Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control 2.x
BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
Deprecated Fixlets and Tasks
This topic lists ten deprecated BigFix Application Control v2.0.0 Fixlets and Tasks that are scheduled for removal in a future release. The deprecated tasks cover self-signed certificate setup and renewal, Microsoft default and custom WDAC base policy deployment, supplemental policy deployment, certificate thumbprint refresh, BAC folder ACL enforcement, blocked WDAC event log generation, base and supplemental policy removal, and full WDAC component removal. Use the current administration tasks in Lifecycle/Application_Control/ACv2.0.0/administrating_ac_v2.1.0.html instead.
Remove WDAC Components from Endpoint
This deprecated task performs a complete WDAC infrastructure cleanup on the endpoint: it mounts the EFI system partition and removes the AllowAll base policy, uninstalls the Windows SDK including SignTool.exe, and deletes the entire BAC folder and its contents — fully decommissioning Windows Defender Application Control (WDAC) enforcement on the endpoint. A system reboot is required for changes to take effect.

BigFix Documentation Homepage
BigFix 10 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
  - Overview
    Application Control v2.x is a centralized application control solution that uses Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across Windows endpoints in a BigFix-managed enterprise. It centralizes all policy authoring, signing, and deployment on a dedicated WDAC Management Node, and is administered entirely through the BigFix Console with full RBAC governance and compliance reporting.
  - What's New in This Release
    BigFix Application Control v2.x introduces a robust, secure foundation for Windows Defender Application Control (WDAC) management on enterprise Windows endpoints. Key capabilities include WDAC Base and Supplemental Policy Deployment via BigFix Fixlets, Centralized Policy Management from the BigFix Console with publisher, file hash, file name, and file path rules, Blocked Application Reporting in Audit and Enforcement modes, Active Policy Monitoring, Deployment Status Monitoring, and no-reboot policy activation for both Base and Supplemental policies.
  - Previous Releases
    BigFix Application Control v2.x introduced WDAC-based policy management including Base and Supplemental Policy Deployment, Centralized Policy Management from the BigFix Console, Blocked Application Reporting, and no-reboot policy activation. BigFix Application Control v1.0.0 introduced native application allow/block rule enforcement, real-time block notifications, bulk CSV ruleset management, and a ServiceNow exception request workflow.
  - User Personas
    Application Control defines four user personas — Security Administrator, IT Administrator, SOC Analyst, and End User — each with distinct responsibilities for authoring policies, deploying them to endpoints, monitoring enforcement events, and managing application exceptions within a BigFix-managed enterprise environment.
  - System Architecture
    The system architecture of Application Control v2.x introduces a centralized WDAC Integration Model in which all policy authoring, compilation, signing, and publication are consolidated on a dedicated WDAC Management Node. This topic describes the current v2.x architecture components, the end-to-end policy lifecycle, and contrasts it with the deprecated distributed architecture.
  - WDAC Rule Types and Use Cases
    BigFix Application Control supports six WDAC rule types — Publisher, Hash, File Path, File Attributes, Package/PFN, and COM — each suited to a different application identification method and control objective. This topic describes when to use each rule type, the benefits it provides, and illustrative example scenarios to guide rule selection in enterprise environments.
  - Application Control v2.x Best Practices
    Guidance for deploying and managing WDAC policies through BigFix® Application Control 2.x — covering core validation principles, policy naming and overwrite behavior, change tracking recommendations, dual-node emergency signing and certificate rotation, co-located management node constraints, and the recommended rule validation workflow for onboarding new applications.
  - WDAC Policy Event ID Reference
    Reference table of WDAC Code Integrity and App Control event IDs covering audit-mode and enforcement-mode events for binaries, scripts, packaged applications, and signature validation failures — used to identify blocked or audited application files on managed Windows endpoints.
  - WDAC Limitations
    BigFix Application Control deployments are subject to known Windows Defender Application Control (WDAC) / App Control for Business limitations documented by Microsoft. This reference covers platform and version requirements, policy structure constraints, signed-policy signing rules, Memory Integrity (HVCI) interactions, and Smart App Control conflicts — each with an impact assessment and a Microsoft documentation reference.
  - BitLocker Key Requirements
    On BitLocker-encrypted endpoints, disabling UEFI Secure Boot alters the TPM platform integrity measurement and may trigger a BitLocker recovery key prompt. Have the 48-digit BitLocker Recovery Key available before beginning any WDAC recovery procedure, and be prepared to temporarily suspend BitLocker protection during boot configuration changes.
  - Policy Removal and Retirement
