Glossary
App Control for Business (WDAC)
Windows' kernel-enforced application allowlisting, formerly Windows Defender Application Control: only drivers and code allowed by policy can run.
App Control for Business, previously called Windows Defender Application Control (WDAC), is the application allowlisting technology built into Windows. It is enforced by the kernel's code integrity component and applies to drivers and user-mode code for all users on a device. Policies trust code by signer, file hash, path, managed installer or Intelligent Security Graph reputation, and can run in audit or enforced mode.
When a policy is enforced, PowerShell automatically runs scripts that are not allowed in Constrained Language Mode. Policies can be signed to resist removal by local administrators, and extended with supplemental policies. Audit and block events are 3076 and 3077 in the CodeIntegrity Operational log.