Application control (WDAC / App Control for Business) is enforced via Intune

Maester checks this too

MT.1179 (Ensure App Control for Business is enabled.) checks the same setting. Running both reports it twice.

Overview

App Control for Business, formerly Windows Defender Application Control, limits which apps and code can run on managed Windows devices. An assigned policy must be enforced rather than audit-only to prevent untrusted code from running after phishing, downloads, removable media, or supply-chain events. Plan deployments carefully so legitimate line-of-business apps are not blocked.

Remediation

• App Control for Business deployment guide
• App Control for Business and Managed Installer in Intune
• App Control for Business design guide

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	High
Impact on users	Medium
Pillar	SecOps
Category	Endpoint threat protection
Product	Intune
Feature	Endpoint security
Area	Devices and endpoints
ATT&CK	T1204.002 Malicious File
Licence	INTUNE_A
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.