Deploy and Refresh WDAC Policies on Target Endpoints

Fetch signed .cip.p7 WDAC policy files from the BigFix Custom Site, parse policy GUIDs from file manifests, stage binary policies into the Active CodeIntegrity directory (and EFI partition for UEFI systems), and trigger RefreshPolicy.exe to enforce the new policies immediately — without requiring a system reboot. Before running, ensure the target endpoint has been initialized by Task ID 356 and that the policy has been compiled and published by Task ID 355. For Supplemental policies, the parent Base policy must already be present in the \BAC_CLIENT\Deployed folder on each target endpoint.

About this task

This task (ID 357) performs the deployment, GUID parsing, active staging, and live enforcement refresh of compiled WDAC binary policies on target endpoint machines.
The task applies the following enforcement matrix when determining whether a policy can be deployed:
  • Base Policy Branch (Base_*)
    • Case A (Clean State): \Deployed folder is empty AND no active .cip files exist in System32/EFI. Application Control v2.x can proceed to enforce it.
    • Case B (Valid Overwrite): Matching policy XML exists in \Deployed AND matching GUID exists in System32 & EFI. Application Control v2.x can proceed to enforce it.
    • Case C (Conflict): Active policies present that do not match requested GUID. Application Control v2.x will reject deployment with exit code 25.
  • Supplemental Policy Branch (Supp_*)
    • Prerequisite Check: Parent Base Policy (Base_*) must exist in \BAC_CLIENT\Deployed folder.
    • If the PASS Parent policy is confirmed then Application Control v2.x can proceed to enforce it.
    • If the PASS Missing Parent base policy is confirmed then Application Control v2.x will reject deployment with exit code 25.
Figure 1. BigFix Console — Target Endpoint WDAC Policy Deployment and Refresh Task (ID 357) Overview

BigFix Console showing the Target Endpoint WDAC Policy Deployment and Refresh task (ID 357) in the Fixlets and Tasks pane, displaying the three key workflow functions: Custom Site Resolution fetching signed .cip.p7 files, GUID Parsing and Active Staging into the CiPolicies Active directory, and Live Enforcement Refresh via RefreshPolicy.exe without a system reboot. The enforcement matrix shows Base policy deployment cases (clean state, valid overwrite, GUID conflict) and Supplemental policy parent Base prerequisite checks.

Procedure

  1. In the BigFix® Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Target Endpoint - WDAC Policy Deployment and Refresh.
  3. From the Task: Target Endpoint - WDAC Policy Deployment and Refresh pane, under WDAC Policy Deployment Configuration, enter the following.
    Figure 2. WDAC Policy Deployment and Refresh — Configuration Options

    Target Endpoint WDAC Policy Deployment and Refresh task — Configuration Options panel in the BigFix Console, showing three input fields: Site Prefix (for resolving the CustomSite_SitePrefix_Policies_Deployed Custom Site), Policy File Name (.xml) for specifying the WDAC policy to fetch and stage, and Base Policy Name (.xml) required when deploying a Supplemental policy to confirm the parent Base policy exists on the target endpoint.
    Table 1. WDAC Policy Deployment and Refresh — Configuration Options Field Descriptions
    Field Name Description
    Site Prefix The name prefix of the BigFix Custom Site from which signed .cip.p7 policy archives are fetched. The task constructs the full Custom Site name as CustomSite_<SitePrefix>_Policies_Deployed. Enter the site prefix exactly as configured when the BigFix Application Control Custom Site was set up — the value is case-sensitive.
    Policy File Name (.xml) The filename of the WDAC policy to deploy, without the .xml extension. Must match a policy that was compiled, signed, and published to the BigFix Custom Site by Task 355. For Base policies the name must start with Base_; for Supplemental policies it must start with Supp_. The task uses this name to locate the corresponding .cip.p7 signed binary in the Custom Site.
    Base Policy Name (.xml) The filename of the parent Base policy, without the .xml extension. Required only when deploying a Supplemental policy — the task verifies that the specified Base policy already exists in the \BAC_CLIENT\Deployed folder on the target endpoint before proceeding. Leave blank when deploying a Base policy directly.
  4. From the Task: Target Endpoint - WDAC Policy Deployment and Refresh pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply on this task.
  6. Click OK.

Results

A successful execution of this task produces the following outcomes on each target endpoint:

  • Policy archive fetched from Custom Site: The signed .cip.p7 policy archive is downloaded from the CustomSite_<SitePrefix>_Policies_Deployed Custom Site to the \BFACCLIENT\BAC_CLIENT\Temp staging directory on the target endpoint.
  • Policy GUID parsed and enforcement matrix evaluated: The policy GUID is extracted from the file manifest and validated against the enforcement matrix — confirming either a clean-state deployment (Case A), a valid same-GUID overwrite (Case B), or detecting a conflicting GUID (Case C, exit code 25). For Supplemental policies, the parent Base policy prerequisite in \BAC_CLIENT\Deployed is verified before proceeding.
  • Binary policy staged to Active CodeIntegrity: The compiled .cip binary is copied to System32\CodeIntegrity\CiPolicies\Active. On UEFI systems, the binary is also written to the EFI partition (EFI\Microsoft\Boot\CiPolicies\Active) to ensure enforcement persists across Secure Boot.
  • Policy record written to Deployed folder: The policy XML and metadata are recorded in the \BAC_CLIENT\Deployed folder, enabling future Supplemental policy deployments to validate the parent Base policy prerequisite.
  • Live enforcement activated without reboot: RefreshPolicy.exe is invoked to signal the Windows kernel to load and apply the newly staged policy immediately. WDAC enforcement begins on the target endpoint without requiring a system reboot.
Important:
If the task exits with code 25, either a conflicting Base policy GUID is already active on the endpoint (Case C — remove the existing Base policy before deploying a new one) or the required parent Base policy is missing from \BAC_CLIENT\Deployed (Supplemental policy prerequisite check failed — deploy the parent Base policy first using this task, then re-run for the Supplemental policy).