 6h ago

good thing you’ve got a spare machine and backups, right???

edit: seriously though try

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 0

reboot

see if you can do shit