You have an SCCM server that's set up to deploy and install packages on a 32-bit or 64-bit Microsoft Windows operating system endpoint. The SCCM server communicates to the SCCM client, which is responsible for deploying the package and installing the application on the Windows endpoint. The SCCM client itself is pushed and installed by the SCCM server.
With Application Control enabled, the SCCM client installation, reinstallation, or upgrade might fail. You might observe write-denied and pkg-modification-prevented events.