Administering Workflow Builder

Components and defaults

The bf-wrkflw.exe command-line interface

The BigFix Workflow Service ships with the bf-wrkflw.exe command-line tool, installed by default in C:\Program Files (x86)\BigFix Enterprise\BFWorkFlow. Every invocation logs to workflow-data\logs\wrkflw_cli.log.

Set the environment variable LOG_VERBOSE=true to switch the logs to debug level and emit them to standard output.

Manual installation

1. Create a setup.env file with the connection parameters. Minimal configuration:

   DB_TYPE=sqlserver
   DB_HOST=localhost
   DB_PORT=1433
   DB_NAME=BFEnterprise
   DB_USER=<user>
   DB_PASSWORD=<password>
   DB_AUTH_TYPE=0
   DB_SSL_MODE=1
   BASIC_AUTH_PORT=8089
   MTLS_PORT=9087

2. Run bf-wrkflw.exe --install -f setup.env. The installer verifies and migrates the database, seeds the sample workflows (on an empty database), clears the password from the .env file and stores the credentials in the Windows LockBox, generates the mTLS bootstrap values, and registers the Windows service.
3. Start the service: sc start BigFixWorkFlow.
4. Set up the mTLS connection to the BigFix UI: get the basic authentication credentials from workflow-data\configs\mtls-bootstrap.txt, then on the BigFix UI host run BFUI.exe --configure-wfb from <BigFix UI installation>\cmd\bfui and enter the values when prompted (see Stage 4: Activate the application in the BigFix UI).

Reconfiguring the database user

Use this procedure to correct a database setting entered by mistake at installation, to rotate the database credentials, or after moving the database to a different host or port.

1. Create a file (for example, dbpass.env) with DB_HOST, DB_USER, and DB_PASSWORD (plain text; it is cleared from the file automatically after processing).
2. Stop the service: sc stop BigFixWorkFlow.
3. Run bf-wrkflw.exe --reconfigure-db -f dbpass.env and confirm in workflow-data\logs\wrkflw_cli.log that the connection was reconfigured and verified, and that the password was cleared from the file.
4. Start the service: sc start BigFixWorkFlow, and confirm the start in workflow-data\logs\wrkflw_svc.log.

Running the BigFix Workflow Service under a different service account

After installation you can change the account that runs the service: open Windows Services, change the log-on account of the BigFixWorkFlow service, and restart it. To connect to the database with Windows Authentication under that account, follow the database reconfiguration steps (see Reconfiguring the database user) with a property file that sets DB_HOST, DB_AUTH_TYPE=windows, and placeholder DB_USER/DB_PASSWORD values — both must be present but are ignored when DB_AUTH_TYPE is windows.

Upgrading the BigFix Workflow Service

When you deploy new BigFix Workflow Service binaries, apply the Elevate > Migrate > Revoke > Re-tighten lifecycle:

1. Elevate privileges before the installation:

   USE [BFEnterprise];
   EXEC dbo.sp_SetWrkflwRestrictedUserDDLAccess @UserName = 'wrkflwDbUser', @Enable = 1;

2. Deploy and migrate: install the new binary and confirm that the migration-completed message appears in the logs.
3. Revoke privileges after the installation:

   USE [BFEnterprise];
   EXEC dbo.sp_SetWrkflwRestrictedUserDDLAccess @UserName = 'wrkflwDbUser', @Enable = 0;

4. Re-tighten the object grants if the upgrade introduced new tables in wrkflw: extend the table list and re-run the tightener, so that the new tables get object-scoped DML and the runtime role does not keep schema-wide DML on them:

   USE [BFEnterprise];
   -- Adjust the comma-separated table list to include any new tables introduced by this upgrade.
   EXEC dbo.sp_TightenRestrictedRuntimeGrants
       @SchemaName = N'wrkflw',
       @TableNames = N'workflows,workflow_versions';

Rotating or removing the runtime login

To deprovision or rotate the runtime login, detach the user from both roles and drop the database user: EXEC dbo.sp_DropWrkflwRestrictedUser @UserName = 'wrkflwDbUser', @DropLogin = 1;. To point the BigFix Workflow Service at the new login, follow Reconfiguring the database user (see Reconfiguring the database user).

Uninstallation

The manual steps below perform the clean-up.

1. Run bf-wrkflw.exe --uninstall.
2. Remove the installation folder (C:\Program Files (x86)\BigFix Enterprise\BFWorkFlow).
3. Remove the HKEY_LOCAL_MACHINE\SOFTWARE\BigFix\BESClient\WRKFLW registry key.