Deploy and Monitor Endpoints Using BigFix Application Control

Run the Task: Deploy And Monitor Endpoint from the BigFix Console to deploy BigFix Application Control on managed Windows endpoints. The task executes a three-phase process: installing prerequisite files (.NET 8 SDK, Process Monitor Service, and Notification Utility), creating and configuring the BESBAC Windows service with a default-deny effective_policy.json policy, and activating a BAC Monitoring Service that checks and restarts the solution every five minutes.

Before you begin

It is recommended to first run the Fixlet: Endpoint Not Configured For Application Control to identify non-managed endpoints before running the installer task.

About this task

Use this Fixlet to deploy and monitor BigFix Application Control to endpoints that are not yet managed by the solution.

You can install BigFix Application Control using Task: Deploy And Monitor Endpoint. By running this task on an endpoint, you will deploy and activate a custom BigFix® Application Control (BAC) service on a Windows™ endpoint and a user pop-up service. This service enforces an application allowlisting policy and blocks unauthorized processes from running on the endpoint.

This task performs a multi-step process to install, configure, and enable the BAC service to monitor and control application software. The steps are as follows:
  1. Installation & setup

    In this step, the task first downloads the three pre-requisite files - .NET 8 SDK, ProcessMonitorService.zip, and NotificationUtility.zip. Post downloading, the task installs the .NET 8 SDK, creates a dedicated folder at \Program Files (x86)\ BigFix Enterprise\ BES Client\BAC, and unzips the ProcessMonitorService.zip and NotificationUtility.zip files in the folder.

  2. Service & policy configuration
    In this step, the task creates a Windows™ service called BESBAC. This service is configured to:
    • run the ProcessMonitorService.exe,
    • start automatically with the system, and
    • automatically attempt to restart if it fails.
    Next, the task deploys a security policy by generating a JSON policy file effective_policy.json. This policy works in a default-deny mode, which means that all applications are blocked for running except those explicitly allowed. The initial policy is a allowlist for:
    • essential Windows™ system processes
    • BigFix agent processes
    • any other processes running from C:\Windows directory
  3. Activation & Monitoring
    In this step, the task starts the BESBAC service and immediately begins enforcing the security policy. Next, it creates a monitoring task named BAC Monitoring Service that runs every 5 minutes to check if the BESClient and BESBAC are running. If either of the services are stopped, the monitoring service restarts it ensuring that the solution is always active.

Follow the steps below to deploy the BigFix Application Control on the endpoints:

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
    Figure 1. BigFix Console — Navigate to BigFix Application Control Fixlets and Tasks

    BigFix Console navigation tree showing the path: All Content > BigFix Application Control > Fixlets and Tasks, used to locate the Deploy And Monitor Endpoint task.
  2. From the Fixlets and Tasks pane, select Task: Deploy And Monitor Endpoint.
    Figure 2. BigFix Application Control — Task: Deploy And Monitor Endpoint

    BigFix Application Control Task Deploy And Monitor Endpoint detail pane in the BigFix Console, showing the task description, configuration options, and the Applicable Computers and Take Actions tabs used to select and deploy the installer task on target Windows endpoints.

    This task does not contain any action script and the result set is based on client relevance to get the details of devices not managed by Application Control.

  3. From the Task: Deploy And Monitor Endpoint pane, under Configuration Options enter the following information:
    Figure 3. BigFix Application Control — Deploy And Monitor Endpoint Task Configuration Options

    BigFix Application Control Task Deploy And Monitor Endpoint Configuration Options panel showing the three configurable fields: Temporary Exception Duration in days, Footer Message displayed to endpoint users when raising exception requests, and ServiceNow Instance URL where exception tickets are created.
    Table 1. Deploy And Monitor Endpoint Task — Configuration Options Reference
    Field Name Description
    Temporary Exception Duration (days) Number of days for which the block listed applications are to be allowed for usage as per your organization's policies.
    Footer Message Message to be displayed to the endpoint users when they are raising exception requests.
    ServiceNow Instance URL Your organization’s ServiceNow™ instance URL where the tickets are created for the exceptions raised by Application Control end-users.
  4. From the Task: Deploy And Monitor Endpoint pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  5. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  6. Click OK.

Results

BigFix Application Control is deployed on the selected endpoints. The BESBAC service starts and immediately enforces the effective_policy.json default-deny policy, blocking unauthorized processes and allowlisting essential Windows system and BigFix agent processes. The BAC Monitoring Service activates and checks every five minutes to ensure the solution remains running. Exception requests from endpoint users are routed as tickets to the configured ServiceNow™ instance for exception manager review.