BigFix Application Control v2.x: Best Practices

Validate WDAC policy rules in a test environment before deploying to production endpoints. Use Audit Mode to observe application behavior, collect Code Integrity event data, and determine the appropriate rule type — then promote to Enforcement Mode only after the application's required functionality is confirmed.

Recommended Rule Validation Approach

Follow this validation process when adding a new application to a WDAC policy, or when the appropriate rule type for an application is not yet known. Validating in a controlled test environment before production deployment reduces the risk of blocking legitimate application components and avoids policy rollbacks on managed endpoints.

For new applications, or when the appropriate WDAC rule type is not yet known, it is recommended to validate the application in a test environment or on designated test machines before deploying the policy to production endpoints.

A typical validation process is:
  1. Deploy the WDAC policy in Audit Mode to the test machine.
  2. Run the application and perform the required application workflows, including applicable updates and dependent components.
  3. Monitor the relevant WDAC/Code Integrity events to identify application files or components that are audited.
  4. Review the collected events through BigFix Web Reports or the applicable Application Control reporting mechanism.
  5. Based on the observed application behavior and file characteristics, add the required rules or adjust the rule type as appropriate.
  6. Repeat the validation until the required application functionality is confirmed.
  7. Deploy the validated policy in Enforcement Mode to the test machine and verify that the application continues to function as expected.
  8. After successful validation, deploy the validated policy to the intended production endpoints according to the organization's change and deployment process.
Note:
Audit Mode is intended for validation and does not provide the same blocking behavior as Enforcement Mode. Event data should be evaluated together with the application's signing information, file characteristics, installation path, package identity, and dependencies when determining the appropriate rule type. An audited component should not automatically result in a broader allow rule; the rule should be selected based on the application's characteristics and the intended application control objective.

Co-located Management Node Setup

Architectural Recommendation: Deploy a dedicated, isolated WDAC Management Node to keep policy-signing capabilities separated from general endpoints. If operational constraints require applying policy enforcement on the same host running the WDAC Management components, follow this mandatory workflow:
  • Keep Base Policies Clean: Never add allow rules for signtool.exe or wdacmanager.exe to the global enterprise Base Policy, as this exposes code-signing capabilities fleet-wide.
  • Pre-compile the Supplemental Policy: Create, compile, and sign the WDAC Management Supplemental Policy (authorizing wdacmanager.exe and signtool.exe) before applying a restrictive base policy to the host.
  • Stage to Both Active Paths: Ensure both .cip policy binaries are deployed to both required storage locations:
    • OS Drive: %OSDrive%\Windows\System32\CodeIntegrity\CiPolicies\Active\{PolicyID}.cip
    • EFI Partition: <EFI Partition System>\Microsoft\Boot\CiPolicies\Active\{PolicyID}.cip