Question Application Control turned off

[AFEH]

SAC requires users to allow Optional Diagnostic Data to be sent to MS

SAC is on after disabling "allow Optional Diagnostic Data" during W install, and blocks some files!

 

[oldschool]

SAC is on after disabling "allow Optional Diagnostic Data" during W install, and blocks some files!

I'm surprised, but be aware that SAC may not be offering maximum protection. It may be basing its decisions on local code integrity checks alone and not making full use of its cloud resources. This is only conjecture on my part and inferred from below info.

MS updated its documentation page on November 18, 2025 and it says, in part:

Smart App Control is an app execution control feature that combines Microsoft’s app intelligence services and Windows' code integrity features to protect users from untrusted or potentially dangerous code. ... If the app intelligence service is unable to make a prediction, then Smart App Control will still allow an app to run if it is signed with a certificate issued by a certificate authority (CA) within the Trusted Root Program.

Smart App Control - Windows apps

OTOH, MS is continually refining its cloud data as it collects more and more, so what is blocked today may be allowed tomorrow.

... and coming in 2026: