Windows 10: DEP OptOut not working

Per STIGs we have to do the BCDEDIT /set {current} nx OptOut command on all our machines but when we run it on our Windows 10 machines it says Successfully Completed but SCAP is still showing it as a finding. We have asked the Devs of SCAP and they say that there has been a code change by MS and this command needs updating.Group Title: SRG-OS-000433-GPOS-00192Rule Title: Data Execution Prevention DEP must be configured to at least OptOut.Discussion: Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention DEP prevents harmful code f

:)

 

i can't access DEP

Hi Demuul,

To enable the Data Execution Prevention (DEP) in Windows 10, follow the steps below:

• Open elevated Command Prompt by pressing the Windows key + X, and then click on
  Command Prompt (Admin).
• In Command Prompt, type the command below, and then press Enter:
  
  bcdedit.exe /set {current} nx AlwaysOn

Should you want to disable DEP, enter bcdedit.exe /set {current} nx AlwaysOff
in elevated Command Prompt.

Let us know if you need further assistance.

 

DEP settings reset after Windows 10 upgrade (1903->1909, 1909->2004)

Hello!

My company use Windows workstations configured with DEP enabled ("OptOut" option in Control Panel or "always on" via BDCEdit, not in default option "OptIn").

This is configured manually when new PC is set up for end user.

Strange thing: after upgrade to new Windows 10 version the DEP settings are changed to default (OptIn" option active).

(I observed this when upgrade from 1903 to 1909 and 1909 to 2004, upgrades made by internal WSUS)

(PCs are typical Dell with Windows 10 Professional, domain 2012)

How can I prevent DEP from being reset during an upgrade?

Thanks for info!

 

DEP errors make webpages unavailable

Hi Richard,

Data Execution Prevention (DEP) is a set of hardware and software technologies that perform additional checks on memory to help protect against malicious code exploits. You can turn off Data Execution Prevention for a particular program in Windows by following
the steps below:

• Open File Explorer.
• Right-click on This PC, choose Properties and then click on the
  Advanced system settings link.
• Now click on the Data Execution Prevention tab and you’ll see two radio buttons. By default, DEP should be set to the first radio button and therefore only protect essential Windows programs and services. If the second radio button is selected,
  it will turn on DEP for ALL processes, not just Windows processes.
  
• Since you’re having issues with your browsers, go ahead and try to select the first radio button, restart your computer and see if that fixes the issue. If not, you can go ahead and click the Turn on DEP for all programs and services except those
  I select button and then add the program that is having problems. Make sure to also check the box.
• Click the Add button and browse to the location of the executable for the program you want to remove from DEP protection.

Let us know if you need any other assistance.

Regards.