- BigFix Application Control v2.0.0: WDAC Use Cases and Enforcement Model
BigFix Application Control v2.0.0 leverages Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across managed Windows endpoints. This topic covers the WDAC enforcement model, the BigFix–WDAC integration architecture, foundational infrastructure provisioning using endpoint-based self-signed certificates, and the end-to-end Base Policy and Supplemental Policy lifecycle.
- Migrating from BigFix Application Control v1.0.0 to v2.0.0
Migrating from Application Control v1.0.0 to v2.0.0 replaces the custom BAC rule engine with WDAC-based enforcement. Existing allow rules are recreated as Supplemental Policies, block rules are not migrated, and the process is a one-time, non-reversible operation per endpoint. This topic provides a six-step migration flow summary and key considerations before you begin.
- Create and Set Up a Self-Signed Code-Signing Certificate on Endpoint v2.x
This deprecated task generates and configures a self-signed RSA 4096-bit SHA256 code-signing certificate on the endpoint for use with Windows Defender Application Control (WDAC). The task creates required BAC directories, stores the certificate in the Cert:\LocalMachine\My store, and exports the public certificate to BAC\Certs\WDAC_SigningCert.cer for use in WDAC policy signing and deployment workflows.
- Deploy a Default Microsoft WDAC Base Policy on Endpoint v2.x
This deprecated task deploys a signed Windows Defender Application Control (WDAC) base policy on the endpoint using a secure, hash-validated workflow. Select from seven Microsoft-recommended baseline policy templates — including AllowAll, AllowMicrosoft, DefaultWindows (Audit or Enforced), and RecommendedDriverBlock — and the task converts, signs, and deploys the policy to the EFI partition for firmware-level persistence and enforcement across reboots.
- Create a Custom WDAC Base Policy Using the Policy Wizard
This deprecated topic describes how to use the Microsoft WDAC Policy Wizard to create a custom Windows Defender Application Control (WDAC) base policy. Starting from one of three templates — Default Windows, Allow Microsoft, or Signed and Reputable — configure policy rule options, add custom signing rules (publisher, file path, folder path, or file hash), keep Audit Mode enabled until ready to enforce, then build to generate the policy XML and optional binary for use with the Deploy Custom Base Policy task.
- Deploy a Custom WDAC Base Policy on Endpoint v2.x
This deprecated task deploys a custom Windows Defender Application Control (WDAC) base policy on the endpoint from a user-provided XML configuration. The task automatically bumps the policy version if an older version exists, injects mandatory publisher rules for the BigFix Client, Refresh Tool, and SignTool, converts the policy from XML to binary CIP format, signs it with a trusted certificate, and deploys it to the EFI partition for firmware-level persistence and enforcement across reboots.
- Deploy a Supplemental WDAC Policy on Endpoint v2.x
This deprecated task creates and deploys a signed Windows Defender Application Control (WDAC) supplemental policy on the endpoint. Accept rule input in Single-Level or Multi-Level CSV format, generate WDAC rules from file hash, publisher, file path, or file name attributes, link the new supplemental policy to an existing base policy by GUID, and deploy it signed to the EFI partition in Enforced or Audit mode. Each execution creates a new unique supplemental policy without modifying existing policies.
- Refresh the Self-Signed Certificate and Update Deployed WDAC Policies Signers on Endpoint v2.x
This deprecated task automates the end-to-end renewal, signing, and redeployment of Windows Defender Application Control (WDAC) policies on the endpoint. The task checks whether the current self-signed WDAC signing certificate expires within 30 days and, if so, generates a new 4096-bit RSA replacement. It then scans local XML policies, auto-increments their version numbers, updates signer rules to trust the new certificate, converts them to binary CIP format, and redeploys to the EFI partition — all in a single automated workflow.
- Refresh the Thumbprint of Deployed WDAC Policies Signers on Endpoint v2.x
This deprecated task updates the code-signing certificate thumbprint across all deployed Windows Defender Application Control (WDAC) policies on the endpoint without generating a new certificate. It scans local XML policies, increments their version numbers, updates signer rules to reference the current certificate thumbprint, converts them to binary CIP format using signtool.exe, and redeploys to the EFI partition — refreshing policy enforcement immediately in a single automated five-step workflow.
- Enforce Secure ACL Permissions on the BAC Folder on Endpoint v2.x
This deprecated task hardens the BigFix Application Control (BAC) directory at \Program Files (x86)\BigFix Enterprise\BES Client\BAC by enforcing strict Windows Access Control List (ACL) settings: it disables ACL inheritance, removes all existing inherited permissions, grants exclusive full control to NT AUTHORITY\SYSTEM, and recursively sets SYSTEM as the owner of all files and subfolders — protecting WDAC policy artifacts, signing certificates, and execution logs from unauthorized access.
- Generate Blocked WDAC Event Logs on Endpoint v2.x
This deprecated task extracts Windows Defender Application Control (WDAC) block events from two Windows event log sources — Microsoft-Windows-CodeIntegrity/Operational and Microsoft-Windows-AppLocker/MSI and Script — for a configurable timeframe of 1 to 14 days. It filters audit-mode event IDs 3076, 3034, and 8028 ("would be blocked") and enforced-mode event IDs 3077, 3033, 8029, and 8040 ("blocked"), then outputs a structured JSON report to BAC\WDAC_Reports\WDAC_Blocked_Events.json for dashboard ingestion, policy analysis, or BigFix Web Reports.
- Remove Base or Supplemental WDAC Policy from Endpoint v2.x
This deprecated task removes Windows Defender Application Control (WDAC) policies from the endpoint in one of two modes: Supplemental mode removes a single targeted supplemental policy identified by its Policy GUID from both EFI and System32 storage locations; Base mode performs a full reset by removing all existing WDAC base and supplemental policies from both locations and deploying a clean AllowAll.cip policy to prevent application blocking. A system reboot is required for changes to take effect.
- Remove WDAC Components from Endpoint v2.x
This deprecated task performs a complete WDAC infrastructure cleanup on the endpoint: it mounts the EFI system partition and removes the AllowAll base policy, uninstalls the Windows SDK including SignTool.exe, and deletes the entire BAC folder and its contents — fully decommissioning Windows Defender Application Control (WDAC) enforcement on the endpoint. A system reboot is required for changes to take effect.
- View Application Control Endpoint Details in BigFix Web Reports v2.x
This deprecated task describes how to use BigFix Web Reports to view a read-only overview of all Application Control managed endpoints. The report provides three tabs: the Managed Devices tab lists all managed endpoints with property and OS filtering and CSV export; the Policy Details tab shows the WDAC rules assigned per endpoint; and the Event Details tab displays all events executed on each endpoint.
- BigFix Application Control v2.x Deprecated Tasks: Exit Code Reference (Tasks 201–209)
This reference topic lists the exit codes for all nine deprecated BigFix Application Control v2.x tasks (201–209). Exit code 0 indicates success; non-zero codes pinpoint the specific failure stage — directory creation, certificate generation, policy processing, binary conversion, signing, EFI deployment, or policy refresh — to enable rapid diagnosis without inspecting log files.