You double-click a utility you have run for years, and Windows 11 slams the door with a message about keeping you safe. No run-anyway link, no obvious way in. Here is how to get your app back without leaving the whole machine exposed.

It usually reads something like “This app has been blocked to keep your device secure” or “an app that may be unsafe has been blocked.” The frustrating part is what happens next, which is nothing. There is no button to override it, no right-click trick that jumps out, and the app you know is fine just refuses to launch.

The Gist: if Smart App Control blocked an app you trust, start by confirming the file really is safe, because there is no per-app allow button to fall back on. Check the digital signature, verify the file’s hash, and make sure you downloaded it from the official source. Then try the gentle fixes that keep protection on: clear the “mark of the web” flag, grab a properly signed build, or install a Microsoft Store version if one exists. Turning Smart App Control fully off is the last lever, not the first, because getting it back on is genuinely hard.

What Smart App Control actually does

Smart App Control arrived with Windows 11 version 22H2 as a stricter cousin of SmartScreen. Before an app runs, it checks that app against Microsoft’s cloud trust service. If the app is signed with a valid certificate and has a good reputation, it runs. If the app is unsigned, brand new, or something Microsoft’s service simply cannot vouch for, it gets blocked before it ever opens.

Two details explain most of the pain. First, it only turns on during a clean Windows install, which is why a shiny new 2026 laptop is usually where people meet it for the first time. Second, it runs in one of three modes: On, Evaluation, or Off. Many machines ship in Evaluation, where Windows quietly decides whether Smart App Control is a good fit for how you use the PC.

The feature is built for people who install almost nothing outside the Microsoft Store. So the apps it tends to block are the ones enthusiasts love: older freeware, small indie utilities, homemade scripts, and developer tooling. The reports about it blocking parts of the Python ecosystem, or tripping on system tools like the Windows Subsystem for Linux and mshta, are not rare edge cases. They are the normal experience for anyone whose Start menu looks a little different from the default.

The part nobody warns you about: there is no allow list

Here is where expectations break. With Microsoft Defender you can add an exclusion. With SmartScreen you get a “Run anyway” link. People assume Smart App Control works the same way and go hunting for the equivalent toggle.

It does not exist. Smart App Control has no per-app allow list, no “trust this one” checkbox, and no override for a single program. Microsoft’s own guidance is blunt about it: either get the developer to sign the app so the trust service recognizes it, or turn Smart App Control off for the entire system. According to the Smart App Control FAQ from Microsoft, there is no supported middle path for whitelisting one program.

So the honest question is not “how do I whitelist this app.” It is “have I confirmed this app is safe, and is losing Smart App Control worth it to run this one thing.” That reframing matters, because it turns a quick toggle into a real decision.

Step one: verify the app before you trust it

A block means “unverified,” not “dangerous.” Plenty of perfectly safe tools get caught. But since you are about to override a security warning, spend two minutes proving to yourself that the file deserves it.

Right-click the file, choose Properties, and open the Digital Signatures tab. A legitimately signed app names its publisher and shows a valid signature you can inspect. If that tab is missing, or it lists an unknown publisher, treat it as a reason to slow down rather than proof of malware.

Next, confirm the file’s identity. Many projects publish a SHA-256 hash for each release. Compare theirs against the file you downloaded, or upload the file to VirusTotal and see how the scanners respond. And check the obvious thing people skip when they are in a hurry: did you actually download it from the official site, or from a mirror with a name like “download123” that clones the real page? The whole point of unblocking safely is not accidentally unblocking the wrong thing.

Step two: the fixes that keep protection on

Once you are confident the app is genuine, try these before touching Smart App Control itself.

Clear the mark of the web. Right-click the file, open Properties, and on the General tab look near the bottom for an “Unblock” checkbox next to a note about the file coming from another computer. Tick it, click Apply, and try again. This clears the “downloaded from the internet” flag. It helps when the block was about where the file came from, though it will not override a hard trust verdict on the app itself. It costs nothing to try first.

Find a signed build. Smart App Control trusts apps signed with a valid certificate and good reputation, so a signed installer often walks straight through where a loose .exe got stopped. A lot of indie developers added code signing specifically because of this feature, so check the project’s releases page for a newer or signed version. A signed MSI is your friend here.

Use the Store version if there is one. Apps from the Microsoft Store are trusted by default, so if the tool has a Store listing, installing from there sidesteps the block entirely.

