BigFix Application Control 2.x: Architecture and Component Overview

BigFix Application Control (BAC) 2.x centralizes Windows Defender Application Control (WDAC) policy management on a dedicated WDAC Management Node. All policy compilation, TPM 2.0-based code signing, and endpoint binary delivery are handled by this node — eliminating endpoint-side scripting and reducing the attack surface across your managed fleet.

What BAC 2.x introduces

BAC 2.x offloads all policy creation, binary compilation, validation, and code-signing to a single, isolated WDAC Management Node. The Management Node holds the hardware TPM 2.0-protected signing identity, so compiled .cip policy binaries delivered to endpoints are pre-signed and require no local scripting to apply.

This architecture replaces earlier models where policy-related scripts ran directly on managed endpoints, reducing the attack surface and simplifying compliance auditing.

Core architectural components

BAC 2.x spans three tiers of infrastructure:

BigFix Root Server
Hosts BAC deployment configurations and publishes site content to subscribed endpoints. All Fixlet and Task content originates here.
WDAC Management Node
The central authority for policy authoring, XML-to-binary compilation, TPM-based signing, and staging. Policy assets are pushed from this node to BigFix Custom Sites before distribution.
Target Client Endpoints
Production endpoints that receive pre-compiled, pre-signed .cip binaries and enforce them through the native Windows Code Integrity engine. No policy-generation logic runs on these endpoints.

Custom site lifecycle: Review, Deployed, and Archive

BAC 2.x organizes policy assets across three custom BigFix sites, each prefixed with a configurable site prefix:

  • <Prefix>_Review — Holds draft XML policy files for administrative inspection and rule verification before publication.
  • <Prefix>_Deployed — Houses compiled, TPM-signed .cip binaries approved for active production enforcement.
  • <Prefix>_Archive — Preserves historical XML source and compiled binaries whenever policies are updated, maintaining a full audit trail.

Relationship to Windows Defender Application Control

BAC 2.x manages both Base Policies and Supplemental Policies in WDAC XML format. The Management Node compiles these XML definitions into binary .cip files, signs them, and stages them for BigFix-driven deployment. Endpoints apply the binaries through the native Windows Code Integrity engine without requiring any BAC-specific runtime components.