Windows 11's October update can lock Smart App Control and trip work Wi-Fi

The update is called KB5127648. Microsoft released it on Tuesday, October 13, as the monthly security update for Windows 11.

It covers three versions of Windows 11:

• Version 26H2: OS build 26300.9711
• Version 25H2: OS build 26200.9711
• Version 24H2: OS build 26100.9711

It downloads and installs automatically through Windows Update. So if your PC restarted this week, you probably have it already.

Like every monthly update, it is cumulative. It includes everything from the September updates, plus this month's security fixes. That's why skipping it is not a great idea, even when it comes with a bug or two.

Smart App Control is a Windows 11 security feature that blocks apps and files that look harmful before they run. BleepingComputer describes it as using Microsoft's app intelligence services and code integrity checks, working alongside Microsoft Defender and SmartScreen.

Think of it as a bouncer at the door of your PC. Most apps get waved in. Unknown or suspicious ones get stopped.

Plenty of people turn it off, often because it blocked an app they trust. Normally, you can turn it back on later in the Windows Security app.

After installing KB5127648, some PCs can't turn Smart App Control back on. In Microsoft's words, "the option to turn on Smart App Control might be grayed out."

The bug only hits PCs where the feature was already off. Microsoft says devices where it was turned on "are not affected and remain protected."

BleepingComputer reports that the problem affects Windows 11 version 24H2 and later. A fix isn't ready yet. Microsoft says it "is working on a resolution and will provide an update in an upcoming release."

In real life Say you turned Smart App Control off last spring to install an old printer tool. This week you want the extra protection back, so you open Windows Security. The switch is there, but it's gray and won't move. That's this bug, not you.

Microsoft offers two workarounds while it works on a real fix.

For a single PC, you can edit the registry. Microsoft's steps:

• Step 1: Open Command Prompt by typing cmd in the Search box.
• Step 2: Run two reg add commands that Microsoft lists on its update page. They add two override values under a FeatureManagement key.
• Step 3: Restart the PC.

Microsoft warns that you should back up the registry first and know how to restore it. Editing the registry by hand is a bit like rewiring a light switch: easy when it goes right, annoying when it doesn't.

For company PCs, IT teams can install two special Group Policies instead. Microsoft says both are needed. The first one turns Smart App Control on. The second one turns on logging, so admins can troubleshoot if anything else goes wrong. After setting both to Enabled, the PCs need a restart.

The catch: if you're not comfortable in the registry, the safest move is to wait. Microsoft says the fix will arrive in a future update.

The second problem is bigger for offices, schools and universities. It comes from a deliberate security change, not a classic bug.

Here's the short version. NTLMv1 is an old Windows sign-in method that Microsoft wants gone. Since late August 2025, Windows has been in an "audit" mode for it, logging warnings when something used NTLMv1-derived credentials for single sign-on. Single sign-on is when Windows reuses your PC login so you don't type it again.

With the October update, Windows switches to "enforce" mode by default and blocks those sign-ins instead of just logging them. This applies to PCs where Credential Guard is turned off and an admin hasn't set the policy by hand.

Microsoft's update notes say plainly that this "might affect Wi-Fi, Ethernet, and VPN connections that use MS-CHAPv2-based authentication." MS-CHAPv2 is a common way for work and campus networks to check your username and password.

WinFuture reports that, according to admins posting on Microsoft's Learn forum, the failures hit networks that use WPA2-Enterprise with 802.1X and PEAP. That's the kind of Wi-Fi where you sign in with your work or school account instead of a shared password.

The reported symptoms:

• What happens: the Wi-Fi sign-in starts, then gives up.
• Hardware: it shows up on both Intel and Qualcomm Wi-Fi chips, so it's not a driver problem.
• Error: one admin saw "Event 12014: OneX Held State timeout" in the event log.
• Home networks: ordinary WPA2-Personal Wi-Fi, where everyone types the same password, keeps working.

Admins have two ways out, WinFuture reports. They can uninstall KB5127648, which brings the connection back right away. Or they can set a registry value called BlockNtlmv1SSO to 0, which puts Windows back in audit mode, and then restart.

Why it matters: that registry change is the same one Microsoft lists as its temporary step. But it also lets the old NTLMv1 sign-ins through again. Microsoft's long-term advice is to turn on Credential Guard or move to certificate-based sign-in such as EAP-TLS.

Not everything in KB5127648 is a headache. Microsoft's notes list a long set of fixes:

• Black screen: Explorer no longer fails to start after sign-in on some virtual desktops, such as Azure Virtual Desktop with FSLogix.
• Audio: apps that use AC-3 (Dolby Digital) audio stop crashing. We covered that bug in our story on Windows 11 26H2.
• VPN: Always On VPN connections no longer get stuck on "Connecting."
• Printing: printing works again in apps using RAW or Generic Text Only drivers.
• Gaming: mouse input stutter in some games is fixed.
• Windows Hello: fingerprint sign-in works after a cold boot.
• Time zone: a new Manitoba time zone arrives ahead of the province's November 1 change.

There's also an open issue from September. Non-admin users can't connect over Remote Desktop to PCs that have Administrator protection turned on. They get error 0xC000000D. Microsoft says it is working on a fix and suggests admins temporarily turn that protection off.

Here's the part many home users will miss. Microsoft says the October 2026 update is the last one for Windows 11 version 24H2 Home and Pro. From now on, those PCs won't get monthly security fixes.

Microsoft recommends moving to version 26H2 or 25H2. Version 26H2 is rolling out in phases over the next few months. If you turned on "Get the latest updates as soon as they're available" in Windows Update, you may already be offered it.

Businesses get more time. The Enterprise and Education editions of 24H2 are supported until October 12, 2027.

For more Windows news, see our Microsoft topic page.

• Check your version: open Settings, then System, then About. If it says 24H2 and you're on Home or Pro, plan an upgrade to 25H2 or 26H2.
• Smart App Control: if it's on, you're fine. If it's off and stuck gray, either use Microsoft's registry steps carefully or wait for the fix.
• Work or school Wi-Fi: if your laptop stopped connecting after this week's update, tell your IT team about the NTLMv1 change. Don't uninstall security updates on a work PC without asking.
• Home Wi-Fi: a normal home network with one shared password isn't affected.