How to Enable Kernel-mode Stack Protection in Windows 11
Kernel-mode Stack Protection in Windows 11 adds a strong security layer to your PC. This feature guards your computer against malicious software trying to take control by exploiting how programs manage memory.
Specifically, it helps prevent Return Oriented Programming (ROP) attacks, which are a type of exploit that tricks programs into running harmful code. It does this by watching the expected path of a program’s execution.
This security works on Windows 11 version 22H2 and later versions. It’s a key part of keeping the core parts of Windows safe.
Enable Kernel-mode Hardware-enforced Stack Protection by opening Windows Security, navigating to Device security, then Core isolation details, and toggling the setting on. Ensure Memory Integrity is also enabled. A restart is required to apply the changes.
How It Works
Kernel-mode stack protection in Windows 11 stops attackers from running bad code. The Central Processing Unit (CPU) verifies return addresses by comparing them to a backup copy on the shadow stack. This system protection, available since Windows 11, uses this check to prevent unauthorized address changes.
What You Need
- CPU: Intel Tiger Lake (11th Gen) or newer with Control-Flow Enforcement Technology (CET), or AMD Zen 3 Ryzen or newer with AMD shadow stacks
- CPU virtualization turned on
- Memory Integrity turned on
To use kernel-mode hardware-enforced stack protection, your PC needs a newer CPU that supports special security features. This means an Intel 11th Gen or newer, or an AMD Zen 3 Ryzen or newer processor. You also need CPU virtualization turned on and Memory Integrity active in your Windows Security settings.
Microsoft released a security update package for Windows 11, version 22H2. KB5026372 Build 22621.1702 adds more drivers to a list of drivers that don’t work with Kernel-mode Hardware-enforced Stack Protection. Your computer checks this list when you turn on this feature.
Option 1Use Windows Security App
Turn Kernel-mode Hardware-enforced Stack Protection On or Off
- Open Windows Security.
- Click Device security on the left side. Then click Core isolation details on the right side.
- Turn on (this is the default) or off Kernel-mode Hardware-enforced Stack Protection. Choose what you want.
You can easily turn kernel-mode hardware-enforced stack protection on or off through your Windows Security app. Just open Windows Security, go to Device security, and then click Core isolation details to find the setting and make your choice.
- [REQUIRES ADMIN] If prompted by UAC, click Yes to approve.
- Restart your computer to apply the change.
Option 2Use Registry Editor
Turn Kernel-mode Hardware-enforced Stack Protection On or Off Using Commands
Open the Terminal app as administrator and run the command below. [REQUIRES ADMIN]
Turn On Kernel-mode Hardware-enforced Stack Protection
Kernel-mode hardware-enforced stack protection is typically on by default in Windows 11, but you can manually check and turn it on. This action also confirms that Memory Integrity is running, adding an extra layer of security to your system.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v Enabled /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v WasEnabledBy /t REG_DWORD /d 2 /f
Turn Off Kernel-mode Hardware-enforced Stack Protection
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v Enabled /t REG_DWORD /d 0 /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v WasEnabledBy /f
Summary
Kernel-mode hardware-enforced stack protection is a key security feature in Windows 11 that helps guard your computer’s main processes against malware. It works by checking that programs run as they should, using a safe copy of addresses to detect any tricks.
How to fix kernel mode hardware enforced stack protection?
Search for “Turn Windows features on or off” in the Start Menu and click on it. Scroll down to find “Kernel Mode Hardware Enforced Stack Protection” and ensure its checkbox is selected. Click “OK.” After making the changes, restart your system to apply them.
Does kernel mode hardware enforced stack protection affect gaming performance?
Some gamers have noticed a significant drop in performance, losing many frames per second, when kernel-mode hardware-enforced stack protection is turned on. For example, one user reported losing over 80 FPS in a popular game, with performance returning to normal after disabling the feature.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!