    Retire active WDAC policies using a controlled two-stage sequence that neutralizes the policy's enforcement state before removing its artifacts from disk. This in-band procedure maintains endpoint execution continuity throughout the planned policy retirement lifecycle.
  - Boot-Stop Failure and Emergency Recovery
    An App Control policy that blocks a boot-critical driver or core system component causes a boot-stop failure (BSOD) and prevents Windows from starting. When standard in-band recovery is not possible, administrators must use out-of-band firmware-level procedures to regain file-system access, remove problematic policy artifacts, and restore a secure boot posture.
  - Behavior Considerations
    BigFix Application Control v2.x enforces application execution through a defined set of behavioral rules governing Base and Supplemental Policy interaction, explicit Deny rule precedence, multiple Base Policy evaluation (logical AND), script enforcement under UMCI, FilePath rule security, signed policy protection, application dependency enforcement, and signing certificate requirements. Understanding these 16 behaviors is essential before designing, deploying, or updating Application Control policies in BigFix-managed environments.
  - Administering v2.x
    This chapter covers the 11 administrator tasks required to deploy and operate BigFix Application Control v2.x using the centralized WDAC Management Node model — from Root Server installation, WDAC Management Node configuration, and TPM-backed certificate provisioning through policy authoring, compilation, signing, endpoint deployment, policy review, and full component removal.
  - Deprecated Fixlets and Tasks
    This topic lists ten deprecated BigFix Application Control v2.0.0 Fixlets and Tasks that are scheduled for removal in a future release. The deprecated tasks cover self-signed certificate setup and renewal, Microsoft default and custom WDAC base policy deployment, supplemental policy deployment, certificate thumbprint refresh, BAC folder ACL enforcement, blocked WDAC event log generation, base and supplemental policy removal, and full WDAC component removal. Use the current administration tasks in Lifecycle/Application_Control/ACv2.0.0/administrating_ac_v2.1.0.html instead.
    - AC v2.0.0 Use Cases
      BigFix Application Control v2.0.0 leverages Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across managed Windows endpoints. This topic covers the WDAC enforcement model, the BigFix–WDAC integration architecture, foundational infrastructure provisioning using endpoint-based self-signed certificates, and the end-to-end Base Policy and Supplemental Policy lifecycle.
    - Migrate to v2.0.0
      Migrating from Application Control v1.0.0 to v2.0.0 replaces the custom BAC rule engine with WDAC-based enforcement. Existing allow rules are recreated as Supplemental Policies, block rules are not migrated, and the process is a one-time, non-reversible operation per endpoint. This topic provides a six-step migration flow summary and key considerations before you begin.
    - Create Self-Signed Cert on Endpoint
      This deprecated task generates and configures a self-signed RSA 4096-bit SHA256 code-signing certificate on the endpoint for use with Windows Defender Application Control (WDAC). The task creates required BAC directories, stores the certificate in the Cert:\LocalMachine\My store, and exports the public certificate to BAC\Certs\WDAC_SigningCert.cer for use in WDAC policy signing and deployment workflows.
    - Deploy Default Microsoft Base Policy
      This deprecated task deploys a signed Windows Defender Application Control (WDAC) base policy on the endpoint using a secure, hash-validated workflow. Select from seven Microsoft-recommended baseline policy templates — including AllowAll, AllowMicrosoft, DefaultWindows (Audit or Enforced), and RecommendedDriverBlock — and the task converts, signs, and deploys the policy to the EFI partition for firmware-level persistence and enforcement across reboots.
    - Create Custom WDAC Base Policy
      This deprecated topic describes how to use the Microsoft WDAC Policy Wizard to create a custom Windows Defender Application Control (WDAC) base policy. Starting from one of three templates — Default Windows, Allow Microsoft, or Signed and Reputable — configure policy rule options, add custom signing rules (publisher, file path, folder path, or file hash), keep Audit Mode enabled until ready to enforce, then build to generate the policy XML and optional binary for use with the Deploy Custom Base Policy task.
    - Deploy Custom Base Policy
      This deprecated task deploys a custom Windows Defender Application Control (WDAC) base policy on the endpoint from a user-provided XML configuration. The task automatically bumps the policy version if an older version exists, injects mandatory publisher rules for the BigFix Client, Refresh Tool, and SignTool, converts the policy from XML to binary CIP format, signs it with a trusted certificate, and deploys it to the EFI partition for firmware-level persistence and enforcement across reboots.
    - Deploy Supplemental Policy on Endpoint
      This deprecated task creates and deploys a signed Windows Defender Application Control (WDAC) supplemental policy on the endpoint. Accept rule input in Single-Level or Multi-Level CSV format, generate WDAC rules from file hash, publisher, file path, or file name attributes, link the new supplemental policy to an existing base policy by GUID, and deploy it signed to the EFI partition in Enforced or Audit mode. Each execution creates a new unique supplemental policy without modifying existing policies.
