Set Policy Modifications on Endpoints in BigFix Application Control

Use the Task: Set Policy Modifications from the BigFix Console to create, update, or remove application control rules in the local policy file (bes_bac.pol) on managed endpoints. The task provides three Select Mode options: Set New Rule (create a custom Allow or Block rule by path pattern or file hash), Remove Existing Rule (delete or partially modify a rule), and Apply CSV Ruleset (bulk-manage rules from a centrally maintained CSV file).

About this task

Use Task: Set Policy Modifications to create, update, or remove application control rules on target endpoints.

This task manages application control rules on target endpoints by modifying the local policy file (...\BES Client\BAC\bes_bac.pol). It enforces security policies, prevents the execution of unauthorized software, and hardens endpoints against malware. Rules can be based on file path patterns, file hashes, or a centrally managed CSV file. The action performed is determined by the Select Mode parameter chosen by the administrator.

The task has three Select Mode options:
  • Mode 1: Set New Rule
    Creates and deploys a new, custom application control rule. Any new rule is added to a central configuration that determines which applications are permitted or denied. The configuration supports:
    • Allow Rules: Explicitly permit necessary applications to run.
    • Block Rules: Explicitly deny unauthorized or risky applications.
    Table 1. BigFix Application Control — Set Policy Modifications Task: Mode 1 (Set New Rule) — Configuration Fields Reference
    Field Name Description
    Rule Name Name of the rule. Provide a clear, unique name for the policy (for example, "Block unauthorized torrent applications"). If a rule with the same name already exists, the task fails.
    Rule Type Type of rule. Can be either Block or Allow.
    Path Pattern Path of the application or process to be allowed or blocked. Enter an executable name (for example, msedge.exe) or a full file path. Wildcards (*) are supported. For multiple entries, use a comma-separated list (for example, C:\Temp*.exe,C:\Users*\downloads*.exe).
    File Hash Hash value of the application file. For a more specific rule, provide the SHA-256 or SHA-384 hash of the file. For multiple hashes, use a comma-separated list.
    Rationale Description or reasoning for the rule.
    Note:
    Provide a value for either Path Pattern or File Hash for the rule to be valid. For more effective control, use a combination of both wherever feasible.
  • Mode 2: Remove Existing Rule
    Modifies or completely removes an existing application control rule. It offers granular control — you can delete an entire rule or selectively remove specific criteria (file paths or hashes) from within a rule. The task performs one of the following operations:
    • Full Rule Deletion: To delete an entire rule, provide the Rule Name and Rule Type, but leave both the Path Pattern and File Hash fields empty. The task finds the matching rule and removes it completely.
    • Partial Rule Modification: To remove specific criteria from an existing rule, provide the Rule Name, Rule Type, and the Path Pattern or File Hash to remove. The task finds the matching rule and removes only the specified path or hash values, leaving the rest of the rule intact.
    After modifying the policy file, the task restarts the BigFix Application Control service (BESBAC) to ensure the changes are applied immediately. If no rule matching the specified criteria is found, no changes are made.
  • Mode 3: Apply CSV Ruleset
    Creates or updates application control rules by reading from centrally managed CSV files, enabling bulk management of application allow and block lists without altering the task action script. The task performs the following actions:
    • Based on the Rule Type selected (Block or Allow), the task reads from the corresponding source file: allowlisted_applications.csv or blocklisted_applications.csv.
      Note:
      Download the sample allowlisted and blocklisted CSV format files from the links below:
    • The task parses the source file to extract a list of application file paths and file hashes.
    • The task finds the rule specified by the Rule Name in the local policy file. If the rule exists, it is updated with the information from the CSV; if it does not exist, it is added as a new entry.
    Remember:
    For this mode to function correctly, complete the following prerequisite steps before running the task:
    1. Create the CSV file — name it blocklisted_applications.csv (for blocking) or allowlisted_applications.csv (for allowing). The file must contain the headers Path Patterns and Hashes.
    2. Upload the CSV file to the BigFix server Master Action Site — in the BigFix Console, navigate to Master Action Site > Files, right-click and select Add Files. Choose your CSV file and select the Send to clients check box before adding.

Perform the following steps to set policy modifications on managed endpoints:

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Set Policy Modifications.
    Figure 1. BigFix Application Control — Task: Set Policy Modifications in Fixlets and Tasks Pane

    BigFix Application Control Task Set Policy Modifications entry in the Fixlets and Tasks pane of the BigFix Console, used to create, update, or remove application control rules in the local bes_bac.pol policy file on managed endpoints.
  3. From the Task: Set Policy Modifications pane, enter the following information on the Description tab:
    Table 2. BigFix Application Control — Task: Set Policy Modifications — Select Mode Options
    Field Name Description
    Select Mode Select the mode: Set New Rule, Remove Existing Rule, Apply CSV Ruleset as needed.
    Table 3. BigFix Application Control — Task: Set Policy Modifications — Select Mode Options
    Select Mode Option Description
    Set New Rule Create and deploy a new custom Allow or Block rule on the endpoint policy file.
    Remove Existing Rule Delete an entire rule or remove specific path patterns or hash values from an existing rule.
    Apply CSV Ruleset Bulk-manage Allow or Block rules by reading from a centrally maintained CSV file uploaded to the Master Action Site.
    Based on the mode selected, the task displays the corresponding configuration options for that mode.

Results

The task applies the selected policy modification to the bes_bac.pol local policy file on the target endpoints and restarts the BESBAC service to enforce the changes immediately. The updated rules are reflected in the Analyses: Effective Configuration view in the BigFix Console.

What to do next

Based on the mode selected, complete the task using the appropriate child topic: