App & Browser control section is completely missing from windows security center

fg2001gf11F said:

I just fixed the 3rd machine the same way.

It also works with the 25183 version, if the folder 2209 and the setup.exe are removed.

Click to expand...

22621 is the correct version for non - Dev so I'll sort that out! MS must've realised the error and pulled the updates. The 1.0.2209 one was even showing in wushowhide as an update recently

BrianInEngland said:

22621 is the correct version for non - Dev so I'll sort that out! MS must've realised the error and pulled the updates. The 1.0.2209 one was even showing in wushowhide as an update recently

Click to expand...

I'm surprised on this Beta box at 22623.746.
This was not a clean install, but after I fixed it the same as the other machines it now shows Smart App Control set for Evaluation instead of Off.
I have no idea why; this was a machine that went through many updates, but probably some old Dev Builds before 22621 and 22623 became Beta. It let me set to "On" too.

I used the 2207 folder to install 22621 Security app, (didn't copy the folder to C:) and then deleted the 2209 folder and the Setup program in Recovery mode so the Security health folder is now empty. Re-enabled the TPM and so far so good. SAC is Off though even though this was originally a clean install.

fg2001gf11F said:

I'm surprised on this Beta box at 22623.746.
This was not a clean install, but after I fixed it the same as the other machines it now shows Smart App Control set for Evaluation instead of Off.
I have no idea why; this was a machine that went through many updates, but probably some old Dev Builds before 22621 and 22623 became Beta. It let me set to "On" too.

View attachment 42754

View attachment 42755

Click to expand...

So the question is, is there a way to make Windows *think* it's a clean install? It was in June and SAC showed Evaluation then. Since the security problems it's not worked, now it's back but it's Off. Even after a repair install it was in Eval mode!

BrianInEngland said:

So the question is, is there a way to make Windows *think* it's a clean install? It was in June and SAC showed Evaluation then. Since the security problems it's not worked, now it's back but it's Off. Even after a repair install it was in Eval mode!

Click to expand...

@BrianInEngland,
It was also weird that after I turned it to On, I could not put it back to Evaluation. It was grayed out at that point.
I'm not really interested on changing Smart App Control to On or to Evaluation, given the different reasons why it can be turned Off as explained in the link below. I sure don't want to do a "Reset this PC" or a "Clean install" on my working systems.
I only do Reset or Clean installs for testing purposes, I don't want to waste my time reinstalling all my programs and Apps in order to get back to normal operation.
That is a big waste of time for me.
For now, we just proved that the updates to the Windows Security Application were a mistake by MS and the source for the bugs.
They caused the missing "App and Browser control" with 21H2 Builds and the missing "Smart App Control" with 22H2.

Why is Smart App Control turned off?​

Smart App Control is only available on clean installs of Windows 11. Also, there are other reasons why Smart App Control could be turned off.

• During evaluation mode we determined that you weren't a good candidate for Smart App Control.
• It was turned off manually by you or another user signed into your machine.
• You have optional diagnostic data in Windows turned off. If you want to turn Smart App Control on, you'll need to reset this PC, or reinstall Windows, and select Send optional diagnostic data during the setup process.
  Note: At this time Smart App Control is only supported in the North American and European regions.
  
  
  

  
  Why can't I turn Smart App Control back on?​

  In order to ensure a more secure experience, we only enable Smart App Control on clean installs of Microsoft Windows 11. We want to be sure that there aren't already untrusted apps running on the device when we turn Smart App Control on.
  Tip: If you want to turn Smart App Control on after it's been turned off, you can reset Windows 11 by tapping the Start button, typing Reset in the search box, selecting Reset this PC from the search results, and starting a reset from the Recovery menu. You can choose the Keep my files reset that keeps your personal files and only removes apps and settings. For more information, see Recovery options in Windows.
  

fg2001gf11F said:

@BrianInEngland,
It was also weird that after I turned it to On, I could not put it back to Evaluation. It was grayed out at that point.
I'm not really interested on changing Smart App Control to On or to Evaluation, given the different reasons why it can be turned Off as explained in the link below. I sure don't want to do a "Reset this PC" or a "Clean install" on my working systems.
I only do Reset or Clean installs for testing purposes, I don't want to waste my time reinstalling all my programs and Apps in order to get back to normal operation.
That is a big waste of time for me.
For now, we just proved that the updates to the Windows Security Application were a mistake by MS and the source for the bugs.
They caused the missing "App and Browser control" with 21H2 Builds and the missing "Smart App Control" with 22H2.

Smart App Control Frequently Asked Questions | Microsoft Support

Frequently asked questions (FAQs) about Smart App Control, a Windows feature designed to block malicious, untrusted, or potentially unwanted apps from running on your device.

support.microsoft.com

Why is Smart App Control turned off?​

Smart App Control is only available on clean installs of Windows 11. Also, there are other reasons why Smart App Control could be turned off.

