Remove or Modify an Existing Application Control Rule on Endpoints in BigFix Application Control

Use the Remove Existing Rule mode in the Task: Set Policy Modifications to delete or modify an existing application control rule in the endpoint's local bes_bac.pol policy file. Choose between a full rule deletion (provide only Rule Name and Rule Type, leave Path Pattern and File Hash empty) or a partial rule modification (provide Rule Name, Rule Type, and the specific Path Pattern or File Hash to remove). The BESBAC service restarts automatically to enforce changes immediately.

About this task

Use the Remove Existing Rule mode to delete or modify an existing application control rule on managed endpoints.
As an administrator, you can use this mode in the Task: Set Policy Modifications to modify or delete an existing application control rule from an endpoint's bes_bac.pol policy file. The mode supports two operations:
  • Full Rule Deletion — removes the entire rule from the policy file. Provide only the Rule Name and Rule Type fields; leave Path Pattern and File Hash empty.
  • Partial Rule Modification — removes only specific criteria from within an existing rule. Provide Rule Name, Rule Type, and the specific Path Pattern or File Hash values to remove. The rest of the rule remains intact.
After the policy file is modified, the BESBAC service restarts automatically to ensure the changes are applied immediately. If no rule matching the specified criteria is found, no changes are made.

Select Remove Existing Rule from the Select Mode drop-down in the Task: Set Policy Modifications pane to delete or modify rules on endpoints.

Perform the following steps to remove or modify an existing application control rule on managed endpoints:

Procedure

  1. From the Task: Set Policy Modifications pane, on the Description tab, select Remove Existing Rule from the Select Mode drop-down and enter the following information:
    Figure 1. BigFix Application Control — Task: Set Policy Modifications — Remove Existing Rule Mode Configuration Fields (Rule Name, Rule Type, Path Pattern, File Hash)

    BigFix Application Control Task Set Policy Modifications pane showing the Remove Existing Rule mode configuration fields: Select Mode set to Remove Existing Rule, Rule Name, Rule Type (Allow or Block), Path Pattern (leave empty for full rule deletion, or enter the specific path to remove for partial modification), and File Hash (leave empty for full deletion, or enter the specific hash to remove for partial modification).
    Table 1. BigFix Application Control — Task: Set Policy Modifications — Remove Existing Rule Mode Configuration Fields Reference
    Field Name Description
    Select Mode Select Remove Existing Rule from the drop-down to activate this mode.
    Rule Name The exact name of the existing rule to delete or modify. Required for both full deletion and partial modification. The task uses this name to locate the matching rule in the bes_bac.pol policy file.
    Rule Type The type of the rule to be removed. Select Block or Allow to match the type of the existing rule. Required for both full deletion and partial modification.
    Path Pattern
    • Full Rule Deletion: Leave empty. The task removes the entire rule without needing a path pattern.
    • Partial Modification: Enter the specific path pattern to remove from the rule. Only the matching path entry is deleted; all other entries in the rule remain intact.
    File Hash
    • Full Rule Deletion: Leave empty. The task removes the entire rule without needing a file hash.
    • Partial Modification: Enter the specific SHA-256 or SHA-384 hash value to remove from the rule. Only the matching hash entry is deleted; all other entries in the rule remain intact.
    Note:
    For full rule deletion, provide only Rule Name and Rule Type — leave Path Pattern and File Hash empty. For partial rule modification, provide Rule Name, Rule Type, and the specific Path Pattern or File Hash value to remove.
  2. Select the Take Actions tab and select the endpoints from which you want to remove the rules.
  3. Click OK.

Results

The matching rule is deleted or modified in the bes_bac.pol policy file on the target endpoints. The BESBAC service restarts automatically and the change takes effect immediately. If no rule matching the specified Rule Name and Rule Type is found, no changes are made. The updated policy state is reflected in the Analyses: Effective Configuration view in the BigFix Console.