What Breaks When You Disable Data Execution Prevention in Windows 11

How Data Execution Prevention Works

DEP stops malicious code from running inside memory areas reserved for regular data. Windows and the processor work together to mark specific memory blocks as non-executable. That blocks buffer overflow attacks and stops unauthorized code from taking control of a program.

Here is what happens when an exploit tries to get around this. It injects malicious instructions into a data buffer, then tries to redirect the program’s execution flow to that buffer. The processor checks the memory page permissions first. Because the page has no execute permission, the processor raises an access violation exception. Windows catches the exception, terminates the offending application immediately, and shows a notification that Data Execution Prevention closed the program.

The same exploit that would have ended in a closed program and a warning message can instead run its injected code with that program’s permissions.

Hardware-Enforced vs. Software-Enforced DEP

Hardware-enforced DEP uses your processor to block unauthorized code execution at the chip level, which gives the strongest protection. Software-enforced DEP relies on the operating system to handle memory protection when the processor lacks built-in support.

• Hardware-enforced DEP: This mode relies on the CPU to mark memory locations as non-executable. That means either an AMD processor with Enhanced Virus Protection or an Intel processor with Execute Disable Bit technology. The processor blocks code execution directly, so this is the most secure option.
• Software-enforced DEP: When the processor does not support hardware DEP, Windows applies a software-based mitigation. It intercepts exception handling routines to give basic protection for 32-bit applications. It lacks the strict security boundaries the CPU enforces directly.

Windows 11 only installs on 64-bit processors, and those processors support hardware DEP. On a Windows 11 PC you will almost certainly be running the hardware-enforced mode.

Checking Your DEP Status in Windows

You can check your DEP status with one query in Windows PowerShell. It returns a number that tells you which policy is active. You don't need to change anything to run it, and a standard user account is usually enough.

1. Open the Start menu, type powershell, and press Enter. A PowerShell window opens.
2. Type the following command into the window and press Enter: Get-CimInstance Win32_OperatingSystem | Select-Object DataExecutionPrevention_SupportPolicy. A single number appears in the output.
3. Compare that number with the list below to see your current policy:

   • 0 means DEP is completely disabled.
   • 1 means DEP is enabled for essential Windows programs and services only.
   • 2 means DEP is enabled for all programs and services.
   • 3 means DEP is always on.

Someone or something changed the boot configuration, and you should find out why before doing anything else.

Configuring Data Execution Prevention Settings

If one older app keeps getting closed by DEP, don't turn DEP off for the whole system. Add an exception for just that program. You need an administrator account for this, and the steps are the same on Windows 11 Home and Pro.

1. Press Windows Key + R to open the Run dialog box.
2. Type sysdm.cpl and press Enter. The System Properties window opens.

   

3. Click the Advanced tab at the top of the window.

   

4. Click the Settings button in the Performance section. The Performance Options window opens.
5. Click the Data Execution Prevention tab.

   

   Near the bottom, a note tells you whether your processor supports hardware-based DEP.
6. Select Turn on DEP for all programs and services except those I select.
7. Click the Add button, browse to the executable file (.exe) of the program you want to exclude from DEP checking, and select it. The program now appears in the list with a check mark.
8. Click Apply, then click OK to save your changes. Restart your computer if prompted. The change does not take effect until you restart.

Some limits are worth knowing:

• Exceptions only work for 32-bit programs. If you try to add a 64-bit program, Windows refuses, because 64-bit programs always run with DEP.
• If the options or the Add button are greyed out, you are probably not signed in as an administrator. It can also mean the system policy is set to always on, which this window cannot override.
• To undo an exception, return to the same tab, select the program in the list, and click Remove. You can also switch back to Turn on DEP for essential Windows programs and services only. Click Apply and restart again.

What to do next

You can now check which DEP policy your PC uses, add an exception for a single stubborn program, and recognize when a crash comes from memory protection. Before you add an exception, check whether the vendor has released an update. Newer versions of an app rarely need one, and keeping software current means you can leave DEP fully on.