Forum Discussion
Bookshelf search blocked by Smart App Control (unsigned GRZ runtime)
I am seeing GraphRAG Zero health checks and Bookshelf search fail on Windows 11 when Smart App Control is enabled.
Environment
- Discovery App: 0.15.14-preview
- GRZ runtime: 0.9.0-ci.20260830.3873.1.abbf9992
- OS: Windows 11
- Smart App Control: On when the failure occurred
Error
ImportError: DLL load failed while importing _socket: An Application Control policy has blocked this file.
Windows Code Integrity logs show Event IDs 3033 and 3077. The blocked modules are _internal\_socket.pyd and _internal\_ctypes.pyd, and they and grz-worker.exe are reported as NotSigned.
Bookshelf ingestion completes, but GraphRAG semantic search and related chunk retrieval fail.
As a diagnostic test, I turned Smart App Control off. GraphRAG search then succeeded. This workaround lowers protection for the entire PC, so I would prefer not to rely on it.
Is this a known compatibility issue with Smart App Control? Is a signed GRZ runtime planned, or is there a supported workaround that allows Bookshelf search to work while keeping Smart App Control enabled?
1 Reply
Yes, this is a known compatibility issue. Smart App Control (SAC) in Windows 11 blocks unsigned or low‑reputation runtime components, which explains why your GRZ runtime modules (_internal_socket.pyd, _internal_ctypes.pyd, grz-worker.exe) are being denied. You may try using signed builds or enterprise‑grade App Control policies (WDAC/App Control for Business) instead of disabling SAC entirely.
https://textslashplain.com/2026/04/28/smart-app-control/
