How to Configure Smart App Control Enforcement in Windows 11 Using PowerShell

Ransomware, trojans, and sophisticated phishing payloads frequently attempt to bypass traditional signature-based antivirus solutions by compiling custom or polymorphic binaries. Windows 11 incorporates Smart App Control (SAC)—a cloud-powered application whitelisting and behavioural analysis layer integrated directly into the operating system core. Smart App Control evaluates executables before they launch, blocking unrecognized, unsigned, or malicious software. System administrators can inspect, monitor, and configure SAC states using PowerShell.

How Smart App Control Evaluates Executables

When an application attempts to run, Smart App Control subjects the binary to a dual-tier verification pipeline:

• Cloud Intelligence Check: Windows queries the Microsoft Intelligent Security Graph (ISG). If the cloud database identifies the file as widely used, well-reputed, and safe, execution is permitted instantly.
• Valid Code Signing Verification: If the application is unknown to the cloud model, SAC checks for an authentic, trusted cryptographic signature from a reputable publisher. If signed cleanly, it is allowed to run.
• Automatic Block: Any executable, script, or macro that is unknown to the cloud intelligence model AND lacks a valid digital signature is blocked automatically, protecting the machine from zero-day threats.

Understanding the Three Smart App Control States

Smart App Control operates in one of three modes:

• Evaluation: The default mode on clean Windows 11 installations. SAC runs silently in the background, logging whether application blocking would interfere with normal daily workflows without actually terminating programs.
• On (Enforced): Active protection. Malicious, untrusted, and unsigned applications are forcefully blocked.
• Off: Permanently disabled. Note that once switched to Off, Windows requires a clean operating system reinstallation to re-enable Evaluation or Enforced mode.

Checking Smart App Control Status via PowerShell

To inspect your current SAC configuration state:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Query the Code Integrity and Smart App Control registry keys:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -ErrorAction SilentlyContinue

3. Evaluate the registry state value:
   • 0: Smart App Control is turned Off.
   • 1: Smart App Control is enforced and turned On.
   • 2: Smart App Control is in Evaluation mode.

Enforcing Smart App Control via Registry and Group Policy

If your Windows 11 installation is in Evaluation mode and you wish to transition to strict enforcement:

# Enable strict Smart App Control enforcement:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 1 -Type DWord

Restart the workstation to apply code integrity policy enforcement at the kernel level.

Auditing Smart App Control Blocks in Event Viewer

When an application is blocked by SAC, review diagnostic details to verify publisher trust:

1. Press Win + X and launch Event Viewer.
2. Navigate to: Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
3. Filter for Event ID 3077 (application blocked by reputation). The log provides the full file path, hash, and process tree of the blocked executable.

Deploying Smart App Control on Windows 11 provides an automated, AI-driven defense against untrusted software, elevating endpoint security across modern enterprise environments.