Refreshing Thumbprint of Deployed Policies Signers on Endpoint

Use this task to automate the end-to-end renewal, signing, and deployment of Windows Defender Application Control (WDAC) policies to ensure policies remain active and securely signed.

About this task

The task follows the below listed workflow:
  1. Setup: Initializes the logging and ensures that the required BAC directories exist.
  2. XML Processing: Scans for the XML policies, automatically increments their version numbers, and updates the signer rules to trust the current certificate.
  3. Conversion & Signing: Converts the XML to a binary (*.cip) file and cryptographically signs it using signtool.exe.
  4. EFI Deployment: Temporarily mounts the system's hidden EFI partition and deploys the signed policy directly to the boot manager's Active CiPolicies directory.
  5. Refresh: Invokes the local refresh utility to apply the policy immediately without a reboot.
Refer to the table below to know more about the task's exit code.
Table 1. Exit Codes Table
Exit Code Meaning
0 Success
10 Directory setup failure
20 Certificate creation or export failure
30 XML processing or version bumping failure
40 Binary conversion failure
50 Signtool signing failure
60 EFI mount or deployment failure
70 Policy refresh tool failure
80 Thumbprint rotation failure
Figure 1. Task: Refresh Thumbprint of Deployed Policies Signers on Endpoint

Refresh Thumbprint of Deployed Policies Signers on Endpoint v2.0

Procedure

  1. In the BigFix Console, navigate to All Content > BigFix Application Control > Fixlets and Tasks.
  2. From the Fixlets and Tasks pane, select Task: Refresh Thumbprint of Deployed Policies Signers on Endpoint v2.0.
  3. From the Task: Refresh Thumbprint of Deployed Policies Signers on Endpoint v2.0 pane, click the Applicable Computers(n) tab and view the endpoints on which you want to run the task.
  4. Select the Take Actions tab and select the endpoints on which you want to apply this installer task.
  5. Click OK.
    Note: Once this task is triggered, it remains as an open action and runs on the system whenever the system becomes relevant. Only an administrator can stop this task.

Results

A successful execution of this task results in the following outcomes:
  • Local XML policies are updated with incremented version numbers and new signer rules.
  • Cryptographically signed binary (*.cip) policies are successfully deployed to the EFI partition.
  • System application control policies are immediately refreshed and enforced.