Smart App Control is blocking an unsigned or untrusted binary that the app is loading. It blocks untrusted or unsigned applications, and it can also block unknown script files and macros from the web. There is currently no per-app allow list for Smart App Control.
For this scenario, the supported options are:
- Check whether Smart App Control is enabled
- Open Windows Security.
- Go to App & browser control > Smart App Control settings.
- If it is on, that explains the popup.
- Turn Smart App Control off if development needs to continue immediately
- Smart App Control can be disabled in Windows Security App settings.
- Recent Windows updates allow Smart App Control to be re-enabled without requiring a clean installation.
- Use signed binaries for the app
- To avoid Smart App Control blocks, developers should sign all application code with a code signing certificate from a certificate authority in the Microsoft Trusted Root Program.
- This includes all binaries such as .exe, .dll, temp installer files, scripts, and uninstallers.
- If the device is in developer mode or enterprise-managed, Smart App Control may be turned off automatically
- Microsoft states Smart App Control can be turned off when the device is enterprise-managed or developer mode has been configured.
- If testing is needed, review the Code Integrity log to confirm the blocked file
- Open Event Viewer.
- Browse to Application and Services Logs > Microsoft > Windows > CodeIntegrity > Operational.
- Smart App Control logs blocked or audited files there.
- Event ID 3076 is evaluation mode and 3077 is enforcement mode.
- The log does not explain installer-level failures, but it does identify the specific file that was blocked.
The key limitation is that Smart App Control cannot be told to allow just that one DLL. The practical choices are to disable Smart App Control or sign the app’s binaries.
References: