Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control 2.x
BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
Administering v2.x
This chapter covers the 11 administrator tasks required to deploy and operate BigFix Application Control v2.x using the centralized WDAC Management Node model — from Root Server installation, WDAC Management Node configuration, and TPM-backed certificate provisioning through policy authoring, compilation, signing, endpoint deployment, policy review, and full component removal.
Generate WDAC/AppLocker Blocked Events
Collect WDAC Code Integrity and AppLocker audit and blocked events from target endpoints into ANSI text files, stored in the WDAC_Reports folder on each endpoint, for review through BigFix® Web Reports or the Application Control reporting mechanism.

BigFix Documentation Homepage
BigFix 10 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
  - Overview
    Application Control v2.x is a centralized application control solution that uses Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across Windows endpoints in a BigFix-managed enterprise. It centralizes all policy authoring, signing, and deployment on a dedicated WDAC Management Node, and is administered entirely through the BigFix Console with full RBAC governance and compliance reporting.
  - What's New in This Release
    BigFix Application Control v2.x introduces a robust, secure foundation for Windows Defender Application Control (WDAC) management on enterprise Windows endpoints. Key capabilities include WDAC Base and Supplemental Policy Deployment via BigFix Fixlets, Centralized Policy Management from the BigFix Console with publisher, file hash, file name, and file path rules, Blocked Application Reporting in Audit and Enforcement modes, Active Policy Monitoring, Deployment Status Monitoring, and no-reboot policy activation for both Base and Supplemental policies.
  - Previous Releases
    BigFix Application Control v2.x introduced WDAC-based policy management including Base and Supplemental Policy Deployment, Centralized Policy Management from the BigFix Console, Blocked Application Reporting, and no-reboot policy activation. BigFix Application Control v1.0.0 introduced native application allow/block rule enforcement, real-time block notifications, bulk CSV ruleset management, and a ServiceNow exception request workflow.
  - User Personas
    Application Control defines four user personas — Security Administrator, IT Administrator, SOC Analyst, and End User — each with distinct responsibilities for authoring policies, deploying them to endpoints, monitoring enforcement events, and managing application exceptions within a BigFix-managed enterprise environment.
  - System Architecture
    The system architecture of Application Control v2.x introduces a centralized WDAC Integration Model in which all policy authoring, compilation, signing, and publication are consolidated on a dedicated WDAC Management Node. This topic describes the current v2.x architecture components, the end-to-end policy lifecycle, and contrasts it with the deprecated distributed architecture.
  - WDAC Rule Types and Use Cases
    BigFix Application Control supports six WDAC rule types — Publisher, Hash, File Path, File Attributes, Package/PFN, and COM — each suited to a different application identification method and control objective. This topic describes when to use each rule type, the benefits it provides, and illustrative example scenarios to guide rule selection in enterprise environments.
  - Application Control v2.x Best Practices
    Guidance for deploying and managing WDAC policies through BigFix® Application Control 2.x — covering core validation principles, policy naming and overwrite behavior, change tracking recommendations, dual-node emergency signing and certificate rotation, co-located management node constraints, and the recommended rule validation workflow for onboarding new applications.
  - WDAC Policy Event ID Reference
    Reference table of WDAC Code Integrity and App Control event IDs covering audit-mode and enforcement-mode events for binaries, scripts, packaged applications, and signature validation failures — used to identify blocked or audited application files on managed Windows endpoints.
  - WDAC Limitations
    BigFix Application Control deployments are subject to known Windows Defender Application Control (WDAC) / App Control for Business limitations documented by Microsoft. This reference covers platform and version requirements, policy structure constraints, signed-policy signing rules, Memory Integrity (HVCI) interactions, and Smart App Control conflicts — each with an impact assessment and a Microsoft documentation reference.
  - BitLocker Key Requirements
    On BitLocker-encrypted endpoints, disabling UEFI Secure Boot alters the TPM platform integrity measurement and may trigger a BitLocker recovery key prompt. Have the 48-digit BitLocker Recovery Key available before beginning any WDAC recovery procedure, and be prepared to temporarily suspend BitLocker protection during boot configuration changes.
  - Policy Removal and Retirement
    Retire active WDAC policies using a controlled two-stage sequence that neutralizes the policy's enforcement state before removing its artifacts from disk. This in-band procedure maintains endpoint execution continuity throughout the planned policy retirement lifecycle.
  - Boot-Stop Failure and Emergency Recovery
    An App Control policy that blocks a boot-critical driver or core system component causes a boot-stop failure (BSOD) and prevents Windows from starting. When standard in-band recovery is not possible, administrators must use out-of-band firmware-level procedures to regain file-system access, remove problematic policy artifacts, and restore a secure boot posture.
  - Behavior Considerations
    BigFix Application Control v2.x enforces application execution through a defined set of behavioral rules governing Base and Supplemental Policy interaction, explicit Deny rule precedence, multiple Base Policy evaluation (logical AND), script enforcement under UMCI, FilePath rule security, signed policy protection, application dependency enforcement, and signing certificate requirements. Understanding these 16 behaviors is essential before designing, deploying, or updating Application Control policies in BigFix-managed environments.
  - Administering v2.x
    This chapter covers the 11 administrator tasks required to deploy and operate BigFix Application Control v2.x using the centralized WDAC Management Node model — from Root Server installation, WDAC Management Node configuration, and TPM-backed certificate provisioning through policy authoring, compilation, signing, endpoint deployment, policy review, and full component removal.
    - Root Server Installation
      Task ID 351 is the first required step in the BigFix Application Control deployment sequence. It installs BACPolicyDeploymentServices.exe on the BigFix Root Server — configuring Windows DPAPI credential encryption for the BigFix REST API, creating the Deployed, Archive, and Review policy custom sites for the specified site prefix, and starting the Background Watcher Publisher Windows Service that continuously watches for incoming policy archives and publishes active policies to the custom sites.
    - WDAC Management Node Installation
      Task ID 352 is the second step in the BigFix Application Control deployment sequence, requiring Task ID 351 (Root Server installation) to be completed first. It provisions the dedicated WDAC Management Node (BAC_MGMT) by creating the required folder structure (Certs, Logs, Policies, and Tools) under the BigFix Client installation path, and downloads and extracts WdacManager.exe — the management utility required for WDAC policy creation on the Management Node.
    - Certificate Provisioning (TPM)
      Provision a TPM 2.0–enforced code-signing certificate on the dedicated WDAC Management Node (BAC_MGMT) to enable secure WDAC policy signing. Choose from three certificate modes: self-signed using the Microsoft Platform Crypto Provider, Enterprise CA integrated with Active Directory PKI, or a customer-managed OpenSSL CA using a two-pass CSR generation and trust store import workflow. This task requires Task 352 (WDAC Management Node installation) to be completed first.
    - Create and Manage WDAC Policies
      Create and manage WDAC Base and Supplemental policy XML files on the dedicated WDAC Management Node (BAC_MGMT) directly from the BigFix® Console. The Create Policies workflow guides you through three sequential steps — configuration inputs, rule options, and custom parameter rules. Use the Purge Supplemental Policy Rules workflow to remove specific rules from existing Supplemental policies, and the Add / Remove Signer workflow to inject or strip code-signing certificates from Base or Supplemental policy XML files.
    - Compile, Sign, and Publish
      Compile an existing WDAC XML policy on the BAC_MGMT Management Node into binary CIP format using WdacManager.exe, digitally sign the compiled payload using the local TPM-bound certificate (wdacmgmt.cer by default), archive any previous version of the same Base policy, and publish all signed binaries and XML source files to the BigFix Custom Site for server-wide endpoint deployment. Base policy file names must start with Base_; Supplemental policy file names must start with Supp_; certificate files must use the .cer extension.
    - Set Up and Initialize WDAC Endpoints
      Provision the BAC client deployment environment on target Windows endpoints by deploying the required client utilities and establishing the \BFACCLIENT\BAC_CLIENT folder hierarchy under the BigFix Client installation directory. Specify the Installation Path to match the BigFix Client installation directory on target devices. Completing this task prepares target endpoints to receive, apply, and enforce WDAC policies distributed through the BigFix Custom Site.
    - Deploy and Refresh WDAC Policies
      Fetch signed .cip.p7 WDAC policy files from the BigFix Custom Site, parse policy GUIDs from file manifests, stage binary policies into the Active CodeIntegrity directory (and EFI partition for UEFI systems), and trigger RefreshPolicy.exe to enforce the new policies immediately — without requiring a system reboot. Before running, ensure the target endpoint has been initialized by Task ID 356 and that the policy has been compiled and published by Task ID 355. For Supplemental policies, the parent Base policy must already be present in the \BAC_CLIENT\Deployed folder on each target endpoint.