    - Refresh Self-Signed Cert and Update Policy Signers
      This deprecated task automates the end-to-end renewal, signing, and redeployment of Windows Defender Application Control (WDAC) policies on the endpoint. The task checks whether the current self-signed WDAC signing certificate expires within 30 days and, if so, generates a new 4096-bit RSA replacement. It then scans local XML policies, auto-increments their version numbers, updates signer rules to trust the new certificate, converts them to binary CIP format, and redeploys to the EFI partition — all in a single automated workflow.
    - Refresh Thumbprint of Deployed Policy Signers
      This deprecated task updates the code-signing certificate thumbprint across all deployed Windows Defender Application Control (WDAC) policies on the endpoint without generating a new certificate. It scans local XML policies, increments their version numbers, updates signer rules to reference the current certificate thumbprint, converts them to binary CIP format using signtool.exe, and redeploys to the EFI partition — refreshing policy enforcement immediately in a single automated five-step workflow.
    - Enforce Secure ACL on BAC Folder
      This deprecated task hardens the BigFix Application Control (BAC) directory at \Program Files (x86)\BigFix Enterprise\BES Client\BAC by enforcing strict Windows Access Control List (ACL) settings: it disables ACL inheritance, removes all existing inherited permissions, grants exclusive full control to NT AUTHORITY\SYSTEM, and recursively sets SYSTEM as the owner of all files and subfolders — protecting WDAC policy artifacts, signing certificates, and execution logs from unauthorized access.
    - Generate Blocked WDAC Event Logs
      This deprecated task extracts Windows Defender Application Control (WDAC) block events from two Windows event log sources — Microsoft-Windows-CodeIntegrity/Operational and Microsoft-Windows-AppLocker/MSI and Script — for a configurable timeframe of 1 to 14 days. It filters audit-mode event IDs 3076, 3034, and 8028 ("would be blocked") and enforced-mode event IDs 3077, 3033, 8029, and 8040 ("blocked"), then outputs a structured JSON report to BAC\WDAC_Reports\WDAC_Blocked_Events.json for dashboard ingestion, policy analysis, or BigFix Web Reports.
    - Remove Base or Supplemental WDAC Policy
      This deprecated task removes Windows Defender Application Control (WDAC) policies from the endpoint in one of two modes: Supplemental mode removes a single targeted supplemental policy identified by its Policy GUID from both EFI and System32 storage locations; Base mode performs a full reset by removing all existing WDAC base and supplemental policies from both locations and deploying a clean AllowAll.cip policy to prevent application blocking. A system reboot is required for changes to take effect.
    - Remove WDAC Components from Endpoint
      This deprecated task performs a complete WDAC infrastructure cleanup on the endpoint: it mounts the EFI system partition and removes the AllowAll base policy, uninstalls the Windows SDK including SignTool.exe, and deletes the entire BAC folder and its contents — fully decommissioning Windows Defender Application Control (WDAC) enforcement on the endpoint. A system reboot is required for changes to take effect.
    - View Endpoint Details in Web Reports
      This deprecated task describes how to use BigFix Web Reports to view a read-only overview of all Application Control managed endpoints. The report provides three tabs: the Managed Devices tab lists all managed endpoints with property and OS filtering and CSV export; the Policy Details tab shows the WDAC rules assigned per endpoint; and the Event Details tab displays all events executed on each endpoint.
    - AC v2.x Tasks Exit Code Reference
      This reference topic lists the exit codes for all nine deprecated BigFix Application Control v2.x tasks (201–209). Exit code 0 indicates success; non-zero codes pinpoint the specific failure stage — directory creation, certificate generation, policy processing, binary conversion, signing, EFI deployment, or policy refresh — to enable rapid diagnosis without inspecting log files.
  - FAQs
    This FAQ covers BigFix Application Control v2.x across six topic areas: product fundamentals and architecture, Base and Supplemental Policy design, WDAC policy signing and TPM key protection, Secure Boot and boot recovery, phased deployment and enforcement introduction, Code Integrity telemetry, rule level selection (Publisher, Hash, Path, and File Name), policy naming conventions, and deprecated v2.x distributed-model scenarios.
  - Troubleshooting
    This reference covers three diagnosed WDAC enforcement issues in BigFix Application Control environments: (1) AnyDesk blocked with error 0xc0e90002 (STATUS_CODE_INTEGRITY_VIOLATION) due to an untrusted Google LLC DLL extracted to the temp folder; (2) Postman displaying "Failed to extract installer" because WDAC silently blocks background child processes before the native Device Guard notification appears; and (3) an application blocked by Event ID 3077 despite an explicit allow rule, caused by a FilePublisher or FileAttrib MinimumFileVersion threshold mismatch.
  - Notices
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

