Fixed with 27766 Workaround for “Your organization used App Control for Business to block this app” dialog in the Canary Channel

Anonymous
2024-12-16T16:39:34+00:00

After updating to Build 27764 in the Canary Channel, some Windows Insiders are reporting hitting the issue that previously impacted the Dev Channel where an “Your organization used App Control for Business to block this app” dialog is shown when attempting to use or install certain third-party apps on your PC due to an incorrect policy being enforced. The following steps should mitigate the issue:

  1. Open Command Prompt with administrator privileges.
  2. Type and hit enter: mountvol s: /s
  3. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{8E8A94F0-6EB9-42C7-A189-E018C8CF3D10}.cip
  4. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{36D62F7C-AB85-4F61-8724-744294F24023}.cip
  5. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{66D7D265-7EDD-47DD-86E4-F7C42CD55A8F}.cip
  6. Then reboot your PC.

If you are dual-booting between the Canary Channel and the Dev Channel or another version of Windows, you will need to do this workaround BEFORE booting to the other OS.

If the above steps do not work, you may need to disable Secure Boot first and follow these steps:

  1. Disable Secure Boot on your PC.
  2. You will be asked to enter your BitLocker recovery key.
  3. Log in to your PC and open Command Prompt with administrator privileges.
  4. Type and hit enter: mountvol s: /s
  5. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{8E8A94F0-6EB9-42C7-A189-E018C8CF3D10}.cip
  6. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{36D62F7C-AB85-4F61-8724-744294F24023}.cip
  7. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{66D7D265-7EDD-47DD-86E4-F7C42CD55A8F}.cip
  8. Reboot your PC once with Secure Boot still disabled.
  9. Then reboot again and enable Secure Boot.

In small cases, your PC may not boot into Windows. To get out of this state, you can follow these steps:

  1. Disable Secure Boot on your PC.
  2. Then get into Windows Recovery, choose advanced boot options and disable driver signature enforcement.
  3. Then do the above-mentioned workaround for deleting the policies after logging in.
  4. Alternatively, you can also delete the above-mentioned policies directly from the Windows Recovery console.
Windows Insider program | Windows Insider preview | Install, activate, and Windows update

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

91 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2025-01-06T17:58:23+00:00

    after typing mountvol S: /s, it reply with the directory is not empty. A bit of help? I already reinstall windows and everything was working fine, but after it updated again automatically, the problem return and here I am trying to fix this

    Looks like you may already have an S: volume mounted. You may need to find out what was mounted on S: 😎

    Type S: and see if it finds an S: volume.

    You can remove the mounted volume and remount the one you need using the 2 commands below

    C:\Windows\System32>mountvol S: /d

    C:\Windows\System32>mountvol S: /s

    then type the following to check the files in the directory and then delete the ones suggested. 😎

    S:

    S:>cd EFI\Microsoft/boot/cipolicies\active

    dir

    Image

    mountvol | Microsoft Learn

    Was this answer helpful?

    0 comments
  2. Anonymous
    2025-01-07T13:59:49+00:00

    I ran into this problem today, and this fixed it. Didn't do any rollback stuff etc:

    1. Open Command Prompt with administrator privileges.
    2. Type and hit enter: mountvol s: /s
    3. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{8E8A94F0-6EB9-42C7-A189-E018C8CF3D10}.cip
    4. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{36D62F7C-AB85-4F61-8724-744294F24023}.cip
    5. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{66D7D265-7EDD-47DD-86E4-F7C42CD55A8F}.cip
    6. Then reboot your PC.

    The OS version I'm running: Version 24H2 (0S Build 26100.2033)

    I'm just curious about future updates.. Should I stay away from Windows update for a while?

    Was this answer helpful?

    0 comments
  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  4. Anonymous
    2025-01-07T19:46:44+00:00

    Had the same problem as Morten Described with Windows version 24H2 after KB5048667 got installed via windows update, system was unbootable. I then re-installed the full system with 24H2 media (not knowing what was going on). Once again, after KB5048667 installed, system was unbootable again. I finally figured out that disabling secure boot, booting windows on the usb-stick then select exit and continue to Windows 11 would finally boot the PC. Then I uninstalled KB5048667 that fixed all the problems. But KB5048667 re-installed again, so I finally found this post, so after performing those commands, it seems this fixed the issue completely.

    Note: The system I use has a single OS, thus not multi-boot.

    Open Command Prompt with administrator privileges.

    1. Type and hit enter: mountvol s: /s
    2. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{8E8A94F0-6EB9-42C7-A189-E018C8CF3D10}.cip
    3. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{36D62F7C-AB85-4F61-8724-744294F24023}.cip
    4. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{66D7D265-7EDD-47DD-86E4-F7C42CD55A8F}.cip
    5. Then reboot your PC.

    @Brandon Leblanc, would that be possible that the issue extent is far beyond the Canary channel? This seems a big problem to me?

    Was this answer helpful?

    0 comments
  5. Anonymous
    2025-01-07T19:53:42+00:00

    Had the same problem as Morten Described with Windows version 24H2 after KB5048667 got installed via windows update, system was unbootable. I then re-installed the full system with 24H2 media (not knowing what was going on). Once again, after KB5048667 installed, system was unbootable again. I finally figured out that disabling secure boot, booting windows on the usb-stick then select exit and continue to Windows 11 would finally boot the PC. Then I uninstalled KB5048667 that fixed all the problems. But KB5048667 re-installed again, so I finally found this post, so after performing those commands, it seems this fixed the issue completely.

    Open Command Prompt with administrator privileges.

    1. Type and hit enter: mountvol s: /s
    2. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{8E8A94F0-6EB9-42C7-A189-E018C8CF3D10}.cip
    3. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{36D62F7C-AB85-4F61-8724-744294F24023}.cip
    4. Type and hit enter: del S:\EFI\Microsoft\Boot\cipolicies\active{66D7D265-7EDD-47DD-86E4-F7C42CD55A8F}.cip
    5. Then reboot your PC.

    @Brandon Leblanc, would that be possible that the issue extent is far beyond the Canary channel? This seems a big problem to me?

    If you have a multiboot machine with one of the systems being Canary, it may affect all the other systems that use the common EFI partition with the bad CI policies.

    I had the problem with 2 machines that use multiboot. Deleting those files solved the problem.

    Was this answer helpful?

    0 comments