    - Uninstall Root Server BAC Configuration
      Uninstall the BigFix Application Control (BAC) Server component from the BigFix Enterprise Root Server by stopping and removing the BACPolicyDeploymentServices background Windows service, deleting the BAC_SERVER folder structure and associated executables, and purging DPAPI-encrypted operator credentials and config.properties files. Use the Target Path Removal field to specify the BAC_SERVER installation path.
    - Uninstall Management Node BAC Configuration
      Remove the WDAC Management Environment from the dedicated WDAC Management Node by deleting management binaries including WdacManager.exe and signing helper utilities, purging the BAC_MGMT folder structure (Tools, Certs, Policies, and Logs — including the TPM-bound signing certificate stored in Certs), and removing the parent BFAC folder if left empty after uninstallation. Use Target Removal Path to specify the BAC_MGMT installation path, and select the Cleanup Option to choose between complete removal (all files and logs) or partial removal (preserving the Logs folder for audit retention).
    - Uninstall Target Endpoint WDAC Components
      Remove all deployed signed WDAC policies from target endpoints following Microsoft legacy uninstall standards by fetching a signed AllowAll_*.cip.p7 policy from the BigFix Custom Site identified by Site Prefix, deploying it using the filename specified in AllowAll Policy Name to overwrite active restrictive policies in System32 and EFI partitions, triggering RefreshPolicy.exe to apply the permissive overwrite immediately, purging all binaries and tools from the \BFACCLIENT\BAC_CLIENT directory, and enforcing a mandatory system reboot to flush kernel-cached policy states.
    - Submit WDAC Policy for Review
      Submit an existing WDAC XML policy file from the WDAC Management Node to BigFix® for policy review by archiving and uploading the specified XML file from the <BES Client Installation Path>\BFAC\BAC_MGMT\Policies\Working directory. Base policy XML files must reside directly in the Working directory; supplemental policy XML files must reside in their parent base policy subdirectory under Working. Enter the Policy File Name with or without the .xml extension to identify which policy to submit.
    - Generate Custom WDAC Policy XML
      Generate a custom WDAC XML policy directly on the WDAC Management Node by generating a raw XML or by editing an existing policy XML using the App Control Policy Wizard content into the Policy XML Content field and saving it to the <BES Client Installation Path>\BFAC\BAC_MGMT\Policies\Working directory with inline validation. Pre-existing policy binaries (.xml, .cip, .cip.p7) at the same path are automatically archived with timestamps before the new file is saved. Policy names must follow the Base_ prefix convention for base policies and the Supp_ prefix convention for supplemental policies.
    - Sync Published Policy XML to Management Node
      Copy a published policy XML file from a deployed custom site folder into the WDAC Management Node working directory, with automatic archival of any existing working folder contents, in preparation for compiling, signing, and publishing the policy.
    - Generate WDAC/AppLocker Blocked Events
      Collect WDAC Code Integrity and AppLocker audit and blocked events from target endpoints into ANSI text files, stored in the WDAC_Reports folder on each endpoint, for review through BigFix® Web Reports or the Application Control reporting mechanism.
  - Deprecated Fixlets and Tasks
    This topic lists ten deprecated BigFix Application Control v2.0.0 Fixlets and Tasks that are scheduled for removal in a future release. The deprecated tasks cover self-signed certificate setup and renewal, Microsoft default and custom WDAC base policy deployment, supplemental policy deployment, certificate thumbprint refresh, BAC folder ACL enforcement, blocked WDAC event log generation, base and supplemental policy removal, and full WDAC component removal. Use the current administration tasks in Lifecycle/Application_Control/ACv2.0.0/administrating_ac_v2.1.0.html instead.
  - FAQs
    This FAQ covers BigFix Application Control v2.x across six topic areas: product fundamentals and architecture, Base and Supplemental Policy design, WDAC policy signing and TPM key protection, Secure Boot and boot recovery, phased deployment and enforcement introduction, Code Integrity telemetry, rule level selection (Publisher, Hash, Path, and File Name), policy naming conventions, and deprecated v2.x distributed-model scenarios.
  - Troubleshooting
    This reference covers three diagnosed WDAC enforcement issues in BigFix Application Control environments: (1) AnyDesk blocked with error 0xc0e90002 (STATUS_CODE_INTEGRITY_VIOLATION) due to an untrusted Google LLC DLL extracted to the temp folder; (2) Postman displaying "Failed to extract installer" because WDAC silently blocks background child processes before the native Device Guard notification appears; and (3) an application blocked by Event ID 3077 despite an explicit allow rule, caused by a FilePublisher or FileAttrib MinimumFileVersion threshold mismatch.
  - Notices
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

Generate WDAC Code Integrity and AppLocker Blocked Events

Collect WDAC Code Integrity and AppLocker audit and blocked events from target endpoints into ANSI text files, stored in the WDAC_Reports folder on each endpoint, for review through BigFix® Web Reports or the Application Control reporting mechanism.

About this task

This task (ID 365) collects WDAC Code Integrity and AppLocker audit and blocked events into separate ANSI text files on target endpoints.

Output Location: C:\Program Files (x86)\BigFix Enterprise\BES Client\BFACCLIENT\WDAC_Reports

The Generate WDAC Code Integrity and AppLocker Blocked Events task (ID 365) pane in the BigFix Console, showing the task description and the Fixlets and Tasks navigation location. — Figure 1. Generate WDAC Code Integrity and AppLocker Blocked Events — Task Overview (ID 365)

Procedure

In the BigFix® Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
From the Fixlets and Tasks pane, select Task: Generate WDAC Code Integrity and AppLocker Blocked Events.

From the Task: Generate WDAC Code Integrity and AppLocker Blocked Events pane, under Configuration Options, enter the following.

The Configuration Options section of the Generate WDAC Code Integrity and AppLocker Blocked Events task, showing the Timeframe (Days) input field. — Figure 2. Generate WDAC Code Integrity and AppLocker Blocked Events (ID 365) — Configuration Options

Table 1. Generate WDAC Code Integrity and AppLocker Blocked Events — Configuration Options Field Descriptions
Field Name	Description
Timeframe (Days)	Number of days of event history to collect from each target endpoint. The task queries the endpoint's event log within this window and writes matching WDAC Code Integrity and AppLocker events to the output files in the WDAC_Reports folder.

From the Task: WDAC Management Node - Custom Policy XML Generation pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
Click OK.

Results

WDAC Code Integrity and AppLocker audit and blocked events are collected from each target endpoint and written to separate ANSI text files in the WDAC_Reports folder. The report files are available for review through BigFix® Web Reports or the applicable Application Control reporting mechanism.

Use the collected event data to identify application files or components that are audited or blocked, and to determine the appropriate WDAC rule type for those components.
If the collected events indicate that a policy adjustment is required, update the WDAC policy on the WDAC Management Node and redeploy to the affected endpoints.