Application Control 2.x Overview

HCL BigFix Application Control 2.x uses Windows Defender Application Control (WDAC) to enforce application allowlisting on Windows endpoints. Use this topic to understand what Application Control does, what changed in the latest release, and how its three-tier architecture is deployed.

Application Control 2.x is a BigFix Lifecycle component that uses Windows Defender Application Control (WDAC) to enforce application allowlisting on managed endpoints. This overview provides a summary of the product, what is new in the current release, a reference to prior releases, and a description of the solution architecture.

Overview

Application Control 2.x enables IT administrators to define and enforce WDAC policies that control which applications and scripts are permitted to run on Windows endpoints. Managed through BigFix, it provides a scalable, policy-driven approach to application allowlisting — reducing attack surface without requiring per-device manual configuration. For a full introduction to the product, its goals, and supported configurations, see Overview.

What's New in This Release

Each release of Application Control 2.x introduces new Fixlets, Tasks, and policy management capabilities that extend WDAC coverage and simplify administration. The current release includes enhancements to policy compilation, certificate provisioning, and endpoint initialization workflows. For the full list of new features, resolved issues, and known limitations introduced in this release, see What's New in This Release.

Previous Releases

Application Control 2.x has evolved through a series of releases that progressively replaced the v1.x AppLocker-based approach with a WDAC-based architecture. Documentation for earlier releases — including deprecated Fixlets, migration guidance, and version-specific feature notes — is preserved for reference. For a chronological history of releases and links to archived release documentation, see Previous Releases.

User Personas

Application Control 2.x is designed for distinct roles within an IT organization, each with specific responsibilities in the policy lifecycle. These roles include BigFix administrators who deploy and maintain the BAC configuration, security engineers who author and sign WDAC policies on the Management Node, and endpoint administrators who initialize and manage target devices. Understanding which user persona applies to your role helps you navigate the relevant procedures and reference material. For a description of each user persona, their responsibilities, and the tasks they perform, see Personas.

System Architecture

The Application Control 2.x architecture is structured across three core tiers: a BigFix Root Server that stores and distributes BAC configuration content; a dedicated WDAC Management Node where policies are authored, compiled, and signed; and targeted endpoints where signed WDAC policies are deployed and enforced. Policy integrity is maintained through TPM-based certificate provisioning and digital signatures, guaranteeing that only authorized policies are applied. For detailed component descriptions, data flows, and deployment details, see System Architecture.