[BESAdmin-Announcements] Content Release: Application Control 2026-09-30

[Announcements for BES Administrators]

The BigFix Team is pleased to announce the release of version 2.1.0 of
BigFix Application Control.

The main reasons to upgrade to this release are as follows:

 * Application Control (WDAC)*

   -

   *Overview*
   BigFix Application Control version 2.1.0 delivers a major architectural
   upgrade that provides native, high-performance Windows Defender Application
   Control (WDAC) management across enterprise endpoints. This release
   transitions policy authoring, compilation, signing, and deployment away
   from PowerShell scripting dependencies to a lightweight native
   toolset—leveraging WdacManager.exe, Microsoft native utilities (CiTool.exe,
   SignTool.exe), and background deployment services
   (BACPolicyDeploymentServices.exe). BAC 2.1.0 enables administrators to
   seamlessly configure layered Base and Supplemental policies, enforce
   hardware-bound cryptographic security via TPM 2.0, manage certificates and
   signers, and maintain continuous endpoint control without management
   lockout.
   -

   *New Features*
   -
         -

         *Native WDAC Management & PowerShell Elimination*
         -

            With this release we introduce a high-performance native
            utility (WdacManager.exe) and Go-based background services
to manage the
            complete WDAC policy lifecycle without relying on
PowerShell scripts.
            -

            Direct integration with native Windows utilities (CiTool.exe
            and Microsoft SDK SignTool.exe) for fast policy compilation, binary
            conversion (.cip), signing, and real-time policy refresh.
            -

         *Modular Layered Policy Management (Base & Supplemental Policies)*
         -

            Full support for creating, updating, and deploying modular
            *Base* and *Supplemental* policies, allowing administrators to
            establish enterprise-wide baselines while delegating
flexible, targeted
            application exceptions.
            -

            Multi-rule authoring support across *Publisher/Signer*, *File
            Path*, *Hash*, *File Attributes*, *Package App*, and *COM*
            rules.
            -

            Added dedicated commands to cleanly add, update, and remove
            signers from existing policy configurations without corrupting XML
            structures.
            -

         *Hardware-Enforced & Enterprise Certificate Management*
         -

            *TPM 2.0 Hardware Binding:* Integrated certificate generation
            and signing anchored in TPM 2.0 / Microsoft Platform
Crypto Provider for
            tamper-resistant private key protection.
            -

            *Enterprise CA & Secondary Signer Support:* Support for
            Enterprise CA certificate workflows and secondary update
policy signers to
            ensure uninterrupted policy signing and failover continuity.
            -

            *Extended Cryptographic Support:* Added support for signing
            certificates with RSA key sizes greater than 4096 bits and
automated
            certificate expiry monitoring.
            -

         *Streamlined Fixlet-Driven Deployment Workflow*
         -

            *Fixlet 1 (Install BAC Server):* Deploys
            BACPolicyDeploymentServices.exe, securely encrypts BigFix REST API
            credentials using Windows DPAPI, and automates Custom Site
management.
            -

            *Fixlet 2 (BAC Management Device Setup):* Provisions dedicated
            management environments and deploys WdacManager.exe.
            -

            *Fixlet 3 (Certificate Provisioning):* Configures TPM-backed
            self-signed or Enterprise CA policy signing certificates.
            -

            *Fixlet 4 (WDAC Policy Creation Wizard):* Interactive console
            wizard to configure Base/Supplemental XML policies, rule
types, and policy
            options (such as User Mode Code Integrity, Audit Mode,
Script Enforcement,
            and Dynamic Code Security).
            -

            *Fixlet 5 (Policy Signer & Publisher):* Compiles XML into
            binary CIP, digitally signs the payload, and automatically
publishes it to
            BigFix Custom Sites for endpoint distribution.
            -

         *Endpoint Self-Protection & Forensics*
         -

            *Lockout Prevention:* Automatically injects non-overridable
            allowlist rules for critical BigFix binaries (such as
BESClient.exe,
            signtool.exe, and RefreshPolicy.exe), ensuring endpoints remain
            continuously manageable.

   *On-Demand Forensic Telemetry:* Controlled retrieval of Code Integrity
   blocked events and policy XML files into Web Reports without saturating
   endpoint performance or relay bandwidth

*Additional information about this release*

   -

   Published site and components version:
   -

      Application Control - Site Version: 04

*Useful links*

   -

   BigFix Application Control Documentation:
   Application Control
   <https://help.hcl-software.com/bigfix/11.0/lifecycle/lifecycle_application_control.html>

 – HCL BigFix – Lifecycle Team
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://bigmail.bigfix.com/pipermail/besadmin-announcements/attachments/20260930/bf48520f/attachment.html>