Welcome
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
Application Control v1.0.0 (To be deprecated)
BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
Administrator Guide
This guide is for users who want to administer Application Control.
Managing Application Control
After installing BigFix Application Control, configure and manage the solution from the BigFix Console to maintain endpoint security. Post-installation management includes setting the application control mode, managing application allowlists (adding and removing applications), configuring exception request policies, setting up ServiceNow™ update sets for ticket integration, viewing the effective policy applied to endpoints, and removing the solution from endpoints when required.
Remove Application Control
Use the Task: Remove BAC Components from Endpoints to fully uninstall BigFix Application Control (BAC) from managed endpoints. The task stops and deletes the BESBAC service, removes all Application Control files and folders from the BigFix Client installation directory, cleans the BAC folder from all user Roaming AppData profiles, and deletes the service watcher task — leaving no residual Application Control components on the endpoint.

BigFix Documentation Homepage
BigFix 11 Lifecycle Documentation
Welcome to the BigFix Lifecycle documentation, where you can find information about how to install, maintain, and use BigFix Lifecycle.
BigFix Platform
BigFix Query
Lifecycle overview
BigFix Lifecycle is single-agent, single-console technology that provides near real-time visibility into the state of endpoints.
Lifecycle guides in PDF format
Following is a list of links to the BigFix Lifecycle guides in PDF format:
Software Distribution
Use the BigFix Software Distribution applications to deploy software to endpoints across your network from a single location. Maintain control and visibility into software delivery and installation. Device owners can use the Self Service Application to manage software and other BigFix actions that are deployed to them as offers.
OS Deployment
BigFix OS Deployment, which is part of the BigFix Lifecycle Management suite, provides a consolidated, comprehensive solution to quickly deploy new workstations and servers throughout a network from a single, centralized location. This solution saves time and money, enforces a standardized and approved image, and reduces risks associated with non-compliant or insecure configurations.
Remote Control
BigFix Remote Control application helps to communicate between different components, clients, and endpoints within BigFix environment.
Power Management
Use Power Management to control, monitor, and manage conservation policies in your deployment.
Application Control
BigFix Application Control 2.x lets IT administrators centrally manage and enforce application allowlisting on Windows endpoints using Windows Defender Application Control (WDAC). Built on BigFix, it delivers kernel-level execution control, deny-by-default policy enforcement, TPM-backed code signing, and compliance-ready audit reporting across the enterprise.
- Application Control 2.x
  BigFix® Application Control 2.x uses Windows Defender Application Control (WDAC) as its enforcement engine to apply application allowlisting and blocklisting policies at the kernel level across managed Windows endpoints — centrally managed through the BigFix® Console without relying on Group Policy Objects or separate tools.
- Migrate AC v1.0.0 to v2.x
  Migrate from the custom BAC rule engine in BigFix Application Control v1.0.0 to the Windows Defender Application Control (WDAC)-based enforcement model in v2.x. This one-time, non-reversible six-step process exports existing allowlist rules for recreation as WDAC Supplemental Policies, removes v1.0.0 BAC components from endpoints, deploys a WDAC base policy, and verifies policy activation across managed endpoints.
- Application Control v1.0.0 (To be deprecated)
  BigFix Application Control v1.0.0 is a lightweight, native enforcement system for managing application execution across enterprise endpoints. It delivers policy-driven application control within BigFix, enabling IT administrators to enforce usage policies with real-time monitoring and streamlined exception management.
  - Release Notes
    A summary of new or changed features and enhancements included in BigFix Application Control.
  - Administrator Guide
    This guide is for users who want to administer Application Control.
    - Administrator Guide Overview
      Application Control is a lightweight, native enforcement system designed for comprehensive management of application execution across enterprise endpoints. It provides IT administrators with policy-driven application allowlisting and blocklisting to secure BigFix-managed Windows environments — currently supporting physical and virtual Windows devices, with macOS and Linux support planned for a future release.
    - Installing and Monitoring
      Install BigFix Application Control on managed Windows endpoints in two steps using the BigFix Console: first, run the identification Fixlet to find endpoints that do not yet have Application Control installed; second, execute the installer task on those endpoints to deploy the solution. After deployment, monitor endpoint status to confirm successful installation across your environment.
    - Managing Application Control
      After installing BigFix Application Control, configure and manage the solution from the BigFix Console to maintain endpoint security. Post-installation management includes setting the application control mode, managing application allowlists (adding and removing applications), configuring exception request policies, setting up ServiceNow™ update sets for ticket integration, viewing the effective policy applied to endpoints, and removing the solution from endpoints when required.
      - View Effective Configuration
        Use Analyses: Effective Configuration in the BigFix Console to inspect the active configuration applied to each endpoint managed by BigFix Application Control. The Details tab displays seven data points per endpoint: Control Mode, Blocked Path Patterns Rules, Blocked Hashes Rules, Allowed Path Pattern Rules, Allowed Hash Rules, active Exceptions, and BESBAC Service Status.
      - View Endpoint Details in Web Reports
        Use BigFix Web Reports to view a read-only dashboard of all enterprise endpoints managed by BigFix Application Control. The BigFix Application Control report provides four tabs — Managed Devices, Blocklisted Applications, Allowlisted Applications, and Exception Access Log — each displaying endpoint and application data that can be filtered and exported to CSV.
      - Set Control Mode
        Run the Task: Set Control Mode on Endpoint from the BigFix Console to set the application control mode on managed endpoints. Choose Allow Mode to enforce a default-deny policy — blocking all applications except those matching an explicit Allow Rule — or Block Mode to enforce a default-allow policy — permitting all applications except those matching an explicit Block Rule.
      - Set Policy Modifications
        Use the Task: Set Policy Modifications from the BigFix Console to create, update, or remove application control rules in the local policy file (bes_bac.pol) on managed endpoints. The task provides three Select Mode options: Set New Rule (create a custom Allow or Block rule by path pattern or file hash), Remove Existing Rule (delete or partially modify a rule), and Apply CSV Ruleset (bulk-manage rules from a centrally maintained CSV file).
      - Set Exception
        The Task: Set Exception on Endpoint applies an application exception — a time-bound Allow rule with additional audit metadata — to a managed endpoint. The task requires four parameters: File_Name, Approved_By, Expiration_Date, and Reason. This task is designed to be triggered exclusively by ITSM applications such as ServiceNow™ as part of an exception approval workflow — it cannot be manually triggered from the BigFix Console.
      - Stage ServiceNow Update Set
        Use the Task: Stage ServiceNow Update Set for Administrator Handoff to copy the ServiceNowUpdateSet.xml file to the designated staging directory on the BigFix® Root Server. After staging, the BigFix® operator notifies the ServiceNow™ administrator, who retrieves the file and imports it into the target ServiceNow™ instance to enable the BigFix Application Control exception approval workflow.
      - Configure ServiceNow Update Sets
        Configure the ServiceNow™ instance to receive and process application exception requests from Application Control managed endpoints. This task imports the ServiceNowUpdateSet.xml file staged by the preceding task, configures the Application_Catalog_BigFix and BAC_Application_Exception_Catalog REST Message catalog files with BigFix REST API credentials and endpoint URLs, and sets the BigFix_User_Key and BigFix_User_Name system properties required for the exception approval workflow.
      - Reset Global Policy
        Use the Task: Set Global Policy to reset the Application Control policy on managed endpoints to the factory default state — Block Mode with an empty rules list. The task overwrites the existing bes_bac.pol file with a new default policy, permanently removing all custom Allow and Block rules. Use this task to establish a clean security baseline, resolve policy conflicts, or clear obsolete rules before deploying a new ruleset.
      - Remove Application Control
        Use the Task: Remove BAC Components from Endpoints to fully uninstall BigFix Application Control (BAC) from managed endpoints. The task stops and deletes the BESBAC service, removes all Application Control files and folders from the BigFix Client installation directory, cleans the BAC folder from all user Roaming AppData profiles, and deletes the service watcher task — leaving no residual Application Control components on the endpoint.
    - Support
      Access a variety of resources for additional information and support on this product, including the Knowledge Center, Support Center, Developer site, and user forums. These links provide documentation, technical assistance, and community discussions to help you maximize your use of BigFix. Refer to the listed resources for comprehensive guidance and troubleshooting.
    - Notices
  - User Guide
    This guide is for desktop users or end users who will use .
  - Exception Manager Guide
    Designed for Exception Managers, this guide details the effective use of the ServiceNow™ tool. It highlights important features, functionalities, and best practices for managing exceptions efficiently.
  - Application Control V1 Readme
Server Automation
Server Automation provides powerful automation. You can use it to sequence automation actions in steps across multiple endpoints.
Virtual Endpoint Manager
HCL BigFix Virtual Endpoint Manager (VEM) enhances BigFix with centralized, unified endpoint management for hybrid cloud and data center environments, spanning virtual machines and physical endpoints. VEM delivers real-time endpoint visibility, policy-driven automation for configuration and compliance remediation, and consistent security controls to streamline IT operations, reduce risk, and strengthen regulatory compliance.
Profile Management
Profile Management is a WebUI-based feature of BigFix Lifecycle. It provides Security Administrators the capability to define and deploy security policies to Windows 10 and macOS devices.
BigFix Remediate
BigFix MCM

Remove BigFix Application Control from an Endpoint

Use the Task: Remove BAC Components from Endpoints to fully uninstall BigFix Application Control (BAC) from managed endpoints. The task stops and deletes the BESBAC service, removes all Application Control files and folders from the BigFix Client installation directory, cleans the BAC folder from all user Roaming AppData profiles, and deletes the service watcher task — leaving no residual Application Control components on the endpoint.

About this task

As an administrator, you can use this task to remove or uninstall BigFix Application Control (BAC) from target endpoints. The task removes the BESBAC service and all associated Application Control files and folders from the target endpoints.

The Task: Remove BAC Components from Endpoints performs the following actions on each target endpoint:

Stops and deletes the BESBAC service from Windows™ Service Control Manager.
Removes the BAC directory located in the BigFix Client installation folder.
Scans and cleans all user profiles by removing the BAC folder from their Roaming AppData directory.
Deletes the task that monitors BESBAC and BESClient services.

Follow the steps below to configure the watcher service refresh interval:

Procedure

In the BigFix® Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
From the Fixlets and Tasks pane, select Task: Remove BAC Components from Endpoints.

Figure 1. BigFix Application Control — Fixlets and Tasks — Task: Remove BAC Components from Endpoints (Task Selection)
Select the Take Actions tab and select the endpoints from which you want to remove BigFix Application Control.
Click OK.

Results

BigFix Application Control is fully uninstalled from the selected endpoints. The BESBAC service is stopped and deleted from the Windows Service Control Manager, all Application Control files and folders are removed from the BigFix Client installation directory, the BAC folder is deleted from all user Roaming AppData profiles, and the service watcher task is deleted. No residual Application Control components remain on the endpoint. The endpoint no longer appears as managed in Analyses: Effective Configuration.