What Breaks When You Disable Data Execution Prevention in Windows 11

How Data Execution Prevention Works

DEP stops malicious code from running inside memory areas reserved for regular data. Windows and the processor work together to mark specific memory blocks as non-executable. That blocks buffer overflow attacks and stops unauthorized code from taking control of a program.

Here is what happens when an exploit tries to get around this:

1. The exploit injects malicious instructions into a data buffer.
2. It then tries to redirect the program’s execution flow to that buffer.
3. The processor checks the memory page permissions first. The page has no execute permission, so the processor raises an access violation exception.
4. Windows catches the exception and terminates the offending application immediately. It shows a notification that Data Execution Prevention closed the program.

The same exploit that would have ended in a closed program and a warning message can instead run its injected code with that program’s permissions. If the program runs as an administrator, the injected code does too.

Hardware-Enforced vs. Software-Enforced DEP

Hardware-enforced DEP uses your processor to block unauthorized code execution at the chip level, which gives the strongest protection. Software-enforced DEP relies on the operating system to handle memory protection when the processor lacks built-in support.

• Hardware-enforced DEP: This mode relies on the CPU to mark memory locations as non-executable. That means either an AMD processor with the NX (No-Execute) bit, marketed as Enhanced Virus Protection, or an Intel processor with Execute Disable (XD) Bit technology. The processor blocks code execution directly, so this is the most secure option.
• Software-enforced DEP: When the processor does not support hardware DEP, Windows applies a software-based mitigation. It intercepts exception handling routines to give basic protection for 32-bit applications. It lacks the strict security boundaries the CPU enforces directly.

Windows 11 only installs on 64-bit processors, and those processors support hardware DEP. On a Windows 11 PC you will almost certainly be running the hardware-enforced mode. The software-enforced mode is mainly a concern on very old hardware, which Windows 11 does not support.

Checking Your DEP Status in Windows

You can check your DEP status with one query in Windows PowerShell. It returns a number that tells you which policy is active. You don’t need to change anything to run it, and a standard user account is usually enough.

1. Open the Start menu, type powershell, and press Enter. A PowerShell window opens.
2. Type the following command into the window and press Enter: Get-CimInstance Win32_OperatingSystem | Select-Object DataExecutionPrevention_SupportPolicy. A single number appears in the output.
3. Compare that number with the list below to see your current policy:

   • 0 means DEP is completely disabled.
   • 1 means DEP is enabled for essential Windows programs and services only.
   • 2 means DEP is enabled for all programs and services.
   • 3 means DEP is always on.

The query only reads the setting, so you can run it as often as you like. If you see the value for “completely disabled” and you didn’t set it yourself, treat that as a problem. Someone or something changed the boot configuration, and you should find out why before doing anything else.

Configuring Data Execution Prevention Settings

If one older app keeps getting closed by DEP, don’t turn DEP off for the whole system. Add an exception for just that program. The steps are the same on Windows 11 Home and Pro.

Before you start: changing the DEP policy requires administrator rights and a restart. The change does not take effect until you restart, so save your work first.

An excluded program loses DEP’s exploit protection, so a flaw in it is easier to attack. Try the easier fixes first. Check whether the vendor has released an update. You can also right-click the program’s .exe file, choose Properties, open the Compatibility tab, and try compatibility mode. Use an exception only if neither works.

1. Press Win+R to open the Run dialog box.
2. Type sysdm.cpl and press Enter. The System Properties window opens.

   

3. Click the Advanced tab at the top of the window.

   

4. Click the Settings button in the Performance section. The Performance Options window opens.
5. Click the Data Execution Prevention tab.

   

   Near the bottom, a note tells you whether your processor supports hardware-based DEP.
6. Select Turn on DEP for all programs and services except those I select. The Add button becomes available.
7. Click the Add button, browse to the executable file (.exe) of the program you want to exclude from DEP checking, and select it. The program now appears in the list with a check mark.
8. Click Apply, then click OK to save your changes. Restart your 🔄 computer if prompted. The change does not take effect until you restart.

Some limits are worth knowing:

• Exceptions only work for 32-bit programs. If you try to add a 64-bit program, Windows refuses, because 64-bit programs always run with DEP.
• If the options or the Add button are greyed out, you are probably not signed in as an administrator. It can also mean the system policy is set to always on, which this window cannot override.
• To undo an exception, return to the same tab, select the program in the list, and click Remove. You can also switch back to Turn on DEP for essential Windows programs and services only. Click Apply and restart again.

Windows 11 also has a newer place to set per-app DEP exceptions: Windows Security › App & browser control > Exploit protection. This page has two tabs. System settings covers protections for the whole system, including DEP. Program settings lets you add one program and override DEP for it alone. For per-app exceptions, this is the modern way. The same caution applies: any program you exclude loses that protection, so keep the list short and remove entries you no longer need. You need administrator rights to change these settings, and you may need to restart the affected program or the PC before a change applies.

What to do next

You can now check which DEP policy your PC uses, add an exception for a single stubborn program, and recognize when a crash comes from memory protection. Before you add an exception, check whether the vendor has released an update. Newer versions of an app rarely need one, and keeping software current means you can leave DEP fully on.