Reset the Application Control Global Policy to Default on Endpoints in BigFix Application Control

Use the Task: Set Global Policy to reset the Application Control policy on managed endpoints to the factory default state — Block Mode with an empty rules list. The task overwrites the existing bes_bac.pol file with a new default policy, permanently removing all custom Allow and Block rules. Use this task to establish a clean security baseline, resolve policy conflicts, or clear obsolete rules before deploying a new ruleset.

About this task

Warning:
Running this task permanently deletes all existing custom application control rules from the bes_bac.pol file on the selected endpoints. This action is irreversible.
Note:
Proceed only if you want to revert the endpoints to a factory default security policy.

As an administrator, you can reset the Application Control policy on target endpoints to the factory default state. Running this task removes all custom-defined Allow and Block rules and restores the policy to the initial configuration created during agent installation.

This task is useful for establishing a clean security baseline, troubleshooting policy conflicts, or removing obsolete rules in bulk before deploying a new ruleset.

The task's action script performs the following steps on each target endpoint:
  1. Generates a new default policy object with the control mode set to Block and an empty list of rules.
  2. Encrypts the new default policy and writes it to the bes_bac.pol file, overwriting any existing content.
  3. Restarts the BESBAC service to enforce the default policy immediately.

After this task completes, the endpoint blocks all applications not explicitly allowed by a new policy, as no custom rules are present.

Perform the following steps to reset the global policy on managed endpoints:

Procedure

  1. In the BigFix® Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Set Global Policy.
    Figure 1. BigFix Application Control — Fixlets and Tasks — Task: Set Global Policy (Task Selection)

    BigFix Application Control Fixlets and Tasks pane with the Task: Set Global Policy task selected, showing the task description and the warning that running this task permanently deletes all custom application control rules from the bes_bac.pol file on the selected endpoints.
  3. Select the Take Actions tab and select the endpoints on which you want to apply this task.
  4. Click OK.

Results

The task generates a new default policy object — Block Mode with an empty rules list — encrypts it into the bes_bac.pol file on each target endpoint, and restarts the BESBAC service to enforce the default policy immediately. All previous custom Allow and Block rules are permanently removed. The endpoint now blocks all applications not explicitly permitted by a subsequently deployed policy. The reset policy state is reflected in Analyses: Effective Configuration for each endpoint.