Set Up and Initialize WDAC on Target Endpoints

Provision the BAC client deployment environment on target Windows endpoints by deploying the required client utilities and establishing the \BFACCLIENT\BAC_CLIENT folder hierarchy under the BigFix Client installation directory. Specify the Installation Path to match the BigFix Client installation directory on target devices. Completing this task prepares target endpoints to receive, apply, and enforce WDAC policies distributed through the BigFix Custom Site.

About this task

This task (ID 356) sets up the core BigFix Application Control (BAC) client deployment environment and file structure on target endpoint devices.
The task has the following key function:
  • Environment Provisioning: Deploys necessary client utilities and establishes the \BFACCLIENT\BAC_CLIENT folder hierarchy under the BigFix Client installation directory.
Figure 1. BigFix Console — Target Endpoint WDAC Setup Initialization Task (ID 356) Overview

BigFix Console showing the Target Endpoint WDAC Setup Initialization task (ID 356) in the Fixlets and Tasks pane, displaying the task description and the Environment Provisioning function that deploys client utilities and creates the BFACCLIENT/BAC_CLIENT folder hierarchy on target Windows endpoints.

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Target Endpoint - WDAC Setup Initialization.
  3. From the Task: Target Endpoint - WDAC Setup Initialization pane, under BAC Client Environment Setup, enter the following.
    Figure 2. Target Endpoint WDAC Setup Initialization — Configuration Options: Installation Path

    Target Endpoint WDAC Setup Initialization task — Configuration Options panel in the BigFix Console, showing the Installation Path input field for specifying the BigFix Client installation directory where the BFACCLIENT/BAC_CLIENT folder hierarchy and client utilities will be provisioned on target Windows endpoints. The field accepts the full path to the BigFix Client installation directory and defaults to the standard BigFix Client installation path if left blank.
    Table 1. Target Endpoint Setup — Configuration Options Field Descriptions
    Field Name Description
    Installation Path The full path to the BigFix Client installation directory on target endpoints — the root under which the task creates the \BFACCLIENT\BAC_CLIENT folder hierarchy and deploys client utilities. Defaults to the standard BigFix Client installation path (C:\Program Files (x86)\BigFix Enterprise\BES Client) if left blank. Override this field only if the BigFix Client was installed to a non-default path on the target endpoints.
  4. From the Task: Target Endpoint - WDAC Setup Initialization pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.

Results

A successful execution of this task produces the following outcomes on each target endpoint:

  • BAC_CLIENT folder hierarchy created: The \BFACCLIENT\BAC_CLIENT folder structure is created under the BigFix Client installation directory on the target endpoint, establishing the on-device working directory for all subsequent WDAC policy operations.
  • Client utilities deployed: The required BigFix Application Control client utilities are extracted and placed in the BAC_CLIENT directory, enabling the endpoint to receive, apply, and refresh WDAC policies distributed through the BigFix Custom Site.
  • Endpoint ready for policy deployment: The target endpoint is now prepared to receive its first WDAC policy. Proceed to Deploy and Refresh WDAC Policies on Target Endpoints (Task ID 357, step 7) to push the compiled and signed Base policy from the BigFix Custom Site to initialized endpoints.
Tip:
Run this task against all target endpoints before beginning policy deployment. Endpoints that have not completed this initialization step will not have the BAC_CLIENT folder structure in place and will fail to apply policies distributed by Task ID 357.