Question Does anybody know if indeed SAC can be turned on without reinstalling Windows?
- Thread starter devjitdutta2025
- Start date
- Featured
Windows 11
26 Replies
2,812 Views
Help answer the author's question with clear explanations and useful steps.
Yes; after the latest preview update of Windows; I have turned SAC off and on again with the registry modification.
Before such update, the registry hack did not work.
Before such update, the registry hack did not work.
F
ForgottenSeer 123960
@devjitdutta2025
Affirmative. It's confirmed that the "sterile field" (Clean Install) requirement for Smart App Control (SAC) has been rescinded for Windows 11 versions 24H2 and 25H2.
While registry modifications (likely targeting the VerifiedAndReputablePolicyState) may now function due to this kernel-level policy shift, the official engagement protocol is exposed directly via the UI, navigate to Windows Security > App & Browser Control > Smart App Control to toggle enforcement.
Proceed with caution. Activating SAC on a "dirty" (previously used) system introduces a high probability of immediate "False Positives." Legitimate but unsigned binaries lacking global prevalence will be neutralized (blocked) by the automated Windows Defender Application Control (WDAC) policy. If your environment relies on custom tooling or niche software, anticipate significant operational friction.
Affirmative. It's confirmed that the "sterile field" (Clean Install) requirement for Smart App Control (SAC) has been rescinded for Windows 11 versions 24H2 and 25H2.
While registry modifications (likely targeting the VerifiedAndReputablePolicyState) may now function due to this kernel-level policy shift, the official engagement protocol is exposed directly via the UI, navigate to Windows Security > App & Browser Control > Smart App Control to toggle enforcement.
Proceed with caution. Activating SAC on a "dirty" (previously used) system introduces a high probability of immediate "False Positives." Legitimate but unsigned binaries lacking global prevalence will be neutralized (blocked) by the automated Windows Defender Application Control (WDAC) policy. If your environment relies on custom tooling or niche software, anticipate significant operational friction.
Last edited by a moderator:
Yes.
Notice the On/Off switches and no Evaluation Mode (greyed out).
@Parkinsond - no registry modification needed.
Notice the On/Off switches and no Evaluation Mode (greyed out).
@Parkinsond - no registry modification needed.
On my side, after I turned it off, the "on" button was greyed.
Could not turn it on again, except with registry.
I'm using W 11 IoT EnT LTSC, not the GAC ones.
I forgot that.
The LTSC tax to be paid.
devjitdutta2025
Level 4
So indeed it seems that SAC now can be turned off safely and then re-enabled again without reinstalling the OS. Good job MS.
One good step, but a further one is needed.
I get blocked installer, I turn off SAC to finish installation, then turn SAC back on, then try to launch the app, then SAC blocks the app.
Exception will be a welcome addition.
devjitdutta2025
Level 4
How old is the installer? Is it fairly new?
Sometime SAC blocks the installer when freshly released, then allow it after days or weeks, as with media player classic.
Sometimes it blocks the installer even if old enough, as the case with peazip.
Sometimes it blocks the installer, but allows the installed app to launch; here turning off SAC is useful to bypass installation block.
Sometimes it blocks both the installer and the installed app after installation; turning off SAC will permit installation, but after turning it on again, launching app will be blocked.
I have the latest updates and for some reason mine is still off with no way to turn on.
Submit through the Feedback Hub and wait a few days, then try again.
@Antimalware18 - what version Windows do you have? What region do you live in? It's probably another controlled rollout by MS.
I have the same situation too.
So it's not the issue of LTSC version as I thought.
Forgot to put my location, Southwestern U.S
devjitdutta2025
Level 4
So it looks like there’s some discrepancies regarding SAC. On some PC’s the toggle ON switch is not there while others have it
Controlled rollout.
Recently browsing
Members who viewed this thread in the last 5 minutes
