Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control 2.x
BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
Application Control 2.x Setup Guide
System Requirements
Verify that every host in your BAC 2.x deployment — BigFix Root Server, WDAC Management Node, and target client endpoints — meets the minimum hardware, operating system, and security specifications before you begin installation. The WDAC Management Node requires hardware TPM 2.0; this is a hard requirement with no software alternative.

BigFix Documentation Homepage
BigFix 10 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
  - Overview
    Application Control v2.x is a centralized application control solution that uses Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across Windows endpoints in a BigFix-managed enterprise. It centralizes all policy authoring, signing, and deployment on a dedicated WDAC Management Node, and is administered entirely through the BigFix Console with full RBAC governance and compliance reporting.
  - What's New in This Release
    BigFix Application Control v2.x introduces a robust, secure foundation for Windows Defender Application Control (WDAC) management on enterprise Windows endpoints. Key capabilities include WDAC Base and Supplemental Policy Deployment via BigFix Fixlets, Centralized Policy Management from the BigFix Console with publisher, file hash, file name, and file path rules, Blocked Application Reporting in Audit and Enforcement modes, Active Policy Monitoring, Deployment Status Monitoring, and no-reboot policy activation for both Base and Supplemental policies.
  - Previous Releases
    BigFix Application Control v2.x introduced WDAC-based policy management including Base and Supplemental Policy Deployment, Centralized Policy Management from the BigFix Console, Blocked Application Reporting, and no-reboot policy activation. BigFix Application Control v1.0.0 introduced native application allow/block rule enforcement, real-time block notifications, bulk CSV ruleset management, and a ServiceNow exception request workflow.
  - User Personas
    Application Control defines four user personas — Security Administrator, IT Administrator, SOC Analyst, and End User — each with distinct responsibilities for authoring policies, deploying them to endpoints, monitoring enforcement events, and managing application exceptions within a BigFix-managed enterprise environment.
  - System Architecture
    The system architecture of Application Control v2.x introduces a centralized WDAC Integration Model in which all policy authoring, compilation, signing, and publication are consolidated on a dedicated WDAC Management Node. This topic describes the current v2.x architecture components, the end-to-end policy lifecycle, and contrasts it with the deprecated distributed architecture.
  - Application Control 2.x Setup Guide
    - Architecture Overview
      BigFix Application Control (BAC) 2.x centralizes Windows Defender Application Control (WDAC) policy management on a dedicated WDAC Management Node. All policy compilation, TPM 2.0-based code signing, and endpoint binary delivery are handled by this node — eliminating endpoint-side scripting and reducing the attack surface across your managed fleet.
    - System Requirements
      Verify that every host in your BAC 2.x deployment — BigFix Root Server, WDAC Management Node, and target client endpoints — meets the minimum hardware, operating system, and security specifications before you begin installation. The WDAC Management Node requires hardware TPM 2.0; this is a hard requirement with no software alternative.
    - BigFix Console Site Setup
      Before deploying any WDAC policies, complete three sequential setup steps in the BigFix Console: enable the BAC licensed site, subscribe target computers, and activate the reporting Analyses and event collection Task. All three steps must be completed in order — no policy content reaches endpoints until they are done.
    - Task Execution Workflow
      BAC 2.x uses a fixed, ordered sequence of BigFix Fixlets and Tasks across three infrastructure tiers — Root Server, WDAC Management Node, and target client endpoints. Each phase depends on state established by the previous one; running Tasks out of sequence will produce configuration errors or leave endpoints in an incomplete policy state.
    - Operational Best Practices
      Apply these operational practices to maintain WDAC policy integrity, avoid production enforcement outages, preserve audit history in BigFix Web Reports, and manage the signing certificate lifecycle before expiration interrupts policy compilation in BAC 2.x.
    - Notices
  - Application Control 2.x User Guide
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

BAC 2.x System Requirements and Infrastructure Prerequisites

Verify that every host in your BAC 2.x deployment — BigFix Root Server, WDAC Management Node, and target client endpoints — meets the minimum hardware, operating system, and security specifications before you begin installation. The WDAC Management Node requires hardware TPM 2.0; this is a hard requirement with no software alternative.

BigFix Root Server

Role: Hosts BAC deployment configurations and manages site content publication workflows.

Specification	Requirement
Supported operating systems	Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025
CPU	4 cores minimum; 8 cores recommended
RAM	16 GB minimum; 32 GB recommended

WDAC Management Node

Role: Centralized node for policy authoring, binary compilation, TPM-based signing, validation, and staging.

Important:

Hardware TPM 2.0 is required on the WDAC Management Node. The signing identity that authorizes all compiled .cip binaries is bound to this TPM. A node without TPM 2.0 cannot be used as a Management Node — there is no software fallback.

Specification	Requirement
Supported operating systems	Windows 10 (version 1903 or later) Windows 11 Windows Server 2022 or later
CPU	4 cores minimum; 8 cores recommended
RAM	16 GB minimum; 32 GB recommended
Disk (free space)	80 GB minimum
Hardware security module	Hardware TPM 2.0 (required — no software alternative)

Target Client Endpoints

Role: Managed production endpoints that receive pre-compiled .cip policy binaries and enforce them through the native Windows Code Integrity engine. No BAC runtime components are required on these endpoints.

Specification	Requirement
Supported operating systems	Windows 10 (version 1903 or later) Windows 11 Windows Server 2022 or later
CPU	2 cores minimum; 4 cores recommended
RAM	8 GB minimum
Disk (free space)	20 GB minimum