Windows 11 KB5079391 preview lets users toggle Smart App Control without a reinstall
KB5079391 made Smart App Control switchable without a reinstall and fixed display issues, then was pulled for KB5086672. What Windows developers should know.
On 26 March 2026 Microsoft released KB5079391, an optional non-security preview update for Windows 11 24H2 and 25H2. The most notable change for developers is that Smart App Control (SAC) can now be turned on or off without reinstalling Windows. SAC blocks apps that aren't signed or don't have a known good reputation, so that change affects anyone who builds, ships or tests Windows software. Microsoft later stopped offering the update because of an install bug and replaced it with an out-of-band release.
What happened
KB5079391 moved Windows 11 24H2 to build 26100.8116 and 25H2 to build 26200.8116. BleepingComputer counted 29 changes. As a "D-week" preview, it contained no security fixes; its changes were due to arrive in the following month's Patch Tuesday release.
Notable changes included:
- Smart App Control: it can be switched on or off under Settings > Windows Security > App & Browser Control > Smart App Control settings, without a clean install. This was rolled out gradually.
- Displays: support for monitors that report refresh rates above 1000 Hz, native USB4 monitor connections and more reliable HDR.
- WinRE on ARM64: better stability when running x64 apps in the Windows Recovery Environment on ARM64 devices.
- Other: more reliable Windows Hello fingerprint sign-in on some devices, redesigned dialogs under Settings > Accounts > Other users, and more reliable downloads of required updates.
After release, some users got 0x80073712 errors during installation, and Microsoft paused the rollout. Its support page now says KB5079391 is no longer offered to new devices. Out-of-band update KB5086672, released on 31 March 2026 (builds 26100.8117 and 26200.8117), fixes the install problem and includes all of KB5079391's changes.
Who is affected
- Windows 11 24H2 and 25H2 devices whose users or admins opted into optional preview updates.
- Developers and ISVs who ship Windows executables, installers or scripts. More users can now turn SAC on without reinstalling, so unsigned or low-reputation binaries are more likely to be blocked.
- Teams managing build agents or test VMs on Windows 11, if they let preview updates install automatically.
What it means for developers and engineering teams
Smart App Control uses Microsoft's cloud reputation service and code signing to decide whether an app may run. Previously it could only be enabled on a fresh Windows install, and once it was turned off you couldn't turn it back on without reinstalling, so in practice few developer or power-user machines ran it. Making it a simple toggle means more of your users may end up with it on.
The practical effect is on distribution. A new build of an unsigned tool, an internal utility, or an installer that unpacks unsigned helper binaries can be blocked on a SAC-enabled machine. The user sees a block message, not your error handling. Code signing with a certificate Windows trusts, and keeping a consistent publisher identity across releases, are the main ways to stay on the allowed side.
The pulled release is also a reminder to keep CI and build agents on a controlled update ring. Optional previews exist so issues like the 0x80073712 failure surface before Patch Tuesday. They shouldn't land on machines you rely on for builds.
What to do now
- Install KB5086672 rather than KB5079391 if you want these changes. Check the build with
winver: it should show 26100.8117 or 26200.8117, or later. - Test your releases on a SAC-enabled VM before shipping, including installers, auto-updaters and any helper executables or scripts they launch.
- Sign everything you ship, including nested binaries, with a code-signing certificate from a CA trusted by Windows or Microsoft's managed signing service, and timestamp the signatures.
- Check SAC state on test machines read-only with
reg query "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState, or in Windows Security. - Keep build agents off preview updates using Windows Update for Business policies or your management tool.