Migrate from BigFix Application Control v1.0.0 to v2.x

Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.

About this task

As BigFix Application Control v2.x is the only currently supported version of Application Control, it is strongly recommended that you migrate to Application Control v2.x. This migration replaces the Application Control v1.0.0 custom BAC rule engine with Application Control v2.x WDAC based enforcement. Existing allow rules are recreated as Supplemental Policies. This migration is a one-time, non-reversible per endpoint without redeployment process.

Attention:
BigFix Application Control v2.x is the only currently supported version of Application Control. See its documentation here.
CAUTION:
As BigFix Application Control v2.x is the only supported version of Application Control, the installation of BigFix Application Control v1.0.0 is disabled.
Tip:
To continue using Application Control, we strongly recommend that BigFix Application Control v1.0.0 users migrate to BigFix Application Control v2.x.
Warning:
BigFix Application Control v1.0.0 is planned to be deprecated in a future release.

Procedure

  1. First, export the existing Application Control v1.0.0 rules by using the Web Reports to export the currently configured rules. This will capture the rules for reference. These captured rules (only allowlist ones) will be recreated as Supplemental Policies in Application Control v2.x.
  2. Next, remove Application Control v1.0.0 from the endpoints. To do so, run Remove BAC Components from Endpoint task. This removes the BESBAC service, bes_bac.pol, the v1 rule engine, and the BAC binaries and folders. After the task execution completes successfully, the endpoint becomes ready for WDAC deployment. Refer to Remove BigFix Application Control from an Endpoint topic for more details.
  3. Create and setup a self-signed certificate on the endpoint. Refer to Create and Set Up a Self-Signed Code-Signing Certificate on Endpoint v2.x topic for more details.
  4. Deploy Application Control v2.x Base Policy. You can deploy only one base policy, either the Default Microsoft Base Policy or the Custom Base Policy. This will enable the WDAC enforcement model on the endpoint. Refer to Deploy a Default Microsoft WDAC Base Policy on Endpoint v2.x or Deploy a Custom WDAC Base Policy on Endpoint v2.x topics for more details.
    Note:
    • Base policy is fixed once deployed.
    • No switching or mode change is allowed once the base policy is set.
  5. Recreate the exported rules from step 1 as the Supplemental Policies. The exported rules are used as reference. Create Supplemental Policies. The Supplemental policies only extends the allowlist. No block rules are required (WDAC enforces a default deny policy). Refer to Deploy a Supplemental WDAC Policy on Endpoint v2.x topic for more details.
  6. Lastly, monitor the policy activation by using the Web Reports/Analyses (to monitor policy and rule inventory, and the blocked events). Verify the required applications allowed, policies activated, and ensure there are no unexpected blocks. Refer to View Application Control Endpoint Details in BigFix Web Reports v2.x topic for more details.

Results

A successfully completed migration results in the following outcomes on each endpoint:
  • The v1.0.0 BESBAC service, bes_bac.pol, custom rule engine, and BAC binaries are fully removed.
  • WDAC enforcement is active via the deployed base policy (Default Microsoft or Custom).
  • Existing allowlist rules are operational as WDAC Supplemental Policies.
  • No unexpected application blocks are reported in Web Reports or the Windows event log.