Refresh the Self-Signed Certificate and Update Deployed WDAC Policies Signers on Endpoint v2.x

This deprecated task automates the end-to-end renewal, signing, and redeployment of Windows Defender Application Control (WDAC) policies on the endpoint. The task checks whether the current self-signed WDAC signing certificate expires within 30 days and, if so, generates a new 4096-bit RSA replacement. It then scans local XML policies, auto-increments their version numbers, updates signer rules to trust the new certificate, converts them to binary CIP format, and redeploys to the EFI partition — all in a single automated workflow.

About this task

Important:
This task is deprecated and will be removed from BigFix Application Control v2.x in near future.
The task follows the below listed workflow:
  1. Setup: Initializes logging and ensures that the required BAC directories exist.
  2. Certificate Rotation: Checks if the current WDAC signing certificate expires within 30 days. If yes, this task generates a new 4096-bit RSA self-signed certificate.
  3. XML Processing: Scans for XML policies, automatically increments their version numbers, and updates the signer rules to trust the current certificate.
  4. Conversion & Signing: Converts the XML to a binary *.cip file and cryptographically signs it using the signtool.exe.
  5. EFI Deployment: Temporarily mounts the system's hidden EFI partition and deploys the signed policy directly to the boot manager's Active CiPolicies directory.
  6. Refresh: Invokes the local refresh utility to apply the policy immediately without a reboot.
Refer to the table below to know more about the task's exit code.
Table 1. Refresh Self-Signed Certificate and Update Deployed Policies Signers v2.0: Task Exit Codes and Meanings
Exit Code Meaning
0 Success
10 Directory setup failure
20 Certificate creation or export failure
30 XML processing or version bumping failure
40 Binary conversion failure
50 Signtool signing failure
60 EFI mount or deployment failure
70 Policy refresh tool failure
Figure 1. BigFix Console — Refresh Self-Signed Certificate and Update Deployed WDAC Policies Signers on Endpoint v2.0 Task Overview

BigFix Console showing the Refresh Self-Signed Certificate and Update Deployed Policies Signers on Endpoint v2.0 task in the Fixlets and Tasks pane, displaying the six-step automated workflow: Setup (BAC directory initialization), Certificate Rotation (30-day expiration check generating a new 4096-bit RSA self-signed certificate), XML Processing (version auto-increment and signer rule update), CIP Conversion and signtool.exe signing, EFI partition deployment to Active CiPolicies, and policy refresh utility invocation.

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Refresh Self-Signed Certificate and Update Deployed Policies Signers on Endpoint v2.0.
  3. From the Task: Refresh Self-Signed Certificate and Update Deployed Policies Signers on Endpoint v2.0 pane, under Configuration Options, enter the following information:
    Figure 2. BigFix Console — Refresh Self-Signed Certificate v2.0: Configuration Options Panel Showing Certificate Validity Years Input

    BigFix Console showing the Configuration Options panel for the Refresh Self-Signed Certificate and Update Deployed Policies Signers on Endpoint v2.0 task, with the Certificate Validity (Years) input field where the administrator specifies the validity period in years for the newly generated 4096-bit RSA self-signed WDAC code-signing certificate when the existing certificate is within 30 days of expiration.
    Table 2. Refresh Self-Signed Certificate and Update Deployed Policies Signers v2.0: Configuration Options Parameter Descriptions
    Field Name Description
    Certificate Validity (Years) Number of years for which the newly generated certificate will be valid.
  4. From the Task: Refresh Self-Signed Certificate and Update Deployed Policies Signers on Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.
    Note:
    Once this task is triggered, it remains as an open action and runs on the system whenever the system becomes relevant. Only an administrator can stop this task.

Results

A successful execution of this task results in the following outcomes:
  • WDAC signing certificate is rotated (if within 30 days of expiration).
  • Local XML policies are updated with incremented version numbers and new signer rules.
  • Cryptographically signed binary (*.cip) policies are successfully deployed to the EFI partition.
  • System application control policies are immediately refreshed and enforced.
  • A system reboot is required for the changes to take effect.