• During evaluation mode we determined that you weren't a good candidate for Smart App Control.
• It was turned off manually by you or another user signed into your machine.
• You have optional diagnostic data in Windows turned off. If you want to turn Smart App Control on, you'll need to reset this PC, or reinstall Windows, and select Send optional diagnostic data during the setup process.
  Note: At this time Smart App Control is only supported in the North American and European regions.
  
  
  

  
  Why can't I turn Smart App Control back on?​

  In order to ensure a more secure experience, we only enable Smart App Control on clean installs of Microsoft Windows 11. We want to be sure that there aren't already untrusted apps running on the device when we turn Smart App Control on.
  Tip: If you want to turn Smart App Control on after it's been turned off, you can reset Windows 11 by tapping the Start button, typing Reset in the search box, selecting Reset this PC from the search results, and starting a reset from the Recovery menu. You can choose the Keep my files reset that keeps your personal files and only removes apps and settings. For more information, see Recovery options in Windows.

Click to expand...

Yes they messed up and even after giving feedback nothing has been done!

BrianInEngland said:

Yes they messed up and even after giving feedback nothing has been done!

Click to expand...

Unfortunately, we rarely get a good response from MS.
I'm all done for now; I fixed the problem on all my machines.
We'll see what happens when they throw out next Windows Security App updates.

A colleague sent me the folder 1.0.2207.20002-0 and from there I uploaded a good version of Security Health via APPX. Now everything is in its place and as it should be. Thanks to this, I avoided reinstalling the system as you advised me to do a repair from the ISO image. This option would restore the proper Security Health application, but it would take a long time and become an unnecessary brothel in the system. Because of these issues with Security Health, I had my entire weekend broken. I was stupid that I uploaded an older version from the 1.0.2109.27002-0 folder instead of just deleting this folder. Fortunately, man learns from his own mistakes ...

dujd said:

A colleague sent me the folder 1.0.2207.20002-0 and from there I uploaded a good version of Security Health via APPX. Now everything is in its place and as it should be. Thanks to this, I avoided reinstalling the system as you advised me to do a repair from the ISO image. This option would restore the proper Security Health application, but it would take a long time and become an unnecessary brothel in the system. Because of these issues with Security Health, I had my entire weekend broken. I was stupid that I uploaded an older version from the 1.0.2109.27002-0 folder instead of just deleting this folder. Fortunately, man learns from his own mistakes ...

Click to expand...

A repair install wouldn't fix the problem - I tried it. Doing what we've done - replacing the wrong version with the 2207 version and deleting the 2209 folder fixes it.

BrianInEngland said:

A repair install wouldn't fix the problem - I tried it. Doing what we've done - replacing the wrong version with the 2207 version and deleting the 2209 folder fixes it.

Click to expand...

I think that update/repair could fix it if you do it after cleaning up the SecurityHealth folder.
That is what I did on one of my machines.

A repair installation from an ISO image can and will fix the Security Health problem, but it will also restore services, change the system installation date, and overwrite some updates and drivers with older versions. Therefore, I was far from doing it. From the beginning, I knew that the corresponding APPX installation file would be enough to install the correct version of Security Health. Unfortunately, you will not find it on the internet and I had to be at the mercy of kind people who sent me the appropriate files.

dujd said:

A repair installation from an ISO image can and will fix the Security Health problem, but it will also restore services, change the system installation date, and overwrite some updates and drivers with older versions. Therefore, I was far from doing it. From the beginning, I knew that the corresponding APPX installation file would be enough to install the correct version of Security Health. Unfortunately, you will not find it on the internet and I had to be at the mercy of kind people who sent me the appropriate files.

Click to expand...

Time for you to get a spare machine where you can test things out without worrying about the changes in setting or drivers.

I have a laptop that I use for testing. When I had a problem with this Windows Security application, I checked it on a laptop and even reinstalled the system, and then when I mixed it up again, format and new installation. Alternatively, if I want to check something on my main computer, I connect a second SATA drive and test install a new system on it.

@BrianInEngland @fg2001gf11F @Bree
Sorry to call you out, but you seem to have a handle on this. Any guidance will be appreciated.

I performed a cloud reset on a Win 22H2 device (build 22621.1413) and am now getting the 'Standard hardware security not supported' message when trying to access Device Security. I tried following this thread, but am not super-technical and got lost in the sauce. I'm also unsure as what's still applicable for Win22H2.

I'll try to keep this relatively brief, so pls let me know if you require further detail.

> Get-AppxPackage Microsoft.SecHealthUI: Version: 1000.25305.1000.0, Status: OK

> Chkdsk, SFC, DISM all clean
> BIOS/UEFI is up to date and unchanged from before the reset (I see nothing in there about UEFI MAT)

> Secureboot, Data Execution Prevention, Virtualization all set

> Device Security just shows the non-supported message, so I can't get to Core Isolation and/or Memory Integrity, but assume this is not the issue. %windir%\explorer.exe windowsdefender://appbrowser returns a blank window

> C:\Windows\System32\SecurityHealth is EMPTY.

