This tutorial will show you how to enable or disable Kernel-mode Hardware-enforced Stack Protection for all users in Windows 11.
Core isolation is a security feature of Microsoft Windows that protects important core processes of Windows from malicious software by isolating them in memory. It does this by running those core processes in a virtualized environment.
Hardware-enforced Stack Protection offers robust protection against Return Oriented Programming (ROP) exploits since it maintains a record of the intended execution flow of a program.
The Kernel Mode Hardware Enforced Stack Protection security feature is applicable to Windows 11, version 22H2 and above, and provides additional security enhancement for kernel code.
For code running in kernel mode, the CPU confirms requested return addresses with a second copy of the address stored in the shadow stack to prevent attackers from substituting an address that runs malicious code instead.
Kernel-mode Hardware-enforced Stack Protection requires:
- CPU: Intel Tiger Lake (11th Gen) and beyond supports Control-Flow Enforcement Technology (CET), or AMD Zen 3 Ryzen and beyond that supports AMD shadow stacks.
- CPU virtualization turned on
- Memory Integrity turned on.
Windows 11, version 22H2 Security baseline | Microsoft Community Hub
Microsoft is pleased to announce the release of the security baseline package for Windows 11, version 22H2!
techcommunity.microsoft.com
KB5026372 Build 22621.1702 adds more drivers to the database of drivers that are not compatible with Kernel-mode Hardware-enforced Stack Protection. A device uses this database when you enable the Kernel-mode Hardware-enforced Stack Protection security feature in the Windows Security UI and it loads the drivers.
You must be signed in as an administrator to enable or disable Kernel-mode Hardware-enforced Stack Protection protection.
Not all drivers are compatible with the Kernel Mode Hardware Enforced Stack Protection security feature.
Contents
- Option One: Turn On or Off Kernel-mode Hardware-enforced Stack Protection in Windows Security
- Option Two: Turn On or Off Kernel-mode Hardware-enforced Stack Protection using REG file
1 Open Windows Security.
2 Click/tap on Device security on the left side, and click/tap on the Core isolation details link on the right side. (see screenshot below)
3 Turn on (default) or off Kernel-mode Hardware-enforced Stack Protection for what you want. (see screenshots below)
The Kernel-mode Hardware-enforced Stack Protection setting will be grayed out and disabled if Memory Integrity is turned off.
4 If prompted by UAC, click/tap on Yes to approve.
5 Restart the computer to apply.
1 Do step 2 (on) or step 3 (off) below for what you want.
2 Turn On Kernel-mode Hardware-enforced Stack Protection
This is the default setting.
This will also turn on the required Memory Integrity feature.
A) Click/tap on the Download button below to download the REG file below, and go to step 4 below.
Enable_Kernel_Mode_Hardware_Enforced_Stack_Protection.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks]
"Enabled"=dword:00000001
"WasEnabledBy"=dword:000000023 Turn Off Kernel-mode Hardware-enforced Stack Protection
A) Click/tap on the Download button below to download the REG file below, and go to step 4 below.
Disable_Kernel_Mode_Hardware_Enforced_Stack_Protection.reg
Download
(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\KernelShadowStacks]
"Enabled"=dword:00000000
"WasEnabledBy"=-4 Save the .reg file to your desktop.
5 Double click/tap on the downloaded .reg file to merge it.
6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.
7 Restart the computer to apply.
8 You can now delete the downloaded .reg file if you like.
That's it,
Shawn Brink
Last edited:
)
