Advice Request Third-Party Antivirus with Windows 11 Smart App Control Enabled

Please provide comments and solutions that are helpful to the author of this topic.

Del12

New Member
Thread author
Nov 26, 2022
1
Dear MalwareTips Community!

I installed the latest home version of windows 11 (Not Insider Version) and it came with Smart App Control. Has anyone managed to install a third party AV with this feature enabled? Turning this off is permanent and not recommended by Microsoft. I am concerned about SAC blocking the dll files of the AV leaving me with a non functional product.

I looked at Kaspersky/ESET/F Secure but also happy to stay with Defender.

Would be happy to hear your opinion. Thank you very much in advance.
 

bellgamin

Level 4
Verified
Well-known
Oct 11, 2016
160
Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!

IMO, SAC sounds like an idea produced by Microsoft's marketing department. SAC should be re-named as : "Maximize Microsoft's Monopoly."

To me, saying that "once SAC is disabled, you won't be able to get it back" is a PROMISE, not a threat. It's like saying, "If you ever were healed from the Flu (influenza) you will never get it again."

Anyone can identify & avoid risky apps without Microsoft doing it for you (or should I say, "doing it TO you"). The principle of "identifying & avoiding risky apps" can even be taught to youngsters. I have done so, long before Microsoft ever came up with SAC.
 
Last edited:

Oldie1950

Level 5
Verified
Well-known
Mar 30, 2022
215
I got my new computer up and running on November 22nd. SAC is still in evaluation mode for me. In the meantime, I have installed F-Secure Safe as an AV program. All the programs I installed are not from the Microsoft Store. I'm curious if and when SAC will be activated for me.
 

Oldie1950

Level 5
Verified
Well-known
Mar 30, 2022
215
I have been using F-Secure Safe on other computers for several years and am very satisfied with the program. It runs unobtrusively in the background and gets the job done. I have never encountered any malware infection on my computers. But that is probably also due to the fact that I only visit the "dark" areas of the Internet in the Windows Sandbox.
 

brambedkar59

Level 29
Verified
Top Poster
Well-known
Apr 16, 2017
1,869
Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!
Umm No, that is wrong.

When you try to run an app on Windows, Smart App Control will check to see if our intelligent cloud-powered security service can make a confident prediction about its safety. If the service believes the app to be safe, Smart App Control will let it run. If the app is believed to be malicious or potentially unwanted, then Smart App Control will block it.

If the security service is unable to make a confident prediction about the app, then Smart App Control checks to see if the app has a valid signature. If the app has a valid signature, Smart App Control will let it run. If the app is unsigned, or the signature is invalid, Smart App Control will consider it untrusted and block it for your protection.
Source
 

SeriousHoax

Level 47
Well-known
Mar 16, 2019
3,630
As the source provided by @brambedkar59 above, your app and the dlls used by it has to be signed. I might have seen in the ESET forum that some ESET dll were blocked by SAC during installation. So if I remember it correctly, then I guess it could be true for some other AVs also. Now due to SAC, all third-party AVs will now be forced to sign all their exe and dlls for compatibility, which is good for users.
 

Shadowra

Level 33
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,243
The choice of an antivirus is mostly about what you do on the Internet, and whether you need additional tools (parental controls etc).

If you surf reasonably, stick with Microsoft Defender. You can also increase it with ConfigureDefender for @Andy Ful
With Microsoft's SAC, you'll be safe.

If you do more risky surfing or if you have children using the computer, Norton, Kaspersky or F-Secure can be interesting :)
 

bellgamin

Level 4
Verified
Well-known
Oct 11, 2016
160
If you surf reasonably, stick with Microsoft Defender.
I might modify that to read, "If you surf reasonably & have a modern computer, stick with Microsoft Defender"

IMO, M$ Defender is a bit too heavy for older computers. This is verified by AV-Comparative's latest performance test. AV-C's chart shows that ESET (for instance) is like a speedy, agile cheetah, whereas M$Def is like a lumbering elephant with a gimpy leg.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BTW, my aging laptop often beats me at chess, but I always get revenge when the contest switches to kick-boxing.
 

