Create and Manage WDAC Policies on the WDAC Management Node

Create and manage WDAC Base and Supplemental policy XML files on the dedicated WDAC Management Node (BAC_MGMT) directly from the BigFix® Console. The Create Policies workflow guides you through three sequential steps — configuration inputs, rule options, and custom parameter rules. Use the Purge Supplemental Policy Rules workflow to remove specific rules from existing Supplemental policies, and the Add / Remove Signer workflow to inject or strip code-signing certificates from Base or Supplemental policy XML files.

Before you begin

Requires Task 353 (Provision the TPM-Enforced WDAC Policy Signing Certificate on the WDAC Management Node) to be completed on the BAC_MGMT Management Node beforehand. The TPM-bound signing certificate must be provisioned before policies can be authored and signed.

About this task

This task (ID 354) interactively generates WDAC Base/Supplemental policies or purge rules from existing Supplemental Policies directly from the BigFix Console.
  • Create Policies: Build new XML Base or Supplemental policies from templates, configure rule options, and define custom rule parameters (Path, Hash, Publisher, COM, Package, File Attributes).
  • Purge Supplemental Policy Rules: Remove specific rule ID values or hashes from an existing Supplemental Policy XML and output a cleaned, updated policy XML file.
  • Add / Remove Signer: Strip specified Signer IDs from existing Base or Supplemental policies and inject update or supplemental signing certificates (.cer) for secure policy deployment.
Naming Requirements:
Base policies must start with Base_ | Supplemental Policies must start with Supp_GRPNAME.
Refer to the table below to know more about the task's exit code.
Table 1. Task Exit Code Reference: Policy Management Failure Codes
Exit Code Description
20 Primary Add Signer Certificate (.cer) not found.
21 Emergency Signer Certificate (.cer) not found.
22 Targeted Base Policy XML not found.
23 Targeted Supplemental Policy XML not found.
24 Binary Executable (.exe) path not found.
33 Certificate RSA key sizes greater than 4096 bits.
34 Rule Id/Signer Id not found.
Figure 1. BigFix Console — WDAC Management Node Policy Management Task (ID 354) Overview

BigFix Console showing the WDAC Management Node Policy Management task (ID 354) overview in the Fixlets and Tasks pane, displaying the Create Policies three-step workflow and the Purge Supplemental Policy Rules section for WDAC policy authoring on the BAC_MGMT Management Node.

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select WDAC Management Node - Policy Management.
  3. From the WDAC Management Node - Policy Management pane, under Create Policies, enter the following.
    1. Navigate to the first tab Create Policies > Step 1: Configuration Inputs to configure its options.
      Figure 2. Create Policies — Step 1: Configuration Inputs

      WDAC Management Node Policy Management task — Create Policies Step 1: Configuration Inputs panel, showing fields for Action, Select Base Policy Template, Policy Folder Path, Policy Name, Add Signer (.cer path), and Add Emergency Signer (.cer path).
      Table 2. Create Policies Step 1: Configuration Inputs — Field Descriptions
      Field Name Description
      Action Selects the policy creation workflow: Create Base Policy or Create Supplemental Policy. Base policies define the primary trust boundary for a set of endpoints; Supplemental policies extend a Base policy with group-specific allow or deny rules. The selection determines which naming requirements and template options apply.
      Select Base Policy Template The Microsoft-provided WDAC policy template to use as the starting point. Templates define the initial set of trusted signers and default rule options. Common options include Default Windows (allows Windows-signed binaries only), Allow Microsoft (allows Microsoft-signed and WHQL-signed binaries), and Windows Audit (broad trust in audit mode). Choose based on the intended enforcement level for the target endpoints.
      Policy Folder Path The directory on the WDAC Management Node where the generated policy XML file is written. Defaults to the BAC_MGMT\Policies\ directory. Ensure the path exists and is writable by the BigFix Client service account before running the task.
      Policy Name The name of the output policy XML file, without the .xml extension. Naming is enforced: Base policy names must start with Base_ (for example, Base_Production); Supplemental policy names must start with Supp_GRPNAME, where GRPNAME is the target endpoint group identifier (for example, Supp_FinanceGroup). The task rejects names that do not conform to these conventions.
      Add Signer (.cer) The full path to the primary code-signing certificate (.cer file) on the WDAC Management Node — typically the TPM-bound signing certificate provisioned in Task 353. The certificate is added as a trusted Signer in the generated policy, authorizing files signed by this certificate to run on target endpoints.
      Add Emergency Signer (.cer) The full path to an optional backup or emergency code-signing certificate (.cer file). Adding an emergency signer provides a fallback signing authority if the primary certificate becomes unavailable, preventing a policy-signing outage. Leave blank if no emergency signer is required.
    2. Navigate to the second tab Create Policies > Step 2: Rule Options to select the appropriate check box options for your plan.
      Figure 3. Create Policies — Step 2: Rule Options

