An installer fails with error 1721 on a new Windows 11 PC? It's probably Smart App Control, and there's no "Run anyway"

[u/Future-Plastic7826]

Build: 26300.9550 (26H2)

On a freshly installed Windows 11 PC, an installer that works everywhere else stopped halfway with this:

"There is a problem with this Windows Installer package. A program required for this install to complete could not be run."

That's error 1721, and it reads like the installer is broken. It isn't. The same file on an older PC installed fine. The difference was Smart App Control.

1. What's actually being blocked

Many installers run small programs of their own during setup (custom actions). Smart App Control blocks any program that isn't signed and that Microsoft's cloud doesn't already know. So the installer itself opens, then one of its helpers gets stopped, and Windows Installer reports it as a generic 1721. A plain .exe from the same developer gets blocked right away, with a Smart App Control notice instead.

2. Why there's no "Run anyway"

SmartScreen and Smart App Control look similar but work differently. SmartScreen is a warning about reputation: "More info" > "Run anyway" and you're through. Smart App Control is a code integrity policy enforced by Windows itself. It decides whether the file is allowed to load at all, and it has no per-app exception.

3. Who has it

Only clean installs of Windows 11 22H2 or later. PCs upgraded from Windows 10 don't. It starts in evaluation mode, watches how you use the PC for a while, then turns itself on or off. That's why two "identical" Windows 11 machines can behave differently with the same installer.

4. How to check

- Windows Security > App & browser control > Smart App Control settings: On, Evaluation or Off.

- In a terminal: `reg query HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState` gives 0 for off, 1 for on, 2 for evaluation.

- Event Viewer > Applications and Services Logs > Microsoft > Windows > CodeIntegrity > Operational. A 3077 event at the time of the failure names the exact file that was blocked.

5. What to do about it

- Look for a Microsoft Store version of the app. Store packages are signed by Microsoft, so they pass.

- Tell the developer, with the file name from the 3077 event. Signing only the installer isn't enough: every exe and DLL that runs needs a signature, including the helpers.

- Turning Smart App Control off used to be one-way: the only way to turn it back on was to reinstall Windows. Since the April 2026 updates, on an up-to-date PC you can switch it on and off from Windows Security. Still, I'd keep it on and switch it off only knowingly, for an app you trust.

Has anyone seen how long evaluation mode lasts before it decides? I haven't found a number from Microsoft.

[u/iwannabetheguytoo]

Why did you use AI to generate this instead of using your own words?

[u/Future-Plastic7826 → u/iwannabetheguytoo]

Fair question. English isn't my first language, so I wrote it in Italian and had it cleaned up. The problem itself is one I ran into with my own installer. Is anything in it wrong? That's the part I'd actually like to know.

[u/PriorFortune1 → u/Future-Plastic7826]

Yes, it's AI. If you can speak English, just write it in English, regardless of whether or not you make mistakes. If you can't speak English, run it through a normal translator, not a slop machine. No one wants AI garbage. Not for any reason.