How to Configure Smart App Control in Evaluation Mode in Windows 11 Using PowerShell

Smart App Control (SAC) is a cloud-powered endpoint security feature introduced in Windows 11 that provides sophisticated protection against untrusted, unverified, and potentially malicious applications. Unlike traditional antivirus software that scans for known malware signatures after an executable reaches the disk, Smart App Control uses Microsoft’s cloud intelligence graph and digital certificate validation to block suspicious code before it executes. Because strict enforcement can disrupt specialised developer tools and custom in-house software, Windows 11 includes an Evaluation Mode to monitor application compatibility without blocking legitimate workflows.

Understanding Smart App Control Operating States

Smart App Control operates in one of three distinct system states:

• Evaluation Mode: The operating system monitors application execution patterns in the background, submitting telemetry to Microsoft’s cloud security service. During this phase, Smart App Control determines whether enabling full enforcement would disrupt your daily productivity. No applications are blocked while in evaluation mode.
• On (Enforced): Applications that lack a trusted digital signature or positive cloud reputation score are automatically prevented from running.
• Off: Smart App Control is completely deactivated. Note: Once permanently turned off, Smart App Control cannot be re-enabled through standard settings without performing a clean installation of Windows 11.

Auditing Current Smart App Control Status via PowerShell

To query the active state of Smart App Control on a local machine or remote fleet endpoint, inspect the system registry using an elevated PowerShell console:

# Launch elevated PowerShell and inspect the SAC registry key
$sacPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy"
Get-ItemProperty -Path $sacPath -Name "VerifiedAndReputablePolicyState" -ErrorAction SilentlyContinue

The integer value of VerifiedAndReputablePolicyState maps to the following operational states:

• 0: Smart App Control is Off.
• 1: Smart App Control is On (Enforcement mode active).
• 2: Smart App Control is in Evaluation Mode.

Inspecting Evaluation Mode Telemetry in Windows Event Logs

While running in Evaluation Mode, Windows records diagnostic events whenever an application is executed that would have been blocked under full enforcement mode. Security engineers can audit these events to assess enterprise software readiness:

# Query Code Integrity operational event logs for SAC evaluation entries
Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-CodeIntegrity/Operational'
    Id = 3076, 3077
} -MaxEvents 20 | Select-Object TimeCreated, Id, Message | Format-List

Analyze the returned records:

• Event ID 3076: Logs code that would have been prevented from running due to an untrusted certificate or lack of cloud reputation.
• Event ID 3077: Identifies unsigned or improperly signed kernel and user-mode binaries evaluated by the policy engine.
• Review the logged file paths and binary hashes to identify internal engineering scripts, compilers, or utilities that need official internal code-signing certificates before enforcing SAC.

Configuring Evaluation Mode Policies via Group Policy and Registry

For managed workstations deployed via Microsoft Intune or Active Directory Group Policy, administrators can ensure new Windows 11 images remain in Evaluation Mode during staging:

# Set VerifiedAndReputablePolicyState to 2 (Evaluation Mode)
$regPath = "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy"
if (!(Test-Path $regPath)) {
    New-Item -Path $regPath -Force | Out-Null
}
Set-ItemProperty -Path $regPath -Name "VerifiedAndReputablePolicyState" -Value 2 -Type DWord

# Confirm the updated value
(Get-ItemProperty -Path $regPath).VerifiedAndReputablePolicyState

Transitioning from Evaluation to Enforcement Safely

Once you verify through Event Viewer logs that essential corporate software and developer workflows execute without generating Event ID 3076 warnings, you can transition the machine to enforced mode:

1. Open the Windows Security app.
2. Navigate to App & browser control.
3. Click on Smart App Control settings.
4. If the evaluation period has determined your device is a suitable candidate, toggle the setting from Evaluation to On.
5. Alternatively, enforce via elevated PowerShell:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -Value 1 -Type DWord

6. Restart the workstation to apply strict kernel-level policy enforcement.

By leveraging Evaluation Mode and PowerShell diagnostics, IT administrators can thoroughly assess application compatibility and fortify Windows 11 systems against untrusted software without risking operational downtime.