<div dir="ltr"><p style="box-sizing:border-box;border-width:0px;border-style:solid;border-color:rgb(229,231,235);margin:0.75rem 0px 0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;white-space:pre-wrap;padding:0px;color:rgb(41,42,46);background-color:rgba(5,21,36,0.06)"><span style="white-space:normal"><span style="background-color:transparent">The BigFix Team is pleased to announce the release of version 2.1.0 of BigFix Application Control. </span></span></p><p style="margin:0.75rem 0px 0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;color:rgb(41,42,46);white-space:pre-wrap">The main reasons to upgrade to this release are as follows:</p><p style="margin:0.75rem 0px 0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;color:rgb(41,42,46);white-space:pre-wrap"> <strong> Application Control (WDAC)</strong></p><ul class="gmail-ak-ul" style="margin:12px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;display:flow-root;color:rgb(41,42,46);font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;font-size:14px;white-space:pre-wrap"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Overview</strong><br>BigFix Application Control version 2.1.0 delivers a major architectural upgrade that provides native, high-performance Windows Defender Application Control (WDAC) management across enterprise endpoints. This release transitions policy authoring, compilation, signing, and deployment away from PowerShell scripting dependencies to a lightweight native toolset—leveraging WdacManager.exe, Microsoft native utilities (CiTool.exe, SignTool.exe), and background deployment services (BACPolicyDeploymentServices.exe). BAC 2.1.0 enables administrators to seamlessly configure layered Base and Supplemental policies, enforce hardware-bound cryptographic security via TPM 2.0, manage certificates and signers, and maintain continuous endpoint control without management lockout.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>New Features</strong></p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;display:flow-root"><li style="list-style-type:none;margin-top:0px;margin-bottom:0px"><ul class="gmail-ak-ul" style="margin:0px;padding:0px 0px 0px 24px;box-sizing:border-box;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Native WDAC Management & PowerShell Elimination</strong></p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;list-style-type:disc;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">With this release we introduce a high-performance native utility (WdacManager.exe) and Go-based background services to manage the complete WDAC policy lifecycle without relying on PowerShell scripts.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">Direct integration with native Windows utilities (CiTool.exe and Microsoft SDK SignTool.exe) for fast policy compilation, binary conversion (.cip), signing, and real-time policy refresh.</p></li></ul></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Modular Layered Policy Management (Base & Supplemental Policies)</strong></p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;list-style-type:disc;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">Full support for creating, updating, and deploying modular <strong>Base</strong> and <strong>Supplemental</strong> policies, allowing administrators to establish enterprise-wide baselines while delegating flexible, targeted application exceptions.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">Multi-rule authoring support across <strong>Publisher/Signer</strong>, <strong>File Path</strong>, <strong>Hash</strong>, <strong>File Attributes</strong>, <strong>Package App</strong>, and <strong>COM</strong> rules.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">Added dedicated commands to cleanly add, update, and remove signers from existing policy configurations without corrupting XML structures.</p></li></ul></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Hardware-Enforced & Enterprise Certificate Management</strong></p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;list-style-type:disc;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>TPM 2.0 Hardware Binding:</strong> Integrated certificate generation and signing anchored in TPM 2.0 / Microsoft Platform Crypto Provider for tamper-resistant private key protection.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Enterprise CA & Secondary Signer Support:</strong> Support for Enterprise CA certificate workflows and secondary update policy signers to ensure uninterrupted policy signing and failover continuity.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Extended Cryptographic Support:</strong> Added support for signing certificates with RSA key sizes greater than 4096 bits and automated certificate expiry monitoring.