DEP - Enable or Disable

How to Enable or Disable DEP in Vista, Windows 7, and Windows 8​

   Information

Data Execution Prevention (DEP) is a security feature that can help prevent damage to your computer from viruses and other security threats. Harmful programs can try to attack Windows by attempting to run (also known as execute) code from system memory (RAM) locations reserved only for Windows and other authorized programs. These types of attacks can harm your programs and files. If DEP notices a program on your computer using memory incorrectly, it closes the program and notifies you with the DEP stop error. DEP is ran in a software mode and in a hardware mode. If your processor supports DEP (NX for AMD, and XD for Intel), then you will have hardware and software DEP. If it doesn't, then Vista will just use software DEP. 64 bit applications will have DEP enabled all the time by default, but 32 bit applications do not and must have DEP manually enabled for them. For more information, see: Windows Help and Support: Data Execution Prevention: FAQs

   Note

If a program is being closed by DEP, then make sure that it is a DEP compatible version and check for an updated version. If it is not DEP compatible, then you can uninstall the program or turn off DEP for that particular program.

   Warning

Do not disable DEP, or exclude (OptOut) a program, unless you have adequate protection and are having problems only with a known safe program that DEP will not let run and you cannot live without it. Remember DEP stopped the program for a reason. Either it is just a improperly running program, or some sort of malware trying to get into restricted memory.

Adequate Protection:

• Antivirus program with realtime scanning (EX: Avast or AVG are good ones)
• A spyware/adware program with realtime scanning (EX: Windows Defender, Spybot Search and Destroy)
• Enable Vista's UAC (User Account Control). It asks you for permission first for anything that wants to run with full access to the computer.

EXAMPLE: DEP Enabled and Disable
NOTE: DEP is enabled by default. If you installed Enhanced Mitigation Experience Toolkit (EMET), then it will be used by Windows instead of DEP and gray out the DEP settings like below.

​

​

OPTION ONE

To Enable or Disable DEP in Vista

NOTE: If you have a 64-bit CPU, then you may also have a no exectute option in BIOS that is the built in DEP on the CPU.

1. Open an elevated command prompt.​

​

2. To Enable DEP​

A) In the elevated command prompt, type in bold below and press Enter. (See screenshot below)​

NOTE: If for some reason this command does not enable DEP after restarting the computer, then use the bcdedit.exe /set {current} nx AlwaysOn command instead.​

bcdedit.exe /set {current} nx OptIn​

​

B) You should get a success message back​

​

C) Close the elevated command prompt.​

​

D) Restart the computer to apply.​

​

​

3. To Disable DEP ​

A) In the command prompt, type in bold belowand press Enter. (See screenshot below)​

bcdedit.exe /set {current} nx AlwaysOff​

​

B) You should get a success message back.​

​

C) Close the command prompt.​

​

D) Restart the computer to apply.​

​

​

4. To Verify the Status of DEP ​

A) In the command prompt, type in bold below and press Enter. (See screenshot below table)​

wmic OS Get DataExecutionPrevention_SupportPolicy​

​

B) You will get a number (see table below) that will tell you the status of DEP.​

​

C) Close command prompt when done.​

​

   Note

2 is the default setting.

   Note

​

​

Number	Description	Status
	AlwaysOff	DEP is disabled for all processes. (Step 3 above)
1	AlwaysOn	DEP is enabled for all processes. (Note under step 2)
2	OptIn	DEP is enabled for only Windows system components and services have DEP applied. Default setting. (Step 2 above)
3	OptOut	DEP is enabled for all processes. Administrators can manually create a list of specific applications which do not have DEP applied. (How to Turn DEP On or Off for a Program)

​

​

​

​

​

​

​

OPTION TWO

Enable or Disable DEP in Internet Explorer

NOTE: This will be for the 32 bit version of Internet Explorer.

• For a 32 bit Vista version: C:\Program Files\Internet Explorer\iexplore.exe
• For a 64 bit Vista version: C:\Program Files (x86)\Internet Explorer\iexplore.exe

   Warning

Some Active X Internet Explorer add-ons may not work with DEP on. It can cause them to crash and prevent the startup of IE by DEP closing it. If this happens to you, then see: How to Fix a Crashing Internet Explorer in Vista or disable DEP again.

1. Open the Start Menu.​

​

2. Click on All Programs and right click on Internet Explorer, then click Run as administrator.​

NOTE: If you cannot get IE7 to open using step 2, then click on All Programs and Accessories. Next, right click on Internet Explorer (No Add-ons) and click on Run as administrator instead.​

WARNING: If you do not use Run as administrator, the Enable memory protection to help mitigate online attacks option will be grayed out in steps 5 and 6 below, and you will not be able to enable or disable it.​

​

3. In Internet Explorer, click on Tools and Internet Options.​

​

4. Click on the Advanced tab. (See screenshot below)​

​

5. To Enable DEP for the 32 bit Internet Explorer​

A) Under Security, check Enable memory protection to help mitigate online attacks.​

​

B) Go to step 7.​

​

6. To Disable DEP for the 32 bit Internet Explorer​

A) Under Security, uncheck Enable memory protection to help mitigate online attacks.​

​

7. Click on OK to apply.​

​

​

That's it,
Shawn

Related Tutorials

---

• How to Turn Windows Features On or Off in Vista
• How to Turn DEP On or Off for a Program
• Enhanced Mitigation Experience Toolkit (EMET)
• How to Create a "DEP System Properties" Shortcut in Vista and Windows 7

 

[markeeb]

thanks Shawn....I will try now and report back on progress

 

[Brink]

Your welcome Mark. Please do let us know.

