Windows 11 Smart App Control blocks the Desktop Client and Media Server from starting

What is the issue?

On Windows 11 computers with Smart App Control turned on, the Desktop Client, Media Server, or tray tool might not start. Reinstalling the application doesn't help. Symptoms include:

• A Bad Image error, for example: nx_kit.dll is either not designed to run on Windows or it contains an error. Error status 0xc0e90002.
• A Windows Security notification saying that Windows can't confirm who published a DLL.
• Event 3077 in the Microsoft-Windows-CodeIntegrity/Operational event log.

The blocked DLL can change from one launch to the next, and sometimes the problem clears by itself. The issue was reported with version 6.1.2.42921.

What is the cause of the issue?

Smart App Control checks every executable and DLL as Windows loads it. If a file is unsigned, Windows allows it only after Microsoft's cloud service recognizes the file as trustworthy. Network Optix signs its installers and main executables, but not the DLL files. New builds, especially customized builds with a smaller install base, can be blocked until those files build up reputation. Since the April 2026 Windows update, you can turn Smart App Control on at any time, so it's now active on many more computers.

What is the short term solution?

• On machines managed by your organization: use an App Control for Business (WDAC) policy instead of Smart App Control, with a path or hash rule covering the client installation folder (a publisher rule will not cover the unsigned DLLs).
• On other machines: turn Smart App Control off (Windows Security > App & browser control > Smart App Control settings). On current Windows 11 builds it can be turned back on later without reinstalling Windows.

What is the long term solution?

We are working on a permanent fix, including changes to how the Windows packages are signed.