Remove Base or Supplemental WDAC Policy from Endpoint v2.x

This deprecated task removes Windows Defender Application Control (WDAC) policies from the endpoint in one of two modes: Supplemental mode removes a single targeted supplemental policy identified by its Policy GUID from both EFI and System32 storage locations; Base mode performs a full reset by removing all existing WDAC base and supplemental policies from both locations and deploying a clean AllowAll.cip policy to prevent application blocking. A system reboot is required for changes to take effect.

About this task

Important:
This task is deprecated and will be removed from BigFix Application Control v2.x in near future.
The task performs the following actions:
  • Mounts the EFI system partition to access the boot-level WDAC policies.
  • Supports the following two operational modes:
    • Supplemental Mode: Removes a specific WDAC supplemental policy using the provided Policy GUID.
    • Base Mode:
      • Removes all the existing WDAC policies (base as well as supplemental) from System and EFI locations.
      • Deploys a clean AllowAll policy to ensure no application blocking exists.
      • Ensures only AllowAll.cip exists post this task execution.
  • Handles both the WDAC storage locations:
    • C:\Windows\System32\CodeIntegrity
    • EFI\Microsoft\Boot
  • Removes legacy single-policy files (like SiPolicy.p7b) if present.
  • Converts the AllowAll.xml to binary *.cip and deploys it to the active policy locations.
  • Logs all the operations (success, warning, failure) in the BAC\Logs\WDAC_Policy_Removal.log file.
Refer to the table below to know more about the task's exit code.
Table 1. Remove Base or Supplemental WDAC Policy v2.0: Task Exit Codes and Meanings
Exit Code Meaning
0 Success
10 Invalid input parameters
20 BAC path not found
30 EFI mount failure
40 Policy removal failure
50 AllowAll.xml not found
60 AllowAll deployment failure
Figure 1. BigFix Console — Remove Base or Supplemental WDAC Policy from Endpoint v2.0 Task Overview

BigFix Console showing the Remove Base or Supplemental WDAC Policy from Endpoint v2.0 task in the Fixlets and Tasks pane, displaying the task workflow: EFI system partition mount for boot-level policy access, two operational modes (Supplemental mode using a Policy GUID to remove a single targeted supplemental policy, and Base mode removing all WDAC policies from both System32\CodeIntegrity and EFI\Microsoft\Boot locations and deploying AllowAll.cip for a clean no-blocking state), legacy SiPolicy.p7b removal, AllowAll.xml to binary CIP conversion, and WDAC_Policy_Removal log writing.

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Remove (Base/Supplemental) Policy from Endpoint v2.0.
  3. From the Task: Remove (Base/Supplemental) Policy from Endpoint v2.0 pane, under Configuration Options, enter the following information:
    Figure 2. BigFix Console — Remove Base or Supplemental WDAC Policy v2.0: Configuration Options Panel Showing Policy Type and PolicyId Input Fields

    BigFix Console showing the Configuration Options panel for the Remove Base or Supplemental WDAC Policy from Endpoint v2.0 task, with the Policy Type selector (Base or Supplemental) and the PolicyId GUID field that is required only when Supplemental is selected to identify the specific supplemental policy to remove from the System32\CodeIntegrity and EFI\Microsoft\Boot WDAC storage locations.
    Table 2. Remove Base or Supplemental WDAC Policy v2.0: Configuration Options Parameter Descriptions
    Field Name Options Description
    Policy Type Base Performs full reset and deploys AllowAll (default).
    Supplemental Removes only a specific supplemental policy.
    PolicyId Required only when the policy type is Supplemental. Specifies the GUID of the policy to be removed.
  4. From the Task: Remove (Base/Supplemental) Policy from Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.

Results

A successful execution of this task results in the following outcomes:
  • In Supplemental mode, only the specified policy is removed.
  • In Base mode, all WDAC policies are removed and replaced with AllowAll.
  • System remains stable with a valid WDAC configuration.
  • A system reboot is required for changes to take effect.