What breaks when you disable Data Execution Prevention in Windows 11

How Data Execution Prevention Works

Data execution prevention protects your computer by stopping malicious code from running inside memory areas reserved for regular data storage. Windows and your computer processor work together to mark specific memory blocks as non-executable, which blocks buffer overflow attacks and prevents unauthorized software from taking control of your system.

If an exploit attempts to inject malicious instructions into a data buffer and redirect the execution flow toward that buffer, the processor checks the memory page permissions. Because the target page lacks an execute bit, the processor generates an access violation exception. Windows intercepts this exception, terminates the offending application immediately, and displays a notification to inform you that Data Execution Prevention closed the program.

Hardware-Enforced vs. Software-Enforced DEP

Hardware-enforced data execution prevention uses your computer processor to block unauthorized code execution at the chip level for maximum security. Software-enforced data execution prevention relies on the Windows operating system to handle memory protections for older programs when your processor lacks built-in hardware support.

• Hardware-enforced DEP: This mode relies on the CPU—either an AMD processor with Enhanced Virus Protection or an Intel processor with Execute Disable Bit technology—to mark memory locations as non-executable. The processor hardware blocks code execution directly, offering maximum security.
• Software-enforced DEP: When the processor does not support hardware DEP, Windows applies a software-based mitigation mechanism. This software approach intercepts exception handling routines to offer basic protection for 32-bit applications, though it lacks the rigorous security boundaries enforced directly by the CPU.

Checking Your DEP Status in Windows

Checking your data execution prevention status in Windows takes just a quick command in Windows PowerShell. You can run a short system query to see if hardware-enforced protection is currently active and working on your machine.

1. Open the Start menu, type powershell, and press Enter to launch Windows PowerShell.
2. Type the following command into the window and press Enter: Get-CimInstance Win32_OperatingSystem | Select-Object DataExecutionPrevention_SupportPolicy
3. Review the returned number to determine your current policy. A value of 0 means DEP is completely disabled, 1 means DEP is enabled for essential Windows programs and services only, 2 means DEP is enabled for all programs and services, and 3 means DEP is always on.

Configuring Data Execution Prevention Settings

Configuring data execution prevention settings lets you add program exceptions for older apps that trigger false security warnings. You can change these options through the System Properties window if you have administrator access on your computer.

1. Press the Windows Key + R to open the Run dialog box.
2. Type sysdm.cpl and press Enter to open System Properties.

   

3. Click the Advanced tab at the top of the window.

   

4. Click the Settings button located in the Performance section.
5. Click the Data Execution Prevention tab in the Performance Options window.

   

6. Select the option labeled Turn on DEP for all programs and services except those I select.
7. Click the Add button to browse your computer and select the executable file (.exe) of the program you want to exclude from DEP checking.
8. Click Apply, then click OK to save your changes and restart your computer if prompted.

What to do next

You should now be able to verify your processor capabilities, configure application exceptions, and troubleshoot unexpected application crashes related to memory protections. Consider reviewing your installed software updates to ensure all applications run compatible versions that minimize the need for manual DEP exclusions.