How to Enable Kernel-mode Stack Protection in Windows 11
Kernel-mode Stack Protection in Windows 11 is a built-in security setting that blocks bad software from taking over your PC through memory tricks. Available on Windows 11 version 22H2 and later, this tool stops hackers from running harmful code by watching how programs run behind the scenes.
You can turn on this protection in the Windows Security app to keep the core parts of your computer safe from advanced attacks.
Enable Kernel-mode Hardware-enforced Stack Protection by opening Windows Security, navigating to Device security, then Core isolation details, and toggling the setting on. Ensure Memory Integrity is also enabled. A restart is required to apply the changes.
How It Works
Kernel-mode stack protection in Windows 11 stops attackers from running bad code. The Central Processing Unit (CPU) verifies return addresses by comparing them to a backup copy on the shadow stack. This system protection, available since Windows 11, uses this check to prevent unauthorized address changes.
What You Need
- CPU: Intel Tiger Lake (11th Gen) or newer with Control-Flow Enforcement Technology (CET), or AMD Zen 3 Ryzen or newer with AMD shadow stacks
- CPU virtualization turned on
- Memory Integrity turned on
Kernel-mode hardware-enforced stack protection requires specific hardware and settings to work on your Windows 11 PC. Your computer must have an Intel 11th Gen or newer processor with Control-Flow Enforcement Technology (CET) or an AMD Zen 3 Ryzen or newer processor with shadow stacks. You also need to turn on CPU virtualization and Memory Integrity in your system settings before you can use this feature.
Microsoft released a security update package for Windows 11, version 22H2. KB5026372 Build 22621.1702 adds more drivers to a list of drivers that don’t work with Kernel-mode Hardware-enforced Stack Protection. Your computer checks this list when you turn on this feature.
Not all drivers work with Kernel Mode Hardware Enforced Stack Protection.
Option 1Use Windows Security App
Turn Kernel-mode Hardware-enforced Stack Protection On or Off
- Open Windows Security.
- Click Device security on the left side. Then click Core isolation details on the right side.
- Turn on (this is the default) or off Kernel-mode Hardware-enforced Stack Protection. Choose what you want.
Kernel-mode hardware-enforced stack protection can be turned on or off through the Windows Security app on your computer. You can change this setting at any time by opening the device security menu and adjusting your core isolation preferences. Windows turns this security feature on by default on compatible computers to block malicious attacks.
- [REQUIRES ADMIN] If prompted by UAC, click Yes to approve.
- Restart your computer to apply the change.
Option 2Use Registry Editor
Turn Kernel-mode Hardware-enforced Stack Protection On or Off Using Commands
Open the Terminal app as administrator and run the command below. [REQUIRES ADMIN]
Turn On Kernel-mode Hardware-enforced Stack Protection
Kernel-mode hardware-enforced stack protection is usually on by default in Windows 11, but you can also turn it on manually using the Windows registry if needed. This action ensures that Memory Integrity is running properly and adds an extra layer of security to protect your system from dangerous exploits.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v Enabled /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v WasEnabledBy /t REG_DWORD /d 2 /f
Turn Off Kernel-mode Hardware-enforced Stack Protection
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v Enabled /t REG_DWORD /d 0 /f
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks" /v WasEnabledBy /f
Summary
Kernel-mode hardware-enforced stack protection is a key security feature in Windows 11 that helps guard your computer's main processes against malware. It works by checking that programs run as they should, using a safe copy of addresses to detect any tricks.
How to fix kernel mode hardware enforced stack protection?
Search for “Turn Windows features on or off” in the Start Menu and click on it. Scroll down to find “Kernel Mode Hardware Enforced Stack Protection” and ensure its checkbox is selected. Click “OK.” After making the changes, restart your system to apply them.
Does kernel mode hardware enforced stack protection affect gaming performance?
Some gamers have noticed a significant drop in performance, losing many frames per second, when kernel-mode hardware-enforced stack protection is turned on. For example, one user reported losing over 80 FPS in a popular game, with performance returning to normal after disabling the feature.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!