Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control 2.x
BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
WDAC Policy Event ID Reference
Reference table of WDAC Code Integrity and App Control event IDs covering audit-mode and enforcement-mode events for binaries, scripts, packaged applications, and signature validation failures — used to identify blocked or audited application files on managed Windows endpoints.

BigFix Documentation Homepage
BigFix 10 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
  - Overview
    Application Control v2.x is a centralized application control solution that uses Windows Defender Application Control (WDAC) to enforce kernel-level application allowlisting across Windows endpoints in a BigFix-managed enterprise. It centralizes all policy authoring, signing, and deployment on a dedicated WDAC Management Node, and is administered entirely through the BigFix Console with full RBAC governance and compliance reporting.
  - What's New in This Release
    BigFix Application Control v2.x introduces a robust, secure foundation for Windows Defender Application Control (WDAC) management on enterprise Windows endpoints. Key capabilities include WDAC Base and Supplemental Policy Deployment via BigFix Fixlets, Centralized Policy Management from the BigFix Console with publisher, file hash, file name, and file path rules, Blocked Application Reporting in Audit and Enforcement modes, Active Policy Monitoring, Deployment Status Monitoring, and no-reboot policy activation for both Base and Supplemental policies.
  - Previous Releases
    BigFix Application Control v2.x introduced WDAC-based policy management including Base and Supplemental Policy Deployment, Centralized Policy Management from the BigFix Console, Blocked Application Reporting, and no-reboot policy activation. BigFix Application Control v1.0.0 introduced native application allow/block rule enforcement, real-time block notifications, bulk CSV ruleset management, and a ServiceNow exception request workflow.
  - User Personas
    Application Control defines four user personas — Security Administrator, IT Administrator, SOC Analyst, and End User — each with distinct responsibilities for authoring policies, deploying them to endpoints, monitoring enforcement events, and managing application exceptions within a BigFix-managed enterprise environment.
  - System Architecture
    The system architecture of Application Control v2.x introduces a centralized WDAC Integration Model in which all policy authoring, compilation, signing, and publication are consolidated on a dedicated WDAC Management Node. This topic describes the current v2.x architecture components, the end-to-end policy lifecycle, and contrasts it with the deprecated distributed architecture.
  - WDAC Rule Types and Use Cases
    BigFix Application Control supports six WDAC rule types — Publisher, Hash, File Path, File Attributes, Package/PFN, and COM — each suited to a different application identification method and control objective. This topic describes when to use each rule type, the benefits it provides, and illustrative example scenarios to guide rule selection in enterprise environments.
  - Application Control v2.x Best Practices
    Guidance for deploying and managing WDAC policies through BigFix® Application Control 2.x — covering core validation principles, policy naming and overwrite behavior, change tracking recommendations, dual-node emergency signing and certificate rotation, co-located management node constraints, and the recommended rule validation workflow for onboarding new applications.
  - WDAC Policy Event ID Reference
    Reference table of WDAC Code Integrity and App Control event IDs covering audit-mode and enforcement-mode events for binaries, scripts, packaged applications, and signature validation failures — used to identify blocked or audited application files on managed Windows endpoints.
  - WDAC Limitations
    BigFix Application Control deployments are subject to known Windows Defender Application Control (WDAC) / App Control for Business limitations documented by Microsoft. This reference covers platform and version requirements, policy structure constraints, signed-policy signing rules, Memory Integrity (HVCI) interactions, and Smart App Control conflicts — each with an impact assessment and a Microsoft documentation reference.
  - BitLocker Key Requirements
    On BitLocker-encrypted endpoints, disabling UEFI Secure Boot alters the TPM platform integrity measurement and may trigger a BitLocker recovery key prompt. Have the 48-digit BitLocker Recovery Key available before beginning any WDAC recovery procedure, and be prepared to temporarily suspend BitLocker protection during boot configuration changes.
  - Policy Removal and Retirement
    Retire active WDAC policies using a controlled two-stage sequence that neutralizes the policy's enforcement state before removing its artifacts from disk. This in-band procedure maintains endpoint execution continuity throughout the planned policy retirement lifecycle.
  - Boot-Stop Failure and Emergency Recovery
    An App Control policy that blocks a boot-critical driver or core system component causes a boot-stop failure (BSOD) and prevents Windows from starting. When standard in-band recovery is not possible, administrators must use out-of-band firmware-level procedures to regain file-system access, remove problematic policy artifacts, and restore a secure boot posture.
  - Behavior Considerations
    BigFix Application Control v2.x enforces application execution through a defined set of behavioral rules governing Base and Supplemental Policy interaction, explicit Deny rule precedence, multiple Base Policy evaluation (logical AND), script enforcement under UMCI, FilePath rule security, signed policy protection, application dependency enforcement, and signing certificate requirements. Understanding these 16 behaviors is essential before designing, deploying, or updating Application Control policies in BigFix-managed environments.
  - Administering v2.x
    This chapter covers the 11 administrator tasks required to deploy and operate BigFix Application Control v2.x using the centralized WDAC Management Node model — from Root Server installation, WDAC Management Node configuration, and TPM-backed certificate provisioning through policy authoring, compilation, signing, endpoint deployment, policy review, and full component removal.
  - Deprecated Fixlets and Tasks
    This topic lists ten deprecated BigFix Application Control v2.0.0 Fixlets and Tasks that are scheduled for removal in a future release. The deprecated tasks cover self-signed certificate setup and renewal, Microsoft default and custom WDAC base policy deployment, supplemental policy deployment, certificate thumbprint refresh, BAC folder ACL enforcement, blocked WDAC event log generation, base and supplemental policy removal, and full WDAC component removal. Use the current administration tasks in Lifecycle/Application_Control/ACv2.0.0/administrating_ac_v2.1.0.html instead.
  - FAQs
    This FAQ covers BigFix Application Control v2.x across six topic areas: product fundamentals and architecture, Base and Supplemental Policy design, WDAC policy signing and TPM key protection, Secure Boot and boot recovery, phased deployment and enforcement introduction, Code Integrity telemetry, rule level selection (Publisher, Hash, Path, and File Name), policy naming conventions, and deprecated v2.x distributed-model scenarios.
  - Troubleshooting
    This reference covers three diagnosed WDAC enforcement issues in BigFix Application Control environments: (1) AnyDesk blocked with error 0xc0e90002 (STATUS_CODE_INTEGRITY_VIOLATION) due to an untrusted Google LLC DLL extracted to the temp folder; (2) Postman displaying "Failed to extract installer" because WDAC silently blocks background child processes before the native Device Guard notification appears; and (3) an application blocked by Event ID 3077 despite an explicit allow rule, caused by a FilePublisher or FileAttrib MinimumFileVersion threshold mismatch.
  - Notices
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

