Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control v1.0.0 (To be deprecated)
BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Administrator Guide
This guide is for users who want to administer Application Control.
Administrator Guide Overview
Application Control is a lightweight, native enforcement system designed for comprehensive management of application execution across enterprise endpoints. It provides IT administrators with policy-driven application allowlisting and blocklisting to secure BigFix-managed Windows environments — currently supporting physical and virtual Windows devices, with macOS and Linux support planned for a future release.
Key Concepts and Terminology
BigFix Application Control provides policy-driven management of application execution across managed Windows devices in a BigFix environment. This topic defines the four core concepts administrators need to understand before deploying and configuring the solution: Application Control Policy, Application Control Rule, CSV Ruleset File, and Effective Control Policy.

BigFix Documentation Homepage
BigFix 11 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
  - Release Notes
    A summary of new or changed features and enhancements included in BigFix Application Control.
  - Administrator Guide
    This guide is for users who want to administer Application Control.
    - Administrator Guide Overview
      Application Control is a lightweight, native enforcement system designed for comprehensive management of application execution across enterprise endpoints. It provides IT administrators with policy-driven application allowlisting and blocklisting to secure BigFix-managed Windows environments — currently supporting physical and virtual Windows devices, with macOS and Linux support planned for a future release.
      - System Architecture and Decision Flow
        The BigFix Application Control system architecture comprises three integrated layers: BigFix Server components (Core Server, Console, and Web Reports), managed Windows endpoints running the Process Monitor Service, Notification Utility, and Encryption Utility, and a third-party ITSM application such as ServiceNow™ for exception request ticketing and approval. Together these components enforce application execution policy, surface blocked-application notifications to end users, and route exception approval decisions back to endpoints via the BigFix Action API.
      - User Roles
        BigFix Application Control defines three user roles: the Policy Manager/Administrator, who deploys and configures application control policies and manages endpoint rules using the BigFix Console; the Desktop User (end user), who works on a managed endpoint, receives blocked-application notifications, and can raise exception requests; and the Exception Manager, who reviews and approves or denies exception requests in an ITSM application such as ServiceNow™.
      - Key Concepts and Terminology
        BigFix Application Control provides policy-driven management of application execution across managed Windows devices in a BigFix environment. This topic defines the four core concepts administrators need to understand before deploying and configuring the solution: Application Control Policy, Application Control Rule, CSV Ruleset File, and Effective Control Policy.
      - Administrator Audience
        This guide is for IT administrators who deploy and manage Application Control in a BigFix® environment. It covers installation and configuration on endpoints, creating and managing application control rules (allow and block), monitoring the Application Control watcher service, viewing effective endpoint configuration and approved exceptions from the BigFix Console and Web Reports, and uploading CSV rulesets to a content site.
    - Installing and Monitoring
      Install BigFix Application Control on managed Windows endpoints in two steps using the BigFix Console: first, run the identification Fixlet to find endpoints that do not yet have Application Control installed; second, execute the installer task on those endpoints to deploy the solution. After deployment, monitor endpoint status to confirm successful installation across your environment.
    - Managing Application Control
      After installing BigFix Application Control, configure and manage the solution from the BigFix Console to maintain endpoint security. Post-installation management includes setting the application control mode, managing application allowlists (adding and removing applications), configuring exception request policies, setting up ServiceNow™ update sets for ticket integration, viewing the effective policy applied to endpoints, and removing the solution from endpoints when required.
    - Support
      Access a variety of resources for additional information and support on this product, including the Knowledge Center, Support Center, Developer site, and user forums. These links provide documentation, technical assistance, and community discussions to help you maximize your use of BigFix. Refer to the listed resources for comprehensive guidance and troubleshooting.
    - Notices
  - User Guide
    This guide is for desktop users or end users who will use .
  - Exception Manager Guide
    Designed for Exception Managers, this guide details the effective use of the ServiceNow™ tool. It highlights important features, functionalities, and best practices for managing exceptions efficiently.
  - Application Control V1 Readme
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

BigFix Application Control Key Concepts and Terminology

BigFix Application Control provides policy-driven management of application execution across managed Windows devices in a BigFix environment. This topic defines the four core concepts administrators need to understand before deploying and configuring the solution: Application Control Policy, Application Control Rule, CSV Ruleset File, and Effective Control Policy.

The following are the core Application Control terms that administrators should understand before deploying and configuring the solution:

Application Control Policy

A collection of rules applied to an endpoint to restrict or allow the execution of an application or process.
Application Control Rule

A configuration that instructs the monitoring service on the endpoint to allow or block the execution of an application or process.
CSV Ruleset File

A CSV file containing Application Control Rules to be enforced on the endpoints that are subscribed to the content site to which the file has been uploaded.
Effective Control Policy

A collective ruleset consisting of CSV Ruleset Files and Individual Control Rules applied to an endpoint. This is the combined policy that the Process Monitor Service evaluates when determining whether to allow or block an application on the endpoint.