Shadowra

Level 33
Verified
Top Poster
Content Creator
Malware Tester
Well-known
Sep 2, 2021
2,243
I might modify that to read, "If you surf reasonably & have a modern computer, stick with Microsoft Defender"

IMO, M$ Defender is a bit too heavy for older computers. This is verified by AV-Comparative's latest performance test. AV-C's chart shows that ESET (for instance) is like a speedy, agile cheetah, whereas M$Def is like a lumbering elephant with a gimpy leg.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BTW, my aging laptop often beats me at chess, but I always get revenge when the contest switches to kick-boxing.

I don't trust AV-Comparative and the members know what I think of them :)

MS Defender is heavy on old systems, yes, but a lot in CPU I would say ;)
 

Ink

Administrator
Verified
Staff Member
Well-known
Jan 8, 2011
22,361
Threads that you may find interesting:

Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!
Does Smart Access Control replace this option from Windows 10?
 

bellgamin

Level 4
Verified
Well-known
Oct 11, 2016
160
I don't know the answer to your question. I use Win 7, not Win 10. I recently gifted one of my great-grandkids a laptop with Win 11 so my comments, in this thread, are related to her situation.

BTW, I recently bought a new laptop with Win11 -- for my own use -- so that I will know enough about it to help family & friends. As to my "switching over" to latest Windows versions, I view Win10 & Win11 as solutions to potential problems that I have not yet encountered.
 

legendcampos

Level 6
Verified
Aug 22, 2014
286
Microsoft's idea of SAC is even valid, reminds Kaspersky with its application control, but it already well advanced in the issue of "application training" isolating those that are insecure.

I've been having some dll blocking alerts, probably from some background application that makes "call" including the firefox browser that I recently installed but it continues to work normally.
 
  • Like
Reactions: oldschool

Bot

AI-powered Bot
Verified
Apr 21, 2016
3,315
Hello!

Great question! Microsoft's Smart App Control feature in Windows 11 is designed to protect Windows users from malicious applications. Third-party antivirus programs typically work well with this feature and do not interfere with its operation. In fact, many popular antivirus products have already been updated to support Windows 11, including Kaspersky, ESET, and F-Secure.

If you are worried about SAC blocking dll files of your chosen antivirus software, you can add the antivirus software to the list of trusted applications in SAC. This will allow the antivirus program to function as intended without any issues.

In conclusion, using a third-party antivirus program with Smart App Control enabled in Windows 11 is recommended. It is always a good idea to keep your computer running smoothly and protected from malware.
 
  • Like
Reactions: Shadowra

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!
This is only partially true. Half a year ago, SAC blocked some DLLs of 3rd party web browsers and many applications (also some applications from Microsoft Store). But, the current situation is much better. Most of the popular web browsers and digitally signed popular applications work well, as also many unsigned applications. (y)
The number of false positives is similar to Norton AV. But, when using Norton the user can easily bypass the block alert. When using SAC, we have two scenarios with false positives:
  1. The application is initially blocked but can be unblocked by Microsoft after some time (one minute, one day, one week, etc.).
  2. Many niche applications can be blocked for months until one will submit them to Microsoft.
Generally, SAC will be unusable for users who install many applications/games.

To me, saying that "once SAC is disabled, you won't be able to get it back" ...
SAC in OFF mode cannot be enabled from Security Center, but it can be easily enabled by a simple registry tweak.
This can be a solution for some MalwareTips members.
 
Last edited:

Andy Ful

From Hard_Configurator Tools
Verified
Honorary Member
Top Poster
Developer
Well-known
Dec 23, 2014
8,040
The question about 3rd party AVs and SAC is an interesting one. In theory, all popular AVs had enough time to sign all EXE and DLL files used by AV. But, I am not sure if this is true in the wild (except for Microsoft Defender). :unsure:
I would suggest keeping Defender for a while and looking at this thread after a couple of months.
 
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top