Data Execution Prevention

[hazelnut]

If you right-click my computer>properties>advanced>performance and click settings and then the data execution prevention tab, there are two options -for essential windows services and programs, or turn on D.E.P. for ALL programs and settings except those I select.

Would the latter option be a better selection as mine is on the first?

[Mike Rochip]

I was just reading about DEP the other day for some reason. Not sure why but now it may come in handy after all.

 

I found a detailed description of DEP from MS here and an SP2 settings guide. There is also a FAQ that is for Vista but it's easier to understand [at least for me, lol].

 

DEP is designed to prevent malicious code from running on a PC. It looks like the settings depend partly on whether a specific PC supports hardware based DEP or not. Also, if you set DEP to protect all programs and settings security is increased but so is the possibility that some programs you may normally use will be prevented from running. One of those nifty MS trial and error scenarios I guess.

 

Hope this is of some help.

[hazelnut]

It does seems like a six and two threes job. I suppose all cover is theoretically safer but this could prevent some programs from running properly as you say.

One thing I wasn't sure about was that in hardware based DEP enabled systems, it states you cannot disable it, did it mean the protect windows systems bit, the protect all programs cover bit, or both?

[Mike Rochip]

I tried to find some more information about DEP.

 

In How to Configure Memory Protection in Windows XP SP2 it says:

 

"If you configure DEP to protect all applications and programs on your computer, you can exempt individual 32-bit applications from software DEP protection if they have compatibility issues. You cannot disable hardware DEP or exempt 64-bit applications running on 64-bit Windows XP systems with DEP compatible processors."

 

And in kb912923 it says pretty much the same thing again:

 

"In 64-bit versions of Windows, hardware-enforced DEP is always enabled for 64-bit native programs. However, depending on your configuration, hardware-enforced DEP may be disabled for 32-bit programs."

 

But it also states:

 

"On some computers, you can disable processor support for hardware-enforced DEP in the BIOS. You must not disable this support."

 

I noticed it says "must not" which is technically different from "can not." It sounds like maybe it's possible to turn off hardware based DEP entirely but it's not a good idea.

 

My best guess is that they are referring specifically to the -for essential Windows services and programs- setting when they say you can not turn off hardware based DEP.

 

From some of the other sites I Googled it seems like the all programs setting is good to use and on the rare occasion when DEP prevents a program from running it's fine to make an exception as long as the program is known to be safe. The exception will then disable both hardware and software DEP for that program only.

 

I'm really hoping this made some sense, answered your question and is accurate. My ancient PC doesn't support hardware based DEP so I couldn't use it as a crash test dummy to be sure.

[Andavari]

or turn on D.E.P. for ALL programs and settings

 

I had completely forgotten about it, D.E.P. that is. I set it to protect All programs however doing so means I'll have to keep in mind if an app doesn't run to remember my D.E.P. settings.