      WDAC Management Node Policy Management task — Create Policies Step 2: Rule Options panel, showing the 16 WDAC policy rule flag checkboxes including Enabled: UMCI, Enabled: Audit Mode, Enabled: Intelligent Security Graph Authorization, Enabled: Managed Installer, Disabled: Script Enforcement, and Enabled: Dynamic Code Security.
      Table 3. Create Policies Step 2: Rule Options — WDAC Policy Rule Flag Descriptions
      Checkbox Name Description
      Enabled: UMCI Enables User Mode Code Integrity enforcement. When selected, WDAC policy rules apply to all user-mode processes, not only kernel drivers. Required for full application control on managed Windows endpoints.
      Enabled: Audit Mode Runs the policy in monitoring mode rather than enforcement mode. Policy violations are logged to the Windows Event Log (event IDs 3076/3077) but code execution is not blocked. Select this option to baseline a new policy on endpoints before switching to enforcement.
      Disabled: Flight Signing This option is disabled by default in Application Control v2.x because it requires Microsoft™ platform validation.
      Enabled: Unsigned System Integrity Policy Allows this policy XML to be deployed without a cryptographic signature. When cleared, the policy must be signed with a trusted certificate before deployment. Not recommended for production environments — clear this option and sign all policies for security.
      Enabled: Update Policy No Reboot Allows policy updates to take effect at the next refresh cycle without requiring a system reboot. When cleared, policy changes require a reboot to take effect. Select for environments where minimizing downtime during policy updates is a priority.
      Enabled: Advanced Boot Menu Options This option is disabled by default in Application Control v2.x because it requires Microsoft™ platform validation.
      Enabled: Allow Supplemental Policies Allows this Base policy to be extended by Supplemental policies deployed from the BigFix Custom Site. Must be selected on any Base policy that will be paired with group-specific Supplemental policies. Has no effect on Supplemental policies themselves.
      Disabled: Runtime FilePath Rule Protection Disables Windows protection against runtime bypass of file path rules (for example, via symbolic link or junction attacks). Select only when path-based rules are required and the reduced security of unprotected path rules is an accepted trade-off.
      Enabled: Revoked Expired as Unsigned Treats binaries signed with revoked or expired certificates as unsigned rather than categorically denying them. When selected, such binaries are evaluated against unsigned-code rules rather than being blocked outright.
      Required: WHQL This option is disabled by default in Application Control v2.x as this option is kernel-based but BigFix Application Control v2.x works in user mode.
      Enabled: Intelligent Security Graph Authorization This option is disabled by default in Application Control v2.x as this option is kernel-based but BigFix Application Control v2.x works in user mode.
      Enabled: Managed Installer This option is disabled by default in Application Control v2.x as this option is kernel-based but BigFix Application Control v2.x works in user mode.
      Disabled: Script Enforcement Disables WDAC enforcement for scripting hosts (PowerShell, VBScript, JScript, WSH). When selected, scripts run without policy checks. Select during initial deployment phases where script-heavy workloads are not yet covered by policy rules; clear in production to enforce full code integrity.
      Required: Enforce Store Applications This option is disabled by default in Application Control v2.x because it requires Microsoft™ platform validation.
      Enabled: Boot Audit On Failure Switches the policy to audit mode at boot if the policy fails to load normally, rather than blocking the system. Prevents boot failures caused by policy load errors. Recommended for initial policy deployments on production endpoints.
      Enabled: Dynamic Code Security This option is disabled by default in Application Control v2.x because it requires Microsoft™ platform validation and also as this option is kernel-based but BigFix Application Control v2.x works in user-mode.
      To know more about the Rule Options, refer to Understand App Control for Business policy rules and file rules.
    3. Navigate to the third tab Create Policies > Step 3: Custom Parameter Rules to configure its options.
      Figure 4. Create Policies — Step 3: Custom Parameter Rules

      WDAC Management Node Policy Management task — Create Policies Step 3: Custom Parameter Rules panel, showing the Rule Type, Permission, and Path Details fields for defining path-based, publisher-based, or file hash-based WDAC allow or deny rules.
      Table 4. Create Policies Step 3: Custom Parameter Rules — Field Descriptions
      Field Name Description
      Rule Type The type of custom rule to add to the policy: Path (allow or deny by file system path, with wildcard support), Publisher (allow or deny by code-signing certificate subject name, covering all versions from that publisher), or File Hash (allow or deny by SHA-256 cryptographic hash of a specific file version). Hash rules are the most precise but require updates when file content changes; Publisher rules are broader but automatically cover future versions from the same signer.
      Permission Whether the rule grants or blocks execution: Allow (the specified file, path, or publisher is trusted and permitted to run) or Deny (explicitly blocked, regardless of other allow rules). Deny rules take precedence over Allow rules in WDAC policy evaluation.
      Path Details The input value for the selected rule type: a file system path for Path rules (for example, C:\Program Files\MyApp\*), a publisher certificate subject name for Publisher rules, or a SHA-256 hash value for File Hash rules. For Path rules, environment variable substitutions and wildcards (*) are supported. For Hash rules, use Get-AppLockerFileInformation or Get-SystemDriver to obtain the correct hash value.
  4. From the WDAC Management Node - Policy Management pane, under Purge Supplemental Policy Rules, enter the following.
    Figure 5. Purge Supplemental Policy Rules — Configuration Fields Overview