 

[markeeb]

Hi again...it's not working so far

The system restore disk is fine, it boots and tries to mend the system. Witchout luck unfortunately.

I've found the command prompt, but when I stick the command in it tells me:

"An error occured while attempting to reference the specified entry. The system cannot find the file specified"

I'd guessed this to be a PATH error in the first instance. Booting from the disk it's listed as X:\Windows;X:\Windows\System32. I added the same addresses from the C: drive but the error is persistent. Can I be more specific with this command so it knows where to find whatever file it's looking for?

I'm really trying to avoid going down the Dell restore route as I'll lose everything on my hard drive. Well, I'll have an unpleasant job dragging the data off it before formatting and restoring at least.

Thanks again for your help...got my fingers crossed that I'll be able to reverse the bcpedit command rather than resort to more drastic measures....

Mark

 

[Brink]

Mark,

While you are in that command prompt at boot, type this in bold below at each prompt:

c: (press Enter)
cd\windows\system32 (press Enter)
bcdedit.exe /set {current} nx OptIn (press Enter)


The first two commands will get to the correct location in the command prompt to type in the third command to enable DEP again for Vista.

Hope this helps,
Shawn

 

[markeeb]

Still the same problem unfortunately...my modification of the PATH variable should have had the same effect as changing to the system32 directory right ? Either way it's still telling me that the system cannot find the file specified....

Sorry for the hassle....more help needed pleeeeeaaase....

 

[Brink]

Correct, that should open the command prompt to the C:\Windows\System32 location where the bcdedit.exe file is located.

Well, the only thing I can see to do now is a clean install from your Dell recovery partition.

Dell - Support

 

[markeeb]

OK Shawn...thanks for looking/thinking about it...

 

[Brink]

Your welcome Mark. I wish I knew another way for you.

Shawn

 

[WildEagle]

I can't enable DEP for IE7 it's grayed out. I'm guessing it's because I'm running IE7 in protected mode, to run in protected mode one has to leave UAC running.

 

[Brink]

Hi WildEagle,

Did you run IE7 by right clicking on the shortcut or EXE file and click Run as administrator? It will be grayed out until so.

Hope this helps,
Shawn

 

[WildEagle]

It does, but when you open IE7 from a multimedia key on a keyboard like the Microsoft Natural Multimedia keyboard, it grays out the option to enable DEP mode. I also have hardware DEP aka the XD bit enabled in the bios of my motherboard.

This helps, thanks a bunch.

I just checked and 64bit IE7 doesn't have the DEP option, only 32bit IE7 does.

 

[Brink]

Your welcome WildEagle.

The 64bit IE7 does not have the option for you to turn DEP on or off for it, but DEP is enabled for it natively since it is a 64bit application.

 

[WildEagle]

I was wondering about that. I don't know everything about Vista, but I do know enough about it, to set it up the way I want and do tweaks that don't mess up the OS.

Now if Adobe would get the lead out and put out a 64bit Flash and Shockwave player I would use 64bit IE Exclusively, just like I use 64bit Media Player 11 exclusively.

 

[Brink]

LOL, I hear that WildEagle. It would be nice if they or someone had a 64 bit flash player version.

 

[WildEagle]

I've looked a few times, and haven't come across a 64bit flash player that anyone has wrote, or even a beta 64bit Adobe Flash player.

As for DEP, now that I have it enabled, I'm going to leave it on, like I do for the OS and other programs. DEP has saved my hide from errant programs that didn't have tight code, a few times in the past.

I also advise that the XD bit aka NX bit, be enabled if it isn't enabled by default. On that ASUS board I had, I had to enable the XD bit, aka hardware DEP myself, as it wasn't enabled by default. Having the XD bit(hardware DEP) also helps in mitigating online attacks and virus attacks.

 

[Brink]

Oh you bet ya that I have it enabled in my BIOS. I believe my BIOS has it listed as No Execute Memory Protect. It was enabled by default on mine, but it is a good idea for others to make sure that they enable it to.

 

[WildEagle]

In the bios of my 975XBX2 it's listed in the security section as XD Technology, and was enabled by default.

 

[sydoz]

Hey Shawn,
I cant thankk you enough!!! it worked, i have been going nuts over this!!
:D you're a doll!!!
will check out the other one asap!!!
thanks again
serena

 

[Brink]

Your welcome Serena. I'm happy to hear that it is working again for you.

Shawn

 

[sydoz]

:D now how did you get so smart lol