Remove WDAC Components from Endpoint v2.x

This deprecated task performs a complete WDAC infrastructure cleanup on the endpoint: it mounts the EFI system partition and removes the AllowAll base policy, uninstalls the Windows SDK including SignTool.exe, and deletes the entire BAC folder and its contents — fully decommissioning Windows Defender Application Control (WDAC) enforcement on the endpoint. A system reboot is required for changes to take effect.

About this task

Important:

This task is deprecated and will be removed from BigFix Application Control v2.x in near future.

The task performs the following actions:

Mounts the EFI system partition to access the boot-level WDAC policies.
Removes the AllowAll base policy from the endpoint (EFI).
Uninstalls the SDK, including SignTool.exe.
Deletes the BAC folder from the endpoint.
Logs all operations (success, warning, failure) to the BAC\Logs\WDAC_Cleanup.log file.

Refer to the table below to know more about the task's exit code.

Table 1. Remove WDAC Components v2.0: Task Exit Codes and Meanings
Exit Code	Meaning
0	Success
30	EFI mount failure
40	Policy removal failure
50	WDAC_AllowAll.xml file not found.
60	Refresh failure
70	SDK un-installation failure

BigFix Console showing the Remove WDAC Components from Endpoint v2.0 task in the Fixlets and Tasks pane, displaying the complete WDAC decommission workflow: EFI system partition mount for boot-level policy access, AllowAll base policy removal from EFI, Windows SDK and SignTool.exe uninstallation, BAC folder deletion from the endpoint, and WDAC_Cleanup.log generation capturing all operation outcomes (success, warning, failure) with timestamps. A system reboot is required for all changes to take effect. — Figure 1. BigFix Console — Remove WDAC Components from Endpoint v2.0 Task Overview

Procedure

In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
From the Fixlets and Tasks pane, select Task: Remove WDAC Components from Endpoint v2.0.
From the Task: Remove WDAC Components from Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
Click OK.

Results

A successful execution of this task results in the following outcomes:

Removes all the associated Application Control files and folders from the endpoint.
A system reboot is required for the changes to take effect.