Smart App Control (Windows 11)

Smart App Control is a Windows 11 feature that lets an unsigned program run only when Microsoft's cloud service gives it a positive verdict. The Athena Windows agent is unsigned, so Smart App Control may block it, or block a later update of it. Most builds run, so Athena doesn't refuse to install. Instead it tries, then explains: the installers warn you, and if Windows does block the agent, the install or update fails with that exact reason and the fix. Athena never turns Smart App Control off unless you ask it to.

Smart App Control states#

Windows keeps the state in the registry value VerifiedAndReputablePolicyState under HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy. Athena reads that value and acts on it like this:

Value	State	What Athena does
`0`	Off	Nothing. The install and updates go ahead normally.
`1`	On (Enforce)	Prints a warning and installs anyway. If Windows blocks the agent, the install or update fails and says so.
`2`	Evaluation	Prints a warning that Windows may switch Smart App Control on later, and that it may then block agent updates. The install goes ahead.
Missing	Not present (for example, not Windows 11)	Nothing.

To check a machine's state yourself, run this in PowerShell on it:

(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy' -Name VerifiedAndReputablePolicyState -ErrorAction SilentlyContinue).VerifiedAndReputablePolicyState

Turning Smart App Control off can't be undone

Once Smart App Control is off, Windows can't turn it back on without a reinstall of Windows. That's why Athena never turns it off on its own. Not the installers, and not the agent. It happens only when you pass -DisableSmartAppControl, set ATHENA_DISABLE_SMART_APP_CONTROL, or run Disable-AthenaSmartAppControl, as described below.

During agent install#

All three Windows install paths check Smart App Control first, before anything is installed:

the copy-paste bootstrap one-liner,
the ZIP install bundle (Install-HermesAgent.ps1), and
the Install-AthenaAgent cmdlet, which checks each target computer separately.

When Smart App Control is on or in evaluation, the installer prints a yellow WARNING: line that names the opt-in switch, then carries on. Install-AthenaAgent writes the same warning, prefixed with the computer name, and still installs that target.

When Windows blocks the agent#

If the HermesAgent service then won't start, the installer checks the Windows CodeIntegrity log (Microsoft-Windows-CodeIntegrity/Operational). If that log has an event 3077 for Hermes.Agent since the service start, Windows App Control blocked the agent. The install fails with that reason rather than a bare "cannot start service":

FAILED: Smart App Control - Windows App Control (Smart App Control) blocked Hermes.Agent.exe (CodeIntegrity event 3077). Run this installer again with -DisableSmartAppControl ...

Install-AthenaAgent reports the same cause in that computer's Error, and tells you to re-run with -DisableSmartAppControl. To look for the event yourself:

Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-CodeIntegrity/Operational'; Id = 3077 } -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -like '*Hermes.Agent*' } | Select-Object -First 5 TimeCreated, Message

Turning it off while you install#

If you've decided to turn Smart App Control off, say so when you install. Each install path has an explicit opt-in:

Install path	How to opt in
Bootstrap one-liner	The one-liner runs the script directly, so you can't add a switch to it. Set the environment variable first, in the same elevated PowerShell window, then paste the one-liner: `$env:ATHENA_DISABLE_SMART_APP_CONTROL='1'`
ZIP install bundle	`.\Install-HermesAgent.ps1 -DisableSmartAppControl` (with your usual parameters). The bundle installer also honours `ATHENA_DISABLE_SMART_APP_CONTROL=1`.
`Install-AthenaAgent`	Add `-DisableSmartAppControl`. It applies to every target where Smart App Control is on or in evaluation.

# Bootstrap: opt in, then paste the exact one-liner from the Agent Installer card
$env:ATHENA_DISABLE_SMART_APP_CONTROL='1'
# <paste the one-liner here>

# AD push to several machines
Install-AthenaAgent -ComputerName PC1, PC2 -DisableSmartAppControl

With the opt-in, on a machine where Smart App Control is on or in evaluation, the installer:

prints Turning Smart App Control OFF (-DisableSmartAppControl). This cannot be undone without reinstalling Windows.
sets VerifiedAndReputablePolicyState to 0,
runs CiTool.exe -r so Windows reloads its code-integrity policy, and
prints Smart App Control is off. and goes on with the install.

Install-AthenaAgent writes a per-computer warning instead: <computer>: Smart App Control turned OFF (-DisableSmartAppControl); this cannot be undone without reinstalling Windows. If Smart App Control is already off, the opt-in changes nothing.

If CiTool.exe is missing or fails, the value is already 0 but the install stops. Restart Windows on that machine, then run the installer again.

Turning it off on machines that already run the agent#

For a machine that already runs the agent, use Disable-AthenaSmartAppControl from the Athena PowerShell module. It does the same step over PowerShell Remoting without reinstalling the agent. It talks only to the target computers, so it doesn't need a connection to the Athena server.

# One machine, prompting for credentials
Disable-AthenaSmartAppControl -ComputerName PC1 -Credential (Get-Credential)

# Several machines, without the confirmation prompt
Disable-AthenaSmartAppControl -ComputerName PC1, PC2, PC3 -Confirm:$false

Parameter	Meaning
`-ComputerName`	Required. One or more computer names. Also accepts the pipeline, including objects with a `DnsHostName` or `Name` property.
`-Credential`	Optional. The account used for the remote session. It needs administrator rights on the target.
`-Authentication`	Optional. The remoting authentication mechanism: `Default` (default), `Basic`, `Negotiate`, `NegotiateWithImplicitCredential`, `Credssp`, `Digest` or `Kerberos`.

