Advice Request Third-Party Antivirus with Windows 11 Smart App Control Enabled

[Del12]

Dear MalwareTips Community!

I installed the latest home version of windows 11 (Not Insider Version) and it came with Smart App Control. Has anyone managed to install a third party AV with this feature enabled? Turning this off is permanent and not recommended by Microsoft. I am concerned about SAC blocking the dll files of the AV leaving me with a non functional product.

I looked at Kaspersky/ESET/F Secure but also happy to stay with Defender.

Would be happy to hear your opinion. Thank you very much in advance.

 

[bellgamin]

Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!

IMO, SAC sounds like an idea produced by Microsoft's marketing department. SAC should be re-named as : "Maximize Microsoft's Monopoly."

To me, saying that "once SAC is disabled, you won't be able to get it back" is a PROMISE, not a threat. It's like saying, "If you ever were healed from the Flu (influenza) you will never get it again."

Anyone can identify & avoid risky apps without Microsoft doing it for you (or should I say, "doing it TO you"). The principle of "identifying & avoiding risky apps" can even be taught to youngsters. I have done so, long before Microsoft ever came up with SAC.

 

[Oldie1950]

I got my new computer up and running on November 22nd. SAC is still in evaluation mode for me. In the meantime, I have installed F-Secure Safe as an AV program. All the programs I installed are not from the Microsoft Store. I'm curious if and when SAC will be activated for me.

 

[bellgamin]

I have installed F-Secure Safe as an AV program.

Good choice! Let us know how you like F-SS, after you two get accustomed to each other.

 

[Oldie1950]

I have been using F-Secure Safe on other computers for several years and am very satisfied with the program. It runs unobtrusively in the background and gets the job done. I have never encountered any malware infection on my computers. But that is probably also due to the fact that I only visit the "dark" areas of the Internet in the Windows Sandbox.

 

[brambedkar59]

Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!

Umm No, that is wrong.

When you try to run an app on Windows, Smart App Control will check to see if our intelligent cloud-powered security service can make a confident prediction about its safety. If the service believes the app to be safe, Smart App Control will let it run. If the app is believed to be malicious or potentially unwanted, then Smart App Control will block it.

If the security service is unable to make a confident prediction about the app, then Smart App Control checks to see if the app has a valid signature. If the app has a valid signature, Smart App Control will let it run. If the app is unsigned, or the signature is invalid, Smart App Control will consider it untrusted and block it for your protection.

Source

 

[SeriousHoax]

As the source provided by @brambedkar59 above, your app and the dlls used by it has to be signed. I might have seen in the ESET forum that some ESET dll were blocked by SAC during installation. So if I remember it correctly, then I guess it could be true for some other AVs also. Now due to SAC, all third-party AVs will now be forced to sign all their exe and dlls for compatibility, which is good for users.

 

[bellgamin]

Umm No, that is wrong.


Source

You're right!!! (However, I will pout & suck my thumb for a while.)

From your description, it sounds like SAC is Voodoo Shield's pre-pubescent 1st cousin..

 

[Shadowra]

The choice of an antivirus is mostly about what you do on the Internet, and whether you need additional tools (parental controls etc).

If you surf reasonably, stick with Microsoft Defender. You can also increase it with ConfigureDefender for @Andy Ful
With Microsoft's SAC, you'll be safe.

If you do more risky surfing or if you have children using the computer, Norton, Kaspersky or F-Secure can be interesting

 

[bellgamin]

If you surf reasonably, stick with Microsoft Defender.

I might modify that to read, "If you surf reasonably & have a modern computer, stick with Microsoft Defender"

IMO, M$ Defender is a bit too heavy for older computers. This is verified by AV-Comparative's latest performance test. AV-C's chart shows that ESET (for instance) is like a speedy, agile cheetah, whereas M$Def is like a lumbering elephant with a gimpy leg.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BTW, my aging laptop often beats me at chess, but I always get revenge when the contest switches to kick-boxing.