> I've tried resetting Windows Security, but no joy.

**********

I have another (working) Win22H2 device containing:
> C:\Windows\System32\SecurityHealth\SecurityHealthSetup.exe, and
> C:\Windows\System32\SecurityHealth\1.0.2302.21002-0\

Please let me know:

> Can / Should I copy folder contents from the working device into the empty SecurityHealth folder?
> Can I then run SecurityHealthSetup?
> Do I need to execute Microsoft.SecHealthUI_8wekyb3d8bbwe.appx from within the newly copied 1.0.2302.21002-0 folder? If not, then what?

> I saw things in this post about booting in Safe mode, but not sure if this is required and/or when

> Must I change ownership of the SecurityHealth folder? If so:
> at what point in the process?
> can ownership subsequently be changed back to the original (Trusted Installer?) once this is resolved?

Thanks in advance for your help.

safron said:

I performed a cloud reset on a Win 22H2 device (build 22621.1413) and am now getting the 'Standard hardware security not supported' message when trying to access Device Security.

Click to expand...

Check in your bios that Secure boot and TPM are still enabled.

Your device meets the requirements for standard hardware security​

This means your device supports memory integrity and core isolation and also has:

• TPM 2.0 (also referred to as your security processor)
• Secure boot enabled
• DEP
• UEFI MAT

Standard hardware security not supported​

This means that your device does not meet at least one of the requirements of standard hardware security.

Click to expand...

Thank you @ Bree

Secureboot is enabled

TPMSecurity is enabled:
PS C:\Users\xxx> get-tpm
TpmPresent : True
TpmReady : True
TpmEnabled : True
TpmActivated : True
TpmOwned : True
RestartPending : False
ManufacturerId : 1229870147
ManufacturerIdTxt : INTC
etc...

Hello. I haven't looked here for a long time, but I decided to share with you my recent experience with Windows Security. Well, for almost a year now and then an update to Windows Security in Windows Update popped up for me, but for the hell of it I couldn't install it. The update was supposed to install, but after a while it came back as not installed. I even tried running the downloaded SecurityHealthSetup.exe file, but nothing happened when I ran it. Only a few days ago I discovered that I had the Secondary Login service disabled in services.msc. I enabled this service and thanks to that I installed the latest version of Windows Security, i.e. 1.0.2306.10002-0.

It is located in the C:\Windows\System32\SecurityHealth\1.0.2306.10002-0 folder. The folder must not be deleted, otherwise Windows Security will not function properly. Interestingly, the C:\Windows\System32 folder contains old Windows Security program files that are updated by Windows monthly cumulative updates.

I am glad that after such a long time I was able to finally find out why the SecurityHealthSetup.exe file did not want to run for me. Now I will not disable the Secondary Login service anymore, because despite various opinions, this service is needed.

dujd said:

Hello. I haven't looked here for a long time, but I decided to share with you my recent experience with Windows Security. Well, for almost a year now and then an update to Windows Security in Windows Update popped up for me, but for the hell of it I couldn't install it. The update was supposed to install, but after a while it came back as not installed. I even tried running the downloaded SecurityHealthSetup.exe file, but nothing happened when I ran it. Only a few days ago I discovered that I had the Secondary Login service disabled in services.msc. I enabled this service and thanks to that I installed the latest version of Windows Security, i.e. 1.0.2306.10002-0.

It is located in the C:\Windows\System32\SecurityHealth\1.0.2306.10002-0 folder. The folder must not be deleted, otherwise Windows Security will not function properly. Interestingly, the C:\Windows\System32 folder contains old Windows Security program files that are updated by Windows monthly cumulative updates.

I am glad that after such a long time I was able to finally find out why the SecurityHealthSetup.exe file did not want to run for me. Now I will not disable the Secondary Login service anymore, because despite various opinions, this service is needed.

Click to expand...

Too bad they screwed things up with latest kb5007651 1.0.2306.10002-0.
Same security update on Build 22621.1928, Beta 22631.1972 and Canary 25393.1.
1) This context menu is now missing (Was previously available with Right click on the security icon in system tray), just another complication to run what is needed.
2) LSA setting is no longer available on R.P. , Beta and Dev, still available with Canary.






Security version is now the same on all Builds, but the engine version in Canary is higher, 1.1.23060.1005 versus 1.1.23050.3 of all the other builds.
Two Canary machines at the same Build level 25393.1 have to different versions of security Engine and Antimalware Client. 2305 versus 2306.
No idea why.

All that remains now is to wait for the next stable version of Windows Security. In fact, in the latest one, the context menu does not work. It is possible that in a month the next version will be released, which will be automatically updated.