</p></li></ul></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Streamlined Fixlet-Driven Deployment Workflow</strong></p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;list-style-type:disc;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Fixlet 1 (Install BAC Server):</strong> Deploys BACPolicyDeploymentServices.exe, securely encrypts BigFix REST API credentials using Windows DPAPI, and automates Custom Site management.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Fixlet 2 (BAC Management Device Setup):</strong> Provisions dedicated management environments and deploys WdacManager.exe.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Fixlet 3 (Certificate Provisioning):</strong> Configures TPM-backed self-signed or Enterprise CA policy signing certificates.</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Fixlet 4 (WDAC Policy Creation Wizard):</strong> Interactive console wizard to configure Base/Supplemental XML policies, rule types, and policy options (such as User Mode Code Integrity, Audit Mode, Script Enforcement, and Dynamic Code Security).</p></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Fixlet 5 (Policy Signer & Publisher):</strong> Compiles XML into binary CIP, digitally signs the payload, and automatically publishes it to BigFix Custom Sites for endpoint distribution.</p></li></ul></li><li style="margin-top:4px"><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Endpoint Self-Protection & Forensics</strong></p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;list-style-type:disc;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>Lockout Prevention:</strong> Automatically injects non-overridable allowlist rules for critical BigFix binaries (such as BESClient.exe, signtool.exe, and RefreshPolicy.exe), ensuring endpoints remain continuously manageable.</p></li></ul></li></ul></li></ul><p style="margin:0.75rem 0px 0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif"><strong>On-Demand Forensic Telemetry:</strong> Controlled retrieval of Code Integrity blocked events and policy XML files into Web Reports without saturating endpoint performance or relay bandwidth</p></li></ul><p style="margin:0.75rem 0px 0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;color:rgb(41,42,46);white-space:pre-wrap"><strong>Additional information about this release</strong></p><ul class="gmail-ak-ul" style="margin:12px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;display:flow-root;color:rgb(41,42,46);font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;font-size:14px;white-space:pre-wrap"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">Published site and components version:</p><ul class="gmail-ak-ul" style="margin:4px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;display:flow-root"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">Application Control - Site Version: 04</p></li></ul></li></ul><p style="margin:0.75rem 0px 0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;color:rgb(41,42,46);white-space:pre-wrap"><strong>Useful links</strong></p><ul class="gmail-ak-ul" style="margin:12px 0px 0px;padding:0px 0px 0px 24px;box-sizing:border-box;display:flow-root;color:rgb(41,42,46);font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;font-size:14px;white-space:pre-wrap"><li><p style="margin:0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif">BigFix Application Control Documentation:<br><span class="gmail-_0wOv4QAxrc gmail-_3iDTPbS8kF" style="display:inline"><span class="gmail-loader-wrapper"><span class="gmail-hover-card-trigger-wrapper" role="none"><a href="https://help.hcl-software.com/bigfix/11.0/lifecycle/lifecycle_application_control.html" class="gmail-_4FKVYEUjnH gmail-_0bjKvD8mU2 gmail-_23rrnHwQNr gmail-_3iDTPbS8kF gmail-_2NnhnEXpc7 gmail-_1UtDYzM7Tp gmail-_4cb4toYbGa gmail-_0hPERGQvmT gmail-_30huDKOeNX gmail-_0KLXruqi9L gmail-_32C2rkyL8i gmail-_0i9AWAYbGa gmail-_0mm6KQ6wH8 gmail-_0DCa9DyL8i gmail-_3932vvYbGa gmail-_02cRtH6wH8 gmail-_3WzCGiyL8i gmail-_0NqVRtYbGa gmail-_3BKYwu6wH8 gmail-_20VacPJxkL gmail-_1zr6Dc98eZ gmail-_0htemXYbGa gmail-_067LceT6kp gmail-_2AowT47zJH gmail-_0ui43CAaAW gmail-_3DIml2YbGa gmail-_3gzVzLY9q9" style="color:rgb(24,104,219);text-decoration:none;border-radius:6px;border:1.33333px solid rgba(11,18,14,0.14);padding:2px 0px;display:inline"><span class="gmail-_30huDKYbGa gmail-_24h04i2Njc gmail-_034jHtYbGa gmail-_1ANEUSlpBW gmail-_3W2Oc84hR5 gmail-_2NnhnEXpc7 gmail-_0Of8r2FQfX gmail-_1Znuxb1Y8M gmail-_1wydGWFQfX gmail-_2Zuz6Q1Y8M" style="border-width:medium;border-style:none;border-color:currentcolor;padding:2px 4px;box-sizing:border-box;word-break:break-all">Application Control</span></a></span></span></span></p></li></ul><p style="margin:0.75rem 0px 0px;padding:0px;font-style:normal;font-variant:normal;font-size-adjust:none;font-kerning:auto;font-feature-settings:normal;font-stretch:normal;font-size:14px;line-height:1.714;font-family:"Atlassian Sans",ui-sans-serif,-apple-system,BlinkMacSystemFont,"Segoe UI",Ubuntu,"Helvetica Neue",sans-serif;color:rgb(41,42,46);white-space:pre-wrap"> – HCL BigFix – Lifecycle Team<br></p></div>