What's new in this release of BigFix Application Control

BigFix Application Control v2.x introduces a robust, secure foundation for Windows Defender Application Control (WDAC) management on enterprise Windows endpoints. Key capabilities include WDAC Base and Supplemental Policy Deployment via BigFix Fixlets, Centralized Policy Management from the BigFix Console with publisher, file hash, file name, and file path rules, Blocked Application Reporting in Audit and Enforcement modes, Active Policy Monitoring, Deployment Status Monitoring, and no-reboot policy activation for both Base and Supplemental policies.

BigFix Application Control v2.1.0

Overview

BigFix Application Control version 2.1.0 delivers a major architectural upgrade that provides native, high-performance Windows Defender Application Control (WDAC) management across enterprise endpoints. This release transitions policy authoring, compilation, signing, and deployment away from PowerShell scripting dependencies to a lightweight native toolset—leveraging WdacManager.exe, Microsoft native utilities (SignTool.exe), and background deployment services (BACPolicyDeploymentServices.exe). BAC 2.1.0 enables administrators to seamlessly configure layered Base and Supplemental policies, enforce hardware-bound cryptographic security via TPM 2.0, manage certificates and signers, and maintain continuous endpoint control without management lockout.

New features that are introduced in Application Control v2.1.0

This release focuses on providing a robust, stable, and secure foundation for application control.

Native WDAC Management & PowerShell Elimination
With this release we introduce a high-performance native utility (WdacManager.exe) and Go-based background services to manage the complete WDAC policy lifecycle without relying on PowerShell scripts.
Direct integration with native Windows utilities (Microsoft SDK SignTool.exe) for fast policy compilation, binary conversion (.cip), signing, and real-time policy refresh.
Modular Layered Policy Management (Base & Supplemental Policies)
Full support for creating, updating, and deploying modular Base and Supplemental policies, allowing administrators to establish enterprise-wide baselines while delegating flexible, targeted application exceptions.
Multi-rule authoring support across Publisher/Signer, File Path, Hash, File Attributes, Package App, and COM rules.
Added dedicated commands to cleanly add, update, and remove signers from existing policy configurations without corrupting XML structures.
Hardware-Enforced & Enterprise Certificate Management
TPM 2.0 Hardware Binding: Integrated certificate generation and signing anchored in TPM 2.0 / Microsoft Platform Crypto Provider for tamper-resistant private key protection.
Certificates: Our solution supports policy signing using self-signed certificates or customer-managed OpenSSL CA certificates.
Streamlined Fixlet-Driven Deployment Workflow
Fixlet 1 (Install BAC Server): Deploys BACPolicyDeploymentServices.exe, securely encrypts BigFix REST API credentials using Windows DPAPI, and automates Custom Site management.
Fixlet 2 (BAC Management Device Setup): Provisions dedicated management environments and deploys WdacManager.exe.
Fixlet 3 (Certificate Provisioning): Configures TPM-backed self-signed or customer-managed OpenSSL CA certificates.
Fixlet 4 (WDAC Policy Creation Wizard): Interactive console for policy management to configure Base/Supplemental policies, certificate provisioning, compiling, signing, and publishing WDAC Policies, purging supplemental policy rules (to block allowed applications), and so on.
Fixlet 5 (Policy Signer & Publisher): Compiles XML into binary CIP, digitally signs the payload, and automatically publishes it to BigFix Custom Sites for endpoint distribution.
Endpoint Self-Protection & Forensics
On-Demand Forensic Telemetry: Controlled retrieval of Code Integrity blocked events and policy XML files into Web Reports without saturating endpoint performance or relay bandwidth.
Additional information about this release
Published Site and Component Versions:
  • Application Control site version: 4
Application Control Documentation links: