Set the Application Control Mode on an Endpoint in BigFix Application Control

Run the Task: Set Control Mode on Endpoint from the BigFix Console to set the application control mode on managed endpoints. Choose Allow Mode to enforce a default-deny policy — blocking all applications except those matching an explicit Allow Rule — or Block Mode to enforce a default-allow policy — permitting all applications except those matching an explicit Block Rule.

About this task

Use the Task: Set Control Mode on Endpoint to configure the application control mode on BigFix Application Control managed endpoints.

As an administrator, you can set the operational mode for the Application Control policy on managed endpoints. This setting determines the default execution behaviour and which set of rules (Allow or Block) are enforced on the endpoint.

BigFix Application Control supports two control modes:
  • Allow Mode
    Enforces a default-deny policy — all applications are blocked from running by default. Only applications and processes that match a specific Allow Rule are permitted to run. This is the most secure mode and is intended for highly controlled environments.
  • Block Mode
    Enforces a default-allow policy — all applications are permitted to run by default. Only applications and processes that match a specific Block Rule are prevented from running. This mode is intended for flexible environments.

Follow the steps below to set the control mode on managed endpoints:

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Set Control Mode on Endpoint.
    Figure 1. BigFix Application Control — Task: Set Control Mode on Endpoint in Fixlets and Tasks Pane

    BigFix Application Control Task Set Control Mode on Endpoint entry in the Fixlets and Tasks pane of the BigFix Console, used to configure Allow Mode or Block Mode on managed endpoints.
  3. From the Task: Set Control Mode On Endpoint pane, select the relevant Mode from the drop-down, either Allow or Block.
    Figure 2. BigFix Application Control — Task: Set Control Mode on Endpoint — Select Allow Mode or Block Mode from the Drop-Down

    BigFix Application Control Task Set Control Mode on Endpoint configuration pane, showing the control mode drop-down with Allow Mode (default-deny policy, blocks all applications except those matching an Allow Rule) and Block Mode (default-allow policy, permits all applications except those matching a Block Rule) options.
  4. Select the Take Actions tab and select the endpoints on which you want to apply the selected mode.
  5. Click OK.

Results

The selected control mode (Allow Mode or Block Mode) is applied to the target endpoints. Endpoints set to Allow Mode immediately enforce the default-deny policy — blocking all applications except those matching an Allow Rule. Endpoints set to Block Mode enforce the default-allow policy — permitting all applications except those matching a Block Rule. The applied mode is reflected in the Control Mode field in Analyses: Effective Configuration for each endpoint.