Standard WDAC Policy Removal and Retirement Procedure

Retire active WDAC policies using a controlled two-stage sequence that neutralizes the policy's enforcement state before removing its artifacts from disk. This in-band procedure maintains endpoint execution continuity throughout the planned policy retirement lifecycle.

Overview

Standard policy retirement is an in-band administrative workflow performed through a BigFix® Fixlet or Task while Windows and the BigFix Agent are fully operational. The procedure follows the Microsoft App Control Removal Specifications and is designed around a deliberate two-stage sequence:

  • Stage 1 – Policy State Neutralization: Deactivate the policy's enforcement state before touching any artifacts on disk.
  • Stage 2 – Policy Artifact Removal: Delete the compiled policy binary (.cip) from all active policy storage locations and restart the endpoint to clear the policy state from system memory.

The appropriate Stage 1 workflow depends on the policy type being retired — signed Base policies and Supplemental policies follow different paths.

Stage 1, Option A — Signed Base Policy Replacement (Recommended)

For a signed Base Policy, deploy a signed replacement policy before removing any policy artifacts from disk. The replacement policy must meet all of the following requirements.

Policy ID and Version Alignment
The replacement policy must use the exact same PolicyID as the active policy and specify a version equal to or greater than the active policy (VersionEx).
Policy Configuration
Configure the replacement policy as an effectively inactive policy: use Allow * rules for files, allow all COM objects, enable Option 3 (Enabled:Audit Mode) and Option 11 (Disabled:Script Enforcement), include Option 6 (Enabled:Unsigned System Integrity Policy), and remove Option 0 (Enabled:UMCI) where applicable. This configuration is consistent with Microsoft's policy removal guidance.
Signer Continuity and Transitioning

The replacement policy must contain <UpdatePolicySigners> and be signed by a certificate already trusted by the active policy.

If transitioning to a new signer, first update the active policy — using an existing trusted signer — to authorize the new certificate in its <UpdatePolicySigners> block. The replacement policy can then be signed directly with the newly authorized certificate.

Mandatory Endpoint Restart
After deploying the replacement policy, restart the endpoint so that UEFI protection associated with the original signed policy is deactivated before proceeding to Stage 2.
Warning:
Do not remove the original policy artifacts before restarting the endpoint after deploying the replacement policy. Failing to restart first — while UEFI protection for the original signed policy is still active — will result in a boot-start failure (BSOD).

Stage 1, Option B — Supplemental Policy Removal

For a Supplemental Policy — signed or unsigned — the signed Base Policy replacement workflow is not required. Microsoft explicitly states that signed Supplemental Policies can be removed in the same manner as unsigned policies, without requiring the signed Base Policy replacement procedure or UEFI deactivation sequence.

  1. Disable the mechanism used to deploy the Supplemental Policy from BigFix® or your management tool to prevent automatic redeployment.
  2. Proceed directly to Stage 2 for artifact removal.

Stage 2 — Policy Artifact Removal

Once Stage 1 is complete — or immediately for Option B Supplemental Policies — remove the targeted .cip policy file from all active policy storage locations:

  • %OSDrive%\Windows\System32\CodeIntegrity\CiPolicies\Active\{PolicyId}.cip
  • <EFI System Partition>\Microsoft\Boot\CiPolicies\Active\{PolicyId}.cip

After deleting the policy artifacts from both locations, restart the endpoint to complete policy removal and clear the policy state from system memory.

Operational Safety and Execution Continuity

The two-stage retirement sequence intentionally separates policy state neutralization from policy artifact removal. This design ensures continuous execution continuity for critical services — including the BigFix® Agent and core operating system processes — throughout the planned policy retirement lifecycle. Because this is an in-band workflow executed while the operating system remains fully operational, the BigFix Agent remains reachable and responsive at every stage of the procedure.