What is Data Execution Prevention in Windows?

Data execution prevention (DEP) is mainly a security feature installed in windows 10 devices that help you prevent damage to your computer from viruses or other security threats. It was first given preinstalled in Windows XP and Windows Server 2003. It enables your device to mark several pages as non-executable, which means harmful codes cannot be run from that memory region.

There can be some additional code of viruses or other thread injected into the program you are running on your device. Data execution prevention prevents that kind of code from running. It detects these codes, shuts down the program, and also notifies you about potential threats.

Unlike antivirus or firewall, DEP does not protect you from installing a harmful program. Instead, it monitors your installed programs if they are using the system memory safely or not. Therefore, it is not a tool you use to prevent all kinds of threats. However, you can use it with your antivirus or firewall.

How Does Data Execution Prevention Work?

There is a reserved memory region in our operating system where critical programs and functions run. This space is limited. If a code is not written correctly or harmful to your device, it will consume considerable space. In addition, it will lead you to a buffer overflow situation which can give access to the critical data to that virus or malicious program.

That is where DEP steps in. It counters such access or execution by any executable programs that aren’t allowed to run in the system. It raises an exception when it detects suspicious code loading and stops it from opening.

DEP works in two methods-

Hardware-Enforced DEP: It sends instructions to the CPU to mark some programs as non-executable. It inserts a bit in the page table entry, which prevents the system from executing those codes.

Software-Enforced DEP: First, the operating system must support this type of DEP. Then it only prevents the device from user-mode processes. It does not control the system from executing a malicious code; instead, it protects you from another type of threat called Security Exception Handling (SEH) overwrite.

How Can I Check Data Execution Prevention?

To check the status of your DEP, follow these simple steps:

Open Control Panel and go to System and Security.

Go to System.

Type View Advanced System Setting in the search box.

Go to Setting in the Performance section.

Select Data Execution Prevention.

Here, you see the current DEP status of your system also whether your computer supports hardware-enforced DEP or not.

You can add exceptions to the DEP. To add exceptions, select Turn on DEP for all programs and services except those I select and select Add. Then choose the files you want to exclude and restart your system for the changes to take effect.

How Can I Enable or Disable Data Execution Prevention?

After you have checked the status of your DEP, you can enable or disable DEP. You can disable DEP in Windows 10 to modify some applications to be used in Windows 10. Though I do not recommend you to do so, here’s how to do it-

Select Start and type CMD to open the command prompt menu. Then, choose Run as Administrator and open the command prompt.

Type BCDEDIT /SET {CURRENT} NX ALWAYSOFF in the command prompt window and press Enter. Then restart your device to take effect the change.

Now, to again enable DEP, open the command prompt and type BCDEDIT /SET {CURRENT} NX ALWAYSON and press Enter. Then restart the device.

What Are the Benefits and Disadvantages of Data Execution Prevention?

It prevents your system from executing codes in the memory data pages. Hardware-based DEP detects code running from these locations and makes an exception when such an execution occurs. On the other hand, software-enforced DEP supplements the hardware-enforced DEP by preventing malicious codes from taking advantage of exception-handling mechanisms in Windows.

Conclusion

Though all software and hardware do not fully support it, DEP is a valuable feature. Your computer may sometimes face some issues and errors. But it is among the most basic windows-based system to protect your computer. Therefore, without any unavoidable reason, the DEP must be keep enabled all the time.