Consider Evaluation mode instead of Off. In Evaluation, Smart App Control watches without blocking as aggressively while Windows learns whether your machine is a good match. It is a softer setting than fully On. One catch worth knowing: once it leaves Evaluation, whether Microsoft decides for you or you flip the switch yourself, you cannot return to Evaluation without reinstalling Windows. So think of it as a look-once option, not something you toggle back and forth.

When turning it off is the honest answer

Sometimes the tool is genuinely essential, genuinely unsigned, and you have verified it properly. At that point your only remaining lever is the master switch: Settings > Privacy & security > Windows Security > App & browser control > Smart App Control, then set it to Off.

Read this next part twice before you do. Microsoft’s documented way to turn Smart App Control back on is to reset or reinstall Windows and opt into optional diagnostic data during setup. There is a registry value some users flip instead, at HKLM\System\CurrentControlSet\Control\CI\Policy, where VerifiedAndReputablePolicyState reads 0 for off, 1 for on, and 2 for evaluation. It is not officially supported, and people report it does not reliably stick. So treat Off as a door that mostly locks behind you, not a quick toggle you will undo tonight.

None of this leaves you defenseless, by the way. Turning Smart App Control off simply removes one strict reputation layer. Microsoft Defender still scans, SmartScreen still warns on downloads, and your own download habits still matter. It is one lock coming off a door that has several.

A quick way to decide

What kind of machine is this, really? That question answers most of it.

If it is an everyday laptop for browsing, email, Office, and streaming, keep Smart App Control on. The rare block is worth the verify-and-clear routine above, and if one stubborn app refuses to run in any signed form, it is fair to ask whether you actually need it.

If it is a developer or tinkerer’s machine loaded with Python environments, WSL, sideloaded utilities, and scripts you wrote yourself, the two of you will fight constantly. Many people in that situation decide up front that this particular box is not the one for Smart App Control and turn it off on purpose, leaning on Defender and good hygiene instead. That is the same tradeoff calculus behind Memory Integrity blocking drivers you need, another security feature that protects you right up until it breaks something you rely on. If your blocks started right after a big Windows update, it is also worth ruling out unrelated update fallout, the way a bad printer driver can break after an update, and reviewing the usual Windows 11 upgrade questions before you blame the wrong thing. For more Windows how-to guides, browse our Tech section.

Developers who keep hitting this can also point the app’s author at Microsoft’s Smart App Control guidance for app makers, which explains what it takes for a program to be trusted in the first place.

Frequently Asked Questions Can I whitelist a single app in Smart App Control?

No. Smart App Control has no per-app allow list and no run-anyway button. Your real options are a signed and reputable version of the app, or turning the feature off for the whole system.

Will unblocking the file in Properties fix it?

Sometimes. If the block was about the file arriving from the internet, ticking the “Unblock” checkbox can clear it. If Smart App Control has judged the app itself untrusted, unblocking the file will not change that verdict.

If I turn Smart App Control off, can I turn it back on later?

Not easily. Microsoft’s supported path is to reset or reinstall Windows and opt into optional diagnostic data during setup. Plan around “off” being close to permanent unless you intend to reinstall.

Does a block mean the app is malware?

No. It blocks anything it cannot confirm is both signed and reputable, which catches plenty of safe indie tools, older freeware, and developer utilities. A block says “unverified,” so verify it yourself before deciding.

Why did this start on my new laptop?

Smart App Control only activates on clean Windows 11 installs and ships On or in Evaluation on many 2026 machines. A fresh PC is exactly where you tend to meet it.

Does Smart App Control replace my antivirus?

No. It is a reputation gate in front of app execution. Microsoft Defender or your antivirus still handles scanning, so switching it off removes one layer rather than all of them.

The Rundown

• Smart App Control has no per-app allow button, so hunting for a “trust this one” toggle is a dead end.
• Verify first: open the Digital Signatures tab, confirm the file’s hash, and check that you downloaded from the official source.
• Try the gentle fixes before anything drastic: clear the mark of the web, get a signed build, or install a Store version.
• Evaluation mode is a softer middle ground, but leaving it is a one-way trip without a reinstall.
• Turning it off is the last lever, and Microsoft’s official way back on is reinstalling Windows, so decide on purpose.

Playing It Safe

The “smart” in Smart App Control really means opinionated, and its opinion is that anything it cannot vouch for should not run. That is reassuring on a locked-down family laptop and maddening on a workbench full of niche tools. The move is not fighting it one app at a time, because you genuinely cannot. It is deciding what kind of machine this is, verifying the things you choose to unblock, and if you ever switch the feature off, doing it knowing the door mostly locks behind you.