WDAC Code Integrity and App Control Event ID Reference

Reference table of WDAC Code Integrity and App Control event IDs covering audit-mode and enforcement-mode events for binaries, scripts, packaged applications, and signature validation failures — used to identify blocked or audited application files on managed Windows endpoints.

The following table lists the WDAC Code Integrity and App Control event IDs that appear in the Windows Event Log when a policy is active in Audit Mode or Enforcement Mode. For each event type, the table identifies the audit-mode event ID (the file would have been blocked), the enforcement-mode event ID (the file was blocked), the target file scope, and a description of the event. Use these event IDs to identify audited or blocked application files when reviewing event data collected through BigFix® Web Reports or the Application Control reporting mechanism.

Note:

Event 8040 has no audit-mode equivalent. Packaged application blocks (MSIX, AppX) are only surfaced as enforcement-mode events and are not visible in Audit Mode event logs.

Table 1. WDAC Code Integrity and App Control Event IDs — Audit Mode and Enforcement Mode
Audit Event	Enforced Event	Target Scope	Description
3076	3077	Binaries (.exe, .dll, .sys)	Main App Control file evaluation event. 3076 indicates that the file would have been blocked if the policy were enforced; 3077 indicates that the file was blocked by the enforced policy.
8028	8029	Scripts & Installers (.ps1, .msi)	App Control evaluation events for scripts and MSI installers. 8028 indicates that the file would have been blocked if the policy were enforced; 8029 indicates that the file was blocked by the enforced policy.
—	8040	Packaged Apps (MSIX, AppX)	Indicates that a packaged application was blocked by the App Control policy.
3034	3033	Code Integrity / Signature Validation	Indicates that the file under validation did not meet the requirements to pass Code Integrity/App Control. 3033 indicates an enforced failure, while 3034 is the audit-mode equivalent. The event identifies the validation failure, but the specific cause should be investigated using the associated Code Integrity and signature information, particularly Event 3089, together with the applicable policy and signing details.
3099	3099	App Control Policy Information	Provides information about the App Control policy processed by the system, including the Policy ID, which can be used to identify the policy processed.