# Windows App Control for Business (WDAC) is configured and assigned via Intune
Without App Control for Business (formerly Windows Defender Application Control, WDAC), every executable a user can drop onto disk — phishing-delivered…
Source: https://maester.dev/docs/tests/ZTA.51018
## Overview
Without App Control for Business (formerly Windows Defender Application Control, WDAC), every executable a user can drop onto disk — phishing-delivered payloads, malicious npm or PyPI dependencies, sideloaded utilities from a USB stick, ransomware droppers, living-off-the-land binaries that re-package legitimate Microsoft signed tools — can run with the user's full token, against corporate data and Entra ID resources, before any Endpoint Detection and Response (EDR) signal has a chance to fire. EDR is reactive: it sees and may quarantine *after* malware has executed, often after data has already been staged for exfiltration or after persistence has been established. App Control disrupts this kill chain at the kernel level by establishing a Windows code-integrity policy that the kernel itself enforces *before* any executable starts: only files signed by trusted publishers, on a trusted file path, or specifically allow-listed by the organisation are permitted to run; unsigned or unknown executables fail to launch even if SYSTEM-level malware tries to invoke them. Microsoft delivers App Control for Business via Intune's Endpoint Security → App Control for Business policy, which deploys a Windows Code Integrity (WDAC) policy to managed Windows endpoints. Without an enforced App Control policy assigned to the Windows fleet, ransomware and living-off-the-land binaries continue to have an unimpeded path to execution, and the entire Defender / compliance / Conditional Access pipeline downstream of execution is reduced to a detection-and-cleanup story rather than a prevention story.
## Remediation
- [App Control for Business policy for endpoint security in Intune](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-app-control-policy)
- [Manage approved apps for Windows devices with App Control for Business policy and Managed Installer for Microsoft Intune](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-app-control-policy-settings)
- [Windows Defender Application Control (WDAC) design guide](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/wdac-design-guide)
- [Audit App Control policies — testing before enforcement](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/audit-app-control-policies)
- [Microsoft-recommended block rules for App Control for Business](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol)
- [Assign device profiles in Microsoft Intune](https://learn.microsoft.com/en-us/intune/intune-service/configuration/device-profile-assign)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | Medium |
| Pillar | Devices |
| Category | Devices |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Endpoint security |
| Area | Devices and endpoints |
| ATT&CK | [T1204.002](/docs/tests?mitre=T1204.002) Malicious File |
| Licence | INTUNE_A |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.