    WDAC Management Node Policy Management task — Purge Supplemental Policy Rules section showing the full task pane for removing specific rule IDs or hashes from an existing Supplemental policy, with input fields for the Base Policy, Supplemental Policy To Be Changed, and Output Supplemental Policy Name.
    Table 5. Purge Supplemental Policy Rules — Field Descriptions
    Field Name Description
    Base Policy (.xml) The full path to the Base Policy XML file associated with the Supplemental policy being purged. The task uses the Base Policy to validate that the purged output remains a valid child policy. The Base Policy file must already exist in the Policy Folder Path on the WDAC Management Node.
    Supplemental Policy To Be Changed The file name (or full path) of the existing Supplemental Policy XML from which specific rules are to be removed. The task reads this file, removes the specified rule IDs or hashes, and writes the cleaned policy to a new output file. The original Supplemental Policy XML is not modified.
    Output Supplemental Policy Name The name for the new, cleaned Supplemental Policy XML output file, without the .xml extension. Must follow the Supp_GRPNAME naming convention. The task writes the purged policy to this filename in the Policy Folder Path on the WDAC Management Node.
  5. From the WDAC Management Node - Policy Management pane, under Add / Remove Signer, select either the Add Signer or Remove Signer radio option.
    Figure 6. Add / Remove Signer — Action Selection and Configuration Overview

    WDAC Management Node Policy Management task — Add / Remove Signer section showing the radio selection between Add Signer and Remove Signer options, with configuration fields for the target policy and signing certificate or Signer ID to modify.
    1. For the Add Signer option, enter the following options.
      Table 6. Add Signer — Policy and Certificate Field Descriptions
      Field Name Description
      Policy To Be Changed (.xml) The full path to the Base or Supplemental Policy XML file into which the signing certificate will be injected. The task adds the specified certificate as a new trusted Signer element in the policy XML. The updated policy must be re-compiled and re-published to apply the change to target endpoints.
      Base Policy (.xml) The full path to the parent Base Policy XML file. Required when the target policy is a Supplemental policy, to validate that the new signer is consistent with the Base Policy's trust chain. When modifying a Base policy directly, this field references the Base policy being changed.
      Add Signer (.cer) The full path to the signing certificate (.cer file) to inject into the target policy. The certificate's subject name and public key are added as a new Signer element, authorizing files signed by this certificate to run on endpoints where the policy is deployed.
    2. For the Remove Signer option, enter the following options.
      Figure 7. Add / Remove Signer — Remove Signer Configuration Fields

      WDAC Management Node Policy Management task — Remove Signer configuration panel showing the Policy To Be Changed (.xml), Base Policy (.xml), and Signer ID To Remove input fields for stripping a Signer element from a Base or Supplemental WDAC policy XML.
      Table 7. Remove Signer — Policy and Signer ID Field Descriptions
      Field Name Description
      Policy To Be Changed (.xml) The full path to the Base or Supplemental Policy XML file from which the specified Signer ID will be stripped. The task removes the matching Signer element from the policy XML. The updated policy must be re-compiled and re-published to revoke trust from the removed signer on target endpoints.
      Base Policy (.xml) The full path to the parent Base Policy XML file. Used to validate that removing the signer does not break the policy's trust chain. Required when the target policy is a Supplemental policy.
      Signer ID To Remove The Signer ID value to strip from the target policy XML, for example ID_SIGNER_A_1. Signer IDs are found in the policy XML under the <Signers> element. Use a text editor or run Get-CIPolicy -FilePath <policy.xml> in PowerShell to identify the correct Signer ID before running this operation.
  6. From the WDAC Management Node - Policy Management pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  7. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  8. Click OK.

Results

The outcome of a successful execution depends on the selected workflow:

  • Create Base Policy: A new WDAC Base Policy XML file is written to the Policy Folder Path using the selected template, the configured rule options, and any custom parameter rules. The file is named with the Base_ prefix and is ready for compilation, signing, and publication in the next deployment step.
  • Create Supplemental Policy: A new WDAC Supplemental Policy XML file is written to the Policy Folder Path, linked to the parent Base Policy. The file is named with the Supp_GRPNAME prefix and contains the group-specific allow or deny rules defined in Step 3.
  • Purge Supplemental Policy Rules: A new, cleaned Supplemental Policy XML is written using the Output Supplemental Policy Name. The specified rule IDs or hashes are removed from the output policy. The original Supplemental Policy XML is not modified.
  • Add Signer: The specified signing certificate is injected into the target policy XML as a new trusted Signer element. The updated policy trusts files signed by the added certificate. Re-compile and re-publish the policy to apply the change to target endpoints.
  • Remove Signer: The specified Signer ID is stripped from the target policy XML. The updated policy no longer trusts files signed by the removed signer. Re-compile and re-publish the policy to apply the change to target endpoints.

All output policy XML files are written to the Policy Folder Path on the WDAC Management Node. Proceed to Compile, Sign, and Publish WDAC Policies from the WDAC Management Node to compile, sign with the TPM certificate, and publish the updated policies to the BigFix Custom Site for endpoint deployment.