====== KB 10068: Lime CRM Desktop blocked by Smart App Control ======

===== Symptoms =====

On some Windows 11 PCs, Windows Security blocks Lime CRM Desktop with a message that Smart App Control blocked an app or a part of it. It can happen at three points:

  * **Installing** Lime CRM Desktop: the installer stops or rolls back.
  * **Upgrading** to a new version: the upgrade fails, sometimes leaving the old version in place.
  * **Using** Lime CRM Desktop: the client does not start, or a feature or add-on fails while the rest works.

The notification names Smart App Control. Other security messages, such as "Windows protected your PC" from SmartScreen, are a different issue.

===== Applies to =====

Only PCs where Smart App Control is switched **On** are affected. Most company PCs are not.

^ PC ^ Affected? ^
| Windows 11, freshly installed, not managed by an IT department, Smart App Control **On** | Yes |
| Smart App Control in **Evaluation** mode | No: Evaluation mode does not block apps |
| Managed by the company's IT (for example Microsoft Intune or another device-management tool) | No: Windows switches Smart App Control off on these PCs |
| Upgraded to Windows 11 from Windows 10 or an earlier Windows 11 version | No: Smart App Control isn't available |
| Windows 10 | No |

To check, open **Windows Security → App & browser control → Smart App Control settings**.

===== Cause =====

Smart App Control is a Windows 11 security feature. It only lets a program file run if Microsoft's cloud service knows it is safe, or if the file has a valid digital signature from a trusted publisher. It checks every file that loads, not only the main program, and it has no list of exceptions.

Lime CRM Desktop is digitally signed. Lime recently renewed its code-signing certificate, and some files in recent versions are not accepted by Smart App Control. Lime CRM Desktop 11.3.4678 corrects this.

===== Why now =====

Two changes came together. Since the Windows 11 update of April 2026 (KB5083769), users can switch Smart App Control back on without reinstalling Windows. Microsoft is rolling this out gradually, so more PCs have it on each month.

In September 2026, Lime renewed its code-signing certificate, and some files in versions signed after that were not accepted by Smart App Control. The first customer reports came the same month, and more followed as more PCs switched Smart App Control on.

===== Resolution =====

Upgrade to Lime CRM Desktop [[releases:lpdc:11.3.4678|11.3.4678]] or later. In this version, every program file is signed so that Smart App Control accepts it. After the upgrade, Smart App Control can stay on.

All versions and their release notes are listed under [[releases:lpdc:start|Lime CRM Desktop releases]].

If the upgrade to the fixed version is blocked, switch Smart App Control off for the upgrade (see Workaround), then switch it back on. The upgrade first removes the old version, and Windows may block that step.

===== Workaround =====

If you can't upgrade to Lime CRM Desktop 11.3.4678 yet, or the upgrade itself is blocked, switch Smart App Control off. Windows can't make an exception for one app.

  - Select **Start**, type **Smart App Control** and select **Smart App Control settings** in the results. You can also go to **Start → Windows Security → App & browser control → Smart App Control settings**.
  - Check which option is selected. If it is **On**, select **Off**. If it already shows **Off** or **Evaluation**, Smart App Control isn't what's blocking Lime CRM Desktop. Contact Lime support.
  - If Windows asks you to confirm, or asks for an administrator's permission, select **Yes**. Without administrator rights on the PC, ask your IT department to do this step.
  - Check that the page now shows **Off**.
  - Run the Lime CRM Desktop installer again, or start Lime CRM Desktop.

Switching Smart App Control off lowers the PC's protection against unknown programs. If the PC belongs to a company, ask your IT department before you do it. Microsoft Defender Antivirus keeps running when Smart App Control is off.

You can switch Smart App Control back on later in the same place. On a PC with the April 2026 Windows update or later, you don't need to reinstall Windows to do so. Switch it back on once Lime CRM Desktop 11.3.4678 or later is installed.

**Do not** change Smart App Control in the Windows registry. Editing it there has been reported to leave nearly every app blocked.

===== Collect information for Lime support =====

If you contact Lime support about this, send the Windows log that names the blocked files. It helps us confirm the fix.

  - Right-click **Start** and select **Terminal** or **Windows PowerShell**.
  - Paste the command below and press Enter.
  - Attach the file **lime-sac.csv** from your desktop to your support case, along with your Lime CRM Desktop version.

<code powershell>
Get-WinEvent -LogName 'Microsoft-Windows-CodeIntegrity/Operational' | Where-Object Id -in 3033,3076,3077 | Select-Object TimeCreated, Id, Message | Export-Csv "$env:USERPROFILE\Desktop\lime-sac.csv" -NoTypeInformation
</code>

The file lists the program files that Windows checked or blocked, with dates and times. It contains no CRM data.

===== More information =====

  * [[releases:lpdc:11.3.4678|Lime CRM Desktop 11.3.4678 release notes]]
  * [[releases:lpdc:start|Lime CRM Desktop releases]]
  * [[https://learn.microsoft.com/en-us/windows/apps/develop/smart-app-control/overview|Smart App Control overview (Microsoft)]]