Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control 2.x
BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
Application Control 2.x Setup Guide
BigFix Console Site Setup
Before deploying any WDAC policies, complete three sequential setup steps in the BigFix Console: enable the BAC licensed site, subscribe target computers, and activate the reporting Analyses and event collection Task. All three steps must be completed in order — no policy content reaches endpoints until they are done.

BigFix Documentation Homepage
BigFix 10 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
  - Overview
    Application Control v2.x is a centralized application control solution that uses Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across Windows endpoints in a BigFix-managed enterprise. It centralizes all policy authoring, signing, and deployment on a dedicated WDAC Management Node, and is administered entirely through the BigFix Console with full RBAC governance and compliance reporting.
  - What's New in This Release
    BigFix Application Control v2.x introduces a robust, secure foundation for Windows Defender Application Control (WDAC) management on enterprise Windows endpoints. Key capabilities include WDAC Base and Supplemental Policy Deployment via BigFix Fixlets, Centralized Policy Management from the BigFix Console with publisher, file hash, file name, and file path rules, Blocked Application Reporting in Audit and Enforcement modes, Active Policy Monitoring, Deployment Status Monitoring, and no-reboot policy activation for both Base and Supplemental policies.
  - Previous Releases
    BigFix Application Control v2.x introduced WDAC-based policy management including Base and Supplemental Policy Deployment, Centralized Policy Management from the BigFix Console, Blocked Application Reporting, and no-reboot policy activation. BigFix Application Control v1.0.0 introduced native application allow/block rule enforcement, real-time block notifications, bulk CSV ruleset management, and a ServiceNow exception request workflow.
  - User Personas
    Application Control defines four user personas — Security Administrator, IT Administrator, SOC Analyst, and End User — each with distinct responsibilities for authoring policies, deploying them to endpoints, monitoring enforcement events, and managing application exceptions within a BigFix-managed enterprise environment.
  - System Architecture
    The system architecture of Application Control v2.x introduces a centralized WDAC Integration Model in which all policy authoring, compilation, signing, and publication are consolidated on a dedicated WDAC Management Node. This topic describes the current v2.x architecture components, the end-to-end policy lifecycle, and contrasts it with the deprecated distributed architecture.
  - Application Control 2.x Setup Guide
    - Architecture Overview
      BigFix Application Control (BAC) 2.x centralizes Windows Defender Application Control (WDAC) policy management on a dedicated WDAC Management Node. All policy compilation, TPM 2.0-based code signing, and endpoint binary delivery are handled by this node — eliminating endpoint-side scripting and reducing the attack surface across your managed fleet.
    - System Requirements
      Verify that every host in your BAC 2.x deployment — BigFix Root Server, WDAC Management Node, and target client endpoints — meets the minimum hardware, operating system, and security specifications before you begin installation. The WDAC Management Node requires hardware TPM 2.0; this is a hard requirement with no software alternative.
    - BigFix Console Site Setup
      Before deploying any WDAC policies, complete three sequential setup steps in the BigFix Console: enable the BAC licensed site, subscribe target computers, and activate the reporting Analyses and event collection Task. All three steps must be completed in order — no policy content reaches endpoints until they are done.
      - Enable the BAC Site
        Activate the BigFix Application Control (BAC) 2.x licensed site from the BigFix Console to make all BAC Fixlet, Task, and Analysis content available to your operators and subscribed endpoints. You must have Master Operator privileges and a valid BAC license to complete this step.
      - Subscribe Target Computers
        Control which managed endpoints receive BigFix Application Control (BAC) content by configuring computer subscriptions on the BAC site. Subscribe all computers or apply property-based filters to target specific OS platforms or computer groups before deploying WDAC policies.
      - Configure Web Reports and Event Collection
        Activate the three BAC 2.x reporting Analyses (304, 305, 306) and deploy Task 365 to your target endpoints so that policy inventory, certificate health, and blocked execution events are visible in BigFix Web Reports. Without these Analyses active, policy and block event data will not appear in Web Reports regardless of whether policies are deployed.
    - Task Execution Workflow
      BAC 2.x uses a fixed, ordered sequence of BigFix Fixlets and Tasks across three infrastructure tiers — Root Server, WDAC Management Node, and target client endpoints. Each phase depends on state established by the previous one; running Tasks out of sequence will produce configuration errors or leave endpoints in an incomplete policy state.
    - Operational Best Practices
      Apply these operational practices to maintain WDAC policy integrity, avoid production enforcement outages, preserve audit history in BigFix Web Reports, and manage the signing certificate lifecycle before expiration interrupts policy compilation in BAC 2.x.
    - Notices
  - Application Control 2.x User Guide
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

BigFix Console Site Setup for BAC 2.x

Before deploying any WDAC policies, complete three sequential setup steps in the BigFix Console: enable the BAC licensed site, subscribe target computers, and activate the reporting Analyses and event collection Task. All three steps must be completed in order — no policy content reaches endpoints until they are done.

Complete the following three steps in the BigFix Console before running any BAC Task sequence or deploying WDAC policies to endpoints. Each step depends on the previous one being complete.

Enable the BAC site — Activate the BigFix Application Control licensed site from BigFix Management > License Overview. This makes all BAC Fixlets, Tasks, and Analyses available in the console. Requires a Master Operator account and a valid BAC license. See Enable the BigFix Application Control Site in the BigFix Console.
Subscribe target computers — Define which managed endpoints receive BAC content by configuring computer subscriptions on the BAC site. Subscribe all computers or apply property-based filters to target a specific OS group or UAT ring first. See Subscribe Target Computers to the BigFix Application Control Site.
Configure Web Reports and event collection — Activate Analyses 304, 305, and 306 and deploy Task 365 so that policy inventory, certificate health, and blocked execution events are visible in BigFix Web Reports. Without this step, reporting data will not appear regardless of whether policies are deployed. See Configure BAC 2.x Web Reports and Blocked Event Collection.

Important:

Do not proceed to the Task execution sequence (Tasks 351–357) until all three Console setup steps are complete. Running infrastructure Tasks before the site is subscribed and Analyses are active will leave reporting in an incomplete state that requires manual remediation.