 

[Shadowra]

I might modify that to read, "If you surf reasonably & have a modern computer, stick with Microsoft Defender"

IMO, M$ Defender is a bit too heavy for older computers. This is verified by AV-Comparative's latest performance test. AV-C's chart shows that ESET (for instance) is like a speedy, agile cheetah, whereas M$Def is like a lumbering elephant with a gimpy leg.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
BTW, my aging laptop often beats me at chess, but I always get revenge when the contest switches to kick-boxing.

I don't trust AV-Comparative and the members know what I think of them

MS Defender is heavy on old systems, yes, but a lot in CPU I would say

 

[Ink]

Threads that you may find interesting:

• Update - Smart App Control - Windows 11 22H2 feature promises significant protection from malware
• Question - Is the improved performance of Microsoft Defender a myth? Should we necessarily be using a 3rd party AV?

Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!

Does Smart Access Control replace this option from Windows 10?

 

[bellgamin]

Threads that you may find interesting:

• Update - Smart App Control - Windows 11 22H2 feature promises significant protection from malware
• Question - Is the improved performance of Microsoft Defender a myth? Should we necessarily be using a 3rd party AV?

Does Smart Access Control replace this option from Windows 10?

I don't know the answer to your question. I use Win 7, not Win 10. I recently gifted one of my great-grandkids a laptop with Win 11 so my comments, in this thread, are related to her situation.

BTW, I recently bought a new laptop with Win11 -- for my own use -- so that I will know enough about it to help family & friends. As to my "switching over" to latest Windows versions, I view Win10 & Win11 as solutions to potential problems that I have not yet encountered.

 

[legendcampos]

Microsoft's idea of SAC is even valid, reminds Kaspersky with its application control, but it already well advanced in the issue of "application training" isolating those that are insecure.

I've been having some dll blocking alerts, probably from some background application that makes "call" including the firefox browser that I recently installed but it continues to work normally.

 

[Bot]

Hello!

Great question! Microsoft's Smart App Control feature in Windows 11 is designed to protect Windows users from malicious applications. Third-party antivirus programs typically work well with this feature and do not interfere with its operation. In fact, many popular antivirus products have already been updated to support Windows 11, including Kaspersky, ESET, and F-Secure.

If you are worried about SAC blocking dll files of your chosen antivirus software, you can add the antivirus software to the list of trusted applications in SAC. This will allow the antivirus program to function as intended without any issues.

In conclusion, using a third-party antivirus program with Smart App Control enabled in Windows 11 is recommended. It is always a good idea to keep your computer running smoothly and protected from malware.

 

[NormanF]

Umm No, that is wrong.


Source

What sucks about SAC is the user can't enable a blocked program if SAC blocked it by mistake! Its not ready for the home user.

 

[Andy Ful]

Bascially, Smart App Contol (SAC) blocks all app downloads except those from Microsoft Store, and blocks all browsers except Microsoft Edge. Goood grief!!!

This is only partially true. Half a year ago, SAC blocked some DLLs of 3rd party web browsers and many applications (also some applications from Microsoft Store). But, the current situation is much better. Most of the popular web browsers and digitally signed popular applications work well, as also many unsigned applications.
The number of false positives is similar to Norton AV. But, when using Norton the user can easily bypass the block alert. When using SAC, we have two scenarios with false positives:

1. The application is initially blocked but can be unblocked by Microsoft after some time (one minute, one day, one week, etc.).
2. Many niche applications can be blocked for months until one will submit them to Microsoft.

Generally, SAC will be unusable for users who install many applications/games.

To me, saying that "once SAC is disabled, you won't be able to get it back" ...

SAC in OFF mode cannot be enabled from Security Center, but it can be easily enabled by a simple registry tweak.
This can be a solution for some MalwareTips members.

 

[Andy Ful]

The question about 3rd party AVs and SAC is an interesting one. In theory, all popular AVs had enough time to sign all EXE and DLL files used by AV. But, I am not sure if this is true in the wild (except for Microsoft Defender).
I would suggest keeping Defender for a while and looking at this thread after a couple of months.