# Application control (WDAC / App Control for Business) is enforced via Intune
App Control for Business, formerly Windows Defender Application Control, limits which apps and code can run on managed Windows devices.
Source: https://maester.dev/docs/tests/ZTA.41052
:::note[Maester checks this too]
[MT.1179](/docs/tests/MT.1179) (Ensure App Control for Business is enabled.) checks the same setting. Running both reports it twice.
:::
## Overview
App Control for Business, formerly Windows Defender Application Control, limits which apps and code can run on managed Windows devices. An assigned policy must be enforced rather than audit-only to prevent untrusted code from running after phishing, downloads, removable media, or supply-chain events. Plan deployments carefully so legitimate line-of-business apps are not blocked.
## Remediation
- [App Control for Business deployment guide](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide)
- [App Control for Business and Managed Installer in Intune](https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-app-control-policy)
- [App Control for Business design guide](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/appcontrol-design-guide)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | High |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | [T1204.002](/docs/tests?mitre=T1204.002) Malicious File |
| Licence | INTUNE_A |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.