Enable Smart App Control and SmartScreen in Windows 11

The Problem

The most common way a home PC gets infected is not a clever exploit. It is a person downloading something — a cracked game, a "driver updater", a fake installer from an ad above the real search result — and clicking through the warning.

Windows 11 has two layers aimed at exactly this moment. SmartScreen checks a file's reputation and warns you. Smart App Control goes further: it blocks anything that is not signed by a known publisher or already trusted by Microsoft's cloud, with no "run anyway" button.

Smart App Control has an unusual rule that catches people out — it can only be enabled on a clean install of Windows 11. If it was ever turned off, or the PC was upgraded from Windows 10, the option is permanently unavailable until you reinstall. This guide covers turning it on where possible, and hardening SmartScreen properly where it is not.

Already downloaded something you regret? Start with avoid malware from fake downloads and remove virus and malware.

Check Where You Stand

Windows + I → Privacy & security → Windows Security → App & browser control.
Look at Smart App Control. You will see one of three states:
- On — active and blocking. Nothing to do.
- Evaluation mode — Windows is deciding whether it would get in your way. Leave it alone; it will switch itself On or Off within days.
- Off — permanently off on this installation until a clean install.

The Fix: Step-by-Step

Step 1: Set Reputation-Based Protection Correctly

This is the part that works on every Windows 11 PC, including upgraded ones. On App & browser control → Reputation-based protection settings, turn all four on:

Check apps and files — SmartScreen for anything you download and run.
SmartScreen for Microsoft Edge — blocks known phishing and malware sites.
Phishing protection — warns when you type your Windows password into a website or an untrusted app. Enable all three sub-options: warn on malicious sites, on password reuse, and on unsafe storage.
Potentially unwanted app blocking — enable Block apps and Block downloads. This is what catches bundled toolbars, "PC optimisers", and adware installers.

Potentially unwanted app blocking is off by default and is one of the highest-value switches on the page. Most junk that reaches a home PC is technically not malware — it is a PUA, and this setting stops it.

Step 2: Turn On Smart App Control If It Is in Evaluation Mode

If the status reads Evaluation mode, you do not need to do anything except use the PC normally with the apps you care about. Windows watches for a week or so and enables it automatically if it would not block your daily software.

You can force it on: Smart App Control → On. Be aware this is a one-way door in the other direction too — switching it Off later cannot be undone without reinstalling.

Step 3: Decide Whether a Clean Install Is Worth It

If the status is Off and you want Smart App Control, a clean install is the only route. That is a real cost, so weigh it:

Worth it if — the PC is used by someone who installs things casually, it is being set up fresh anyway, or it is a secondary machine for browsing and banking.

Not worth it if — you run development tools, self-compiled binaries, older niche software, or games with unusual launchers. Smart App Control will block them and you cannot make exceptions.

If you go ahead, follow how to clean install Windows 11 and check your files are safe first with transfer files from an old PC to a new PC.

Step 4: Stop Bypassing SmartScreen Out of Habit

SmartScreen's warning on an unrecognised app has a More info → Run anyway path. That link exists for legitimate small-developer software, and it is also how essentially every fake installer gets executed.

Before you click Run anyway, do these three checks:

Where did the link come from? A search ad is not the vendor's site. Type the domain yourself.
Does the publisher line match? Right-click the file → Properties → Digital Signatures. No signature at all on something claiming to be from a big vendor is decisive.
Scan it. Upload to VirusTotal, or right-click → Scan with Microsoft Defender.

The full method is in how to check if a website is safe.

Step 5: Keep the Store Path Where You Can

Microsoft Store apps are sandboxed and reviewed, and they never trip Smart App Control. For common categories — media players, archive tools, note apps — installing from the Store removes an entire class of risk. If the Store itself is broken, fix it with Microsoft Store not working.

Step 6: Verify With a Harmless Test

Download the EICAR test file from eicar.org — a harmless text string every antivirus recognises by agreement. Defender should quarantine it instantly. If nothing happens, real-time protection is off or a third-party product has taken over and is not working; see Windows Defender not working.

Smart App Control vs SmartScreen vs Defender

| | What it does | Can you override it | |---|---|---| | Smart App Control | Blocks untrusted binaries outright | No | | SmartScreen | Warns on low-reputation files and sites | Yes, one click | | Defender real-time | Detects known and behaviourally malicious code | Yes, with an exclusion |

They stack. Smart App Control is strictest and least flexible; SmartScreen is the practical everyday layer; Defender catches what makes it past both.

What Not to Do

Do not disable SmartScreen because it flagged one legitimate download. Use Run anyway for that one file instead.
Do not add broad Defender exclusions — a whole drive, or C:\Users — to stop repeated warnings. Exclusions are permanent blind spots and malware families specifically look for them.
Do not install a "security suite" that replaces Defender unless you have a real reason. Most consumer suites disable Windows Security's own layers and give you a worse stack plus a subscription. See remove fake antivirus and scareware if one arrived uninvited.

FAQ

Why can't I turn Smart App Control back on after switching it off?

By design. Once it is off, Windows stops collecting the trust signals it needs and the state is recorded for that installation. Only a clean install of Windows 11 returns it to evaluation mode. Microsoft chose a hard rule here to stop malware from simply disabling it and re-enabling it in a weakened state.

Does Smart App Control block games and anticheat?

Frequently, yes — particularly game launchers that download and run their own unsigned updaters, emulators, and mods. That is the main reason to leave it off on a gaming PC and rely on SmartScreen plus potentially-unwanted-app blocking instead.

Is potentially unwanted app blocking safe to turn on?

Yes, and it is one of the most useful settings in Windows Security. It targets adware, bundleware, and "system optimiser" installers rather than legitimate software. If it ever blocks something you genuinely want, you can allow that single item from the protection history.

Does SmartScreen send my files to Microsoft?

It sends a hash and metadata for reputation lookup, not the file itself, unless you have automatic sample submission enabled and the file is suspicious and unknown. You can review this under Virus & threat protection settings. If that matters to you, see disable Windows 11 telemetry and tracking for the wider picture.

Do I still need this if I only install from the Microsoft Store?

The Store path is already low risk, but SmartScreen and phishing protection also cover browser downloads, links in email, and password reuse on websites — none of which the Store touches. Leave them on.

Will these settings block my company's internal tools?

Possibly, if those tools are unsigned. On a managed work laptop these settings are usually controlled by policy already. Do not change them yourself — ask IT.

Still Not Working?

If the App & browser control page is blank or the toggles are greyed out, either a third-party antivirus has taken ownership of that surface or a group policy is enforcing the setting. Uninstall the third-party product to return control to Windows Security; on a work device, the policy is intentional.