Content Release: Application Control 2026-09-30

Release Announcements Lifecycle (Release Announcements)
1

The BigFix Team is pleased to announce the release of version 2.1.0 of BigFix Application Control.

The main reasons to upgrade to this release are as follows:

Application Control (WDAC)

  • Overview
    BigFix Application Control version 2.1.0 delivers a major architectural upgrade that provides native, high-performance Windows Defender Application Control (WDAC) management across enterprise endpoints. This release transitions policy authoring, compilation, signing, and deployment away from PowerShell scripting dependencies to a lightweight native toolset—leveraging WdacManager.exe, Microsoft native utilities (CiTool.exe, SignTool.exe), and background deployment services (BACPolicyDeploymentServices.exe). BAC 2.1.0 enables administrators to seamlessly configure layered Base and Supplemental policies, enforce hardware-bound cryptographic security via TPM 2.0, manage certificates and signers, and maintain continuous endpoint control without management lockout.

  • New Features

      • Native WDAC Management & PowerShell Elimination

        • With this release we introduce a high-performance native utility (WdacManager.exe) and Go-based background services to manage the complete WDAC policy lifecycle without relying on PowerShell scripts.

        • Direct integration with native Windows utilities (CiTool.exe and Microsoft SDK SignTool.exe) for fast policy compilation, binary conversion (.cip), signing, and real-time policy refresh.

      • Modular Layered Policy Management (Base & Supplemental Policies)

        • Full support for creating, updating, and deploying modular Base and Supplemental policies, allowing administrators to establish enterprise-wide baselines while delegating flexible, targeted application exceptions.

        • Multi-rule authoring support across Publisher/Signer, File Path, Hash, File Attributes, Package App, and COM rules.

        • Added dedicated commands to cleanly add, update, and remove signers from existing policy configurations without corrupting XML structures.

      • Hardware-Enforced & Enterprise Certificate Management

        • TPM 2.0 Hardware Binding: Integrated certificate generation and signing anchored in TPM 2.0 / Microsoft Platform Crypto Provider for tamper-resistant private key protection.

        • Enterprise CA & Secondary Signer Support: Support for Enterprise CA certificate workflows and secondary update policy signers to ensure uninterrupted policy signing and failover continuity.

        • Extended Cryptographic Support: Added support for signing certificates with RSA key sizes greater than 4096 bits and automated certificate expiry monitoring.

      • Streamlined Fixlet-Driven Deployment Workflow

        • Fixlet 1 (Install BAC Server): Deploys BACPolicyDeploymentServices.exe, securely encrypts BigFix REST API credentials using Windows DPAPI, and automates Custom Site management.

        • Fixlet 2 (BAC Management Device Setup): Provisions dedicated management environments and deploys WdacManager.exe.

        • Fixlet 3 (Certificate Provisioning): Configures TPM-backed self-signed or Enterprise CA policy signing certificates.

        • Fixlet 4 (WDAC Policy Creation Wizard): Interactive console wizard to configure Base/Supplemental XML policies, rule types, and policy options (such as User Mode Code Integrity, Audit Mode, Script Enforcement, and Dynamic Code Security).

        • Fixlet 5 (Policy Signer & Publisher): Compiles XML into binary CIP, digitally signs the payload, and automatically publishes it to BigFix Custom Sites for endpoint distribution.

      • Endpoint Self-Protection & Forensics

        • Lockout Prevention: Automatically injects non-overridable allowlist rules for critical BigFix binaries (such as BESClient.exe, signtool.exe, and RefreshPolicy.exe), ensuring endpoints remain continuously manageable.

    On-Demand Forensic Telemetry: Controlled retrieval of Code Integrity blocked events and policy XML files into Web Reports without saturating endpoint performance or relay bandwidth

Additional information about this release

  • Published site and components version:

    • Application Control - Site Version: 04

Useful links

– HCL BigFix – Lifecycle Team

1 Like