The BES Support site is the only site by design where action locks are not enforced by BigFix, and of course, all computers are subscribed to it, so you can always unlock any client.
Following up on @trn’s comment, you can specify one additional site where action locks are not enforced. Using the BigFix Administration tool, choose the Edit Masthead option, and check the box next to Exempt the following site URL from action locking:, and enter the site URL (starts with http://). Then, unlock actions created in this site will be honored by any subscribed computer.
This is typically used to allow a site like BFI or ILMT to do its work, regardless of the client’s lock state. But any site URL is allowed. For example, a custom site URL might look like: http://bigfixroot.acme.com:52311/cgi-bin/bfgather.exe/CustomSite_Custom_Content