Administering Application Control v2.x

This chapter covers the 11 administrator tasks required to deploy and operate BigFix Application Control v2.x using the centralized WDAC Management Node model — from Root Server installation, WDAC Management Node configuration, and TPM-backed certificate provisioning through policy authoring, compilation, signing, endpoint deployment, policy review, and full component removal.

Important:
Tasks from Application Control v2.x that used the distributed model — including per-endpoint self-signed certificate creation, direct Base and Supplemental Policy deployment on individual endpoints, and related Fixlets — are deprecated. Refer to the Deprecated Application Control v2.x Fixlets and Tasks chapter for reference documentation on those tasks.

All the tasks described in this section must be performed by users with an administrator role. The tasks cover the full lifecycle of BigFix Application Control v2.x, from initial installation and configuration through policy management, deployment, and removal.

BigFix Application Control v2.x introduces a centralized WDAC Management Node model. Policy authoring, generation, signing, and publication are performed on a dedicated WDAC Management Node rather than on individual managed endpoints. BigFix Server Components handle deployment execution, endpoint management, and telemetry collection.

The following tasks are covered under this chapter:

Installation and Configuration

  • Configure and Install BigFix Application Control (BAC) on the Root Server: Configures and installs the required BigFix Application Control components on the BigFix Root Server, including the WDAC Deployment Service, Custom Site setup, and Enterprise Database initialization. This is the first step in deploying Application Control v2.x.
  • Configure and Install the WDAC Management Node: Provisions the dedicated WDAC Management Node by deploying the BigFix Agent, the WDAC Policy Service, and the Custom Policy Generation Engine. The WDAC Management Node is the centralized host for all WDAC policy authoring, generation, signing, and publication operations.
  • Provision the TPM-Backed Code-Signing Certificate on the WDAC Management Node: Generates and provisions the TPM-backed RSA code-signing certificate on the WDAC Management Node. The private key is bound to the Trusted Platform Module (TPM) and never leaves it. This certificate is used to digitally sign all WDAC policies and to authenticate publication requests to the WDAC Deployment Service using TPM-signed JWTs.

Policy Management

  • Manage WDAC Policies on the WDAC Management Node: Covers policy authoring, version assignment, rule management (allow/deny), and policy metadata persistence. Includes creating new Base Policies and Supplemental Policies, updating existing policy versions, and validating policy configuration before generation. All policy lifecycle operations are performed on the WDAC Management Node through the BigFix UI.
  • Compile, Sign, and Publish WDAC Policies from the WDAC Management Node: Generates the compiled WDAC policy binary (.cip), signs it using the TPM-backed certificate, and publishes the signed artifact to the WDAC Deployment Service. The Deployment Service validates the TPM-signed JWT and publishes the policy to the BigFix Custom Site for downstream deployment. Reference binaries used during policy generation are removed from the node after compilation.

Endpoint Setup and Policy Deployment

  • Set Up and Initialize WDAC on Target Endpoints: Prepares managed Windows endpoints for WDAC policy enforcement. This includes verifying endpoint prerequisites, checking for and handling any existing Smart App Control (SAC) policy, and initializing the endpoint to receive centrally deployed WDAC policies from the BigFix Relay.
  • Deploy and Refresh WDAC Policies on Target Endpoints: Deploys signed Base and Supplemental Policy artifacts from the BigFix Custom Site to managed endpoints via the BigFix Relay. Applies version validation (anti-rollback) and calls RefreshPolicy to activate enforcement. Monitors deployment execution status and collects Code Integrity telemetry and compliance state via BigFix Analysis.

Policy Review

  • Submit Policy for Review: Submits a drafted or updated WDAC policy for administrative review and approval before it is signed and published. Ensures that all WDAC policies are validated, version-controlled, and appropriately scoped prior to enterprise-wide deployment, in accordance with the policy governance controls of Application Control v2.x.

Removal and Uninstallation

  • Uninstall BigFix Application Control Configuration from the Root Server: Removes the BigFix Application Control components from the BigFix Root Server, including the WDAC Deployment Service configuration, Custom Site content, and associated credentials from the credential store.
  • Uninstall BigFix Application Control Configuration from the WDAC Management Node: Removes the WDAC Policy Service, Custom Policy Generation Engine, and associated configuration from the WDAC Management Node. Includes removal of the TPM-backed signing certificate and any locally cached policy artifacts.
  • Uninstall WDAC Components from Target Endpoints: Removes all WDAC policy artifacts, associated files, and Application Control components from managed endpoints. Performs a controlled policy removal sequence to avoid endpoint disruption during uninstallation.