BigFix Application Control v2.x: Product Overview

Application Control v2.x is a centralized application control solution that uses Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across Windows endpoints in a BigFix-managed enterprise. It centralizes all policy authoring, signing, and deployment on a dedicated WDAC Management Node, and is administered entirely through the BigFix Console with full RBAC governance and compliance reporting.

BigFix® Application Control is a security solution designed to manage which software can run on Windows devices within BigFix-managed enterprise environments. It uses Windows Defender Application Control (WDAC) as its enforcement engine to apply policies at the kernel level, preventing unauthorized software execution before it can start.

The newer version of 2.x introduces a centralized WDAC Integration Model. All policy authoring, generation, signing, and publication are performed on a dedicated WDAC Management Node rather than on individual managed endpoints. The BigFix platform handles deployment execution, endpoint management, and telemetry collection. Administrators interact with the solution exclusively through the BigFix Console and its Fixlets and tasks. The solution supports multiple policy formats and enables the deployment of multiple audit or enforcement policies to endpoints.

The following sections describe the core components and how they work together:

  1. Core Security Mechanism: WDAC Integration

    The solution's enforcement strength derives from its use of Windows Defender Application Control (WDAC), a kernel-mode Code Integrity feature built into Windows.

    • Kernel-level Enforcement: WDAC operates within the Windows kernel (Code Integrity engine), meaning security checks occur at the deepest layer of the operating system — before any unauthorized code can execute in user mode.
    • Allowlisting and Blocklisting:
      • Allowlisting: A Zero Trust approach where only explicitly approved applications are permitted to run; all other execution is blocked by default.
      • Blocklisting: Specific known-malicious or unwanted programs are explicitly denied, while all other software is permitted.
    • Policy Types: The solution supports two types of WDAC policies that work in combination:
      • Base Policy: Defines the enterprise-wide security baseline. All managed endpoints receive and enforce the Base Policy.
      • Supplemental Policy: Extends the Base Policy for a specific department or endpoint group without modifying the Base Policy itself. Multiple Supplemental Policies can reference the same Base Policy.

  2. Centralized Policy Lifecycle: WDAC Management Node

    The latest version of 2.x centralizes all WDAC-specific processing on a dedicated WDAC Management Node — a designated machine running the BigFix Agent. This eliminates the dependency on endpoint-resident PowerShell tooling (ConfigCI) that was required in earlier releases.

    • WDAC Policy Service: Manages the full policy lifecycle, including authoring, versioning, rule management, and publication.
    • Custom Policy Generation Engine: Generates the compiled WDAC policy binary (.cip) from authored policy definitions. Reference binaries are processed locally on the node and removed after policy generation to minimize attack surface.
    • TPM-Backed Code-Signing Certificate: A non-exportable RSA certificate whose private key is bound to the Trusted Platform Module (TPM) and never leaves it. All generated WDAC policies are digitally signed by this certificate.
    • Upload Manager: Transfers the signed policy artifact from the Secure Folder on the WDAC Management Node to the designated Secure Folder on the BigFix Root Server, providing a controlled integrity boundary between the policy-management and publication environments.

  3. Centralized Management and Deployment: BigFix Platform Integration

    The BigFix platform provides all deployment execution, endpoint management, and telemetry capabilities. Application Control v2.x integrates with native BigFix platform services rather than duplicating them.

    • BigFix Console: The sole administrative interface for all Application Control operations. Administrators author policies, review status, and initiate deployments through the BigFix Console's Fixlets and Tasks. Direct access to the WDAC Management Node is not permitted. Role-Based Access Control (RBAC) is enforced through native BigFix access controls.
    • WDAC Deployment Service: Runs on the BigFix Root Server and includes a Watcher that monitors the Root Server Secure Folder for newly available signed policy artifacts. When a new artifact is detected, the WDAC Deployment Service validates the expected publication workflow and publishes the artifact to the designated BigFix Custom Site. The service uses protected credentials when authentication to the BigFix REST API is required.
    • BigFix Relay: Distributes signed policy artifacts from the BigFix Root Server to managed endpoints at scale.
    • BigFix Web Reports: Delivers compliance dashboards, deployment status reporting, Code Integrity event visibility, and policy lifecycle history.
    • BigFix Custom Site & Central Policy Repository: Serves as the single source of truth (SSOT) for all active enterprise WDAC policies, staging policy binaries (.cip), Base/Supplemental policy XMLs, and reference schemas. Supports Policy XML Review & Staging, an Offline Customization Workflow for out-of-band policy authoring, and a Temporary Node Site Subscription model that minimizes attack surface by subscribing the WDAC Management Node to the Custom Site only when needed.

  4. Policy Governance

    The latest version of Application Control v2.x enforces the following governance controls to ensure that only validated, correctly scoped policies reach managed endpoints:

    • Immutable Policy Versioning: Every published policy is an immutable, version-controlled artifact. Existing policy versions cannot be modified in place. Every update produces a new version, preserving full history for audit and rollback.
    • Department-Scoped Supplemental Policies: Supplemental Policies are scoped to their assigned department. Supplemental policies can be better scoped to their assigned department.
    • Pre-Deployment Review: Policies must be validated and approved before being signed and published, ensuring correctness of content and deployment scope.

To know more about Application Control v2.x's latest architecture updates, refer to BigFix Application Control: System Architecture.

Table 1. BigFix Application Control v2.x: Feature and Benefit Summary
Feature Benefit
WDAC Kernel Enforcement Stops unauthorized code at the deepest layer of the OS before it can execute, providing high-assurance security that is difficult for malware to bypass or disable.
Centralized WDAC Management Node Consolidates policy authoring, generation, and signing on a single dedicated node, eliminating dependency on endpoint-resident PowerShell tooling and enabling reliable operation in hardened environments.
TPM-Backed Code Signing Binds the signing key to the hardware TPM so the private key never leaves the device, eliminating distributed trust fragmentation and ensuring policy authenticity.
Immutable Policy Versioning Treats every published policy as an immutable artifact with full version history, enabling rollback and providing a complete audit trail for compliance.
Department-Scoped Supplemental Policies Allows per-department policy exceptions without modifying the enterprise Base Policy, maintaining isolation and preventing unintended cross-department policy propagation.
BigFix Console Provides a single, RBAC-governed interface for all policy operations, preventing direct access to infrastructure components and enabling enterprise-scale administration.
BigFix Platform Integration Reuses native BigFix deployment, relay, telemetry, and reporting capabilities rather than duplicating them, reducing operational complexity and leveraging existing BigFix scale.
Controlled Policy Artifact Handoff The Upload Manager enforces a defined integrity checkpoint between the WDAC Management Node and the BigFix publication environment, preventing unsigned or unvalidated artifacts from entering the deployment pipeline.
BigFix Custom Site (Central Policy Repository) Acts as the SSOT for all policy artifacts, preventing version fragmentation and supporting offline policy customization and emergency recovery workflows.
Note:
  • Application Control currently supports application enforcement for both physical and virtual Windows™ (environment) devices only.
  • Non-Windows environment (macOS™UNIX™Linux™) support is planned for a future release.