Because the change can't be undone, the cmdlet asks you to confirm each computer by default. Use -Confirm:$false to skip the prompt, or -WhatIf to see which computers it would change. It returns one object per computer:

Property	Meaning
`ComputerName`	The target.
`Status`	`Success`, `Failed`, or `Skipped` (you declined the prompt or used `-WhatIf`).
`Before` / `After`	The state value before and after. On a machine where Smart App Control was already off or isn't present, nothing changes. The result is `Success` with the same value in both.
`Error`	Why it failed. For example, the remote session couldn't be opened, or `CiTool.exe -r` failed. In that case, restart Windows on the target and try again.

Don't re-run the bootstrap installer just to turn it off

Re-running the bootstrap one-liner re-points the agent's configuration to the one server it installs from. On an agent that reports to several servers (see Multi-Homed Agents), that drops the others. Disable-AthenaSmartAppControl leaves the agent and its configuration alone.

Agent updates under Smart App Control#

A Windows agent doesn't refuse an update just because Smart App Control is on. It tries the update. When Smart App Control is on or in evaluation, it first writes a warning to its log: Smart App Control is on (Enforce): trying the update anyway; if Windows blocks the new exe it is rolled back and reported as blocked by Windows App Control (Smart App Control).

Windows can block the new build at either of two points. Athena handles both:

Before the swap. The new executable is test-run before it replaces the old one. If Windows refuses to run it, the installed agent is never touched and the update fails.
After the swap. If the service won't start on the new executable and the CodeIntegrity log has an event 3077 for Hermes.Agent, the previous version is put back (rollback).

Either way, the reason reported to the server reads:

New Hermes.Agent.exe was blocked by Windows App Control (Smart App Control). Turn Smart App Control off with Disable-AthenaSmartAppControl or the Athena installer's -DisableSmartAppControl (cannot be undone without reinstalling Windows), then push this build again with force or release a new one.

The agent also records that build as failed on this machine, so automatic pushes and the retry window don't keep reinstalling it. A later push of the same build is turned down with Refused: this build already failed on this machine. A new build (a different file) is accepted, and a forced push clears the record and tries again.

Where you see it#

Update History. A Failed or RolledBack row shows the agent's reason under its status badge. See Update history & status.
The agent's badge. The agent stays online on its old version and shows the amber Update rolled back badge. Hover over it to read the reason.
Staged rollouts. Under the wave table, a rollout lists its failed agents grouped by reason, for example 3 agent(s) failed: …blocked by Windows App Control (Smart App Control)…. The REST view of a rollout carries each failure in waves[].failures. A blocked agent counts as failed toward the auto-halt threshold.

Fixing a blocked update#

Turn Smart App Control off on the affected machines with Disable-AthenaSmartAppControl.
Push the same build again with force, which clears the agent's failed-build record. Use Send-AthenaAgentUpdate -AgentId <id> -Force, or POST api/agent-updates/push with "force": true (see Pushing updates). Or upload and activate a new build instead.

Agents on Windows agent 1.2.168

Windows agent 1.2.168 alone refused every update in advance when Smart App Control was on (Enforce), with a message starting Smart App Control is on (Enforce) on this machine…. From 1.2.169 the agent tries the update as described above. To move a 1.2.168 agent on a machine with Smart App Control on, push the newer version with force.

Troubleshooting#

Message	What it means & how to fix it
`WARNING: Smart App Control is ON (Enforce)…`	Just a warning, and the install carries on. Most builds run under Smart App Control. If you'd rather rule it out, re-run with the opt-in.
`WARNING: Smart App Control is in evaluation mode…`	Windows may switch Smart App Control on later, and it may then block agent updates. The install carries on.
`FAILED: Smart App Control - Windows App Control (Smart App Control) blocked Hermes.Agent.exe (CodeIntegrity event 3077)…`	Windows refused to run the agent. Re-run the installer with the opt-in.
`FAILED: Smart App Control - … CiTool.exe is missing` / `CiTool.exe -r failed (exit N)`	The state is already set to off, but Windows didn't reload its policy. Restart Windows, then run the installer again.
Update `Failed` / `RolledBack`: …blocked by Windows App Control (Smart App Control)…	Windows blocked the new build. See Fixing a blocked update.
Refused: this build already failed on this machine	That exact build failed earlier on this machine and was rolled back. Fix the cause, then push it with force, or release a new build.
Smart App Control is on (Enforce) on this machine… (update refused)	The agent runs 1.2.168. Push the newer version with force (see the note above).

For anything else in the install or update, check the install transcript (%TEMP%\athena-install.log for the bootstrap installer) and the agent's logs under C:\ProgramData\Hermes\Logs\. See Windows Agent and Troubleshooting a Windows update.

Windows Agent: the bootstrap installer and the service.
Agent Install Bundle: installing from a ZIP.
AD Agent Deployment: Install-AthenaAgent across a domain.
Agent Binaries & Updates: pushing, forcing and rolling back updates.
Staged Agent Rollouts: waves, failure reasons and the auto-halt.
PowerShell Module: the full cmdlet reference.