Application Control

Key Features

• WDAC Kernel Enforcement: Enforces policy at the Windows kernel level, blocking unauthorized code before it can execute in user mode.
• Centralized WDAC Management Node: All policy authoring, generation, and signing are performed on a single dedicated node — no endpoint-resident PowerShell tooling required.
• TPM-Backed Code Signing: Policies are signed by a non-exportable RSA certificate bound to the Trusted Platform Module (TPM), ensuring authenticity and eliminating distributed trust fragmentation.
• Base and Supplemental Policies: The Base Policy defines the enterprise-wide security baseline; Supplemental Policies extend it per department without modifying the Base Policy.
• Immutable Policy Versioning: Every published policy is a version-controlled, immutable artifact, preserving full history for audit and rollback.
• Rule-Based Allow/Deny: Policies are built from rules based on file hash, file name, file path, or publisher.
• Compliance Reporting: BigFix Web Reports delivers compliance dashboards, deployment status, Code Integrity event visibility, and policy lifecycle history.

Key Components

BigFix Application Control 2.x operates across three major component groups:

WDAC Management Node

The WDAC Management Node is a dedicated Windows machine that hosts the Application Control policy management environment: the wdacmanager.exe policy generation and compilation engine, the TPM-backed signing certificate and private key (where TPM-backed signing is configured), a set of approved reference binaries used during policy creation and validation, a BigFix® Agent, and the Management Node Secure Folder used for the controlled handoff of signed policy artifacts. When a policy-management Fixlet executes on this node, it invokes wdacmanager.exe to generate, compile, validate, and digitally sign the WDAC policy.

BigFix Server Components

Includes the WDAC Deployment Service, Enterprise Database, BigFix Relay, and BigFix Web Reports. The WDAC Deployment Service publishes signed policies to managed endpoints via BigFix Custom Sites.

Managed Endpoints

Windows endpoints running the BigFix Agent. Once a signed WDAC policy is deployed, the OS kernel enforces it — allowing or blocking execution of user applications and scripts. Endpoints report compliance status and Code Integrity events back to the BigFix Server for monitoring and reporting.

For the complete system architecture diagram and component interaction details, see BigFix Application Control: System Architecture.

Ideal Use Cases for BigFix Application Control 2.x

IT environments requiring strong execution control

Supports organizations adopting a deny-by-default model to reduce unauthorized or unknown application execution. The centralized WDAC Management Node and kernel-level WDAC enforcement help limit exposure to untrusted software and common malware execution paths without requiring endpoint-resident PowerShell tooling.

Compliance-driven and regulated environments

Suitable for organizations implementing stricter endpoint security baselines or application control requirements. Immutable, version-controlled policy artifacts preserve full history for audit and rollback, directly supporting compliance reporting requirements. Kernel-level enforcement through Windows Defender Application Control helps strengthen application governance and policy consistency.

Phased application control rollouts

Well suited for environments that require staged deployment using Audit mode before enforcement. Organizations can observe application usage, refine policies, and reduce operational disruption during rollout. The Base and Supplemental Policy model supports scoping rollouts per department without modifying the enterprise-wide baseline.

Environments with strong application visibility

Existing visibility into installed and used applications helps simplify Base Policy creation, and the department-scoped Supplemental Policy model allows targeted exceptions without disrupting the enterprise baseline.

When BigFix Application Control 2.x Is Not a Strong Fit

Blocklist-only or selective application blocking

WDAC works by allowing only approved applications to run and blocking everything else. It is not designed for simple block-only scenarios, such as blocking a single application. Even if you only want to block one application, you still need to author and deploy a full Base Policy — which involves significantly more setup than the scenario requires.

Environments expecting protection from privileged users

BigFix Application Control 2.x helps strengthen execution control but should not be treated as a complete safeguard against highly privileged or administrative users. Additional security controls and governance processes may still be required.